commit 038d61fd642278bab63ee8ef722c50d10ab01e8f Author: Linus Torvalds Date: Sun Jul 27 14:26:38 2025 -0700 Linux 6.16 commit b711733e89a3f84c8e1e56e2328f9a0fa5facc7c Merge: ec2df4364666a9 67c632b4a7fbd6 Author: Linus Torvalds Date: Sun Jul 27 09:31:32 2025 -0700 Merge tag 'timers-urgent-2025-07-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Thomas Gleixner: "A single fix for the PTP systemcounter mechanism: The rework of this mechanism added a 'use_nsec' member to struct system_counterval. get_device_system_crosststamp() instantiates that struct on the stack and hands a pointer to the driver callback. Only the drivers which set use_nsec to true, initialize that field, but all others ignore it. As get_device_system_crosststamp() does not initialize the struct, the use_nsec field contains random stack content in those cases. That causes a miscalulation usually resulting in a failing range check in the best case. Initialize the structure before handing it to the drivers to cure that" * tag 'timers-urgent-2025-07-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: timekeeping: Zero initialize system_counterval when querying time from phc drivers commit ec2df4364666a96e7868b7257bc7235bae263dcb Merge: 513fc69f8fc7f8 f820034864dd46 Author: Linus Torvalds Date: Sat Jul 26 14:38:33 2025 -0700 Merge tag 'spi-fix-v6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fix from Mark Brown: "One last fix for v6.16, removing some hard coding to avoid data corruption on some NAND devices in the QPIC driver" * tag 'spi-fix-v6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: spi-qpic-snand: don't hardcode ECC steps commit 513fc69f8fc7f85dfbdd35b6f59b6ef2da422e9c Merge: 874885990b1807 31f08841dd5d47 Author: Linus Torvalds Date: Sat Jul 26 14:25:41 2025 -0700 Merge tag 'i2c-for-6.16-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: - qup: avoid potential hang when waiting for bus idle - tegra: improve ACPI reset error handling - virtio: use interruptible wait to prevent hang during transfer * tag 'i2c-for-6.16-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: qup: jump out of the loop in case of timeout i2c: virtio: Avoid hang by using interruptible completion wait i2c: tegra: Fix reset error handling with ACPI commit 874885990b18073213ff1797774c401df29676af Merge: 302f88ff3584a4 e4b2a0c2b9be6d Author: Linus Torvalds Date: Sat Jul 26 13:26:33 2025 -0700 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "A few Allwinner clk driver fixes: - Mark Allwinner A523 MBUS clock as critical to avoid system stalls - Fix names of CSI related clocks on Allwinner V3s. This includes changes to the driver, DT bindings and DT files. - Fix parents of TCON clock on Allwinner V3s" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: sunxi-ng: v3s: Fix TCON clock parents clk: sunxi-ng: v3s: Fix CSI1 MCLK clock name clk: sunxi-ng: v3s: Fix CSI SCLK clock name clk: sunxi-ng: a523: Mark MBUS clock as critical commit 302f88ff3584a4ed7a169e534ba5c75d9ca92048 Merge: 6121f69c363370 53e7e1fb81cc8b Author: Linus Torvalds Date: Sat Jul 26 10:21:25 2025 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux Pull ARM fixes from Russell King: - use an absolute path for asm/unified.h in KBUILD_AFLAGS to solve a regression caused by commit d5c8d6e0fa61 ("kbuild: Update assembler calls to use proper flags and language target") - fix dead code elimination binutils version check again * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux: ARM: 9450/1: Fix allowing linker DCE with binutils < 2.36 ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS commit 6121f69c36337076fb0ffaa23acee3cf8cc5c931 Merge: 5f33ebd2018ced 912b1f2a796ec7 Author: Linus Torvalds Date: Sat Jul 26 10:10:05 2025 -0700 Merge tag 'soc-fixes-6.16-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "These are two fixes that came in late, one addresses a regression on a rockchips based board, the other is for ensuring a consistent dt binding for a device added in 6.16 before the incorrect one makes it into a release" * tag 'soc-fixes-6.16-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: arm64: dts: rockchip: Drop netdev led-triggers on NanoPi R5S arm64: dts: allwinner: a523: Rename emac0 to gmac0 commit 31f08841dd5d479458ee98bdc91d63910ee19861 Merge: 89be9a83ccf1f8 a7982a14b30125 Author: Wolfram Sang Date: Sat Jul 26 00:59:39 2025 +0200 Merge tag 'i2c-host-fixes-6.16-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current i2c-host-fixes for v6.16-rc8 qup: avoid potential hang when waiting for bus idle tegra: improve ACPI reset error handling virtio: use interruptible wait to prevent hang during transfer commit 5f33ebd2018ced2600b3fad2f8e2052498eb4072 Merge: 327579671a9bec 14e8f8e74dc137 Author: Linus Torvalds Date: Fri Jul 25 13:36:35 2025 -0700 Merge tag 'drm-fixes-2025-07-26' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes (part 2) from Dave Airlie: "Just the follow up fixes for i915 and xe, all pretty minor. i915: - Fix DP 2.7 Gbps DP_LINK_BW value on g4x - Fix return value on intel_atomic_commit_fence_wait xe: - Fix build without debugfs" * tag 'drm-fixes-2025-07-26' of https://gitlab.freedesktop.org/drm/kernel: drm/xe: Fix build without debugfs drm/i915/display: Fix dma_fence_wait_timeout() return value handling drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x commit 327579671a9becc43369f7c0637febe7e03d4003 Merge: 4bb01220911d2d 1966554b2e82b8 Author: Linus Torvalds Date: Fri Jul 25 08:05:17 2025 -0700 Merge tag 'block-6.16-20250725' of git://git.kernel.dk/linux Pull block fix from Jens Axboe: "Just a single fix for regression in this release, where a module reference could be leaked" * tag 'block-6.16-20250725' of git://git.kernel.dk/linux: block: fix module reference leak in mq-deadline I/O scheduler commit 4bb01220911d2dd6846573850937e89691f92e20 Merge: bef3012b2f6814 8b3c655fa2406b Author: Linus Torvalds Date: Fri Jul 25 08:00:48 2025 -0700 Merge tag 'vfs-6.16-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: "Two last-minute fixes for this cycle: - Set afs vllist to NULL if addr parsing fails - Add a missing check for reaching the end of the string in afs" * tag 'vfs-6.16-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: afs: Set vllist to NULL if addr parsing fails afs: Fix check for NULL terminator commit bef3012b2f6814af2b5c5abd6b5f85921dbb8a01 Merge: 2942242dde896e c37495fe353164 Author: Linus Torvalds Date: Fri Jul 25 07:56:38 2025 -0700 Merge tag 'bcachefs-2025-07-24' of git://evilpiepirate.org/bcachefs Pull bcachefs fixes from Kent Overstreet: "User reported fixes: - Fix btree node scan on encrypted filesystems by not using btree node header fields encrypted - Fix a race in btree write buffer flush; this caused EROs primarily during fsck for some people" * tag 'bcachefs-2025-07-24' of git://evilpiepirate.org/bcachefs: bcachefs: Add missing snapshots_seen_add_inorder() bcachefs: Fix write buffer flushing from open journal entry bcachefs: btree_node_scan: don't re-read before initializing found_btree_node commit 53e7e1fb81cc8ba2da1cb31f8917ef397caafe91 Author: Nathan Chancellor Date: Mon Jul 14 20:56:47 2025 +0100 ARM: 9450/1: Fix allowing linker DCE with binutils < 2.36 Commit e7607f7d6d81 ("ARM: 9443/1: Require linker to support KEEP within OVERLAY for DCE") accidentally broke the binutils version restriction that was added in commit 0d437918fb64 ("ARM: 9414/1: Fix build issue with LD_DEAD_CODE_DATA_ELIMINATION"), reintroducing the segmentation fault addressed by that workaround. Restore the binutils version dependency by using CONFIG_LD_CAN_USE_KEEP_IN_OVERLAY as an additional condition to ensure that CONFIG_HAVE_LD_DEAD_CODE_DATA_ELIMINATION is only enabled with binutils >= 2.36 and ld.lld >= 21.0.0. Closes: https://lore.kernel.org/6739da7d-e555-407a-b5cb-e5681da71056@landley.net/ Closes: https://lore.kernel.org/CAFERDQ0zPoya5ZQfpbeuKVZEo_fKsonLf6tJbp32QnSGAtbi+Q@mail.gmail.com/ Cc: stable@vger.kernel.org Fixes: e7607f7d6d81 ("ARM: 9443/1: Require linker to support KEEP within OVERLAY for DCE") Reported-by: Rob Landley Tested-by: Rob Landley Reported-by: Martin Wetterwald Signed-off-by: Nathan Chancellor Signed-off-by: Russell King (Oracle) commit 87c4e1459e80bf65066f864c762ef4dc932fad4b Author: Nathan Chancellor Date: Fri Jun 20 19:08:09 2025 +0100 ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS After commit d5c8d6e0fa61 ("kbuild: Update assembler calls to use proper flags and language target"), which updated as-instr to use the 'assembler-with-cpp' language option, the Kbuild version of as-instr always fails internally for arch/arm with : fatal error: asm/unified.h: No such file or directory compilation terminated. because '-include' flags are now taken into account by the compiler driver and as-instr does not have '$(LINUXINCLUDE)', so unified.h is not found. This went unnoticed at the time of the Kbuild change because the last use of as-instr in Kbuild that arch/arm could reach was removed in 5.7 by commit 541ad0150ca4 ("arm: Remove 32bit KVM host support") but a stable backport of the Kbuild change to before that point exposed this potential issue if one were to be reintroduced. Follow the general pattern of '-include' paths throughout the tree and make unified.h absolute using '$(srctree)' to ensure KBUILD_AFLAGS can be used independently. Closes: https://lore.kernel.org/CACo-S-1qbCX4WAVFA63dWfHtrRHZBTyyr2js8Lx=Az03XHTTHg@mail.gmail.com/ Cc: stable@vger.kernel.org Fixes: d5c8d6e0fa61 ("kbuild: Update assembler calls to use proper flags and language target") Reported-by: KernelCI bot Reviewed-by: Masahiro Yamada Signed-off-by: Nathan Chancellor Signed-off-by: Russell King (Oracle) commit c37495fe3531647db4ae5787a80699ae1438d7cf Author: Kent Overstreet Date: Mon Jul 21 14:25:21 2025 -0400 bcachefs: Add missing snapshots_seen_add_inorder() This fixes an infinite loop when repairing "extent past end of inode", when the extent is an older snapshot than the inode that needs repair. Without the snaphsots_seen_add_inorder() we keep trying to delete the same extent, even though it's no longer visible in the inode's snapshot. Fixes: 63d6e9311999 ("bcachefs: bch2_fpunch_snapshot()") Signed-off-by: Kent Overstreet commit 1831840c2bc502c98c21df2ea0fa419b2ed0a6ec Author: Kent Overstreet Date: Mon Jul 21 23:41:50 2025 -0400 bcachefs: Fix write buffer flushing from open journal entry When flushing the btree write buffer, we pull write buffer keys directly from the journal instead of letting the journal write path copy them to the write buffer. When flushing from the currently open journal buffer, we have to block new reservations and wait for outstanding reservations to complete. Recheck the reservation state after blocking new reservations: previously, we were checking the reservation count from before calling __journal_block(). Signed-off-by: Kent Overstreet commit 2942242dde896ea8544f321617c86f941899c544 Merge: 94ce1ac2c9b492 0dec7201788b91 Author: Linus Torvalds Date: Thu Jul 24 19:13:30 2025 -0700 Merge tag 'mm-hotfixes-stable-2025-07-24-18-03' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "11 hotfixes. 9 are cc:stable and the remainder address post-6.15 issues or aren't considered necessary for -stable kernels. 7 are for MM" * tag 'mm-hotfixes-stable-2025-07-24-18-03' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: sprintf.h requires stdarg.h resource: fix false warning in __request_region() mm/damon/core: commit damos_quota_goal->nid kasan: use vmalloc_dump_obj() for vmalloc error reports mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() mm: update MAINTAINERS entry for HMM nilfs2: reject invalid file types when reading inodes selftests/mm: fix split_huge_page_test for folio_split() tests mailmap: add entry for Senozhatsky mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list commit 14e8f8e74dc137ff9f1dfb2781784ceb19497ee5 Merge: e6b39e516c441f 99e91521cef80d Author: Dave Airlie Date: Fri Jul 25 11:01:39 2025 +1000 Merge tag 'drm-xe-fixes-2025-07-24' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Driver Changes: - Fix build without debugfs (Lucas) Signed-off-by: Dave Airlie From: Thomas Hellstrom Link: https://lore.kernel.org/r/aIKWC2RPlbRxZc5o@fedora commit 0dec7201788b9152f06321d0dab46eed93834cda Author: Stephen Rothwell Date: Mon Jul 21 16:15:57 2025 +1000 sprintf.h requires stdarg.h In file included from drivers/crypto/intel/qat/qat_common/adf_pm_dbgfs_utils.c:4: include/linux/sprintf.h:11:54: error: unknown type name 'va_list' 11 | __printf(2, 0) int vsprintf(char *buf, const char *, va_list); | ^~~~~~~ include/linux/sprintf.h:1:1: note: 'va_list' is defined in header ''; this is probably fixable by adding '#include ' Link: https://lkml.kernel.org/r/20250721173754.42865913@canb.auug.org.au Fixes: 39ced19b9e60 ("lib/vsprintf: split out sprintf() and friends") Signed-off-by: Stephen Rothwell Cc: Andriy Shevchenko Cc: Herbert Xu Cc: Petr Mladek Cc: Steven Rostedt Cc: Rasmus Villemoes Cc: Sergey Senozhatsky Cc: Signed-off-by: Andrew Morton commit 91a229bb7ba86b2592c3f18c54b7b2c5e6fe0f95 Author: Akinobu Mita Date: Sat Jul 19 20:26:04 2025 +0900 resource: fix false warning in __request_region() A warning is raised when __request_region() detects a conflict with a resource whose resource.desc is IORES_DESC_DEVICE_PRIVATE_MEMORY. But this warning is only valid for iomem_resources. The hmem device resource uses resource.desc as the numa node id, which can cause spurious warnings. This warning appeared on a machine with multiple cxl memory expanders. One of the NUMA node id is 6, which is the same as the value of IORES_DESC_DEVICE_PRIVATE_MEMORY. In this environment it was just a spurious warning, but when I saw the warning I suspected a real problem so it's better to fix it. This change fixes this by restricting the warning to only iomem_resource. This also adds a missing new line to the warning message. Link: https://lkml.kernel.org/r/20250719112604.25500-1-akinobu.mita@gmail.com Fixes: 7dab174e2e27 ("dax/hmem: Move hmem device registration to dax_hmem.ko") Signed-off-by: Akinobu Mita Reviewed-by: Dan Williams Cc: Signed-off-by: Andrew Morton commit 1aef9df0ee90650ac3879dc994bb1a4b0e6dd83f Author: SeongJae Park Date: Sat Jul 19 11:19:32 2025 -0700 mm/damon/core: commit damos_quota_goal->nid DAMOS quota goal uses 'nid' field when the metric is DAMOS_QUOTA_NODE_MEM_{USED,FREE}_BP. But the goal commit function is not updating the goal's nid field. Fix it. Link: https://lkml.kernel.org/r/20250719181932.72944-1-sj@kernel.org Fixes: 0e1c773b501f ("mm/damon/core: introduce damos quota goal metrics for memory node utilization") [6.16.x] Signed-off-by: SeongJae Park Cc: Signed-off-by: Andrew Morton commit e6b39e516c441faecee20f3f34734ffa5ed834de Merge: 337666c522b9ec fd77b2c1b6eb7c Author: Dave Airlie Date: Fri Jul 25 10:57:21 2025 +1000 Merge tag 'drm-intel-fixes-2025-07-24' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Fix DP 2.7 Gbps DP_LINK_BW value on g4x (Ville) - Fix return value on intel_atomic_commit_fence_wait (Aakash) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://lore.kernel.org/r/aIJE9F-PcCe35PFb@intel.com commit 94ce1ac2c9b4925c39fc976dc3f4421fc9230942 Merge: dd9c17322a6cc5 8c493cc91f3a11 Author: Linus Torvalds Date: Thu Jul 24 15:33:00 2025 -0700 Merge tag 'pci-v6.16-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci fix from Bjorn Helgaas: - Create pwrctrl devices only when we need them, i.e., when CONFIG_PCI_PWRCTRL is enabled. This allows brcmstb to work around a pwrctrl regression by disabling CONFIG_PCI_PWRCTRL (Manivannan Sadhasivam) * tag 'pci-v6.16-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI/pwrctrl: Create pwrctrl devices only when CONFIG_PCI_PWRCTRL is enabled commit 99e91521cef80d74e4fefed16a156848052b13df Author: Lucas De Marchi Date: Tue Jul 22 12:52:08 2025 -0700 drm/xe: Fix build without debugfs When CONFIG_DEBUG_FS is off, drivers/gpu/drm/xe/xe_gt_debugfs.o is not built and build fails on some setups with: ld: drivers/gpu/drm/xe/xe_gt.o: in function `xe_fault_inject_gt_reset': drivers/gpu/drm/xe/xe_gt.h:27:(.text+0x1659): undefined reference to `gt_reset_failure' ld: drivers/gpu/drm/xe/xe_gt.h:27:(.text+0x1c16): undefined reference to `gt_reset_failure' collect2: error: ld returned 1 exit status Do not use the gt_reset_failure attribute if debugfs is not enabled. Fixes: 8f3013e0b222 ("drm/xe: Introduce fault injection for gt reset") Cc: Himal Prasad Ghimiray Acked-by: Randy Dunlap Tested-by: Randy Dunlap Reviewed-by: Himal Prasad Ghimiray Link: https://lore.kernel.org/r/20250722-xe-fix-build-fault-v1-1-157384d50987@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 4d3bbe9dd28c0a4ca119e4b8823c5f5e9cb3ff90) Signed-off-by: Thomas Hellström commit dd9c17322a6cc56d57b5d2b0b84393ab76a55c80 Merge: cef6c8c92fafa5 0d57ed922b9a9b Author: Linus Torvalds Date: Thu Jul 24 09:15:16 2025 -0700 Merge tag 'sound-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Some last-minute fixes. All changes are device-specific small fixes or quirks, safe to apply" * tag 'sound-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ASoC: mediatek: common: fix device and OF node leak ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop ALSA: usb-audio: qcom: Adjust mutex unlock order ASoC: SDCA: correct the calculation of the maximum init table size ASoC: rt5650: Eliminate the high frequency glitch ASoC: SOF: Intel: PTL: Add the sdw_process_wakeen op ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv commit cef6c8c92fafa58fa04d8622e89ed4871d121fc3 Merge: 407c114c983f6e d42e6c20de6192 Author: Linus Torvalds Date: Thu Jul 24 08:50:55 2025 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "Two important arm64 fixes ahead of the 6.16 release. The first fixes a regression introduced during the merge window where the KVM UUID (which is used to advertise KVM-specific hypercalls for things like time synchronisation in the guest) was corrupted thanks to an endianness bug introduced when converting the code to use the UUID_INIT() helper. The second fixes a stack-pointer corruption issue during context-switch which has been observed in the wild when taking a pseudo-NMI with shadow call stack enabled. Summary: - Fix broken UUID value for the KVM/arm64 hypervisor SMCCC interface - Fix stack corruption on context-switch, primarily seen on (but not limited to) configurations with both pNMI and SCS enabled" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() arm64: kvm, smccc: Fix vendor uuid commit 407c114c983f6eb87161853f0fdbe4a08e394b92 Merge: 25fae0b93d1d7d 291d5dc80eca1f Author: Linus Torvalds Date: Thu Jul 24 08:44:42 2025 -0700 Merge tag 'net-6.16-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from can and xfrm. The TI regression notified last week is actually on our net-next tree, it does not affect 6.16. We are investigating a virtio regression which is quite hard to reproduce - currently only our CI sporadically hits it. Hopefully it should not be critical, and I'm not sure that an additional week would be enough to solve it. Current release - fix to a fix: - sched: sch_qfq: avoid sleeping in atomic context in qfq_delete_class Previous releases - regressions: - xfrm: - set transport header to fix UDP GRO handling - delete x->tunnel as we delete x - eth: - mlx5: fix memory leak in cmd_exec() - i40e: when removing VF MAC filters, avoid losing PF-set MAC - gve: fix stuck TX queue for DQ queue format Previous releases - always broken: - can: fix NULL pointer deref of struct can_priv::do_set_mode - eth: - ice: fix a null pointer dereference in ice_copy_and_init_pkg() - ism: fix concurrency management in ism_cmd() - dpaa2: fix device reference count leak in MAC endpoint handling - icssg-prueth: fix buffer allocation for ICSSG Misc: - selftests: mptcp: increase code coverage" * tag 'net-6.16-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (34 commits) net: hns3: default enable tx bounce buffer when smmu enabled net: hns3: fixed vf get max channels bug net: hns3: disable interrupt when ptp init failed net: hns3: fix concurrent setting vlan filter issue s390/ism: fix concurrency management in ism_cmd() selftests: drv-net: wait for iperf client to stop sending MAINTAINERS: Add in6.h to MAINTAINERS selftests: netfilter: tone-down conntrack clash test can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class gve: Fix stuck TX queue for DQ queue format net: appletalk: Fix use-after-free in AARP proxy probe net: bcmasp: Restore programming of TX map vector register selftests: mptcp: connect: also cover checksum selftests: mptcp: connect: also cover alt modes e1000e: ignore uninitialized checksum word on tgp e1000e: disregard NVM checksum on tgp when valid checksum bit is not set ice: Fix a null pointer dereference in ice_copy_and_init_pkg() i40e: When removing VF MAC filters, only check PF-set MAC i40e: report VF tx_dropped with tx_errors instead of tx_discards ... commit 291d5dc80eca1fc67a0fa4c861d13c101345501a Merge: 89fd905dab912a 28712d6ed32028 Author: Paolo Abeni Date: Thu Jul 24 12:30:39 2025 +0200 Merge tag 'ipsec-2025-07-23' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2025-07-23 1) Premption fixes for xfrm_state_find. From Sabrina Dubroca. 2) Initialize offload path also for SW IPsec GRO. This fixes a performance regression on SW IPsec offload. From Leon Romanovsky. 3) Fix IPsec UDP GRO for IKE packets. From Tobias Brunner, 4) Fix transport header setting for IPcomp after decompressing. From Fernando Fernandez Mancera. 5) Fix use-after-free when xfrmi_changelink tries to change collect_md for a xfrm interface. From Eyal Birger . 6) Delete the special IPcomp x->tunnel state along with the state x to avoid refcount problems. From Sabrina Dubroca. Please pull or let me know if there are problems. * tag 'ipsec-2025-07-23' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec: Revert "xfrm: destroy xfrm_state synchronously on net exit path" xfrm: delete x->tunnel as we delete x xfrm: interface: fix use-after-free after changing collect_md xfrm interface xfrm: ipcomp: adjust transport header after decompressing xfrm: Set transport header to fix UDP GRO handling xfrm: always initialize offload path xfrm: state: use a consistent pcpu_id in xfrm_state_find xfrm: state: initialize state_ptrs earlier in xfrm_state_find ==================== Link: https://patch.msgid.link/20250723075417.3432644-1-steffen.klassert@secunet.com Signed-off-by: Paolo Abeni commit 89fd905dab912a5712149ec5c06d251ceaedf743 Merge: 897e8601b9cff1 49ade8630f36e9 Author: Paolo Abeni Date: Thu Jul 24 11:27:26 2025 +0200 Merge branch 'there-are-some-bugfix-for-the-hns3-ethernet-driver' Jijie Shao says: ==================== There are some bugfix for the HNS3 ethernet driver v1: https://lore.kernel.org/all/20250702130901.2879031-1-shaojijie@huawei.com/ ==================== Link: https://patch.msgid.link/20250722125423.1270673-1-shaojijie@huawei.com Signed-off-by: Paolo Abeni commit 49ade8630f36e9dca2395592cfb0b7deeb07e746 Author: Jijie Shao Date: Tue Jul 22 20:54:23 2025 +0800 net: hns3: default enable tx bounce buffer when smmu enabled The SMMU engine on HIP09 chip has a hardware issue. SMMU pagetable prefetch features may prefetch and use a invalid PTE even the PTE is valid at that time. This will cause the device trigger fake pagefaults. The solution is to avoid prefetching by adding a SYNC command when smmu mapping a iova. But the performance of nic has a sharp drop. Then we do this workaround, always enable tx bounce buffer, avoid mapping/unmapping on TX path. This issue only affects HNS3, so we always enable tx bounce buffer when smmu enabled to improve performance. Fixes: 295ba232a8c3 ("net: hns3: add device version to replace pci revision") Signed-off-by: Jian Shen Signed-off-by: Jijie Shao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250722125423.1270673-5-shaojijie@huawei.com Signed-off-by: Paolo Abeni commit b3e75c0bcc53f647311960bc1b0970b9b480ca5a Author: Jian Shen Date: Tue Jul 22 20:54:22 2025 +0800 net: hns3: fixed vf get max channels bug Currently, the queried maximum of vf channels is the maximum of channels supported by each TC. However, the actual maximum of channels is the maximum of channels supported by the device. Fixes: 849e46077689 ("net: hns3: add ethtool_ops.get_channels support for VF") Signed-off-by: Jian Shen Signed-off-by: Hao Lan Signed-off-by: Jijie Shao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250722125423.1270673-4-shaojijie@huawei.com Signed-off-by: Paolo Abeni commit cde304655f25d94a996c45b0f9956e7dcc2bc4c0 Author: Yonglong Liu Date: Tue Jul 22 20:54:21 2025 +0800 net: hns3: disable interrupt when ptp init failed When ptp init failed, we'd better disable the interrupt and clear the flag, to avoid early report interrupt at next probe. Fixes: 0bf5eb788512 ("net: hns3: add support for PTP") Signed-off-by: Yonglong Liu Signed-off-by: Jijie Shao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250722125423.1270673-3-shaojijie@huawei.com Signed-off-by: Paolo Abeni commit 4555f8f8b6aa46940f55feb6a07704c2935b6d6e Author: Jian Shen Date: Tue Jul 22 20:54:20 2025 +0800 net: hns3: fix concurrent setting vlan filter issue The vport->req_vlan_fltr_en may be changed concurrently by function hclge_sync_vlan_fltr_state() called in periodic work task and function hclge_enable_vport_vlan_filter() called by user configuration. It may cause the user configuration inoperative. Fixes it by protect the vport->req_vlan_fltr by vport_lock. Fixes: 2ba306627f59 ("net: hns3: add support for modify VLAN filter state") Signed-off-by: Jian Shen Signed-off-by: Jijie Shao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250722125423.1270673-2-shaojijie@huawei.com Signed-off-by: Paolo Abeni commit 897e8601b9cff1d054cdd53047f568b0e1995726 Author: Halil Pasic Date: Tue Jul 22 18:18:17 2025 +0200 s390/ism: fix concurrency management in ism_cmd() The s390x ISM device data sheet clearly states that only one request-response sequence is allowable per ISM function at any point in time. Unfortunately as of today the s390/ism driver in Linux does not honor that requirement. This patch aims to rectify that. This problem was discovered based on Aliaksei's bug report which states that for certain workloads the ISM functions end up entering error state (with PEC 2 as seen from the logs) after a while and as a consequence connections handled by the respective function break, and for future connection requests the ISM device is not considered -- given it is in a dysfunctional state. During further debugging PEC 3A was observed as well. A kernel message like [ 1211.244319] zpci: 061a:00:00.0: Event 0x2 reports an error for PCI function 0x61a is a reliable indicator of the stated function entering error state with PEC 2. Let me also point out that a kernel message like [ 1211.244325] zpci: 061a:00:00.0: The ism driver bound to the device does not support error recovery is a reliable indicator that the ISM function won't be auto-recovered because the ISM driver currently lacks support for it. On a technical level, without this synchronization, commands (inputs to the FW) may be partially or fully overwritten (corrupted) by another CPU trying to issue commands on the same function. There is hard evidence that this can lead to DMB token values being used as DMB IOVAs, leading to PEC 2 PCI events indicating invalid DMA. But this is only one of the failure modes imaginable. In theory even completely losing one command and executing another one twice and then trying to interpret the outputs as if the command we intended to execute was actually executed and not the other one is also possible. Frankly, I don't feel confident about providing an exhaustive list of possible consequences. Fixes: 684b89bc39ce ("s390/ism: add device driver for internal shared memory") Reported-by: Aliaksei Makarau Tested-by: Mahanta Jambigi Tested-by: Aliaksei Makarau Signed-off-by: Halil Pasic Reviewed-by: Alexandra Winter Signed-off-by: Alexandra Winter Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250722161817.1298473-1-wintera@linux.ibm.com Signed-off-by: Paolo Abeni commit 0d57ed922b9a9b0d36c90a992e076d850b779be5 Merge: 931837cd924048 696e123aa36bf0 Author: Takashi Iwai Date: Thu Jul 24 08:45:13 2025 +0200 Merge tag 'asoc-fix-v6.16-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.16 A few device specific fixes, none especially remarkable though all useful. commit 25fae0b93d1d7ddb25958bcb90c3c0e5e0e202bd Merge: f9af7b5d9349bf 337666c522b9ec Author: Linus Torvalds Date: Wed Jul 23 18:56:24 2025 -0700 Merge tag 'drm-fixes-2025-07-24' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "This might just be part one, but I'm sending it a bit early as it has two sets of reverts for regressions, one is all the gem/dma-buf handling and another was a nouveau ioctl change. Otherwise there is an amdgpu fix, nouveau fix and a scheduler fix. If any other changes come in I'll follow up with another more usual Fri/Sat MR. gem: - revert all the dma-buf/gem changes as there as lifetime issues with them nouveau: - revert an ioctl change as it causes issues - fix NULL ptr on fermi bridge: - remove extra semicolon sched: - remove hang causing optimisation amdgpu: - fix garbage in cleared vram after resume" * tag 'drm-fixes-2025-07-24' of https://gitlab.freedesktop.org/drm/kernel: drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() Revert "drm/nouveau: check ioctl command codes better" drm/nouveau/nvif: fix null ptr deref on pre-fermi boards Revert "drm/gem-dma: Use dma_buf from GEM object instance" Revert "drm/gem-shmem: Use dma_buf from GEM object instance" Revert "drm/gem-framebuffer: Use dma_buf from GEM object instance" Revert "drm/prime: Use dma_buf from GEM object instance" Revert "drm/etnaviv: Use dma_buf from GEM object instance" Revert "drm/vmwgfx: Use dma_buf from GEM object instance" Revert "drm/virtio: Use dma_buf from GEM object instance" drm/sched: Remove optimization that causes hang when killing dependent jobs drm/amdgpu: Reset the clear flag in buddy during resume commit 86941382508850d58c11bdafe0fec646dfd31b09 Author: Nimrod Oren Date: Tue Jul 22 15:26:55 2025 +0300 selftests: drv-net: wait for iperf client to stop sending A few packets may still be sent out during the termination of iperf processes. These late packets cause failures in rss_ctx.py when they arrive on queues expected to be empty. Example failure observed: Check failed 2 != 0 traffic on inactive queues (context 1): [0, 0, 1, 1, 386385, 397196, 0, 0, 0, 0, ...] Check failed 4 != 0 traffic on inactive queues (context 2): [0, 0, 0, 0, 2, 2, 247152, 253013, 0, 0, ...] Check failed 2 != 0 traffic on inactive queues (context 3): [0, 0, 0, 0, 0, 0, 1, 1, 282434, 283070, ...] To avoid such failures, wait until all client sockets for the requested port are either closed or in the TIME_WAIT state. Fixes: 847aa551fa78 ("selftests: drv-net: rss_ctx: factor out send traffic and check") Signed-off-by: Nimrod Oren Reviewed-by: Gal Pressman Reviewed-by: Carolina Jubran Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250722122655.3194442-1-noren@nvidia.com Signed-off-by: Jakub Kicinski commit a7982a14b3012527a9583d12525cd0dc9f8d8934 Author: Yang Xiwen Date: Mon Jun 16 00:01:10 2025 +0800 i2c: qup: jump out of the loop in case of timeout Original logic only sets the return value but doesn't jump out of the loop if the bus is kept active by a client. This is not expected. A malicious or buggy i2c client can hang the kernel in this case and should be avoided. This is observed during a long time test with a PCA953x GPIO extender. Fix it by changing the logic to not only sets the return value, but also jumps out of the loop and return to the caller with -ETIMEDOUT. Fixes: fbfab1ab0658 ("i2c: qup: reorganization of driver code to remove polling for qup v1") Signed-off-by: Yang Xiwen Cc: # v4.17+ Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250616-qca-i2c-v1-1-2a8d37ee0a30@outlook.com commit a663b3c47ab10f66130818cf94eb59c971541c3f Author: Viresh Kumar Date: Thu Jul 3 17:01:02 2025 +0530 i2c: virtio: Avoid hang by using interruptible completion wait The current implementation uses wait_for_completion(), which can cause the caller to hang indefinitely if the transfer never completes. Switch to wait_for_completion_interruptible() so that the operation can be interrupted by signals. Fixes: 84e1d0bf1d71 ("i2c: virtio: disable timeout handling") Signed-off-by: Viresh Kumar Cc: # v5.16+ Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/b8944e9cab8eb959d888ae80add6f2a686159ba2.1751541962.git.viresh.kumar@linaro.org commit 56344e241c543f17e8102fa13466ad5c3e7dc9ff Author: Akhil R Date: Thu Jul 10 18:42:04 2025 +0530 i2c: tegra: Fix reset error handling with ACPI The acpi_evaluate_object() returns an ACPI error code and not Linux one. For the some platforms the err will have positive code which may be interpreted incorrectly. Use device_reset() for reset control which handles it correctly. Fixes: bd2fdedbf2ba ("i2c: tegra: Add the ACPI support") Reported-by: Andy Shevchenko Signed-off-by: Akhil R Cc: # v5.17+ Reviewed-by: Andy Shevchenko Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250710131206.2316-2-akhilrajeev@nvidia.com commit 14822f782700a094baa9b5966cc047a9b1b31701 Author: Kees Cook Date: Tue Jul 22 09:56:49 2025 -0700 MAINTAINERS: Add in6.h to MAINTAINERS My CC-adding automation returned nothing on a future patch to the include/linux/in6.h file, and I went looking for why. Add the missed in6.h to MAINTAINERS. Signed-off-by: Kees Cook Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250722165645.work.047-kees@kernel.org Signed-off-by: Jakub Kicinski commit f9af7b5d9349bf92cc4d0a0baa8a151295f12f4b Merge: 01a412d06bc578 5a53249d149f48 Author: Linus Torvalds Date: Wed Jul 23 15:04:27 2025 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fix from Paolo Bonzini: - Fix cleanup mistake (probably a cut-and-paste error) in a Xen hypercall * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls commit 5a53249d149f48b558368c5338b9921b76a12f8c Author: Manuel Andreas Date: Wed Jul 23 17:51:20 2025 +0200 KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls kvm_xen_schedop_poll does a kmalloc_array() when a VM polls the host for more than one event channel potr (nr_ports > 1). After the kmalloc_array(), the error paths need to go through the "out" label, but the call to kvm_read_guest_virt() does not. Fixes: 92c58965e965 ("KVM: x86/xen: Use kvm_read_guest_virt() instead of open-coding it badly") Reviewed-by: David Woodhouse Signed-off-by: Manuel Andreas [Adjusted commit message. - Paolo] Signed-off-by: Paolo Bonzini commit 337666c522b9eca36deabf4133f7b2279155b69f Merge: 89be9a83ccf1f8 15a7ca747d9538 Author: Dave Airlie Date: Thu Jul 24 06:49:38 2025 +1000 Merge tag 'drm-misc-fixes-2025-07-23' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes drm-misc-fixes for v6.16-rc8/final?: - Revert all uses of drm_gem_object->dmabuf to drm_gem_object->import_attach->dmabuf. - Fix amdgpu returning BIOS cluttered VRAM after resume. - Scheduler hang fix. - Revert nouveau ioctl fix as it caused regressions. - Fix null pointer deref in nouveau. - Fix unnecessary semicolon in ti_sn_bridge_probe. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://lore.kernel.org/r/72235afd-c849-49fe-9cc1-2b1781abdf08@linux.intel.com commit 01a412d06bc5786eb4e44a6c8f0f4659bd4c9864 Merge: 964ebc07c546c7 e09a335a819133 Author: Linus Torvalds Date: Wed Jul 23 08:53:38 2025 -0700 Merge tag 'pull-ufs-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull ufs fix from Al Viro: "Fix regression in ufs options parsing" * tag 'pull-ufs-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: fix the regression in ufs options parsing commit e09a335a819133c0a9d6799adcf6d51837a7da2d Author: Al Viro Date: Sun Jul 20 16:43:53 2025 -0400 fix the regression in ufs options parsing A really dumb braino on rebasing and a dumber fuckup with managing #for-next Fixes: b70cb459890b ("ufs: convert ufs to the new mount API") Fucked-up-by: Al Viro Signed-off-by: Al Viro commit fd77b2c1b6eb7c7d2087e2c2b37c671d47fd2d4f Author: Aakash Deep Sarkar Date: Tue Jul 8 07:45:40 2025 +0000 drm/i915/display: Fix dma_fence_wait_timeout() return value handling dma_fence_wait_timeout returns a long type but the driver is only using the lower 32 bits of the retval and discarding the upper 32 bits. This is particularly problematic if there are already signalled or stub fences on some of the hw planes. In this case the dma_fence_wait_timeout function will immediately return with timeout value MAX_SCHEDULE_TIMEOUT (0x7fffffffffffffff) since the fence is already signalled. If the driver only uses the lower 32 bits of this return value then it'll interpret it as an error code (0xFFFFFFFF or (-1)) and skip the wait on the remaining fences. This issue was first observed in the xe driver with the Android compositor where the GPU composited layer was not properly waited on when there were stub fences in other overlay planes resulting in visual artifacts. Fixes: d59cf7bb73f3c ("drm/i915/display: Use dma_fence interfaces instead of i915_sw_fence") Signed-off-by: Aakash Deep Sarkar Reviewed-by: Matthew Brost Signed-off-by: Ankit Nautiyal Link: https://lore.kernel.org/r/20250708074540.1948068-1-aakash.deep.sarkar@intel.com (cherry picked from commit cdb16039515a5ac4d2c923f7a651cf19a803a3fe) Signed-off-by: Rodrigo Vivi commit f820034864dd463cdcd2bebe7940f2eca0eb4223 Author: Gabor Juhos Date: Wed Jul 23 10:06:43 2025 +0200 spi: spi-qpic-snand: don't hardcode ECC steps NAND devices with different page sizes requires different number of ECC steps, yet the qcom_spi_ecc_init_ctx_pipelined() function sets 4 steps in 'ecc_cfg' unconditionally. The correct number of the steps is calculated earlier in the function already, so use that instead of the hardcoded value. Fixes: 7304d1909080 ("spi: spi-qpic: add driver for QCOM SPI NAND flash Interface") Signed-off-by: Gabor Juhos Link: https://patch.msgid.link/20250723-qpic-snand-fix-steps-v1-1-d800695dde4c@gmail.com Signed-off-by: Mark Brown commit 696e123aa36bf0bc72bda98df96dd8f379a6e854 Author: Johan Hovold Date: Tue Jul 22 11:25:42 2025 +0200 ASoC: mediatek: common: fix device and OF node leak Make sure to drop the references to the accdet OF node and platform device taken by of_parse_phandle() and of_find_device_by_node() after looking up the sound component during probe. Fixes: cf536e2622e2 ("ASoC: mediatek: common: Handle mediatek,accdet property") Cc: stable@vger.kernel.org # 6.15 Cc: Nícolas F. R. A. Prado Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20250722092542.32754-1-johan@kernel.org Signed-off-by: Mark Brown commit 8b3c655fa2406b9853138142746a39b7615c54a2 Author: Edward Adam Davis Date: Mon Jul 21 15:26:51 2025 +0100 afs: Set vllist to NULL if addr parsing fails syzbot reported a bug in in afs_put_vlserverlist. kAFS: bad VL server IP address BUG: unable to handle page fault for address: fffffffffffffffa ... Oops: Oops: 0002 [#1] SMP KASAN PTI ... RIP: 0010:refcount_dec_and_test include/linux/refcount.h:450 [inline] RIP: 0010:afs_put_vlserverlist+0x3a/0x220 fs/afs/vl_list.c:67 ... Call Trace: afs_alloc_cell fs/afs/cell.c:218 [inline] afs_lookup_cell+0x12a5/0x1680 fs/afs/cell.c:264 afs_cell_init+0x17a/0x380 fs/afs/cell.c:386 afs_proc_rootcell_write+0x21f/0x290 fs/afs/proc.c:247 proc_simple_write+0x114/0x1b0 fs/proc/generic.c:825 pde_write fs/proc/inode.c:330 [inline] proc_reg_write+0x23d/0x330 fs/proc/inode.c:342 vfs_write+0x25c/0x1180 fs/read_write.c:682 ksys_write+0x12a/0x240 fs/read_write.c:736 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Because afs_parse_text_addrs() parses incorrectly, its return value -EINVAL is assigned to vllist, which results in -EINVAL being used as the vllist address when afs_put_vlserverlist() is executed. Set the vllist value to NULL when a parsing error occurs to avoid this issue. Fixes: e2c2cb8ef07a ("afs: Simplify cell record handling") Reported-by: syzbot+5c042fbab0b292c98fc6@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5c042fbab0b292c98fc6 Tested-by: syzbot+5c042fbab0b292c98fc6@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis Signed-off-by: David Howells Link: https://lore.kernel.org/4119365.1753108011@warthog.procyon.org.uk cc: Marc Dionne cc: linux-afs@lists.infradead.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit 9aa64182952db7d931201ab4fcdf767c11fb4ab0 Author: Leo Stone Date: Mon Jul 21 15:29:12 2025 +0100 afs: Fix check for NULL terminator Add a missing check for reaching the end of the string while attempting to split a command. Fixes: f94f70d39cc2 ("afs: Provide a way to configure address priorities") Reported-by: syzbot+7741f872f3c53385a2e2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7741f872f3c53385a2e2 Signed-off-by: Leo Stone Signed-off-by: David Howells Link: https://lore.kernel.org/4119428.1753108152@warthog.procyon.org.uk Acked-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit 67e9d0b40bd7990d6eab63b5afedea3c17578993 Merge: dca56cc8b5c3be c1f3f9797c1f44 Author: Jakub Kicinski Date: Tue Jul 22 18:39:51 2025 -0700 Merge tag 'linux-can-fixes-for-6.16-20250722' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2025-07-22 The patch is by me and fixes a potential NULL pointer deref in the CAN device driver infrastructure. It can be triggered from user space. * tag 'linux-can-fixes-for-6.16-20250722' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode ==================== Link: https://patch.msgid.link/20250722110059.3664104-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit dca56cc8b5c3bee889d6cb0d2ee3e933b21cb4ec Author: Florian Westphal Date: Tue Jul 22 00:36:49 2025 +0200 selftests: netfilter: tone-down conntrack clash test The test is supposed to observe that the 'clash_resolve' stat counter incremented (i.e., the code path was covered). This check was incorrect, 'conntrack -S' needs to be called in the revevant namespace, not the initial netns. The clash resolution logic in conntrack is only exercised when multiple packets with the same udp quadruple race. Depending on kernel config, number of CPUs, scheduling policy etc. this might not trigger even after several retries. Thus the script eventually returns SKIP if the retry count is exceeded. The udpclash tool with also exit with a failure if it did not observe the expected number of replies. In the script, make a note of this but do not fail anymore, just check if the clash resolution logic triggered after all. Remove the 'single-core' test: while unlikely, with preemptible kernel it should be possible to also trigger clash resolution logic. With this change the test will either SKIP or pass. Hard error could be restored later once its clear whats going on, so also dump 'conntrack -S' when some packets went missing to see if conntrack dropped them on insert. Fixes: 78a588363587 ("selftests: netfilter: add conntrack clash resolution test case") Signed-off-by: Florian Westphal Link: https://patch.msgid.link/20250721223652.6956-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit 71c33df471a6ed40cc3ec7902cf889d813219b07 Merge: cf074eca0065bc 61114910a5f6a7 Author: Jakub Kicinski Date: Tue Jul 22 18:24:10 2025 -0700 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2025-07-21 (i40e, ice, e1000e) For i40e: Dennis Chen adjusts reporting of VF Tx dropped to a more appropriate field. Jamie Bainbridge fixes a check which can cause a PF set VF MAC address to be lost. For ice: Haoxiang Li adds an error check in DDP load to prevent NULL pointer dereference. For e1000e: Jacek Kowalski adds workarounds for issues surrounding Tiger Lake platforms with uninitialized NVMs. * '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: e1000e: ignore uninitialized checksum word on tgp e1000e: disregard NVM checksum on tgp when valid checksum bit is not set ice: Fix a null pointer dereference in ice_copy_and_init_pkg() i40e: When removing VF MAC filters, only check PF-set MAC i40e: report VF tx_dropped with tx_errors instead of tx_discards ==================== Link: https://patch.msgid.link/20250721173733.2248057-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 912b1f2a796ec73530a709b11821cb0c249fb23e Author: Diederik de Haas Date: Tue Jul 22 14:35:33 2025 +0200 arm64: dts: rockchip: Drop netdev led-triggers on NanoPi R5S Sometimes the netdev triggers causes tasks to get blocked for more then 120 seconds, which in turn makes the (WAN) network port on the NanoPi R5S fail to come up. This results in the following (partial) trace: INFO: task kworker/0:1:11 blocked for more than 120 seconds. Not tainted 6.16-rc6+unreleased-arm64-cknow #1 Debian 6.16~rc6-1~exp1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:1 state:D stack:0 pid:11 tgid:11 ppid:2 task_flags:0x4208060 flags:0x00000010 Workqueue: events_power_efficient reg_check_chans_work [cfg80211] Call trace: __switch_to+0xf8/0x168 (T) __schedule+0x3f8/0xda8 schedule+0x3c/0x120 schedule_preempt_disabled+0x2c/0x58 __mutex_lock.constprop.0+0x4d0/0xab8 __mutex_lock_slowpath+0x1c/0x30 mutex_lock+0x50/0x68 rtnl_lock+0x20/0x38 reg_check_chans_work+0x40/0x478 [cfg80211] process_one_work+0x178/0x3e0 worker_thread+0x260/0x390 kthread+0x150/0x250 ret_from_fork+0x10/0x20 INFO: task kworker/0:1:11 is blocked on a mutex likely owned by task dhcpcd:615. task:dhcpcd state:D stack:0 pid:615 tgid:615 ppid:614 task_flags:0x400140 flags:0x00000018 Call trace: __switch_to+0xf8/0x168 (T) __schedule+0x3f8/0xda8 schedule+0x3c/0x120 schedule_preempt_disabled+0x2c/0x58 rwsem_down_write_slowpath+0x1e4/0x750 down_write+0x98/0xb0 led_trigger_register+0x134/0x1c0 phy_led_triggers_register+0xf4/0x258 [libphy] phy_attach_direct+0x30c/0x390 [libphy] phylink_fwnode_phy_connect+0xb0/0x138 [phylink] __stmmac_open+0xec/0x520 [stmmac] stmmac_open+0x4c/0xe8 [stmmac] __dev_open+0x130/0x2e0 __dev_change_flags+0x1c4/0x248 netif_change_flags+0x2c/0x80 dev_change_flags+0x88/0xc8 devinet_ioctl+0x35c/0x610 inet_ioctl+0x204/0x260 sock_do_ioctl+0x6c/0x140 sock_ioctl+0x2e4/0x388 __arm64_sys_ioctl+0xb4/0x120 invoke_syscall+0x6c/0x100 el0_svc_common.constprop.0+0x48/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x3c/0x188 el0t_64_sync_handler+0x10c/0x140 el0t_64_sync+0x198/0x1a0 In order to not introduce a regression with kernel 6.16, drop the netdev triggers for now while the problem is being investigated further. Fixes: 1631cbdb8089 ("arm64: dts: rockchip: Improve LED config for NanoPi R5S") Helped-by: Robin Murphy Signed-off-by: Diederik de Haas Link: https://lore.kernel.org/r/20250722123628.25660-1-didi.debian@cknow.org Signed-off-by: Heiko Stuebner Signed-off-by: Arnd Bergmann commit 8c493cc91f3a1102ad2f8c75ae0cf80f0a057488 Author: Manivannan Sadhasivam Date: Tue Jul 1 12:17:31 2025 +0530 PCI/pwrctrl: Create pwrctrl devices only when CONFIG_PCI_PWRCTRL is enabled If devicetree describes power supplies related to a PCI device, we unnecessarily created a pwrctrl device even if CONFIG_PCI_PWRCTL was not enabled. We only need pci_pwrctrl_create_device() when CONFIG_PCI_PWRCTRL is enabled. Compile it out when CONFIG_PCI_PWRCTRL is not enabled. When pci_pwrctrl_create_device() creates and returns a pwrctrl device, pci_scan_device() doesn't enumerate the PCI device. It assumes the pwrctrl core will rescan the bus after turning on the power. However, if CONFIG_PCI_PWRCTRL is not enabled, the rescan never happens, which breaks PCI enumeration on any system that describes power supplies in devicetree but does not use pwrctrl. Jim reported that some brcmstb platforms break this way. The brcmstb driver is still broken if CONFIG_PCI_PWRCTRL is enabled, but this commit at least allows brcmstb to work when it's NOT enabled. Fixes: 957f40d039a9 ("PCI/pwrctrl: Move creation of pwrctrl devices to pci_scan_device()") Reported-by: Jim Quinlan Link: https://lore.kernel.org/r/CA+-6iNwgaByXEYD3j=-+H_PKAxXRU78svPMRHDKKci8AGXAUPg@mail.gmail.com Signed-off-by: Manivannan Sadhasivam [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas Reviewed-by: Lukas Wunner Cc: stable@vger.kernel.org # v6.15 Link: https://patch.msgid.link/20250701064731.52901-1-manivannan.sadhasivam@linaro.org commit 931837cd924048ab785eedb4cee5b276c90a2924 Author: SHARAN KUMAR M Date: Tue Jul 22 22:52:24 2025 +0530 ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop this patch is to fix my previous Commit i have fixed mute led but for by This patch corrects the coefficient mask value introduced in commit , which was intended to enable the mute LED functionality. During testing, multiple values were evaluated, and an incorrect value was mistakenly included in the final commit. This update fixes that error by applying the correct mask value for proper mute LED behavior. Tested on 6.15.5-arch1-1 Fixes: e5182305a519 ("ALSA: hda/realtek: Enable Mute LED on HP OMEN 16 Laptop xd000xx") Signed-off-by: SHARAN KUMAR M Link: https://patch.msgid.link/20250722172224.15359-1-sharweshraajan@gmail.com Signed-off-by: Takashi Iwai commit d42e6c20de6192f8e4ab4cf10be8c694ef27e8cb Author: Ada Couprie Diaz Date: Fri Jul 18 15:28:14 2025 +0100 arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() `cpu_switch_to()` and `call_on_irq_stack()` manipulate SP to change to different stacks along with the Shadow Call Stack if it is enabled. Those two stack changes cannot be done atomically and both functions can be interrupted by SErrors or Debug Exceptions which, though unlikely, is very much broken : if interrupted, we can end up with mismatched stacks and Shadow Call Stack leading to clobbered stacks. In `cpu_switch_to()`, it can happen when SP_EL0 points to the new task, but x18 stills points to the old task's SCS. When the interrupt handler tries to save the task's SCS pointer, it will save the old task SCS pointer (x18) into the new task struct (pointed to by SP_EL0), clobbering it. In `call_on_irq_stack()`, it can happen when switching from the task stack to the IRQ stack and when switching back. In both cases, we can be interrupted when the SCS pointer points to the IRQ SCS, but SP points to the task stack. The nested interrupt handler pushes its return addresses on the IRQ SCS. It then detects that SP points to the task stack, calls `call_on_irq_stack()` and clobbers the task SCS pointer with the IRQ SCS pointer, which it will also use ! This leads to tasks returning to addresses on the wrong SCS, or even on the IRQ SCS, triggering kernel panics via CONFIG_VMAP_STACK or FPAC if enabled. This is possible on a default config, but unlikely. However, when enabling CONFIG_ARM64_PSEUDO_NMI, DAIF is unmasked and instead the GIC is responsible for filtering what interrupts the CPU should receive based on priority. Given the goal of emulating NMIs, pseudo-NMIs can be received by the CPU even in `cpu_switch_to()` and `call_on_irq_stack()`, possibly *very* frequently depending on the system configuration and workload, leading to unpredictable kernel panics. Completely mask DAIF in `cpu_switch_to()` and restore it when returning. Do the same in `call_on_irq_stack()`, but restore and mask around the branch. Mask DAIF even if CONFIG_SHADOW_CALL_STACK is not enabled for consistency of behaviour between all configurations. Introduce and use an assembly macro for saving and masking DAIF, as the existing one saves but only masks IF. Cc: Signed-off-by: Ada Couprie Diaz Reported-by: Cristian Prundeanu Fixes: 59b37fe52f49 ("arm64: Stash shadow stack pointer in the task struct on interrupt") Tested-by: Cristian Prundeanu Acked-by: Will Deacon Link: https://lore.kernel.org/r/20250718142814.133329-1-ada.coupriediaz@arm.com Signed-off-by: Will Deacon commit 15a7ca747d9538c2ad8b0c81dd4c1261e0736c82 Author: Douglas Anderson Date: Mon Jul 14 13:06:32 2025 -0700 drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() As reported by the kernel test robot, a recent patch introduced an unnecessary semicolon. Remove it. Fixes: 55e8ff842051 ("drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506301704.0SBj6ply-lkp@intel.com/ Reviewed-by: Devarsh Thakkar Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250714130631.1.I1cfae3222e344a3b3c770d079ee6b6f7f3b5d636@changeid commit 67c632b4a7fbd6b76a08b86f4950f0f84de93439 Author: Markus Blöchl Date: Sun Jul 20 15:54:51 2025 +0200 timekeeping: Zero initialize system_counterval when querying time from phc drivers Most drivers only populate the fields cycles and cs_id of system_counterval in their get_time_fn() callback for get_device_system_crosststamp(), unless they explicitly provide nanosecond values. When the use_nsecs field was added to struct system_counterval, most drivers did not care. Clock sources other than CSID_GENERIC could then get converted in convert_base_to_cs() based on an uninitialized use_nsecs field, which usually results in -EINVAL during the following range check. Pass in a fully zero initialized system_counterval_t to cure that. Fixes: 6b2e29977518 ("timekeeping: Provide infrastructure for converting to/from a base clock") Signed-off-by: Markus Blöchl Signed-off-by: Thomas Gleixner Acked-by: John Stultz Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20250720-timekeeping_uninit_crossts-v2-1-f513c885b7c2@blochl.de commit 270b329f7ec4e4e8dca6735bd1fe286a8e39b82d Author: Arnd Bergmann Date: Tue Jul 22 13:58:18 2025 +0200 Revert "drm/nouveau: check ioctl command codes better" My previous patch ended up causing a regression for the DRM_IOCTL_NOUVEAU_NVIF ioctl. The intention of my patch was to only pass ioctl commands that have the correct dir/type/nr bits into the nouveau_abi16_ioctl() function. This turned out to be too strict, as userspace does use at least write-only and write-read direction settings. Checking for both of these still did not fix the issue, so the best we can do for the 6.16 release is to revert back to what we've had since linux-3.16. This version is still fragile, but at least it is known to work with existing userspace. Fixing this properly requires a better understanding of what commands are being passed from userspace in practice, and how that relies on the undocumented (miss)behavior in nouveau_drm_ioctl(). Fixes: e5478166dffb ("drm/nouveau: check ioctl command codes better") Reported-by: Satadru Pramanik Closes: https://lore.kernel.org/lkml/CAFrh3J85tsZRpOHQtKgNHUVnn=EG=QKBnZTRtWS8eWSc1K1xkA@mail.gmail.com/ Reported-by: Chris Bainbridge Closes: https://lore.kernel.org/lkml/aH9n_QGMFx2ZbKlw@debian.local/ Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250722115830.2587297-1-arnd@kernel.org [ Add Closes: tags, fix minor typo in commit message. - Danilo ] Signed-off-by: Danilo Krummrich commit c1f3f9797c1f44a762e6f5f72520b2e520537b52 Author: Marc Kleine-Budde Date: Tue Jul 15 22:35:46 2025 +0200 can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode Andrei Lalaev reported a NULL pointer deref when a CAN device is restarted from Bus Off and the driver does not implement the struct can_priv::do_set_mode callback. There are 2 code path that call struct can_priv::do_set_mode: - directly by a manual restart from the user space, via can_changelink() - delayed automatic restart after bus off (deactivated by default) To prevent the NULL pointer deference, refuse a manual restart or configure the automatic restart delay in can_changelink() and report the error via extack to user space. As an additional safety measure let can_restart() return an error if can_priv::do_set_mode is not set instead of dereferencing it unchecked. Reported-by: Andrei Lalaev Closes: https://lore.kernel.org/all/20250714175520.307467-1-andrey.lalaev@gmail.com Fixes: 39549eef3587 ("can: CAN Network device driver and Netlink interface") Link: https://patch.msgid.link/20250718-fix-nullptr-deref-do_set_mode-v1-1-0b520097bb96@pengutronix.de Signed-off-by: Marc Kleine-Budde commit cf074eca0065bc5142e6004ae236bb35a2687fdf Author: Xiang Mei Date: Thu Jul 17 16:01:28 2025 -0700 net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class might_sleep could be trigger in the atomic context in qfq_delete_class. qfq_destroy_class was moved into atomic context locked by sch_tree_lock to avoid a race condition bug on qfq_aggregate. However, might_sleep could be triggered by qfq_destroy_class, which introduced sleeping in atomic context (path: qfq_destroy_class->qdisc_put->__qdisc_destroy->lockdep_unregister_key ->might_sleep). Considering the race is on the qfq_aggregate objects, keeping qfq_rm_from_agg in the lock but moving the left part out can solve this issue. Fixes: 5e28d5a3f774 ("net/sched: sch_qfq: Fix race condition on qfq_aggregate") Reported-by: Dan Carpenter Signed-off-by: Xiang Mei Link: https://patch.msgid.link/4a04e0cc-a64b-44e7-9213-2880ed641d77@sabinyo.mountain Reviewed-by: Cong Wang Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20250717230128.159766-1-xmei5@asu.edu Signed-off-by: Paolo Abeni commit 48915162b5ad598bc6fbf8959683f43664b4f6f1 Author: Erick Karanja Date: Mon Jul 21 14:45:53 2025 +0300 ALSA: usb-audio: qcom: Adjust mutex unlock order The mutexes qdev_mutex and chip->mutex are acquired in that order throughout the driver. To preserve proper lock hierarchy and avoid potential deadlocks, they must be released in the reverse order of acquisition. This change reorders the unlock sequence to first release chip->mutex followed by qdev_mutex, ensuring consistency with the locking pattern. [ fixed the code indentations and Fixes tag by tiwai ] Fixes: 326bbc348298a ("ALSA: usb-audio: qcom: Introduce QC USB SND offloading support") Signed-off-by: Erick Karanja Link: https://patch.msgid.link/20250721114554.1666104-1-karanja99erick@gmail.com Signed-off-by: Takashi Iwai commit b03f15c0192b184078206760c839054ae6eb4eaa Author: Praveen Kaligineedi Date: Thu Jul 17 19:20:24 2025 +0000 gve: Fix stuck TX queue for DQ queue format gve_tx_timeout was calculating missed completions in a way that is only relevant in the GQ queue format. Additionally, it was attempting to disable device interrupts, which is not needed in either GQ or DQ queue formats. As a result, TX timeouts with the DQ queue format likely would have triggered early resets without kicking the queue at all. This patch drops the check for pending work altogether and always kicks the queue after validating the queue has not seen a TX timeout too recently. Cc: stable@vger.kernel.org Fixes: 87a7f321bb6a ("gve: Recover from queue stall due to missed IRQ") Co-developed-by: Tim Hostetler Signed-off-by: Tim Hostetler Signed-off-by: Praveen Kaligineedi Signed-off-by: Harshitha Ramamurthy Link: https://patch.msgid.link/20250717192024.1820931-1-hramamurthy@google.com Signed-off-by: Jakub Kicinski commit 6c4a92d07b0850342d3becf2e608f805e972467c Author: Kito Xu (veritas501) Date: Thu Jul 17 01:28:43 2025 +0000 net: appletalk: Fix use-after-free in AARP proxy probe The AARP proxy‐probe routine (aarp_proxy_probe_network) sends a probe, releases the aarp_lock, sleeps, then re-acquires the lock. During that window an expire timer thread (__aarp_expire_timer) can remove and kfree() the same entry, leading to a use-after-free. race condition: cpu 0 | cpu 1 atalk_sendmsg() | atif_proxy_probe_device() aarp_send_ddp() | aarp_proxy_probe_network() mod_timer() | lock(aarp_lock) // LOCK!! timeout around 200ms | alloc(aarp_entry) and then call | proxies[hash] = aarp_entry aarp_expire_timeout() | aarp_send_probe() | unlock(aarp_lock) // UNLOCK!! lock(aarp_lock) // LOCK!! | msleep(100); __aarp_expire_timer(&proxies[ct]) | free(aarp_entry) | unlock(aarp_lock) // UNLOCK!! | | lock(aarp_lock) // LOCK!! | UAF aarp_entry !! ================================================================== BUG: KASAN: slab-use-after-free in aarp_proxy_probe_network+0x560/0x630 net/appletalk/aarp.c:493 Read of size 4 at addr ffff8880123aa360 by task repro/13278 CPU: 3 UID: 0 PID: 13278 Comm: repro Not tainted 6.15.2 #3 PREEMPT(full) Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xc1/0x630 mm/kasan/report.c:521 kasan_report+0xca/0x100 mm/kasan/report.c:634 aarp_proxy_probe_network+0x560/0x630 net/appletalk/aarp.c:493 atif_proxy_probe_device net/appletalk/ddp.c:332 [inline] atif_ioctl+0xb58/0x16c0 net/appletalk/ddp.c:857 atalk_ioctl+0x198/0x2f0 net/appletalk/ddp.c:1818 sock_do_ioctl+0xdc/0x260 net/socket.c:1190 sock_ioctl+0x239/0x6a0 net/socket.c:1311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl fs/ioctl.c:892 [inline] __x64_sys_ioctl+0x194/0x200 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcb/0x250 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Allocated: aarp_alloc net/appletalk/aarp.c:382 [inline] aarp_proxy_probe_network+0xd8/0x630 net/appletalk/aarp.c:468 atif_proxy_probe_device net/appletalk/ddp.c:332 [inline] atif_ioctl+0xb58/0x16c0 net/appletalk/ddp.c:857 atalk_ioctl+0x198/0x2f0 net/appletalk/ddp.c:1818 Freed: kfree+0x148/0x4d0 mm/slub.c:4841 __aarp_expire net/appletalk/aarp.c:90 [inline] __aarp_expire_timer net/appletalk/aarp.c:261 [inline] aarp_expire_timeout+0x480/0x6e0 net/appletalk/aarp.c:317 The buggy address belongs to the object at ffff8880123aa300 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 96 bytes inside of freed 192-byte region [ffff8880123aa300, ffff8880123aa3c0) Memory state around the buggy address: ffff8880123aa200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880123aa280: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc >ffff8880123aa300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880123aa380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff8880123aa400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kito Xu (veritas501) Link: https://patch.msgid.link/20250717012843.880423-1-hxzene@gmail.com Signed-off-by: Jakub Kicinski commit 18ff09c1b94fa1584b31d3f4e9eecdca29230ce5 Author: Florian Fainelli Date: Fri Jul 18 14:22:42 2025 -0700 net: bcmasp: Restore programming of TX map vector register On ASP versions v2.x we need to program the TX map vector register to properly exercise end-to-end flow control, otherwise the TX engine can either lock-up, or cause the hardware calculated checksum to be wrong/corrupted when multiple back to back packets are being submitted for transmission. This register defaults to 0, which means no flow control being applied. Fixes: e9f31435ee7d ("net: bcmasp: Add support for asp-v3.0") Signed-off-by: Florian Fainelli Link: https://patch.msgid.link/20250718212242.3447751-1-florian.fainelli@broadcom.com Signed-off-by: Jakub Kicinski commit 53b2fb6b05cd343aa22367857c0e97aef72e8087 Merge: 81e0db8e839822 fdf0f60a2bb02b Author: Jakub Kicinski Date: Mon Jul 21 16:21:32 2025 -0700 Merge branch 'selftests-mptcp-connect-cover-alt-modes' Matthieu Baerts says: ==================== selftests: mptcp: connect: cover alt modes mptcp_connect.sh can be executed manually with "-m " and "-C" to make sure everything works as expected when using "mmap" and "sendfile" modes instead of "poll", and with the MPTCP checksum support. These modes should be validated, but they are not when the selftests are executed via the kselftest helpers. It means that most CIs validating these selftests, like NIPA for the net development trees and LKFT for the stable ones, are not covering these modes. To fix that, new test programs have been added, simply calling mptcp_connect.sh with the right parameters. The first patch can be backported up to v5.6, and the second one up to v5.14. v1: https://lore.kernel.org/20250714-net-mptcp-sft-connect-alt-v1-0-bf1c5abbe575@kernel.org ==================== Link: https://patch.msgid.link/20250715-net-mptcp-sft-connect-alt-v2-0-8230ddd82454@kernel.org Signed-off-by: Jakub Kicinski commit fdf0f60a2bb02ba581d9e71d583e69dd0714a521 Author: Matthieu Baerts (NGI0) Date: Tue Jul 15 20:43:29 2025 +0200 selftests: mptcp: connect: also cover checksum The checksum mode has been added a while ago, but it is only validated when manually launching mptcp_connect.sh with "-C". The different CIs were then not validating these MPTCP Connect tests with checksum enabled. To make sure they do, add a new test program executing mptcp_connect.sh with the checksum mode. Fixes: 94d66ba1d8e4 ("selftests: mptcp: enable checksum in mptcp_connect.sh") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250715-net-mptcp-sft-connect-alt-v2-2-8230ddd82454@kernel.org Signed-off-by: Jakub Kicinski commit 37848a456fc38c191aedfe41f662cc24db8c23d9 Author: Matthieu Baerts (NGI0) Date: Tue Jul 15 20:43:28 2025 +0200 selftests: mptcp: connect: also cover alt modes The "mmap" and "sendfile" alternate modes for mptcp_connect.sh/.c are available from the beginning, but only tested when mptcp_connect.sh is manually launched with "-m mmap" or "-m sendfile", not via the kselftests helpers. The MPTCP CI was manually running "mptcp_connect.sh -m mmap", but not "-m sendfile". Plus other CIs, especially the ones validating the stable releases, were not validating these alternate modes. To make sure these modes are validated by these CIs, add two new test programs executing mptcp_connect.sh with the alternate modes. Fixes: 048d19d444be ("mptcp: add basic kselftest for mptcp") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250715-net-mptcp-sft-connect-alt-v2-1-8230ddd82454@kernel.org Signed-off-by: Jakub Kicinski commit 61114910a5f6a71d0b6ea3b95082dfe031b19dfe Author: Jacek Kowalski Date: Mon Jun 30 10:35:00 2025 +0200 e1000e: ignore uninitialized checksum word on tgp As described by Vitaly Lifshits: > Starting from Tiger Lake, LAN NVM is locked for writes by SW, so the > driver cannot perform checksum validation and correction. This means > that all NVM images must leave the factory with correct checksum and > checksum valid bit set. Unfortunately some systems have left the factory with an uninitialized value of 0xFFFF at register address 0x3F (checksum word location). So on Tiger Lake platform we ignore the computed checksum when such condition is encountered. Signed-off-by: Jacek Kowalski Tested-by: Vlad URSU Fixes: 4051f68318ca9 ("e1000e: Do not take care about recovery NVM checksum") Cc: stable@vger.kernel.org Reviewed-by: Simon Horman Reviewed-by: Vitaly Lifshits Tested-by: Mor Bar-Gabay Signed-off-by: Tony Nguyen commit 536fd741c7ac907d63166cdae1081b1febfab613 Author: Jacek Kowalski Date: Mon Jun 30 10:33:39 2025 +0200 e1000e: disregard NVM checksum on tgp when valid checksum bit is not set As described by Vitaly Lifshits: > Starting from Tiger Lake, LAN NVM is locked for writes by SW, so the > driver cannot perform checksum validation and correction. This means > that all NVM images must leave the factory with correct checksum and > checksum valid bit set. Since Tiger Lake devices were the first to have > this lock, some systems in the field did not meet this requirement. > Therefore, for these transitional devices we skip checksum update and > verification, if the valid bit is not set. Signed-off-by: Jacek Kowalski Reviewed-by: Simon Horman Reviewed-by: Vitaly Lifshits Fixes: 4051f68318ca9 ("e1000e: Do not take care about recovery NVM checksum") Cc: stable@vger.kernel.org Tested-by: Mor Bar-Gabay Signed-off-by: Tony Nguyen commit 4ff12d82dac119b4b99b5a78b5af3bf2474c0a36 Author: Haoxiang Li Date: Thu Jul 3 17:52:32 2025 +0800 ice: Fix a null pointer dereference in ice_copy_and_init_pkg() Add check for the return value of devm_kmemdup() to prevent potential null pointer dereference. Fixes: c76488109616 ("ice: Implement Dynamic Device Personalization (DDP) download") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li Reviewed-by: Michal Swiatkowski Reviewed-by: Aleksandr Loktionov Reviewed-by: Simon Horman Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 5a0df02999dbe838c3feed54b1d59e9445f68b89 Author: Jamie Bainbridge Date: Wed Jun 25 09:29:18 2025 +1000 i40e: When removing VF MAC filters, only check PF-set MAC When the PF is processing an Admin Queue message to delete a VF's MACs from the MAC filter, we currently check if the PF set the MAC and if the VF is trusted. This results in undesirable behaviour, where if a trusted VF with a PF-set MAC sets itself down (which sends an AQ message to delete the VF's MAC filters) then the VF MAC is erased from the interface. This results in the VF losing its PF-set MAC which should not happen. There is no need to check for trust at all, because an untrusted VF cannot change its own MAC. The only check needed is whether the PF set the MAC. If the PF set the MAC, then don't erase the MAC on link-down. Resolve this by changing the deletion check only for PF-set MAC. (the out-of-tree driver has also intentionally removed the check for VF trust here with OOT driver version 2.26.8, this changes the Linux kernel driver behaviour and comment to match the OOT driver behaviour) Fixes: ea2a1cfc3b201 ("i40e: Fix VF MAC filter removal") Signed-off-by: Jamie Bainbridge Reviewed-by: Simon Horman Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit 50b2af451597ca6eefe9d4543f8bbf8de8aa00e7 Author: Dennis Chen Date: Wed Jun 18 15:52:40 2025 -0400 i40e: report VF tx_dropped with tx_errors instead of tx_discards Currently the tx_dropped field in VF stats is not updated correctly when reading stats from the PF. This is because it reads from i40e_eth_stats.tx_discards which seems to be unused for per VSI stats, as it is not updated by i40e_update_eth_stats() and the corresponding register, GLV_TDPC, is not implemented[1]. Use i40e_eth_stats.tx_errors instead, which is actually updated by i40e_update_eth_stats() by reading from GLV_TEPC. To test, create a VF and try to send bad packets through it: $ echo 1 > /sys/class/net/enp2s0f0/device/sriov_numvfs $ cat test.py from scapy.all import * vlan_pkt = Ether(dst="ff:ff:ff:ff:ff:ff") / Dot1Q(vlan=999) / IP(dst="192.168.0.1") / ICMP() ttl_pkt = IP(dst="8.8.8.8", ttl=0) / ICMP() print("Send packet with bad VLAN tag") sendp(vlan_pkt, iface="enp2s0f0v0") print("Send packet with TTL=0") sendp(ttl_pkt, iface="enp2s0f0v0") $ ip -s link show dev enp2s0f0 16: enp2s0f0: mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000 link/ether 3c:ec:ef:b7:e0:ac brd ff:ff:ff:ff:ff:ff RX: bytes packets errors dropped missed mcast 0 0 0 0 0 0 TX: bytes packets errors dropped carrier collsns 0 0 0 0 0 0 vf 0 link/ether e2:c6:fd:c1:1e:92 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off RX: bytes packets mcast bcast dropped 0 0 0 0 0 TX: bytes packets dropped 0 0 0 $ python test.py Send packet with bad VLAN tag . Sent 1 packets. Send packet with TTL=0 . Sent 1 packets. $ ip -s link show dev enp2s0f0 16: enp2s0f0: mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000 link/ether 3c:ec:ef:b7:e0:ac brd ff:ff:ff:ff:ff:ff RX: bytes packets errors dropped missed mcast 0 0 0 0 0 0 TX: bytes packets errors dropped carrier collsns 0 0 0 0 0 0 vf 0 link/ether e2:c6:fd:c1:1e:92 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off RX: bytes packets mcast bcast dropped 0 0 0 0 0 TX: bytes packets dropped 0 0 0 A packet with non-existent VLAN tag and a packet with TTL = 0 are sent, but tx_dropped is not incremented. After patch: $ ip -s link show dev enp2s0f0 19: enp2s0f0: mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000 link/ether 3c:ec:ef:b7:e0:ac brd ff:ff:ff:ff:ff:ff RX: bytes packets errors dropped missed mcast 0 0 0 0 0 0 TX: bytes packets errors dropped carrier collsns 0 0 0 0 0 0 vf 0 link/ether 4a:b7:3d:37:f7:56 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off RX: bytes packets mcast bcast dropped 0 0 0 0 0 TX: bytes packets dropped 0 0 2 Fixes: dc645daef9af5bcbd9c ("i40e: implement VF stats NDO") Signed-off-by: Dennis Chen Link: https://www.intel.com/content/www/us/en/content-details/596333/intel-ethernet-controller-x710-tm4-at2-carlsville-datasheet.html Reviewed-by: Simon Horman Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit ab16122115327b2a602595f539cae7e39a331d0e Author: Jack Thomson Date: Mon Jul 21 14:05:58 2025 +0100 arm64: kvm, smccc: Fix vendor uuid Commit 13423063c7cb ("arm64: kvm, smccc: Introduce and use API for getting hypervisor UUID") replaced the explicit register constants with the UUID_INIT macro. However, there is an endian issue, meaning the UUID generated and used in the handshake didn't match UUID prior to the commit. The change in UUID causes the SMCCC vendor handshake to fail with older guest kernels, meaning devices such as PTP were not available in the guest. This patch updates the parameters to the macro to generate a UUID which matches the previous value, and re-establish backwards compatibility with older guest kernels. Fixes: 13423063c7cb ("arm64: kvm, smccc: Introduce and use API for getting hypervisor UUID") Signed-off-by: Jack Thomson Reviewed-by: Marc Zyngier Tested-by: Marc Zyngier Reviewed-by: Sudeep Holla Link: https://lore.kernel.org/r/20250721130558.50823-1-jackabt.amazon@gmail.com Signed-off-by: Will Deacon commit e4b2a0c2b9be6d10b0e50a7485fe9f569a6f2436 Merge: a42b4dcc4f9f30 01fdcbc7e5a56c Author: Stephen Boyd Date: Mon Jul 21 10:17:51 2025 -0700 Merge tag 'sunxi-clk-fixes-for-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into clk-fixes Pull Allwinner clock fixes from Chen-Yu Tsai: - Mark A523 MBUS clock as critical - Fix names of CSI related clocks on V3s This includes changes to the driver, DT bindings and DT files. - Fix parents of TCON clock on V3s * tag 'sunxi-clk-fixes-for-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: clk: sunxi-ng: v3s: Fix TCON clock parents clk: sunxi-ng: v3s: Fix CSI1 MCLK clock name clk: sunxi-ng: v3s: Fix CSI SCLK clock name clk: sunxi-ng: a523: Mark MBUS clock as critical commit 964ebc07c546c76b78aea5b6dff0d02c602d4793 Merge: 89be9a83ccf1f8 e2967b50b70997 Author: Linus Torvalds Date: Mon Jul 21 08:32:36 2025 -0700 Merge tag 'platform-drivers-x86-v6.16-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform drivers fixes from Ilpo Järvinen: - power supply code: - Add get/set property direct to allow avoiding taking psy->extensions_sem twice from power supply extensions - alienware-wmi-wmax: - Add AWCC support for Alienware Area-51m and m15 R5 - Fix `dmi_system_id` array termination - arm64: huawei-gaokun-ec: fix OF node leak - dell-ddv: Fix taking psy->extensions_sem twice - dell-lis3lv02d: Add Precision 3551 accelerometer support - firmware_attributes_class: Fix initialization order - ideapad-laptop: Retain FnLock and kbd backlight across boots - lenovo-wmi-hotkey: Avoid triggering error -5 due to missing mute LED - mellanox: mlxbf-pmc: Validate event names and bool input * tag 'platform-drivers-x86-v6.16-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: MAINTAINERS: Update entries for IFS and SBL drivers platform/x86: dell-lis3lv02d: Add Precision 3551 platform/x86: alieneware-wmi-wmax: Add AWCC support to more laptops platform/x86: Fix initialization order for firmware_attributes_class platform: arm64: huawei-gaokun-ec: fix OF node leak lenovo-wmi-hotkey: Avoid triggering error -5 due to missing mute LED platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots platform/x86: ideapad-laptop: Fix FnLock not remembered among boots platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input platform/mellanox: mlxbf-pmc: Validate event/enable input platform/mellanox: mlxbf-pmc: Remove newline char from event name input platform/x86: dell-ddv: Fix taking the psy->extensions_sem lock twice power: supply: test-power: Test access to extended power supply power: supply: core: Add power_supply_get/set_property_direct() platform/x86: alienware-wmi-wmax: Fix `dmi_system_id` array commit 9e55f1192648a5b327f03c60e411126b3d19c5c5 Author: Shuming Fan Date: Mon Jul 21 19:23:34 2025 +0800 ASoC: SDCA: correct the calculation of the maximum init table size One initial setting is 5 bytes, so num_init_writes should divide by 5. Signed-off-by: Shuming Fan Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20250721112334.388506-1-shumingf@realtek.com Signed-off-by: Mark Brown commit 9e0c433d0c05fde284025264b89eaa4ad59f0a3e Author: Ville Syrjälä Date: Thu Jul 10 23:17:12 2025 +0300 drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x On g4x we currently use the 96MHz non-SSC refclk, which can't actually generate an exact 2.7 Gbps link rate. In practice we end up with 2.688 Gbps which seems to be close enough to actually work, but link training is currently failing due to miscalculating the DP_LINK_BW value (we calcualte it directly from port_clock which reflects the actual PLL outpout frequency). Ideas how to fix this: - nudge port_clock back up to 270000 during PLL computation/readout - track port_clock and the nominal link rate separately so they might differ a bit - switch to the 100MHz refclk, but that one should be SSC so perhaps not something we want While we ponder about a better solution apply some band aid to the immediate issue of miscalculated DP_LINK_BW value. With this I can again use 2.7 Gbps link rate on g4x. Cc: stable@vger.kernel.org Fixes: 665a7b04092c ("drm/i915: Feed the DPLL output freq back into crtc_state") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250710201718.25310-2-ville.syrjala@linux.intel.com Reviewed-by: Imre Deak (cherry picked from commit a8b874694db5cae7baaf522756f87acd956e6e66) Signed-off-by: Rodrigo Vivi commit d312962188dd1f682b0351ccf9933334738ac462 Author: Derek Fang Date: Mon Jul 21 11:47:28 2025 +0800 ASoC: rt5650: Eliminate the high frequency glitch The glitch was detected in the high frequency of the HP playback. This patch adjusts the DAC dither setting to avoid this situation for almost all cases. Signed-off-by: Derek Fang Link: https://patch.msgid.link/20250721034728.1396238-1-derek.fang@realtek.com Signed-off-by: Mark Brown commit 0503ac474a3d57b62ea40c7720058ae42668d948 Author: Ranjani Sridharan Date: Mon Jul 21 14:30:38 2025 +0800 ASoC: SOF: Intel: PTL: Add the sdw_process_wakeen op Add the missing op in the device description to avoid issues with jack detection. Signed-off-by: Ranjani Sridharan Reviewed-by: Guennadi Liakhovetski Signed-off-by: Bard Liao Link: https://patch.msgid.link/20250721063039.2234279-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit e2967b50b709970547b5cdfa1b42526835327f36 Author: Jithu Joseph Date: Mon Jul 14 09:46:43 2025 -0700 MAINTAINERS: Update entries for IFS and SBL drivers Update the MAINTAINERS file to reflect the following changes for two Intel platform drivers: - Tony has agreed to take over maintainership of the Intel In-Field Scan (IFS) driver, and is now listed as the new maintainer. - Remove myself as the maintainer for the Slim BootLoader (SBL) firmware update driver and mark it as Orphan. To the best of my knowledge, there is no one familiar with SBL who can take over this role. These changes are being made as I will soon be leaving Intel. Signed-off-by: Jithu Joseph Acked-by: Tony Luck Link: https://lore.kernel.org/r/20250714164643.3879784-1-jithu.joseph@intel.com Signed-off-by: Ilpo Järvinen commit 491254fff9a8dcb4af99bf2fb40f1e63a7257fd3 Author: Ben Skeggs Date: Mon Jul 14 12:59:23 2025 +1000 drm/nouveau/nvif: fix null ptr deref on pre-fermi boards Check that gpfifo.post() exists before trying to call it. Fixes: 862450a85b85 ("drm/nouveau/gf100-: track chan progress with non-WFI semaphore release") Reported-by: Jamie Heilman Closes: https://lore.kernel.org/lkml/aElJIo9_Se6tAR1a@audible.transient.net/ Reported-by: Rui Salvaterra Closes: https://lore.kernel.org/all/CALjTZvZgH0N43rMTcZiDVSX93PFL680hsYPwtp8=Ja1OWPvZ1A@mail.gmail.com/ Tested-by: Rui Salvaterra Signed-off-by: Ben Skeggs Link: https://lore.kernel.org/r/20250714025923.29591-1-bskeggs@nvidia.com Signed-off-by: Danilo Krummrich commit 9744ede7099e8a69c04aa23fbea44c15bc390c04 Author: Dawid Rezler Date: Sun Jul 20 17:49:08 2025 +0200 ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx The mute LED on the HP Pavilion Laptop 15-eg0xxx, which uses the ALC287 codec, didn't work. This patch fixes the issue by enabling the ALC287_FIXUP_HP_GPIO_LED quirk. Tested on a physical device, the LED now works as intended. Signed-off-by: Dawid Rezler Cc: Link: https://patch.msgid.link/20250720154907.80815-2-dawidrezler.patches@gmail.com Signed-off-by: Takashi Iwai commit 89be9a83ccf1f88522317ce02f854f30d6115c41 Author: Linus Torvalds Date: Sun Jul 20 15:18:33 2025 -0700 Linux 6.16-rc7 commit 2013e8c2e6fd3a4bdf4ccc658ad20a4469360eff Merge: c10ee5cc1217c7 b5e8acc14dcb31 Author: Linus Torvalds Date: Sun Jul 20 13:03:31 2025 -0700 Merge tag 'trace-v6.16-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix timerlat with use of FORTIFY_SOURCE FORTIFY_SOURCE was added to the stack tracer where it compares the entry->caller array to having entry->size elements. timerlat has the following: memcpy(&entry->caller, fstack->calls, size); entry->size = size; Which triggers FORTIFY_SOURCE as the caller is populated before the entry->size is initialized. Swap the order to satisfy FORTIFY_SOURCE logic. - Add down_write(trace_event_sem) when adding trace events in modules Trace events being added to the ftrace_events array are protected by the trace_event_sem semaphore. But when loading modules that have trace events, the addition of the events are not protected by the semaphore and loading two modules that have events at the same time can corrupt the list. Also add a lockdep_assert_held(trace_event_sem) to _trace_add_event_dirs() to confirm it is held when iterating the list. * tag 'trace-v6.16-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Add down_write(trace_event_sem) when adding trace event tracing/osnoise: Fix crash in timerlat_dump_stack() commit c10ee5cc1217c79dfa606c432aa95d5ee2e81083 Merge: 07fa9cad54609d a8780906ca2604 Author: Linus Torvalds Date: Sun Jul 20 12:56:13 2025 -0700 Merge tag 'i2c-for-6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "omap: - add missing error check - fix PM disable in probe error path stm32: - unmap DMA buffer on transfer failure - use correct device when mapping and unmapping during transfers" * tag 'i2c-for-6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: stm32f7: unmap DMA mapped buffer i2c: stm32: fix the device used for the DMA map i2c: omap: Fix an error handling path in omap_i2c_probe() i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() commit 1966554b2e82b89d4f6490f430ce76a379e23f1f Author: Nilay Shroff Date: Sat Jul 19 18:56:47 2025 +0530 block: fix module reference leak in mq-deadline I/O scheduler During probe, when the block layer registers a request queue, it defaults to the mq-deadline I/O scheduler if the device is single-queue and the mq-deadline module is available. To determine availability, the elevator_set_default() invokes elevator_find_get(), which increments the module's reference count. However, this reference is never released, resulting in a module reference leak that prevents the mq-deadline module from being unloaded. This patch fixes the issue by ensuring the acquired module reference is properly released. Fixes: 1e44bedbc921 ("block: unifying elevator change") Signed-off-by: Nilay Shroff Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250719132722.769536-1-nilay@linux.ibm.com Signed-off-by: Jens Axboe commit 07fa9cad54609df3eea00cd5b167df6088ce01a6 Merge: 92329d578d60fe 6b995d01683fea Author: Linus Torvalds Date: Sun Jul 20 11:27:52 2025 -0700 Merge tag 'x86-urgent-2025-07-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 bug fix from Thomas Gleixner: "A single fix for a GCC wreckage, which emits a KCSAN instrumentation call in __sev_es_nmi_complete() despite the function being annotated with 'noinstr'. As all functions in that source file are noinstr, exclude the whole file from KCSAN in the Makefile to cure it" * tag 'x86-urgent-2025-07-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/sev: Work around broken noinstr on GCC commit 92329d578d60fe944e30da287ee28f5c154a5802 Merge: 62347e279092ae d0a48dc4df5c98 Author: Linus Torvalds Date: Sun Jul 20 11:22:05 2025 -0700 Merge tag 'locking-urgent-2025-07-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fix from Thomas Gleixner: "A single fix for the futex selftest code to make 32-bit user space work correctly on 64-bit kernels. sys_futex_wait() expects a struct __kernel_timespec for the timeout, but the selftest uses struct timespec, which is the original 32-bit non 2038 compliant variant. Fix it up by converting the callsite supplied timespec to a __kernel_timespec and hand that into the syscall" * tag 'locking-urgent-2025-07-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: selftests/futex: Convert 32-bit timespec to 64-bit version for 32-bit compatibility mode commit 62347e279092ae704877467abdc8533e914f945e Merge: 5f054ef2e0f1ca 36569780b0d64d Author: Linus Torvalds Date: Sun Jul 20 11:08:51 2025 -0700 Merge tag 'sched-urgent-2025-07-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Thomas Gleixner: "A single fix for the scheduler. A recent commit changed the runqueue counter nr_uninterruptible to an unsigned int. Due to the fact that the counters are not updated on migration of a uninterruptble task to a different CPU, these counters can exceed INT_MAX. The counter is cast to long in the load average calculation, which means that the cast expands into negative space resulting in bogus load average values. Convert it back to unsigned long to fix this. * tag 'sched-urgent-2025-07-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched: Change nr_uninterruptible type to unsigned long commit eef91707009ad8d98e0d397d58df47caa6ff2330 Author: Kent Overstreet Date: Sat Jul 19 20:47:09 2025 -0400 bcachefs: btree_node_scan: don't re-read before initializing found_btree_node If the btree node is encrypted, this caused us to initialize found_btree_node from the encrypted header. Signed-off-by: Kent Overstreet commit 5f054ef2e0f1ca7d32ac48e275d08e2ac29d84f3 Merge: 4f066b189f9162 a4131a50d072b3 Author: Linus Torvalds Date: Sun Jul 20 09:29:43 2025 -0700 Merge tag 'hyperv-fixes-signed-20250718' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull hyperv fixes from Wei Liu: - Select use CONFIG_SYSFB only if EFI is enabled (Michael Kelley) - An assorted set of fixes to remove warnings for missing export.h header inclusion (Naman Jain) - An assorted set of fixes for when Linux run as the root partition for Microsoft Hypervisor (Mukesh Rathor, Nuno Das Neves, Stanislav Kinsburskii) - Fix the check for HYPERVISOR_CALLBACK_VECTOR (Naman Jain) - Fix fcopy tool to handle irregularities with size of ring buffer (Naman Jain) - Fix incorrect file path conversion in fcopy tool (Yasumasa Suenaga) * tag 'hyperv-fixes-signed-20250718' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: tools/hv: fcopy: Fix irregularities with size of ring buffer PCI: hv: Use the correct hypercall for unmasking interrupts on nested x86/hyperv: Expose hv_map_msi_interrupt() Drivers: hv: Use nested hypercall for post message and signal event x86/hyperv: Clean up hv_map/unmap_interrupt() return values x86/hyperv: Fix usage of cpu_online_mask to get valid cpu PCI: hv: Don't load the driver for baremetal root partition net: mana: Fix warnings for missing export.h header inclusion PCI: hv: Fix warnings for missing export.h header inclusion clocksource: hyper-v: Fix warnings for missing export.h header inclusion x86/hyperv: Fix warnings for missing export.h header inclusion Drivers: hv: Fix warnings for missing export.h header inclusion Drivers: hv: Fix the check for HYPERVISOR_CALLBACK_VECTOR tools/hv: fcopy: Fix incorrect file path conversion Drivers: hv: Select CONFIG_SYSFB only if EFI is enabled commit 4f066b189f91622f3a3a231736659f25eb6e30b0 Merge: 673cf893b66a7d 2521106fc732b0 Author: Linus Torvalds Date: Sun Jul 20 09:21:53 2025 -0700 Merge tag 'usb-6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt fixes from Greg KH: "Here are some USB and Thunderbolt driver fixes for reported problems for 6.16-rc6. Included in here are: - Thunderbolt fixes for some much-reported issues - dwc2 driver fixes - dwc3 driver fixes - new usb-serial driver device ids - gadgetfs configfs fix - musb driver fix - USB hub driver fix All of these have been in linux-next for a while with no reported problems" * tag 'usb-6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: hub: Don't try to recover devices lost during warm reset. usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY usb: dwc3: qcom: Don't leave BCR asserted USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI usb: gadget: configfs: Fix OOB read on empty string write usb: musb: fix gadget state on disconnect USB: serial: option: add Foxconn T99W640 thunderbolt: Fix bit masking in tb_dp_port_set_hops() thunderbolt: Fix wake on connect at runtime commit 673cf893b66a7dd76c9378f4506b3d4a870c80b2 Merge: b933c72d650abf 6c0e9f05c9d787 Author: Linus Torvalds Date: Sun Jul 20 09:14:32 2025 -0700 Merge tag 'tty-6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull serial driver fixes from Greg KH: "Here are two serial driver fixes for 6.16-rc6 that do: - fix for the serial core OF resource leak - pch_uart driver fix for a "incorrect variable" issue Both of these have been in linux-next for over a week with no reported problems" * tag 'tty-6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: pch_uart: Fix dma_sync_sg_for_device() nents value serial: core: fix OF node leak commit b933c72d650abfb833b6ef700c26271d0a252f37 Merge: ecf11d31bf5ccd f2b8ebfb867011 Author: Linus Torvalds Date: Sun Jul 20 09:08:55 2025 -0700 Merge tag 'staging-6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are some small driver fixes for the vchiq_arm staging driver: - reverts of previous changes that turned out to caused problems. - change to prevent a resource leak All of these have been in linux-next this week with no reported problems" * tag 'staging-6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: vchiq_arm: Make vchiq_shutdown never fail Revert "staging: vchiq_arm: Create keep-alive thread during probe" Revert "staging: vchiq_arm: Improve initial VCHIQ connect" commit ecf11d31bf5ccde62c91abe94d4edb867b64958f Merge: 990b11a523a80d 2d7521aa26ec2d Author: Linus Torvalds Date: Sun Jul 20 09:03:41 2025 -0700 Merge tag 'char-misc-6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char / misc / IIO fixes from Greg KH: "Here are some char/misc/iio and other driver fixes for 6.16-rc7. Included in here are: - IIO driver fixes for reported problems - Interconnect driver fixes for reported problems - nvmem driver fixes - bunch of comedi driver fixes for long-term bugs - Kconfig dependancy fixes for mux drivers - other small driver fixes for reported problems. All of these have been in linux-next for a while with no reported problems" * tag 'char-misc-6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (35 commits) nvmem: layouts: u-boot-env: remove crc32 endianness conversion misc: amd-sbi: Explicitly clear in/out arg "mb_in_out" misc: amd-sbi: Address copy_to/from_user() warning reported in smatch misc: amd-sbi: Address potential integer overflow issue reported in smatch comedi: comedi_test: Fix possible deletion of uninitialized timers comedi: Fix initialization of data for instructions that write to subdevice comedi: Fix use of uninitialized data in insn_rw_emulate_bits() comedi: das6402: Fix bit shift out of bounds comedi: aio_iiro_16: Fix bit shift out of bounds comedi: pcl812: Fix bit shift out of bounds comedi: das16m1: Fix bit shift out of bounds comedi: Fix some signed shift left operations comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large nvmem: imx-ocotp: fix MAC address byte length MAINTAINERS: add miscdevice Rust abstractions mux: mmio: Fix missing CONFIG_REGMAP_MMIO iio: dac: ad3530r: Fix incorrect masking for channels 4-7 in powerdown mode iio: adc: ad7380: fix adi,gain-milli property parsing iio: adc: ad7949: use spi_is_bpw_supported() iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush ... commit 990b11a523a80de81ca4eacb1bdac80ad78fdf11 Merge: 875dd235ceca6d 710505212e3272 Author: Linus Torvalds Date: Sun Jul 20 08:58:58 2025 -0700 Merge tag 'spi-fix-v6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fix from Mark Brown: "A fix adding missing validation that 8 bit I/O mode is actually supported for the specific device when attempting to use it. Anything that runs into this should already have been having problems, enforcing this should just make things safer and more obvious" * tag 'spi-fix-v6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: Add check for 8-bit transfer with 8 IO mode support commit 875dd235ceca6dc1821ea4ba6a7d41cdf0df6a55 Merge: e2e9e161997ad0 c871c199accb39 Author: Linus Torvalds Date: Sun Jul 20 08:56:40 2025 -0700 Merge tag 'regmap-fix-v6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap fix from Mark Brown: "A fix for a memory leak when we get an error during regmap init for a bus that uses free_on_exit to clean up device specific data" * tag 'regmap-fix-v6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: fix potential memory leak of regmap_bus commit e2e9e161997ad0b44e37c82824fcab4e0a1e261d Merge: f4a40a4282f467 bcce05041b2188 Author: Linus Torvalds Date: Sun Jul 20 08:53:58 2025 -0700 Merge tag 'input-for-v6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fix from Dmitry Torokhov: - just a small fixup to the xpad driver correcting the recent addition of the Acer NGR200 controller * tag 'input-for-v6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: xpad - set correct controller type for Acer NGR200 commit bcce05041b21888f10b80ea903dcfe51a25c586e Author: Nilton Perim Neto Date: Sat Jul 19 22:07:36 2025 -0700 Input: xpad - set correct controller type for Acer NGR200 The controller should have been set as XTYPE_XBOX360 and not XTYPE_XBOX. Also the entry is in the wrong place. Fix it. Reported-by: Vicki Pfau Signed-off-by: Nilton Perim Neto Link: https://lore.kernel.org/r/20250708033126.26216-2-niltonperimneto@gmail.com Fixes: 22c69d786ef8 ("Input: xpad - support Acer NGR 200 Controller") Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 6ade153349c6bb990d170cecc3e8bdd8628119ab Author: Marco Elver Date: Wed Jul 16 17:23:28 2025 +0200 kasan: use vmalloc_dump_obj() for vmalloc error reports Since 6ee9b3d84775 ("kasan: remove kasan_find_vm_area() to prevent possible deadlock"), more detailed info about the vmalloc mapping and the origin was dropped due to potential deadlocks. While fixing the deadlock is necessary, that patch was too quick in killing an otherwise useful feature, and did no due-diligence in understanding if an alternative option is available. Restore printing more helpful vmalloc allocation info in KASAN reports with the help of vmalloc_dump_obj(). Example report: | BUG: KASAN: vmalloc-out-of-bounds in vmalloc_oob+0x4c9/0x610 | Read of size 1 at addr ffffc900002fd7f3 by task kunit_try_catch/493 | | CPU: [...] | Call Trace: | | dump_stack_lvl+0xa8/0xf0 | print_report+0x17e/0x810 | kasan_report+0x155/0x190 | vmalloc_oob+0x4c9/0x610 | [...] | | The buggy address belongs to a 1-page vmalloc region starting at 0xffffc900002fd000 allocated at vmalloc_oob+0x36/0x610 | The buggy address belongs to the physical page: | page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x126364 | flags: 0x200000000000000(node=0|zone=2) | raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000 | raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 | page dumped because: kasan: bad access detected | | [..] Link: https://lkml.kernel.org/r/20250716152448.3877201-1-elver@google.com Fixes: 6ee9b3d84775 ("kasan: remove kasan_find_vm_area() to prevent possible deadlock") Signed-off-by: Marco Elver Suggested-by: Uladzislau Rezki Acked-by: Uladzislau Rezki (Sony) Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Sebastian Andrzej Siewior Cc: Yeoreum Yun Cc: Yunseong Kim Cc: Signed-off-by: Andrew Morton commit 153ad566724fe6f57b14f66e9726d295d22e576d Author: Nathan Chancellor Date: Tue Jul 15 12:56:16 2025 -0700 mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() After a recent change in clang to expose uninitialized warnings from const variables [1], there is a false positive warning from the if statement in advisor_mode_show(). mm/ksm.c:3687:11: error: variable 'output' is used uninitialized whenever 'if' condition is false [-Werror,-Wsometimes-uninitialized] 3687 | else if (ksm_advisor == KSM_ADVISOR_SCAN_TIME) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mm/ksm.c:3690:33: note: uninitialized use occurs here 3690 | return sysfs_emit(buf, "%s\n", output); | ^~~~~~ Rewrite the if statement to implicitly make KSM_ADVISOR_NONE the else branch so that it is obvious to the compiler that ksm_advisor can only be KSM_ADVISOR_NONE or KSM_ADVISOR_SCAN_TIME due to the assignments in advisor_mode_store(). Link: https://lkml.kernel.org/r/20250715-ksm-fix-clang-21-uninit-warning-v1-1-f443feb4bfc4@kernel.org Fixes: 66790e9a735b ("mm/ksm: add sysfs knobs for advisor") Signed-off-by: Nathan Chancellor Closes: https://github.com/ClangBuiltLinux/linux/issues/2100 Link: https://github.com/llvm/llvm-project/commit/2464313eef01c5b1edf0eccf57a32cdee01472c7 [1] Acked-by: David Hildenbrand Cc: Chengming Zhou Cc: Stefan Roesch Cc: xu xin Cc: Signed-off-by: Andrew Morton commit d367a177e2e4097065c0181ea4da7cdce4d68921 Author: Jason Gunthorpe Date: Fri Jul 11 19:34:44 2025 -0300 mm: update MAINTAINERS entry for HMM Jérôme has moved on from RH and has not been looking at HMM patches for some time. I've made the most changes to the core code in the recent period and Leon is now working on the HMM side from the RDMA ODP. Link: https://lkml.kernel.org/r/0-v1-a1df5219c7a3+1d981-hmm_maintainers_jgg@nvidia.com Closes: https://lore.kernel.org/all/39d43309-9f34-48bc-a9ad-108c607ba175@samsung.com/ Signed-off-by: Jason Gunthorpe Reported-by: Marek Szyprowski Acked-by: David Hildenbrand Acked-by: Leon Romanovsky Cc: Lorenzo Stoakes Signed-off-by: Andrew Morton commit 4aead50caf67e01020c8be1945c3201e8a972a27 Author: Ryusuke Konishi Date: Thu Jul 10 22:49:08 2025 +0900 nilfs2: reject invalid file types when reading inodes To prevent inodes with invalid file types from tripping through the vfs and causing malfunctions or assertion failures, add a missing sanity check when reading an inode from a block device. If the file type is not valid, treat it as a filesystem error. Link: https://lkml.kernel.org/r/20250710134952.29862-1-konishi.ryusuke@gmail.com Fixes: 05fe58fdc10d ("nilfs2: inode operations") Signed-off-by: Ryusuke Konishi Reported-by: syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d Cc: Signed-off-by: Andrew Morton commit 7563fcbfd484b347b776aeed4d7dac78b30884aa Author: Zi Yan Date: Tue Jul 8 21:27:59 2025 -0400 selftests/mm: fix split_huge_page_test for folio_split() tests PID_FMT does not have an offset field, so folio_split() tests are not performed. Add PID_FMT_OFFSET with an offset field and use it to perform folio_split() tests. Link: https://lkml.kernel.org/r/20250709012800.3225727-1-ziy@nvidia.com Fixes: 80a5c494c89f ("selftests/mm: add tests for folio_split(), buddy allocator like split") Signed-off-by: Zi Yan Tested-by: Baolin Wang Reviewed-by: Lorenzo Stoakes Reviewed-by: Donet Tom Tested-by : Donet Tom Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Liam Howlett Cc: Mariano Pache Cc: Ryan Roberts Cc: Shuah Khan Cc: Signed-off-by: Andrew Morton commit 091a08b002d9b5040b92531fff07b52879f29722 Author: Sergey Senozhatsky Date: Mon Jul 7 16:52:13 2025 +0900 mailmap: add entry for Senozhatsky Consolidate and map all addresses to a single one. Link: https://lkml.kernel.org/r/20250707075243.858895-1-senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Signed-off-by: Andrew Morton commit 694d6b99923eb05a8fd188be44e26077d19f0e21 Author: Harry Yoo Date: Fri Jul 4 19:30:53 2025 +0900 mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n Commit 48b4800a1c6a ("zsmalloc: page migration support") added support for migrating zsmalloc pages using the movable_operations migration framework. However, the commit did not take into account that zsmalloc supports migration only when CONFIG_COMPACTION is enabled. Tracing shows that zsmalloc was still passing the __GFP_MOVABLE flag even when compaction is not supported. This can result in unmovable pages being allocated from movable page blocks (even without stealing page blocks), ZONE_MOVABLE and CMA area. Possible user visible effects: - Some ZONE_MOVABLE memory can be not actually movable - CMA allocation can fail because of this - Increased memory fragmentation due to ignoring the page mobility grouping feature I'm not really sure who uses kernels without compaction support, though :( To fix this, clear the __GFP_MOVABLE flag when !IS_ENABLED(CONFIG_COMPACTION). Link: https://lkml.kernel.org/r/20250704103053.6913-1-harry.yoo@oracle.com Fixes: 48b4800a1c6a ("zsmalloc: page migration support") Signed-off-by: Harry Yoo Acked-by: David Hildenbrand Reviewed-by: Sergey Senozhatsky Cc: Minchan Kim Cc: Signed-off-by: Andrew Morton commit 9f1e8cd0b7c4c944e9921b52a6661b5eda2705ab Author: Jinjiang Tu Date: Fri Jun 27 20:57:46 2025 +0800 mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list In shrink_folio_list(), the hwpoisoned folio may be large folio, which can't be handled by unmap_poisoned_folio(). For THP, try_to_unmap_one() must be passed with TTU_SPLIT_HUGE_PMD to split huge PMD first and then retry. Without TTU_SPLIT_HUGE_PMD, we will trigger null-ptr deref of pvmw.pte. Even we passed TTU_SPLIT_HUGE_PMD, we will trigger a WARN_ON_ONCE due to the page isn't in swapcache. Since UCE is rare in real world, and race with reclaimation is more rare, just skipping the hwpoisoned large folio is enough. memory_failure() will handle it if the UCE is triggered again. This happens when memory reclaim for large folio races with memory_failure(), and will lead to kernel panic. The race is as follows: cpu0 cpu1 shrink_folio_list memory_failure TestSetPageHWPoison unmap_poisoned_folio --> trigger BUG_ON due to unmap_poisoned_folio couldn't handle large folio [tujinjiang@huawei.com: add comment to unmap_poisoned_folio()] Link: https://lkml.kernel.org/r/69fd4e00-1b13-d5f7-1c82-705c7d977ea4@huawei.com Link: https://lkml.kernel.org/r/20250627125747.3094074-2-tujinjiang@huawei.com Signed-off-by: Jinjiang Tu Fixes: 1b0449544c64 ("mm/vmscan: don't try to reclaim hwpoison folio") Reported-by: syzbot+3b220254df55d8ca8a61@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68412d57.050a0220.2461cf.000e.GAE@google.com/ Acked-by: David Hildenbrand Reviewed-by: Miaohe Lin Acked-by: Zi Yan Reviewed-by: Oscar Salvador Cc: Kefeng Wang Cc: Michal Hocko Cc: Oscar Salvador Cc: Signed-off-by: Andrew Morton commit f4a40a4282f467ec99745c6ba62cb84346e42139 Merge: bf61759db409ce 64e135f1eaba0b Author: Linus Torvalds Date: Sat Jul 19 16:27:03 2025 -0700 Merge tag 'efi-fixes-for-v6.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI fix from Ard Biesheuvel: - Fix potential memory leak reported by kmemleak * tag 'efi-fixes-for-v6.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths commit b5e8acc14dcb314a9b61ff19dcd9fdd0d88f70df Author: Steven Rostedt Date: Fri Jul 18 22:31:58 2025 -0400 tracing: Add down_write(trace_event_sem) when adding trace event When a module is loaded, it adds trace events defined by the module. It may also need to modify the modules trace printk formats to replace enum names with their values. If two modules are loaded at the same time, the adding of the event to the ftrace_events list can corrupt the walking of the list in the code that is modifying the printk format strings and crash the kernel. The addition of the event should take the trace_event_sem for write while it adds the new event. Also add a lockdep_assert_held() on that semaphore in __trace_add_event_dirs() as it iterates the list. Cc: stable@vger.kernel.org Cc: Mathieu Desnoyers Acked-by: Masami Hiramatsu (Google) Link: https://lore.kernel.org/20250718223158.799bfc0c@batman.local.home Reported-by: Fusheng Huang(黄富生) Closes: https://lore.kernel.org/all/20250717105007.46ccd18f@batman.local.home/ Fixes: 110bf2b764eb6 ("tracing: add protection around module events unload") Signed-off-by: Steven Rostedt (Google) commit bf61759db409ce21a8f2a5bb442b7c35905a713d Merge: c64004df8914cf 06efc9fe0b8dee Author: Linus Torvalds Date: Sat Jul 19 10:40:30 2025 -0700 Merge tag 'sched_ext-for-6.16-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fixes from Tejun Heo: - Fix handling of migration disabled tasks in default idle selection - update_locked_rq() called __this_cpu_write() spuriously with NULL when @rq was not locked. As the writes were spurious, it didn't break anything directly. However, the function could be called in a preemptible leading to a context warning in __this_cpu_write(). Skip the spurious NULL writes. - Selftest fix on UP * tag 'sched_ext-for-6.16-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: sched_ext: idle: Handle migration-disabled tasks in idle selection sched/ext: Prevent update_locked_rq() calls with NULL rq selftests/sched_ext: Fix exit selftest hang on UP commit c64004df8914cf5cf4455d9e78d8f371d0f7322f Merge: bd4a1567b6e345 14a67b42cb6f3a Author: Linus Torvalds Date: Sat Jul 19 10:00:47 2025 -0700 Merge tag 'cgroup-for-6.16-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: "An earlier commit to suppress a warning introduced a race condition where tasks can escape cgroup1 freezer. Revert the commit and simply remove the warning which was spurious to begin with" * tag 'cgroup-for-6.16-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" sched,freezer: Remove unnecessary warning in __thaw_task commit bd4a1567b6e3454eda1113ed3a537119208e9c7a Merge: acc0bac1c62597 ce3cf7c8a17478 Author: Linus Torvalds Date: Sat Jul 19 09:51:01 2025 -0700 Merge tag 'hwmon-for-v6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - corsair-cpro: Validate the size of the received input buffer - ina238: Report energy in microjoules as expected by the ABI - pmbus/ucd9000: Fixed GPIO functionality * tag 'hwmon-for-v6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (pmbus/ucd9000) Fix error in ucd9000_gpio_set hwmon: (ina238) Report energy in microjoules hwmon: (corsair-cpro) Validate the size of the received input buffer commit acc0bac1c625972f3622339080194061e28fa243 Merge: 1c6aa1121e7a5c 7498159226772d Author: Linus Torvalds Date: Sat Jul 19 09:22:26 2025 -0700 Merge tag 'rust-fixes-6.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux Pull Rust fixes from Miguel Ojeda: "Toolchain and infrastructure: - Fix build and modpost confusion for the upcoming Rust 1.89.0 release - Clean objtool warning for the upcoming Rust 1.89.0 release by adding one more noreturn function 'kernel' crate: - Fix build error when using generics in the 'try_{,pin_}init!' macros" * tag 'rust-fixes-6.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: rust: use `#[used(compiler)]` to fix build and `modpost` with Rust >= 1.89.0 objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 rust: init: Fix generics in *_init! macros commit 1c6aa1121e7a5cd296d7038dbdd619da8bee1cd5 Merge: 4871b7cb27f480 a88cddaaa3bf74 Author: Linus Torvalds Date: Sat Jul 19 08:47:59 2025 -0700 Merge tag 'vfs-6.16-rc7.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - Fix a memory leak in fcntl_dirnotify() - Raise SB_I_NOEXEC on secrement superblock instead of messing with flags on the mount - Add fsdevel and block mailing lists to uio entry. We had a few instances were very questionable stuff was added without either block or the VFS being aware of it - Fix netfs copy-to-cache so that it performs collection with ceph+fscache - Fix netfs race between cache write completion and ALL_QUEUED being set - Verify the inode mode when loading entries from disk in isofs - Avoid state_lock in iomap_set_range_uptodate() - Fix PIDFD_INFO_COREDUMP check in PIDFD_GET_INFO ioctl - Fix the incorrect return value in __cachefiles_write() * tag 'vfs-6.16-rc7.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: MAINTAINERS: add block and fsdevel lists to iov_iter netfs: Fix race between cache write completion and ALL_QUEUED being set netfs: Fix copy-to-cache so that it performs collection with ceph+fscache fix a leak in fcntl_dirnotify() iomap: avoid unnecessary ifs_set_range_uptodate() with locks isofs: Verify inode mode when loading from disk cachefiles: Fix the incorrect return value in __cachefiles_write() secretmem: use SB_I_NOEXEC coredump: fix PIDFD_INFO_COREDUMP ioctl check commit 4871b7cb27f480f6ecce804f81d4b9ee27281dd2 Merge: 27c2570359d688 8767cb3fbd514c Author: Linus Torvalds Date: Fri Jul 18 22:32:30 2025 -0700 Merge tag 'v6.16-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - fix creating special files to Samba when using SMB3.1.1 POSIX Extensions - fix incorrect caching on new file creation with directory leases enabled - two use after free fixes: one in oplock_break and one in async decryption * tag 'v6.16-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: Fix SMB311 posix special file creation to servers which do not advertise reparse support smb: invalidate and close cached directory when creating child entries smb: client: fix use-after-free in crypt_message when using async crypto smb: client: fix use-after-free in cifs_oplock_break commit 27c2570359d688884887cd45fa92e678523012a6 Merge: 414aaef1537ac7 ccafe2821cfaa8 Author: Linus Torvalds Date: Fri Jul 18 18:15:21 2025 -0700 Merge tag 'v6.16-p7' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: "This fixes buffer overflows in qat and chelsio" * tag 'v6.16-p7' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: qat - Use crypto_shash_export_core crypto: chelsio - Use crypto_shash_export_core commit 81e0db8e839822b8380ce4716cd564a593ccbfc5 Merge: 6e86fb73de0fe3 5b4c56ad4da0aa Author: Jakub Kicinski Date: Fri Jul 18 17:33:05 2025 -0700 Merge branch 'mlx5-misc-fixes-2025-07-17' Tariq Toukan says: ==================== mlx5 misc fixes 2025-07-17 This small patchset provides misc bug fixes from the team to the mlx5 driver. ==================== Link: https://patch.msgid.link/1752753970-261832-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 5b4c56ad4da0aa00b258ab50b1f5775b7d3108c7 Author: Shahar Shitrit Date: Thu Jul 17 15:06:10 2025 +0300 net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch In the original design, it is assumed local and peer eswitches have the same number of vfs. However, in new firmware, local and peer eswitches can have different number of vfs configured by mlxconfig. In such configuration, it is incorrect to derive the number of vfs from the local device's eswitch. Fix this by updating the peer miss rules add and delete functions to use the peer device's eswitch and vf count instead of the local device's information, ensuring correct behavior regardless of vf configuration differences. Fixes: ac004b832128 ("net/mlx5e: E-Switch, Add peer miss rules") Signed-off-by: Shahar Shitrit Reviewed-by: Mark Bloch Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1752753970-261832-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 3afa3ae3db52e3c216d77bd5907a5a86833806cc Author: Chiara Meiohas Date: Thu Jul 17 15:06:09 2025 +0300 net/mlx5: Fix memory leak in cmd_exec() If cmd_exec() is called with callback and mlx5_cmd_invoke() returns an error, resources allocated in cmd_exec() will not be freed. Fix the code to release the resources if mlx5_cmd_invoke() returns an error. Fixes: f086470122d5 ("net/mlx5: cmdif, Return value improvements") Reported-by: Alex Tereshkin Signed-off-by: Chiara Meiohas Reviewed-by: Moshe Shemesh Signed-off-by: Vlad Dumitrescu Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1752753970-261832-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 6e86fb73de0fe3ec5cdcd5873ad1d6005f295b64 Author: Himanshu Mittal Date: Thu Jul 17 15:12:20 2025 +0530 net: ti: icssg-prueth: Fix buffer allocation for ICSSG Fixes overlapping buffer allocation for ICSSG peripheral used for storing packets to be received/transmitted. There are 3 buffers: 1. Buffer for Locally Injected Packets 2. Buffer for Forwarding Packets 3. Buffer for Host Egress Packets In existing allocation buffers for 2. and 3. are overlapping causing packet corruption. Packet corruption observations: During tcp iperf testing, due to overlapping buffers the received ack packet overwrites the packet to be transmitted. So, we see packets on wire with the ack packet content inside the content of next TCP packet from sender device. Details for AM64x switch mode: -> Allocation by existing driver: +---------+-------------------------------------------------------------+ | | SLICE 0 | SLICE 1 | | +------+--------------+--------+------+--------------+--------+ | | Slot | Base Address | Size | Slot | Base Address | Size | |---------+------+--------------+--------+------+--------------+--------+ | | 0 | 70000000 | 0x2000 | 0 | 70010000 | 0x2000 | | | 1 | 70002000 | 0x2000 | 1 | 70012000 | 0x2000 | | | 2 | 70004000 | 0x2000 | 2 | 70014000 | 0x2000 | | FWD | 3 | 70006000 | 0x2000 | 3 | 70016000 | 0x2000 | | Buffers | 4 | 70008000 | 0x2000 | 4 | 70018000 | 0x2000 | | | 5 | 7000A000 | 0x2000 | 5 | 7001A000 | 0x2000 | | | 6 | 7000C000 | 0x2000 | 6 | 7001C000 | 0x2000 | | | 7 | 7000E000 | 0x2000 | 7 | 7001E000 | 0x2000 | +---------+------+--------------+--------+------+--------------+--------+ | | 8 | 70020000 | 0x1000 | 8 | 70028000 | 0x1000 | | | 9 | 70021000 | 0x1000 | 9 | 70029000 | 0x1000 | | | 10 | 70022000 | 0x1000 | 10 | 7002A000 | 0x1000 | | Our | 11 | 70023000 | 0x1000 | 11 | 7002B000 | 0x1000 | | LI | 12 | 00000000 | 0x0 | 12 | 00000000 | 0x0 | | Buffers | 13 | 00000000 | 0x0 | 13 | 00000000 | 0x0 | | | 14 | 00000000 | 0x0 | 14 | 00000000 | 0x0 | | | 15 | 00000000 | 0x0 | 15 | 00000000 | 0x0 | +---------+------+--------------+--------+------+--------------+--------+ | | 16 | 70024000 | 0x1000 | 16 | 7002C000 | 0x1000 | | | 17 | 70025000 | 0x1000 | 17 | 7002D000 | 0x1000 | | | 18 | 70026000 | 0x1000 | 18 | 7002E000 | 0x1000 | | Their | 19 | 70027000 | 0x1000 | 19 | 7002F000 | 0x1000 | | LI | 20 | 00000000 | 0x0 | 20 | 00000000 | 0x0 | | Buffers | 21 | 00000000 | 0x0 | 21 | 00000000 | 0x0 | | | 22 | 00000000 | 0x0 | 22 | 00000000 | 0x0 | | | 23 | 00000000 | 0x0 | 23 | 00000000 | 0x0 | +---------+------+--------------+--------+------+--------------+--------+ --> here 16, 17, 18, 19 overlapping with below express buffer +-----+-----------------------------------------------+ | | SLICE 0 | SLICE 1 | | +------------+----------+------------+----------+ | | Start addr | End addr | Start addr | End addr | +-----+------------+----------+------------+----------+ | EXP | 70024000 | 70028000 | 7002C000 | 70030000 | <-- Overlapping | PRE | 70030000 | 70033800 | 70034000 | 70037800 | +-----+------------+----------+------------+----------+ +---------------------+----------+----------+ | | SLICE 0 | SLICE 1 | +---------------------+----------+----------+ | Default Drop Offset | 00000000 | 00000000 | <-- Field not configured +---------------------+----------+----------+ -> Allocation this patch brings: +---------+-------------------------------------------------------------+ | | SLICE 0 | SLICE 1 | | +------+--------------+--------+------+--------------+--------+ | | Slot | Base Address | Size | Slot | Base Address | Size | |---------+------+--------------+--------+------+--------------+--------+ | | 0 | 70000000 | 0x2000 | 0 | 70040000 | 0x2000 | | | 1 | 70002000 | 0x2000 | 1 | 70042000 | 0x2000 | | | 2 | 70004000 | 0x2000 | 2 | 70044000 | 0x2000 | | FWD | 3 | 70006000 | 0x2000 | 3 | 70046000 | 0x2000 | | Buffers | 4 | 70008000 | 0x2000 | 4 | 70048000 | 0x2000 | | | 5 | 7000A000 | 0x2000 | 5 | 7004A000 | 0x2000 | | | 6 | 7000C000 | 0x2000 | 6 | 7004C000 | 0x2000 | | | 7 | 7000E000 | 0x2000 | 7 | 7004E000 | 0x2000 | +---------+------+--------------+--------+------+--------------+--------+ | | 8 | 70010000 | 0x1000 | 8 | 70050000 | 0x1000 | | | 9 | 70011000 | 0x1000 | 9 | 70051000 | 0x1000 | | | 10 | 70012000 | 0x1000 | 10 | 70052000 | 0x1000 | | Our | 11 | 70013000 | 0x1000 | 11 | 70053000 | 0x1000 | | LI | 12 | 00000000 | 0x0 | 12 | 00000000 | 0x0 | | Buffers | 13 | 00000000 | 0x0 | 13 | 00000000 | 0x0 | | | 14 | 00000000 | 0x0 | 14 | 00000000 | 0x0 | | | 15 | 00000000 | 0x0 | 15 | 00000000 | 0x0 | +---------+------+--------------+--------+------+--------------+--------+ | | 16 | 70014000 | 0x1000 | 16 | 70054000 | 0x1000 | | | 17 | 70015000 | 0x1000 | 17 | 70055000 | 0x1000 | | | 18 | 70016000 | 0x1000 | 18 | 70056000 | 0x1000 | | Their | 19 | 70017000 | 0x1000 | 19 | 70057000 | 0x1000 | | LI | 20 | 00000000 | 0x0 | 20 | 00000000 | 0x0 | | Buffers | 21 | 00000000 | 0x0 | 21 | 00000000 | 0x0 | | | 22 | 00000000 | 0x0 | 22 | 00000000 | 0x0 | | | 23 | 00000000 | 0x0 | 23 | 00000000 | 0x0 | +---------+------+--------------+--------+------+--------------+--------+ +-----+-----------------------------------------------+ | | SLICE 0 | SLICE 1 | | +------------+----------+------------+----------+ | | Start addr | End addr | Start addr | End addr | +-----+------------+----------+------------+----------+ | EXP | 70018000 | 7001C000 | 70058000 | 7005C000 | | PRE | 7001C000 | 7001F800 | 7005C000 | 7005F800 | +-----+------------+----------+------------+----------+ +---------------------+----------+----------+ | | SLICE 0 | SLICE 1 | +---------------------+----------+----------+ | Default Drop Offset | 7001F800 | 7005F800 | +---------------------+----------+----------+ Rootcause: missing buffer configuration for Express frames in function: prueth_fw_offload_buffer_setup() Details: Driver implements two distinct buffer configuration functions that are invoked based on the driver state and ICSSG firmware:- - prueth_fw_offload_buffer_setup() - prueth_emac_buffer_setup() During initialization, driver creates standard network interfaces (netdevs) and configures buffers via prueth_emac_buffer_setup(). This function properly allocates and configures all required memory regions including: - LI buffers - Express packet buffers - Preemptible packet buffers However, when the driver transitions to an offload mode (switch/HSR/PRP), buffer reconfiguration is handled by prueth_fw_offload_buffer_setup(). This function does not reconfigure the buffer regions required for Express packets, leading to incorrect buffer allocation. Fixes: abd5576b9c57 ("net: ti: icssg-prueth: Add support for ICSSG switch firmware") Signed-off-by: Himanshu Mittal Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250717094220.546388-1-h-mittal1@ti.com Signed-off-by: Jakub Kicinski commit 96e056ffba912ef18a72177f71956a5b347b5177 Author: Ma Ke Date: Thu Jul 17 10:23:09 2025 +0800 dpaa2-switch: Fix device reference count leak in MAC endpoint handling The fsl_mc_get_endpoint() function uses device_find_child() for localization, which implicitly calls get_device() to increment the device's reference count before returning the pointer. However, the caller dpaa2_switch_port_connect_mac() fails to properly release this reference in multiple scenarios. We should call put_device() to decrement reference count properly. As comment of device_find_child() says, 'NOTE: you will need to drop the reference with put_device() after use'. Found by code review. Cc: stable@vger.kernel.org Fixes: 84cba72956fd ("dpaa2-switch: integrate the MAC endpoint support") Signed-off-by: Ma Ke Tested-by: Ioana Ciornei Reviewed-by: Ioana Ciornei Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250717022309.3339976-3-make24@iscas.ac.cn Signed-off-by: Jakub Kicinski commit ee9f3a81ab08dfe0538dbd1746f81fd4d5147fdc Author: Ma Ke Date: Thu Jul 17 10:23:08 2025 +0800 dpaa2-eth: Fix device reference count leak in MAC endpoint handling The fsl_mc_get_endpoint() function uses device_find_child() for localization, which implicitly calls get_device() to increment the device's reference count before returning the pointer. However, the caller dpaa2_eth_connect_mac() fails to properly release this reference in multiple scenarios. We should call put_device() to decrement reference count properly. As comment of device_find_child() says, 'NOTE: you will need to drop the reference with put_device() after use'. Found by code review. Cc: stable@vger.kernel.org Fixes: 719479230893 ("dpaa2-eth: add MAC/PHY support through phylink") Signed-off-by: Ma Ke Tested-by: Ioana Ciornei Reviewed-by: Ioana Ciornei Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250717022309.3339976-2-make24@iscas.ac.cn Signed-off-by: Jakub Kicinski commit bddbe13d36a02d5097b99cf02354d5752ad1ac60 Author: Ma Ke Date: Thu Jul 17 10:23:07 2025 +0800 bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() The fsl_mc_get_endpoint() function may call fsl_mc_device_lookup() twice, which would increment the device's reference count twice if both lookups find a device. This could lead to a reference count leak. Found by code review. Cc: stable@vger.kernel.org Fixes: 1ac210d128ef ("bus: fsl-mc: add the fsl_mc_get_endpoint function") Signed-off-by: Ma Ke Tested-by: Ioana Ciornei Reviewed-by: Simon Horman Fixes: 8567494cebe5 ("bus: fsl-mc: rescan devices if endpoint not found") Link: https://patch.msgid.link/20250717022309.3339976-1-make24@iscas.ac.cn Signed-off-by: Jakub Kicinski commit 414aaef1537ac7f90dcb54e618864680aca2e197 Merge: c7de79e662b868 b65ca21835ed61 Author: Linus Torvalds Date: Fri Jul 18 15:31:46 2025 -0700 Merge tag 'riscv-for-linus-6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: - Three fixes for unnecessary spew: an ACPI CPPC boot-time debug message, the link-time warnings for R_RISCV_NONE in binaries, and some compile-time warnings in __put_user_nocheck - A fix for a race during text patching - Interrupts are no longer disabled during exception handling - A fix for a missing sign extension in the misaligned load handler - A fix to avoid static ftrace being selected in Kconfig, as we have moved to dynamic ftrace * tag 'riscv-for-linus-6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: uaccess: Fix -Wuninitialized and -Wshadow in __put_user_nocheck riscv: Stop supporting static ftrace riscv: traps_misaligned: properly sign extend value in misaligned load handler riscv: Enable interrupt during exception handling riscv: ftrace: Properly acquire text_mutex to fix a race condition ACPI: RISC-V: Remove unnecessary CPPC debug message riscv: Stop considering R_RISCV_NONE as bad relocations commit 85a3bce695b361d85fc528e6fbb33e4c8089c806 Author: Tomas Glozar Date: Wed Jul 16 16:36:01 2025 +0200 tracing/osnoise: Fix crash in timerlat_dump_stack() We have observed kernel panics when using timerlat with stack saving, with the following dmesg output: memcpy: detected buffer overflow: 88 byte write of buffer size 0 WARNING: CPU: 2 PID: 8153 at lib/string_helpers.c:1032 __fortify_report+0x55/0xa0 CPU: 2 UID: 0 PID: 8153 Comm: timerlatu/2 Kdump: loaded Not tainted 6.15.3-200.fc42.x86_64 #1 PREEMPT(lazy) Call Trace: ? trace_buffer_lock_reserve+0x2a/0x60 __fortify_panic+0xd/0xf __timerlat_dump_stack.cold+0xd/0xd timerlat_dump_stack.part.0+0x47/0x80 timerlat_fd_read+0x36d/0x390 vfs_read+0xe2/0x390 ? syscall_exit_to_user_mode+0x1d5/0x210 ksys_read+0x73/0xe0 do_syscall_64+0x7b/0x160 ? exc_page_fault+0x7e/0x1a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e __timerlat_dump_stack() constructs the ftrace stack entry like this: struct stack_entry *entry; ... memcpy(&entry->caller, fstack->calls, size); entry->size = fstack->nr_entries; Since commit e7186af7fb26 ("tracing: Add back FORTIFY_SOURCE logic to kernel_stack event structure"), struct stack_entry marks its caller field with __counted_by(size). At the time of the memcpy, entry->size contains garbage from the ringbuffer, which under some circumstances is zero, triggering a kernel panic by buffer overflow. Populate the size field before the memcpy so that the out-of-bounds check knows the correct size. This is analogous to __ftrace_trace_stack(). Cc: stable@vger.kernel.org Cc: John Kacur Cc: Luis Goncalves Cc: Attila Fazekas Link: https://lore.kernel.org/20250716143601.7313-1-tglozar@redhat.com Fixes: e7186af7fb26 ("tracing: Add back FORTIFY_SOURCE logic to kernel_stack event structure") Signed-off-by: Tomas Glozar Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit c7de79e662b8681f54196c107281f1e63c26a3db Merge: e347810e840940 4b7d440de209cb Author: Linus Torvalds Date: Fri Jul 18 12:38:34 2025 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "ARM: - Fix use of u64_replace_bits() in adjusting the guest's view of MDCR_EL2.HPMN RISC-V: - Fix an issue related to timer cleanup when exiting to user-space - Fix a race-condition in updating interrupts enabled for the guest when IMSIC is hardware-virtualized x86: - Reject KVM_SET_TSC_KHZ for guests with a protected TSC (currently only TDX) - Ensure struct kvm_tdx_capabilities fields that are not explicitly set by KVM are zeroed Documentation: - Explain how KVM contributions should be made testable - Fix a formatting goof in the TDX documentation" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: TDX: Don't report base TDVMCALLs KVM: VMX: Ensure unused kvm_tdx_capabilities fields are zeroed out KVM: Documentation: document how KVM is tested KVM: Documentation: minimal updates to review-checklist.rst KVM: x86: Reject KVM_SET_TSC_KHZ vCPU ioctl for TSC protected guest RISC-V: KVM: Move HGEI[E|P] CSR access to IMSIC virtualization RISC-V: KVM: Disable vstimecmp before exiting to user-space Documentation: KVM: Fix unexpected unindent warning KVM: arm64: Fix enforcement of upper bound on MDCR_EL2.HPMN commit e347810e84094078d155663acbf36d82efe91f95 Merge: e5ac874257bf06 c7cafd5b81cc07 Author: Linus Torvalds Date: Fri Jul 18 12:21:26 2025 -0700 Merge tag 'io_uring-6.16-20250718' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: - dmabug offset fix for zcrx - Fix for the POLLERR connect work around handling * tag 'io_uring-6.16-20250718' of git://git.kernel.dk/linux: io_uring/poll: fix POLLERR handling io_uring/zcrx: disallow user selected dmabuf offset and size commit e5ac874257bf06eba00282e5b627f23b72ac8f7d Merge: 7abc678e308467 2680efde75ccdd Author: Linus Torvalds Date: Fri Jul 18 12:16:13 2025 -0700 Merge tag 'block-6.16-20250718' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: - NVMe changes via Christoph: - revert the cross-controller atomic write size validation that caused regressions (Christoph Hellwig) - fix endianness of command word printout in nvme_log_err_passthru() (John Garry) - fix callback lock for TLS handshake (Maurizio Lombardi) - fix misaccounting of nvme-mpath inflight I/O (Yu Kuai) - fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing) - Fix for a kobject leak in queue unregistration - Fix for loop async file write start/end handling * tag 'block-6.16-20250718' of git://git.kernel.dk/linux: loop: use kiocb helpers to fix lockdep warning nvmet-tcp: fix callback lock for TLS handshake nvme: fix misaccounting of nvme-mpath inflight I/O nvme: revert the cross-controller atomic write size validation nvme: fix endianness of command word prints in nvme_log_err_passthru() nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() block: fix kobject leak in blk_unregister_queue commit 7abc678e308467ab60ffb8c31f4638a47ee3518c Merge: 16e14971df69ff 621a88dbfe9006 Author: Linus Torvalds Date: Fri Jul 18 12:02:17 2025 -0700 Merge tag 'pmdomain-v6.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain / cpuidle-psci fixes from Ulf Hansson: "pmdomain core: - Respect CPU latency QoS limit in the genpd governor for CPUs cpuidle-psci: - Fix cpuhotplug support for PREEMPT_RT" * tag 'pmdomain-v6.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov commit 16e14971df69ff8e655196b77515821b1724c61f Merge: d786aba32000f2 11ff5e06e02326 Author: Linus Torvalds Date: Fri Jul 18 11:57:41 2025 -0700 Merge tag 'gpio-fixes-for-v6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix the devres release callback for devm_gpiod_put_array() - add an ACPI quirk for Acer Nitro V15 suspend & wakeup * tag 'gpio-fixes-for-v6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpiolib: devres: release GPIOs in devm_gpiod_put_array() gpiolib: acpi: Add a quirk for Acer Nitro V15 commit d786aba32000f20a58bb79c2e3ae326e4fb377a1 Merge: c460535a6d6182 0238c45fbbf822 Author: Linus Torvalds Date: Fri Jul 18 11:46:26 2025 -0700 Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: - Fix handling of BPF arena relocations (Andrii Nakryiko) - Fix race in bpf_arch_text_poke() on s390 (Ilya Leoshkevich) - Fix use of virt_to_phys() on arm64 when mmapping BTF (Lorenz Bauer) - Reject %p% format string in bprintf-like BPF helpers (Paul Chaignon) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: libbpf: Fix handling of BPF arena relocations btf: Fix virt_to_phys() on arm64 when mmapping BTF selftests/bpf: Stress test attaching a BPF prog to another BPF prog s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again selftests/bpf: Add negative test cases for snprintf bpf: Reject %p% format string in bprintf-like helpers commit c460535a6d6182dcb00773132a8c384c1f9b5408 Merge: f0afb7bd4374fd 4d33ed640ffc06 Author: Linus Torvalds Date: Fri Jul 18 11:27:46 2025 -0700 Merge tag 'drm-fixes-2025-07-18-1' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Seems like a quiet enough week, xe/amdgpu being the usual suspects, then mediatek with a few fixes, and otherwise just misc other bits. dp: - aux dpcd address fix xe: - SR-IOV fixes for GT reset and TLB invalidation - Fix memory copy direction during migration - Fix alignment check on migration - Fix MOCS and page fault init order to correctly account for topology amdgpu: - Fix a DC memory leak - DCN 4.0.1 degamma LUT fix - Fix reset counter handling for soft recovery - GC 8 fix radeon: - Drop console locks when suspending/resuming nouveau: - ioctl validation fix panfrost: - scheduler bug fix mediatek: - Add wait_event_timeout when disabling plane - only announce AFBC if really supported - mtk_dpi: Reorder output formats on MT8195/88" * tag 'drm-fixes-2025-07-18-1' of https://gitlab.freedesktop.org/drm/kernel: drm/mediatek: mtk_dpi: Reorder output formats on MT8195/88 drm/mediatek: only announce AFBC if really supported drm/mediatek: Add wait_event_timeout when disabling plane drm/xe/pf: Resend PF provisioning after GT reset drm/xe/pf: Prepare to stop SR-IOV support prior GT reset drm/xe/migrate: Fix alignment check drm/xe: Move page fault init after topology init drm/xe/mocs: Initialize MOCS index early drm/xe/migrate: fix copy direction in access_memory drm/xe: Dont skip TLB invalidations on VF drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume drm/amdgpu: Increase reset counter only on success drm/radeon: Do not hold console lock during resume drm/radeon: Do not hold console lock while suspending clients drm/amd/display: Disable CRTC degamma LUT for DCN401 drm/amd/display: Free memory allocation drm/dp: Change AUX DPCD probe address from LANE0_1_STATUS to TRAINING_PATTERN_SET drm/panfrost: Fix scheduler workqueue bug drm/nouveau: check ioctl command codes better commit f0afb7bd4374fdb30da8bf6cd74528bba131bd88 Merge: e1da8eb20a06c7 348954f9b78e15 Author: Linus Torvalds Date: Fri Jul 18 11:15:55 2025 -0700 Merge tag 'sound-6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes again. The only change in the core is about the handling of ALSA compress-offload ioctl numbers for avoiding potential abusing the API (if any). Other than that, all changes are device-specific small fixes and quirks, which should be safe to apply" * tag 'sound-6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx ASoC: Intel: soc-acpi: add support for HP Omen14 ARL ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX ALSA: hda/realtek: Support mute LED for Yoga with ALC287 ASoC: Intel: fix SND_SOC_SOF dependencies ASoC: rt5660: Fix the dmic data source from GPIO2 ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx ALSA: compress_offload: tighten ioctl command number checks ASoC: Intel: avs: Fix NULL ptr deref on rmmod ASoC: amd: yc: add DMI quirk for ASUS M6501RM commit e1da8eb20a06c71022252754ce6c20de9fcdbbeb Merge: fcc481f76b2917 834bce6a715ae9 Author: Linus Torvalds Date: Fri Jul 18 11:04:39 2025 -0700 Merge tag 'soundwire-6.16-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire Pull soundwire fixes from Vinod Koul: "This contains a couple of amd driver fixes to handle alerts when the link is down and the cmd status register clears up. Also a revert of the qualcomm driver channel map support due to a regression" * tag 'soundwire-6.16-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: soundwire: Revert "soundwire: qcom: Add set_channel_map api support" soundwire: amd: fix for clearing command status register soundwire: amd: fix for handling slave alerts after link is down commit fcc481f76b291798ff1e3054c8a8602937087cb3 Merge: 5b35eb8435fd33 3df63fa8f2afd0 Author: Linus Torvalds Date: Fri Jul 18 10:59:26 2025 -0700 Merge tag 'dmaengine-fix-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine fixes from Vinod Koul: - Mediatek flag reuse error fix - Array overbound fix for nbpfaxi - Frame size warning in driver probe * tag 'dmaengine-fix-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: dma: dw-edma: Fix build warning in dw_edma_pcie_probe() dmaengine: nbpfaxi: Fix memory corruption in probe() dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() commit 5b35eb8435fd33f357918f2aefa50357695522e3 Merge: a4e3703088546a b7acfeab8af9ee Author: Linus Torvalds Date: Fri Jul 18 10:54:23 2025 -0700 Merge tag 'phy-fix-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy Pull phy fixes from Vinod Koul: "Core: - use per-PHY lockdep keys, in order to fix a phy using internal phys Drivers: - tegra: - fixes for unbalanced regulator - decouple pad calibration fix - disable periodic updates - qualcomm: - error code fix for driver probe" * tag 'phy-fix-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: phy: qcom: fix error code in snps_eusb2_hsphy_probe() phy: use per-PHY lockdep keys phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode phy: tegra: xusb: Disable periodic tracking on Tegra234 phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode commit a4e3703088546abca27e7319e2fb95569ccd59fd Merge: d551d7bbf264ed 21b34a3a204ed6 Author: Linus Torvalds Date: Fri Jul 18 10:23:03 2025 -0700 Merge tag 'mmc-v6.16-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: "MMC host: - bcm2835: Fix dma_unmap_sg() nents value - sdhci_am654: Add workaround for maximum HW timeout - sdhci-pci: Disable broken CQE Intel GLK-based Positivo models MEMSTICK: - Zero initialize id_reg in h_memstick_read_dev_id()" * tag 'mmc-v6.16-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() mmc: bcm2835: Fix dma_unmap_sg() nents value mmc: sdhci_am654: Workaround for Errata i2312 mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models commit 8767cb3fbd514c4cf85b4f516ca30388e846f540 Author: Steve French Date: Mon Jul 14 22:16:19 2025 -0500 Fix SMB311 posix special file creation to servers which do not advertise reparse support Some servers (including Samba), support the SMB3.1.1 POSIX Extensions (which use reparse points for handling special files) but do not properly advertise file system attribute FILE_SUPPORTS_REPARSE_POINTS. Although we don't check for this attribute flag when querying special file information, we do check it when creating special files which causes them to fail unnecessarily. If we have negotiated SMB3.1.1 POSIX Extensions with the server we can expect the server to support creating special files via reparse points, and even if the server fails the operation due to really forbidding creating special files, then it should be no problem and is more likely to return a more accurate rc in any case (e.g. EACCES instead of EOPNOTSUPP). Allow creating special files as long as the server supports either reparse points or the SMB3.1.1 POSIX Extensions (note that if the "sfu" mount option is specified it uses a different way of storing special files that does not rely on reparse points). Cc: Fixes: 6c06be908ca19 ("cifs: Check if server supports reparse points before using them") Acked-by: Ralph Boehme Acked-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French commit d551d7bbf264ed11d897368e3670bda5b37b360e Merge: d3d16f31d7b305 5948705adbf1a7 Author: Linus Torvalds Date: Fri Jul 18 10:09:48 2025 -0700 Merge tag 'xfs-fixes-6.16-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Carlos Maiolino: "This contains mostly code clean up, refactoring and comments modification. The most important patch in this series is the last one that removes an unnecessary data structure allocation of xfs busy extents which might lead to a memory leak on the zoned allocator code" * tag 'xfs-fixes-6.16-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: don't allocate the xfs_extent_busy structure for zoned RTGs xfs: remove the bt_bdev_file buftarg field xfs: rename the bt_bdev_* buftarg fields xfs: refactor xfs_calc_atomic_write_unit_max xfs: add a xfs_group_type_buftarg helper xfs: remove the call to sync_blockdev in xfs_configure_buftarg xfs: clean up the initial read logic in xfs_readsb xfs: replace strncpy with memcpy in xattr listing commit ce3cf7c8a17478456f502cb2facd6660e519ead3 Author: Torben Nielsen Date: Fri Jul 18 11:36:45 2025 +0200 hwmon: (pmbus/ucd9000) Fix error in ucd9000_gpio_set The GPIO output functionality does not work as intended. The ucd9000_gpio_set function should set UCD9000_GPIO_CONFIG_OUT_VALUE (bit 2) in order to change the output value of the selected GPIO. Instead UCD9000_GPIO_CONFIG_STATUS (bit 3) is set, but this is a read-only value. This patch fixes the mistake and provides the intended functionality of the GPIOs. See UCD90xxx Sequencer and System Health Controller PMBus Command SLVU352C section 10.43 for reference. Signed-off-by: Torben Nielsen Link: https://lore.kernel.org/r/20250718093644.356085-2-t8927095@gmail.com Signed-off-by: Guenter Roeck commit 3e8e93cbb8b0fe67661665a3e7e80642a02884a5 Author: Jonas Rebmann Date: Tue Jul 15 15:02:41 2025 +0200 hwmon: (ina238) Report energy in microjoules The hwmon sysfs interface specifies that energy values should be reported in microjoules. This is also what tools such as lmsensors expect, reporting wrong values otherwise. Adjust the driver to scale the output accordingly and adjust ina238 driver documentation. Fixes: 6daaf15a1173 ("hwmon: (ina238) Add support for SQ52206") Signed-off-by: Jonas Rebmann Link: https://lore.kernel.org/r/20250715-hwmon-ina238-microjoules-v1-1-9df678568a41@pengutronix.de Signed-off-by: Guenter Roeck commit d3d16f31d7b305df46080a95f2d254f78e04d588 Merge: 6832a9317eee28 89edfcf710875f Author: Linus Torvalds Date: Fri Jul 18 09:19:57 2025 -0700 Merge tag 'bcachefs-2025-07-17' of git://evilpiepirate.org/bcachefs Pull bcachefs fixes from Kent Overstreet: - two small syzbot fixes - fix discard behaviour regression; we no longer wait until the number of buckets needing discard is greater than the number of buckets available before kicking off discards - fix a fast_list leak when async object debugging is enabled - fixes for casefolding when CONFIG_UTF8 != y * tag 'bcachefs-2025-07-17' of git://evilpiepirate.org/bcachefs: bcachefs: Fix bch2_maybe_casefold() when CONFIG_UTF8=n bcachefs: Fix build when CONFIG_UNICODE=n bcachefs: Fix reference to invalid bucket in copygc bcachefs: Don't build aux search tree when still repairing node bcachefs: Tweak threshold for allocator triggering discards bcachefs: Fix triggering of discard by the journal path bcachefs: io_read: remove from async obj list in rbio_done() commit 5948705adbf1a7afcecfe9a13ff39221ef61e16b Author: Christoph Hellwig Date: Wed Jul 16 14:54:01 2025 +0200 xfs: don't allocate the xfs_extent_busy structure for zoned RTGs Busy extent tracking is primarily used to ensure that freed blocks are not reused for data allocations before the transaction that deleted them has been committed to stable storage, and secondarily to drive online discard. None of the use cases applies to zoned RTGs, as the zoned allocator can't overwrite blocks before resetting the zone, which already flushes out all transactions touching the RTGs. So the busy extent tracking is not needed for zoned RTGs, and also not called for zoned RTGs. But somehow the code to skip allocating and freeing the structure got lost during the zoned XFS upstreaming process. This not only causes these structures to unnecessarily allocated, but can also lead to memory leaks as the xg_busy_extents pointer in the xfs_group structure is overlayed with the pointer for the linked list of to be reset zones. Stop allocating and freeing the structure to not pointlessly allocate memory which is then leaked when the zone is reset. Fixes: 080d01c41d44 ("xfs: implement zoned garbage collection") Signed-off-by: Christoph Hellwig Cc: # v6.15 [cem: Fix type and add stable tag] Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 21c8ed9047b7f44c1c49b889d4ba2f555d9ee17e Author: Edip Hazuri Date: Fri Jul 18 00:26:26 2025 +0300 ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx The mute led on this laptop is using ALC245 but requires a quirk to work This patch enables the existing quirk for the device. Tested on my Victus 15-fa0xxx Laptop. The LED behaviour works as intended. Cc: Signed-off-by: Edip Hazuri Link: https://patch.msgid.link/20250717212625.366026-2-edip@medip.dev Signed-off-by: Takashi Iwai commit 6bea85979d05470e6416a2bb504a9bcd9178304c Author: Guoqing Jiang Date: Thu Jul 10 09:18:06 2025 +0800 ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv Given mt8365_dai_set_priv allocate priv_size space to copy priv_data which means we should pass mt8365_i2s_priv[i] or "struct mtk_afe_i2s_priv" instead of afe_priv which has the size of "struct mt8365_afe_private". Otherwise the KASAN complains about. [ 59.389765] BUG: KASAN: global-out-of-bounds in mt8365_dai_set_priv+0xc8/0x168 [snd_soc_mt8365_pcm] ... [ 59.394789] Call trace: [ 59.395167] dump_backtrace+0xa0/0x128 [ 59.395733] show_stack+0x20/0x38 [ 59.396238] dump_stack_lvl+0xe8/0x148 [ 59.396806] print_report+0x37c/0x5e0 [ 59.397358] kasan_report+0xac/0xf8 [ 59.397885] kasan_check_range+0xe8/0x190 [ 59.398485] asan_memcpy+0x3c/0x98 [ 59.399022] mt8365_dai_set_priv+0xc8/0x168 [snd_soc_mt8365_pcm] [ 59.399928] mt8365_dai_i2s_register+0x1e8/0x2b0 [snd_soc_mt8365_pcm] [ 59.400893] mt8365_afe_pcm_dev_probe+0x4d0/0xdf0 [snd_soc_mt8365_pcm] [ 59.401873] platform_probe+0xcc/0x228 [ 59.402442] really_probe+0x340/0x9e8 [ 59.402992] driver_probe_device+0x16c/0x3f8 [ 59.403638] driver_probe_device+0x64/0x1d8 [ 59.404256] driver_attach+0x1dc/0x4c8 [ 59.404840] bus_for_each_dev+0x100/0x190 [ 59.405442] driver_attach+0x44/0x68 [ 59.405980] bus_add_driver+0x23c/0x500 [ 59.406550] driver_register+0xf8/0x3d0 [ 59.407122] platform_driver_register+0x68/0x98 [ 59.407810] mt8365_afe_pcm_driver_init+0x2c/0xff8 [snd_soc_mt8365_pcm] Fixes: 402bbb13a195 ("ASoC: mediatek: mt8365: Add I2S DAI support") Signed-off-by: Guoqing Jiang Reviewed-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20250710011806.134507-1-guoqing.jiang@canonical.com Signed-off-by: Mark Brown commit 64e135f1eaba0bbb0cdee859af3328c68d5b9789 Author: Breno Leitao Date: Wed Jul 16 08:23:12 2025 -0700 efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths When processing mount options, efivarfs allocates efivarfs_fs_info (sfi) early in fs_context initialization. However, sfi is associated with the superblock and typically freed when the superblock is destroyed. If the fs_context is released (final put) before fill_super is called—such as on error paths or during reconfiguration—the sfi structure would leak, as ownership never transfers to the superblock. Implement the .free callback in efivarfs_context_ops to ensure any allocated sfi is properly freed if the fs_context is torn down before fill_super, preventing this memory leak. Suggested-by: James Bottomley Fixes: 5329aa5101f73c ("efivarfs: Add uid/gid mount options") Signed-off-by: Breno Leitao Signed-off-by: Ard Biesheuvel commit 816309d500ac34b9ae3ff88f130ca7dbbe467bfb Merge: 347e9f5043c896 a46b4822bed08d Author: Arnd Bergmann Date: Fri Jul 18 08:23:59 2025 +0200 Merge tag 'sunxi-fixes-for-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into arm/fixes Allwinner fixes for 6.16 Only one fix: Correct the name of the A523's EMAC0 to GMAC0, as seen in the SoC's datasheets. The matching DT binding change is in the net tree. * tag 'sunxi-fixes-for-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: arm64: dts: allwinner: a523: Rename emac0 to gmac0 Signed-off-by: Arnd Bergmann commit 4d33ed640ffc06734271cebda5ac2e3b5a79f453 Merge: 4399e3d84d6a64 5c244eeca57ff4 Author: Dave Airlie Date: Fri Jul 18 14:04:02 2025 +1000 Merge tag 'drm-xe-fixes-2025-07-17' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Driver Changes: - SR-IOV fixes for GT reset and TLB invalidation - Fix memory copy direction during migration - Fix alignment check on migration - Fix MOCS and page fault init order to correctly account for topology Signed-off-by: Dave Airlie From: Lucas De Marchi Link: https://lore.kernel.org/r/6jworkgupwstm4v7aohbuzod3dyz4u7pyfhshr5ifgf2xisgj3@cm5em5yupjiu commit 0238c45fbbf8228f52aa4642f0cdc21c570d1dfe Author: Andrii Nakryiko Date: Thu Jul 17 17:10:09 2025 -0700 libbpf: Fix handling of BPF arena relocations Initial __arena global variable support implementation in libbpf contains a bug: it remembers struct bpf_map pointer for arena, which is used later on to process relocations. Recording this pointer is problematic because map pointers are not stable during ELF relocation collection phase, as an array of struct bpf_map's can be reallocated, invalidating all the pointers. Libbpf is dealing with similar issues by using a stable internal map index, though for BPF arena map specifically this approach wasn't used due to an oversight. The resulting behavior is non-deterministic issue which depends on exact layout of ELF object file, number of actual maps, etc. We didn't hit this until very recently, when this bug started triggering crash in BPF CI when validating one of sched-ext BPF programs. The fix is rather straightforward: we just follow an established pattern of remembering map index (just like obj->kconfig_map_idx, for example) instead of `struct bpf_map *`, and resolving index to a pointer at the point where map information is necessary. While at it also add debug-level message for arena-related relocation resolution information, which we already have for all other kinds of maps. Fixes: 2e7ba4f8fd1f ("libbpf: Recognize __arena global variables.") Signed-off-by: Andrii Nakryiko Tested-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250718001009.610955-1-andrii@kernel.org Signed-off-by: Alexei Starovoitov commit 4399e3d84d6a64f3b5307983b76f75a0f56edd43 Merge: 8d2ad05666d726 5ceed7a6d34a88 Author: Dave Airlie Date: Fri Jul 18 11:58:31 2025 +1000 Merge tag 'mediatek-drm-fixes-20250718' of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-fixes Mediatek DRM Fixes - 20250718 1. Add wait_event_timeout when disabling plane 2. only announce AFBC if really supported 3. mtk_dpi: Reorder output formats on MT8195/88 Signed-off-by: Dave Airlie From: Chun-Kuang Hu Link: https://lore.kernel.org/r/20250717232916.12372-1-chunkuang.hu@kernel.org commit 8d2ad05666d7263db3426d02558dc7e86c49ad14 Merge: fbefd8adda4ef6 83261934015c43 Author: Dave Airlie Date: Fri Jul 18 11:41:10 2025 +1000 Merge tag 'amd-drm-fixes-6.16-2025-07-17' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.16-2025-07-17: amdgpu: - Fix a DC memory leak - DCN 4.0.1 degamma LUT fix - Fix reset counter handling for soft recovery - GC 8 fix radeon: - Drop console locks when suspending/resuming Signed-off-by: Dave Airlie From: Alex Deucher Link: https://lore.kernel.org/r/20250717171935.642380-1-alexander.deucher@amd.com commit fbefd8adda4ef6c7a3a7b875ad075a75f0256094 Merge: cbc3fa828894cd d34d6feaf4a768 Author: Dave Airlie Date: Fri Jul 18 09:59:42 2025 +1000 Merge tag 'drm-intel-fixes-2025-07-17' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - DP AUX DPCD address fix (Imre) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://lore.kernel.org/r/aHkQmRhelb4Fzqau@intel.com commit cbc3fa828894cdad0af94e9d3d2704952fc11587 Merge: 347e9f5043c896 cb345f954eacd1 Author: Dave Airlie Date: Fri Jul 18 09:42:22 2025 +1000 Merge tag 'drm-misc-fixes-2025-07-16' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes drm-misc-fixes for v6.16 final?: - nouveau ioctl validation fix. - panfrost scheduler bug. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://lore.kernel.org/r/ee784a3a-30b4-489a-8503-b1be3b09268c@linux.intel.com commit 5ceed7a6d34a8800bc39673bf2d5573990fbac4d Author: Louis-Alexis Eyraud Date: Fri Jun 6 14:50:12 2025 +0200 drm/mediatek: mtk_dpi: Reorder output formats on MT8195/88 Reorder output format arrays in both MT8195 DPI and DP_INTF block configuration by decreasing preference order instead of alphanumeric one, as expected by the atomic_get_output_bus_fmts callback function of drm_bridge controls, so the RGB ones are used first during the bus format negotiation process. Fixes: 20fa6a8fc588 ("drm/mediatek: mtk_dpi: Allow additional output formats on MT8195/88") Signed-off-by: Louis-Alexis Eyraud Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: CK Hu Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20250606-mtk_dpi-mt8195-fix-wrong-color-v1-1-47988101b798@collabora.com/ Signed-off-by: Chun-Kuang Hu commit 8d121a82fa564e0c8bd86ce4ec56b2a43b9b016e Author: Icenowy Zheng Date: Sat May 31 20:11:40 2025 +0800 drm/mediatek: only announce AFBC if really supported Currently even the SoC's OVL does not declare the support of AFBC, AFBC is still announced to the userspace within the IN_FORMATS blob, which breaks modern Wayland compositors like KWin Wayland and others. Gate passing modifiers to drm_universal_plane_init() behind querying the driver of the hardware block for AFBC support. Fixes: c410fa9b07c3 ("drm/mediatek: Add AFBC support to Mediatek DRM driver") Signed-off-by: Icenowy Zheng Reviewed-by: CK Hu Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20250531121140.387661-1-uwu@icenowy.me/ Signed-off-by: Chun-Kuang Hu commit d208261e9f7c66960587b10473081dc1cecbe50b Author: Jason-JH Lin Date: Tue Jun 24 19:31:41 2025 +0800 drm/mediatek: Add wait_event_timeout when disabling plane Our hardware registers are set through GCE, not by the CPU. DRM might assume the hardware is disabled immediately after calling atomic_disable() of drm_plane, but it is only truly disabled after the GCE IRQ is triggered. Additionally, the cursor plane in DRM uses async_commit, so DRM will not wait for vblank and will free the buffer immediately after calling atomic_disable(). To prevent the framebuffer from being freed before the layer disable settings are configured into the hardware, which can cause an IOMMU fault error, a wait_event_timeout has been added to wait for the ddp_cmdq_cb() callback,indicating that the GCE IRQ has been triggered. Fixes: 2f965be7f900 ("drm/mediatek: apply CMDQ control flow") Signed-off-by: Jason-JH Lin Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: CK Hu Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20250624113223.443274-1-jason-jh.lin@mediatek.com/ Signed-off-by: Chun-Kuang Hu commit 2e2713ae1a05eea7dda2f3b6988827196e33b25a Author: Lorenz Bauer Date: Thu Jul 17 17:49:49 2025 +0100 btf: Fix virt_to_phys() on arm64 when mmapping BTF Breno Leitao reports that arm64 emits the following warning with CONFIG_DEBUG_VIRTUAL: [ 58.896157] virt_to_phys used for non-linear address: 000000009fea9737 (__start_BTF+0x0/0x685530) [ 23.988669] WARNING: CPU: 25 PID: 1442 at arch/arm64/mm/physaddr.c:15 __virt_to_phys (arch/arm64/mm/physaddr.c:?) ... [ 24.075371] Tainted: [E]=UNSIGNED_MODULE, [N]=TEST [ 24.080276] Hardware name: Quanta S7GM 20S7GCU0010/S7G MB (CG1), BIOS 3D22 07/03/2024 [ 24.088295] pstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 24.098440] pc : __virt_to_phys (arch/arm64/mm/physaddr.c:?) [ 24.105398] lr : __virt_to_phys (arch/arm64/mm/physaddr.c:?) ... [ 24.197257] Call trace: [ 24.199761] __virt_to_phys (arch/arm64/mm/physaddr.c:?) (P) [ 24.206883] btf_sysfs_vmlinux_mmap (kernel/bpf/sysfs_btf.c:27) [ 24.214264] sysfs_kf_bin_mmap (fs/sysfs/file.c:179) [ 24.218536] kernfs_fop_mmap (fs/kernfs/file.c:462) [ 24.222461] mmap_region (./include/linux/fs.h:? mm/internal.h:167 mm/vma.c:2405 mm/vma.c:2467 mm/vma.c:2622 mm/vma.c:2692) It seems that the memory layout on arm64 maps the kernel image in vmalloc space which is different than x86. This makes virt_to_phys emit the warning. Fix this by translating the address using __pa_symbol as suggested by Breno instead. Reported-by: Breno Leitao Closes: https://lore.kernel.org/bpf/g2gqhkunbu43awrofzqb4cs4sxkxg2i4eud6p4qziwrdh67q4g@mtw3d3aqfgmb/ Signed-off-by: Lorenz Bauer Tested-by: Breno Leitao Fixes: a539e2a6d51d ("btf: Allow mmap of vmlinux btf") Link: https://lore.kernel.org/r/20250717-vmlinux-mmap-pa-symbol-v1-1-970be6681158@isovalent.com Signed-off-by: Alexei Starovoitov commit 06efc9fe0b8deeb83b47fd7c5451fe1a60c8a761 Author: Andrea Righi Date: Sat Jul 5 07:43:51 2025 +0200 sched_ext: idle: Handle migration-disabled tasks in idle selection When SCX_OPS_ENQ_MIGRATION_DISABLED is enabled, migration-disabled tasks are also routed to ops.enqueue(). A scheduler may attempt to dispatch such tasks directly to an idle CPU using the default idle selection policy via scx_bpf_select_cpu_and() or scx_bpf_select_cpu_dfl(). This scenario must be properly handled by the built-in idle policy to avoid returning an idle CPU where the target task isn't allowed to run. Otherwise, it can lead to errors such as: EXIT: runtime error (SCX_DSQ_LOCAL[_ON] cannot move migration disabled Chrome_ChildIOT[291646] from CPU 3 to 14) Prevent this by explicitly handling migration-disabled tasks in the built-in idle selection logic, maintaining their CPU affinity. Fixes: a730e3f7a48bc ("sched_ext: idle: Consolidate default idle CPU selection kfuncs") Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit 14a67b42cb6f3ab66f41603c062c5056d32ea7dd Author: Chen Ridong Date: Thu Jul 17 08:55:50 2025 +0000 Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" This reverts commit cff5f49d433fcd0063c8be7dd08fa5bf190c6c37. Commit cff5f49d433f ("cgroup_freezer: cgroup_freezing: Check if not frozen") modified the cgroup_freezing() logic to verify that the FROZEN flag is not set, affecting the return value of the freezing() function, in order to address a warning in __thaw_task. A race condition exists that may allow tasks to escape being frozen. The following scenario demonstrates this issue: CPU 0 (get_signal path) CPU 1 (freezer.state reader) try_to_freeze read freezer.state __refrigerator freezer_read update_if_frozen WRITE_ONCE(current->__state, TASK_FROZEN); ... /* Task is now marked frozen */ /* frozen(task) == true */ /* Assuming other tasks are frozen */ freezer->state |= CGROUP_FROZEN; /* freezing(current) returns false */ /* because cgroup is frozen (not freezing) */ break out __set_current_state(TASK_RUNNING); /* Bug: Task resumes running when it should remain frozen */ The existing !frozen(p) check in __thaw_task makes the WARN_ON_ONCE(freezing(p)) warning redundant. Removing this warning enables reverting the commit cff5f49d433f ("cgroup_freezer: cgroup_freezing: Check if not frozen") to resolve the issue. The warning has been removed in the previous patch. This patch revert the commit cff5f49d433f ("cgroup_freezer: cgroup_freezing: Check if not frozen") to complete the fix. Fixes: cff5f49d433f ("cgroup_freezer: cgroup_freezing: Check if not frozen") Reported-by: Zhong Jiawei Signed-off-by: Chen Ridong Signed-off-by: Tejun Heo commit 9beb8c5e77dc10e3889ff5f967eeffba78617a88 Author: Chen Ridong Date: Thu Jul 17 08:55:49 2025 +0000 sched,freezer: Remove unnecessary warning in __thaw_task Commit cff5f49d433f ("cgroup_freezer: cgroup_freezing: Check if not frozen") modified the cgroup_freezing() logic to verify that the FROZEN flag is not set, affecting the return value of the freezing() function, in order to address a warning in __thaw_task. A race condition exists that may allow tasks to escape being frozen. The following scenario demonstrates this issue: CPU 0 (get_signal path) CPU 1 (freezer.state reader) try_to_freeze read freezer.state __refrigerator freezer_read update_if_frozen WRITE_ONCE(current->__state, TASK_FROZEN); ... /* Task is now marked frozen */ /* frozen(task) == true */ /* Assuming other tasks are frozen */ freezer->state |= CGROUP_FROZEN; /* freezing(current) returns false */ /* because cgroup is frozen (not freezing) */ break out __set_current_state(TASK_RUNNING); /* Bug: Task resumes running when it should remain frozen */ The existing !frozen(p) check in __thaw_task makes the WARN_ON_ONCE(freezing(p)) warning redundant. Removing this warning enables reverting commit cff5f49d433f ("cgroup_freezer: cgroup_freezing: Check if not frozen") to resolve the issue. This patch removes the warning from __thaw_task. A subsequent patch will revert commit cff5f49d433f ("cgroup_freezer: cgroup_freezing: Check if not frozen") to complete the fix. Reported-by: Zhong Jiawei Signed-off-by: Chen Ridong Signed-off-by: Tejun Heo commit 6832a9317eee280117cd695fa885b2b7a7a38daf Merge: e6e82e5bedd7e9 a2bbaff6816a15 Author: Linus Torvalds Date: Thu Jul 17 10:04:04 2025 -0700 Merge tag 'net-6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from Bluetooth, CAN, WiFi and Netfilter. More code here than I would have liked. That said, better now than next week. Nothing particularly scary stands out. The improvement to the OpenVPN input validation is a bit large but better get them in before the code makes it to a final release. Some of the changes we got from sub-trees could have been split better between the fix and -next refactoring, IMHO, that has been communicated. We have one known regression in a TI AM65 board not getting link. The investigation is going a bit slow, a number of people are on vacation. We'll try to wrap it up, but don't think it should hold up the release. Current release - fix to a fix: - Bluetooth: L2CAP: fix attempting to adjust outgoing MTU, it broke some headphones and speakers Current release - regressions: - wifi: ath12k: fix packets received in WBM error ring with REO LUT enabled, fix Rx performance regression - wifi: iwlwifi: - fix crash due to a botched indexing conversion - mask reserved bits in chan_state_active_bitmap, avoid FW assert() Current release - new code bugs: - nf_conntrack: fix crash due to removal of uninitialised entry - eth: airoha: fix potential UaF in airoha_npu_get() Previous releases - regressions: - net: fix segmentation after TCP/UDP fraglist GRO - af_packet: fix the SO_SNDTIMEO constraint not taking effect and a potential soft lockup waiting for a completion - rpl: fix UaF in rpl_do_srh_inline() for sneaky skb geometry - virtio-net: fix recursive rtnl_lock() during probe() - eth: stmmac: populate entire system_counterval_t in get_time_fn() - eth: libwx: fix a number of crashes in the driver Rx path - hv_netvsc: prevent IPv6 addrconf after IFF_SLAVE lost that meaning Previous releases - always broken: - mptcp: fix races in handling connection fallback to pure TCP - rxrpc: assorted error handling and race fixes - sched: another batch of "security" fixes for qdiscs (QFQ, HTB) - tls: always refresh the queue when reading sock, avoid UaF - phy: don't register LEDs for genphy, avoid deadlock - Bluetooth: btintel: check if controller is ISO capable on btintel_classify_pkt_type(), work around FW returning incorrect capabilities Misc: - make OpenVPN Netlink input checking more strict before it makes it to a final release - wifi: cfg80211: remove scan request n_channels __counted_by, it's only yielding false positives" * tag 'net-6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (66 commits) rxrpc: Fix to use conn aborts for conn-wide failures rxrpc: Fix transmission of an abort in response to an abort rxrpc: Fix notification vs call-release vs recvmsg rxrpc: Fix recv-recv race of completed call rxrpc: Fix irq-disabled in local_bh_enable() selftests/tc-testing: Test htb_dequeue_tree with deactivation and row emptying net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree net: bridge: Do not offload IGMP/MLD messages selftests: Add test cases for vlan_filter modification during runtime net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime tls: always refresh the queue when reading sock virtio-net: fix recursived rtnl_lock() during probe() net/mlx5: Update the list of the PCI supported devices hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU netfilter: nf_conntrack: fix crash due to removal of uninitialised entry net: fix segmentation after TCP/UDP fraglist GRO ipv6: mcast: Delay put pmc->idev in mld_del_delrec() net: airoha: fix potential use-after-free in airoha_npu_get() ... commit e6e82e5bedd7e924b670cea041d63aba1e03d06e Merge: e2291551827fe5 ebd6884167eac9 Author: Linus Torvalds Date: Thu Jul 17 09:46:37 2025 -0700 Merge tag 'pm-6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These address three issues introduced during the current development cycle and related to system suspend and hibernation, one triggering when asynchronous suspend of devices fails, one possibly affecting memory management in the core suspend code error path, and one due to duplicate filesystems freezing during system suspend: - Fix a deadlock that may occur on asynchronous device suspend failures due to missing completion updates in error paths (Rafael Wysocki) - Drop a misplaced pm_restore_gfp_mask() call, which may cause swap to be accessed too early if system suspend fails, from suspend_devices_and_enter() (Rafael Wysocki) - Remove duplicate filesystems_freeze/thaw() calls, which sometimes cause systems to be unable to resume, from enter_state() (Zihuan Zhang)" * tag 'pm-6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM: sleep: Update power.completion for all devices on errors PM: suspend: clean up redundant filesystems_freeze/thaw() handling PM: suspend: Drop a misplaced pm_restore_gfp_mask() call commit 4b7d440de209cb2bb83827c30107ba05884a50c7 Merge: ed302854d0155e b8be70ec2b47ca Author: Paolo Bonzini Date: Thu Jul 17 17:06:13 2025 +0200 Merge tag 'kvm-x86-fixes-6.16-rc7' of https://github.com/kvm-x86/linux into HEAD KVM TDX fixes for 6.16 - Fix a formatting goof in the TDX documentation. - Reject KVM_SET_TSC_KHZ for guests with a protected TSC (currently only TDX). - Ensure struct kvm_tdx_capabilities fields that are not explicitly set by KVM are zeroed. commit a2bbaff6816a1531fd61b07739c3f2a500cd3693 Merge: 32247444dd8668 d24e4a7fedae12 Author: Jakub Kicinski Date: Thu Jul 17 07:54:48 2025 -0700 Merge tag 'for-net-2025-07-17' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - hci_sync: fix connectable extended advertising when using static random address - hci_core: fix typos in macros - hci_core: add missing braces when using macro parameters - hci_core: replace 'quirks' integer by 'quirk_flags' bitmap - SMP: If an unallowed command is received consider it a failure - SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout - L2CAP: Fix null-ptr-deref in l2cap_sock_resume_cb() - L2CAP: Fix attempting to adjust outgoing MTU - btintel: Check if controller is ISO capable on btintel_classify_pkt_type - btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID * tag 'for-net-2025-07-17' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID Bluetooth: hci_dev: replace 'quirks' integer by 'quirk_flags' bitmap Bluetooth: hci_core: add missing braces when using macro parameters Bluetooth: hci_core: fix typos in macros Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout Bluetooth: SMP: If an unallowed command is received consider it a failure Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type Bluetooth: hci_sync: fix connectable extended advertising when using static random address Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() ==================== Link: https://patch.msgid.link/20250717142849.537425-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit 32247444dd86681966c56e5c6dc9664c3786c706 Merge: 88b06e4fb4bf9e f0295678ad3041 Author: Jakub Kicinski Date: Thu Jul 17 07:50:51 2025 -0700 Merge branch 'rxrpc-miscellaneous-fixes' David Howells says: ==================== rxrpc: Miscellaneous fixes Here are some fixes for rxrpc: (1) Fix the calling of IP routing code with IRQs disabled. (2) Fix a recvmsg/recvmsg race when the first completes a call. (3) Fix a race between notification, recvmsg and sendmsg releasing a call. (4) Fix abort of abort. (5) Fix call-level aborts that should be connection-level aborts. ==================== Link: https://patch.msgid.link/20250717074350.3767366-1-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit f0295678ad304195927829b1dbf06553aa2187b0 Author: David Howells Date: Thu Jul 17 08:43:45 2025 +0100 rxrpc: Fix to use conn aborts for conn-wide failures Fix rxrpc to use connection-level aborts for things that affect the whole connection, such as the service ID not matching a local service. Fixes: 57af281e5389 ("rxrpc: Tidy up abort generation infrastructure") Reported-by: Jeffrey Altman Signed-off-by: David Howells Reviewed-by: Jeffrey Altman cc: Marc Dionne cc: Simon Horman cc: linux-afs@lists.infradead.org Link: https://patch.msgid.link/20250717074350.3767366-6-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit e9c0b96ec0a34fcacdf9365713578d83cecac34c Author: David Howells Date: Thu Jul 17 08:43:44 2025 +0100 rxrpc: Fix transmission of an abort in response to an abort Under some circumstances, such as when a server socket is closing, ABORT packets will be generated in response to incoming packets. Unfortunately, this also may include generating aborts in response to incoming aborts - which may cause a cycle. It appears this may be made possible by giving the client a multicast address. Fix this such that rxrpc_reject_packet() will refuse to generate aborts in response to aborts. Fixes: 248f219cb8bc ("rxrpc: Rewrite the data and ack handling code") Signed-off-by: David Howells Reviewed-by: Jeffrey Altman cc: Marc Dionne cc: Junvyyang, Tencent Zhuque Lab cc: LePremierHomme cc: Linus Torvalds cc: Simon Horman cc: linux-afs@lists.infradead.org Link: https://patch.msgid.link/20250717074350.3767366-5-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit 2fd895842d49c23137ae48252dd211e5d6d8a3ed Author: David Howells Date: Thu Jul 17 08:43:43 2025 +0100 rxrpc: Fix notification vs call-release vs recvmsg When a call is released, rxrpc takes the spinlock and removes it from ->recvmsg_q in an effort to prevent racing recvmsg() invocations from seeing the same call. Now, rxrpc_recvmsg() only takes the spinlock when actually removing a call from the queue; it doesn't, however, take it in the lead up to that when it checks to see if the queue is empty. It *does* hold the socket lock, which prevents a recvmsg/recvmsg race - but this doesn't prevent sendmsg from ending the call because sendmsg() drops the socket lock and relies on the call->user_mutex. Fix this by firstly removing the bit in rxrpc_release_call() that dequeues the released call and, instead, rely on recvmsg() to simply discard released calls (done in a preceding fix). Secondly, rxrpc_notify_socket() is abandoned if the call is already marked as released rather than trying to be clever by setting both pointers in call->recvmsg_link to NULL to trick list_empty(). This isn't perfect and can still race, resulting in a released call on the queue, but recvmsg() will now clean that up. Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both") Signed-off-by: David Howells Reviewed-by: Jeffrey Altman cc: Marc Dionne cc: Junvyyang, Tencent Zhuque Lab cc: LePremierHomme cc: Simon Horman cc: linux-afs@lists.infradead.org Link: https://patch.msgid.link/20250717074350.3767366-4-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit 962fb1f651c2cf2083e0c3ef53ba69e3b96d3fbc Author: David Howells Date: Thu Jul 17 08:43:42 2025 +0100 rxrpc: Fix recv-recv race of completed call If a call receives an event (such as incoming data), the call gets placed on the socket's queue and a thread in recvmsg can be awakened to go and process it. Once the thread has picked up the call off of the queue, further events will cause it to be requeued, and once the socket lock is dropped (recvmsg uses call->user_mutex to allow the socket to be used in parallel), a second thread can come in and its recvmsg can pop the call off the socket queue again. In such a case, the first thread will be receiving stuff from the call and the second thread will be blocked on call->user_mutex. The first thread can, at this point, process both the event that it picked call for and the event that the second thread picked the call for and may see the call terminate - in which case the call will be "released", decoupling the call from the user call ID assigned to it (RXRPC_USER_CALL_ID in the control message). The first thread will return okay, but then the second thread will wake up holding the user_mutex and, if it sees that the call has been released by the first thread, it will BUG thusly: kernel BUG at net/rxrpc/recvmsg.c:474! Fix this by just dequeuing the call and ignoring it if it is seen to be already released. We can't tell userspace about it anyway as the user call ID has become stale. Fixes: 248f219cb8bc ("rxrpc: Rewrite the data and ack handling code") Reported-by: Junvyyang, Tencent Zhuque Lab Signed-off-by: David Howells Reviewed-by: Jeffrey Altman cc: LePremierHomme cc: Marc Dionne cc: Simon Horman cc: linux-afs@lists.infradead.org Link: https://patch.msgid.link/20250717074350.3767366-3-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit e4d2878369d590bf8455e3678a644e503172eafa Author: David Howells Date: Thu Jul 17 08:43:41 2025 +0100 rxrpc: Fix irq-disabled in local_bh_enable() The rxrpc_assess_MTU_size() function calls down into the IP layer to find out the MTU size for a route. When accepting an incoming call, this is called from rxrpc_new_incoming_call() which holds interrupts disabled across the code that calls down to it. Unfortunately, the IP layer uses local_bh_enable() which, config dependent, throws a warning if IRQs are enabled: WARNING: CPU: 1 PID: 5544 at kernel/softirq.c:387 __local_bh_enable_ip+0x43/0xd0 ... RIP: 0010:__local_bh_enable_ip+0x43/0xd0 ... Call Trace: rt_cache_route+0x7e/0xa0 rt_set_nexthop.isra.0+0x3b3/0x3f0 __mkroute_output+0x43a/0x460 ip_route_output_key_hash+0xf7/0x140 ip_route_output_flow+0x1b/0x90 rxrpc_assess_MTU_size.isra.0+0x2a0/0x590 rxrpc_new_incoming_peer+0x46/0x120 rxrpc_alloc_incoming_call+0x1b1/0x400 rxrpc_new_incoming_call+0x1da/0x5e0 rxrpc_input_packet+0x827/0x900 rxrpc_io_thread+0x403/0xb60 kthread+0x2f7/0x310 ret_from_fork+0x2a/0x230 ret_from_fork_asm+0x1a/0x30 ... hardirqs last enabled at (23): _raw_spin_unlock_irq+0x24/0x50 hardirqs last disabled at (24): _raw_read_lock_irq+0x17/0x70 softirqs last enabled at (0): copy_process+0xc61/0x2730 softirqs last disabled at (25): rt_add_uncached_list+0x3c/0x90 Fix this by moving the call to rxrpc_assess_MTU_size() out of rxrpc_init_peer() and further up the stack where it can be done without interrupts disabled. It shouldn't be a problem for rxrpc_new_incoming_call() to do it after the locks are dropped as pmtud is going to be performed by the I/O thread - and we're in the I/O thread at this point. Fixes: a2ea9a907260 ("rxrpc: Use irq-disabling spinlocks between app and I/O thread") Signed-off-by: David Howells Reviewed-by: Jeffrey Altman cc: Marc Dionne cc: Junvyyang, Tencent Zhuque Lab cc: LePremierHomme cc: Simon Horman cc: linux-afs@lists.infradead.org Link: https://patch.msgid.link/20250717074350.3767366-2-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit 88b06e4fb4bf9ee36f788cb6f5a65d188341d0e2 Author: William Liu Date: Thu Jul 17 02:29:47 2025 +0000 selftests/tc-testing: Test htb_dequeue_tree with deactivation and row emptying Ensure that any deactivation and row emptying that occurs during htb_dequeue_tree does not cause a kernel panic. This scenario originally triggered a kernel BUG_ON, and we are checking for a graceful fail now. Signed-off-by: William Liu Signed-off-by: Savino Dicanosa Link: https://patch.msgid.link/20250717022912.221426-1-will@willsroot.io Signed-off-by: Jakub Kicinski commit 0e1d5d9b5c5966e2e42e298670808590db5ed628 Author: William Liu Date: Thu Jul 17 02:28:38 2025 +0000 net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree htb_lookup_leaf has a BUG_ON that can trigger with the following: tc qdisc del dev lo root tc qdisc add dev lo root handle 1: htb default 1 tc class add dev lo parent 1: classid 1:1 htb rate 64bit tc qdisc add dev lo parent 1:1 handle 2: netem tc qdisc add dev lo parent 2:1 handle 3: blackhole ping -I lo -c1 -W0.001 127.0.0.1 The root cause is the following: 1. htb_dequeue calls htb_dequeue_tree which calls the dequeue handler on the selected leaf qdisc 2. netem_dequeue calls enqueue on the child qdisc 3. blackhole_enqueue drops the packet and returns a value that is not just NET_XMIT_SUCCESS 4. Because of this, netem_dequeue calls qdisc_tree_reduce_backlog, and since qlen is now 0, it calls htb_qlen_notify -> htb_deactivate -> htb_deactiviate_prios -> htb_remove_class_from_row -> htb_safe_rb_erase 5. As this is the only class in the selected hprio rbtree, __rb_change_child in __rb_erase_augmented sets the rb_root pointer to NULL 6. Because blackhole_dequeue returns NULL, netem_dequeue returns NULL, which causes htb_dequeue_tree to call htb_lookup_leaf with the same hprio rbtree, and fail the BUG_ON The function graph for this scenario is shown here: 0) | htb_enqueue() { 0) + 13.635 us | netem_enqueue(); 0) 4.719 us | htb_activate_prios(); 0) # 2249.199 us | } 0) | htb_dequeue() { 0) 2.355 us | htb_lookup_leaf(); 0) | netem_dequeue() { 0) + 11.061 us | blackhole_enqueue(); 0) | qdisc_tree_reduce_backlog() { 0) | qdisc_lookup_rcu() { 0) 1.873 us | qdisc_match_from_root(); 0) 6.292 us | } 0) 1.894 us | htb_search(); 0) | htb_qlen_notify() { 0) 2.655 us | htb_deactivate_prios(); 0) 6.933 us | } 0) + 25.227 us | } 0) 1.983 us | blackhole_dequeue(); 0) + 86.553 us | } 0) # 2932.761 us | qdisc_warn_nonwc(); 0) | htb_lookup_leaf() { 0) | BUG_ON(); ------------------------------------------ The full original bug report can be seen here [1]. We can fix this just by returning NULL instead of the BUG_ON, as htb_dequeue_tree returns NULL when htb_lookup_leaf returns NULL. [1] https://lore.kernel.org/netdev/pF5XOOIim0IuEfhI-SOxTgRvNoDwuux7UHKnE_Y5-zVd4wmGvNk2ceHjKb8ORnzw0cGwfmVu42g9dL7XyJLf1NEzaztboTWcm0Ogxuojoeo=@willsroot.io/ Fixes: 512bb43eb542 ("pkt_sched: sch_htb: Optimize WARN_ONs in htb_dequeue_tree() etc.") Signed-off-by: William Liu Signed-off-by: Savino Dicanosa Link: https://patch.msgid.link/20250717022816.221364-1-will@willsroot.io Signed-off-by: Jakub Kicinski commit 683dc24da8bf199bb7446e445ad7f801c79a550e Author: Joseph Huang Date: Wed Jul 16 11:35:50 2025 -0400 net: bridge: Do not offload IGMP/MLD messages Do not offload IGMP/MLD messages as it could lead to IGMP/MLD Reports being unintentionally flooded to Hosts. Instead, let the bridge decide where to send these IGMP/MLD messages. Consider the case where the local host is sending out reports in response to a remote querier like the following: mcast-listener-process (IP_ADD_MEMBERSHIP) \ br0 / \ swp1 swp2 | | QUERIER SOME-OTHER-HOST In the above setup, br0 will want to br_forward() reports for mcast-listener-process's group(s) via swp1 to QUERIER; but since the source hwdom is 0, the report is eligible for tx offloading, and is flooded by hardware to both swp1 and swp2, reaching SOME-OTHER-HOST as well. (Example and illustration provided by Tobias.) Fixes: 472111920f1c ("net: bridge: switchdev: allow the TX data plane forwarding to be offloaded") Signed-off-by: Joseph Huang Acked-by: Nikolay Aleksandrov Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20250716153551.1830255-1-Joseph.Huang@garmin.com Signed-off-by: Jakub Kicinski commit 9bb8a9f6ea964e25b2a2a6e464bad85ea591b230 Merge: afb5bef57f90ed e0f3b3e5c77a5f Author: Jakub Kicinski Date: Thu Jul 17 07:44:30 2025 -0700 Merge branch 'net-vlan-fix-vlan-0-refcount-imbalance-of-toggling-filtering-during-runtime' Dong Chenchen says: ==================== net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime Fix VLAN 0 refcount imbalance of toggling filtering during runtime. ==================== Link: https://patch.msgid.link/20250716034504.2285203-1-dongchenchen2@huawei.com Signed-off-by: Jakub Kicinski commit e0f3b3e5c77a5f9dd7224612a6d74e0888cb055f Author: Dong Chenchen Date: Wed Jul 16 11:45:04 2025 +0800 selftests: Add test cases for vlan_filter modification during runtime Add test cases for vlan_filter modification during runtime, which may triger null-ptr-ref or memory leak of vlan0. Signed-off-by: Dong Chenchen Link: https://patch.msgid.link/20250716034504.2285203-3-dongchenchen2@huawei.com Signed-off-by: Jakub Kicinski commit 579d4f9ca9a9a605184a9b162355f6ba131f678d Author: Dong Chenchen Date: Wed Jul 16 11:45:03 2025 +0800 net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime Assuming the "rx-vlan-filter" feature is enabled on a net device, the 8021q module will automatically add or remove VLAN 0 when the net device is put administratively up or down, respectively. There are a couple of problems with the above scheme. The first problem is a memory leak that can happen if the "rx-vlan-filter" feature is disabled while the device is running: # ip link add bond1 up type bond mode 0 # ethtool -K bond1 rx-vlan-filter off # ip link del dev bond1 When the device is put administratively down the "rx-vlan-filter" feature is disabled, so the 8021q module will not remove VLAN 0 and the memory will be leaked [1]. Another problem that can happen is that the kernel can automatically delete VLAN 0 when the device is put administratively down despite not adding it when the device was put administratively up since during that time the "rx-vlan-filter" feature was disabled. null-ptr-unref or bug_on[2] will be triggered by unregister_vlan_dev() for refcount imbalance if toggling filtering during runtime: $ ip link add bond0 type bond mode 0 $ ip link add link bond0 name vlan0 type vlan id 0 protocol 802.1q $ ethtool -K bond0 rx-vlan-filter off $ ifconfig bond0 up $ ethtool -K bond0 rx-vlan-filter on $ ifconfig bond0 down $ ip link del vlan0 Root cause is as below: step1: add vlan0 for real_dev, such as bond, team. register_vlan_dev vlan_vid_add(real_dev,htons(ETH_P_8021Q),0) //refcnt=1 step2: disable vlan filter feature and enable real_dev step3: change filter from 0 to 1 vlan_device_event vlan_filter_push_vids ndo_vlan_rx_add_vid //No refcnt added to real_dev vlan0 step4: real_dev down vlan_device_event vlan_vid_del(dev, htons(ETH_P_8021Q), 0); //refcnt=0 vlan_info_rcu_free //free vlan0 step5: delete vlan0 unregister_vlan_dev BUG_ON(!vlan_info); //vlan_info is null Fix both problems by noting in the VLAN info whether VLAN 0 was automatically added upon NETDEV_UP and based on that decide whether it should be deleted upon NETDEV_DOWN, regardless of the state of the "rx-vlan-filter" feature. [1] unreferenced object 0xffff8880068e3100 (size 256): comm "ip", pid 384, jiffies 4296130254 hex dump (first 32 bytes): 00 20 30 0d 80 88 ff ff 00 00 00 00 00 00 00 00 . 0............. 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 81ce31fa): __kmalloc_cache_noprof+0x2b5/0x340 vlan_vid_add+0x434/0x940 vlan_device_event.cold+0x75/0xa8 notifier_call_chain+0xca/0x150 __dev_notify_flags+0xe3/0x250 rtnl_configure_link+0x193/0x260 rtnl_newlink_create+0x383/0x8e0 __rtnl_newlink+0x22c/0xa40 rtnl_newlink+0x627/0xb00 rtnetlink_rcv_msg+0x6fb/0xb70 netlink_rcv_skb+0x11f/0x350 netlink_unicast+0x426/0x710 netlink_sendmsg+0x75a/0xc20 __sock_sendmsg+0xc1/0x150 ____sys_sendmsg+0x5aa/0x7b0 ___sys_sendmsg+0xfc/0x180 [2] kernel BUG at net/8021q/vlan.c:99! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 382 Comm: ip Not tainted 6.16.0-rc3 #61 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:unregister_vlan_dev (net/8021q/vlan.c:99 (discriminator 1)) RSP: 0018:ffff88810badf310 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88810da84000 RCX: ffffffffb47ceb9a RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff88810e8b43c8 RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff6cefe80 R10: ffffffffb677f407 R11: ffff88810badf3c0 R12: ffff88810e8b4000 R13: 0000000000000000 R14: ffff88810642a5c0 R15: 000000000000017e FS: 00007f1ff68c20c0(0000) GS:ffff888163a24000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f1ff5dad240 CR3: 0000000107e56000 CR4: 00000000000006f0 Call Trace: rtnl_dellink (net/core/rtnetlink.c:3511 net/core/rtnetlink.c:3553) rtnetlink_rcv_msg (net/core/rtnetlink.c:6945) netlink_rcv_skb (net/netlink/af_netlink.c:2535) netlink_unicast (net/netlink/af_netlink.c:1314 net/netlink/af_netlink.c:1339) netlink_sendmsg (net/netlink/af_netlink.c:1883) ____sys_sendmsg (net/socket.c:712 net/socket.c:727 net/socket.c:2566) ___sys_sendmsg (net/socket.c:2622) __sys_sendmsg (net/socket.c:2652) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) Fixes: ad1afb003939 ("vlan_dev: VLAN 0 should be treated as "no vlan tag" (802.1p packet)") Reported-by: syzbot+a8b046e462915c65b10b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a8b046e462915c65b10b Suggested-by: Ido Schimmel Signed-off-by: Dong Chenchen Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20250716034504.2285203-2-dongchenchen2@huawei.com Signed-off-by: Jakub Kicinski commit afb5bef57f90edaa6e8b10fd27236443218f8b5d Merge: 4ab26bce3969f8 2022d704014d7a Author: Jakub Kicinski Date: Thu Jul 17 07:41:25 2025 -0700 Merge tag 'ovpn-net-20250716' of https://github.com/OpenVPN/ovpn-net-next Antonio Quartulli says: ==================== This bugfix batch includes the following changes: * properly propagate sk mark to skb->mark field * reject unexpected incoming netlink attributes * reset GSO state when moving skb from transport to tunnel layer * tag 'ovpn-net-20250716' of https://github.com/OpenVPN/ovpn-net-next: ovpn: reset GSO metadata after decapsulation ovpn: reject unexpected netlink attributes ovpn: propagate socket mark to skb in UDP ==================== Link: https://patch.msgid.link/20250716115443.16763-1-antonio@openvpn.net Signed-off-by: Jakub Kicinski commit 4ab26bce3969f8fd925fe6f6f551e4d1a508c68b Author: Jakub Kicinski Date: Wed Jul 16 07:38:50 2025 -0700 tls: always refresh the queue when reading sock After recent changes in net-next TCP compacts skbs much more aggressively. This unearthed a bug in TLS where we may try to operate on an old skb when checking if all skbs in the queue have matching decrypt state and geometry. BUG: KASAN: slab-use-after-free in tls_strp_check_rcv+0x898/0x9a0 [tls] (net/tls/tls_strp.c:436 net/tls/tls_strp.c:530 net/tls/tls_strp.c:544) Read of size 4 at addr ffff888013085750 by task tls/13529 CPU: 2 UID: 0 PID: 13529 Comm: tls Not tainted 6.16.0-rc5-virtme Call Trace: kasan_report+0xca/0x100 tls_strp_check_rcv+0x898/0x9a0 [tls] tls_rx_rec_wait+0x2c9/0x8d0 [tls] tls_sw_recvmsg+0x40f/0x1aa0 [tls] inet_recvmsg+0x1c3/0x1f0 Always reload the queue, fast path is to have the record in the queue when we wake, anyway (IOW the path going down "if !strp->stm.full_len"). Fixes: 0d87bbd39d7f ("tls: strp: make sure the TCP skbs do not have overlapping data") Link: https://patch.msgid.link/20250716143850.1520292-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit be5dcaed694e4255dc02dd0acfe036708c535def Author: Zigit Zo Date: Wed Jul 16 19:57:17 2025 +0800 virtio-net: fix recursived rtnl_lock() during probe() The deadlock appears in a stack trace like: virtnet_probe() rtnl_lock() virtio_config_changed_work() netdev_notify_peers() rtnl_lock() It happens if the VMM sends a VIRTIO_NET_S_ANNOUNCE request while the virtio-net driver is still probing. The config_work in probe() will get scheduled until virtnet_open() enables the config change notification via virtio_config_driver_enable(). Fixes: df28de7b0050 ("virtio-net: synchronize operstate with admin state on up/down") Signed-off-by: Zigit Zo Acked-by: Michael S. Tsirkin Acked-by: Jason Wang Link: https://patch.msgid.link/20250716115717.1472430-1-zuozhijie@bytedance.com Signed-off-by: Jakub Kicinski commit ad4f6df4f384905bc85f9fbfc1c0c198fb563286 Author: Maor Gottlieb Date: Wed Jul 16 10:29:29 2025 +0300 net/mlx5: Update the list of the PCI supported devices Add the upcoming ConnectX-10 device ID to the table of supported PCI device IDs. Cc: stable@vger.kernel.org Signed-off-by: Maor Gottlieb Reviewed-by: Mark Bloch Reviewed-by: Eran Ben Elisha Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1752650969-148501-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit d7501e076d859d2f381d57bd984ff6db13172727 Author: Li Tian Date: Wed Jul 16 08:26:05 2025 +0800 hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf Set an additional flag IFF_NO_ADDRCONF to prevent ipv6 addrconf. Commit under Fixes added a new flag change that was not made to hv_netvsc resulting in the VF being assinged an IPv6. Fixes: 8a321cf7becc ("net: add IFF_NO_ADDRCONF and use it in bonding to prevent ipv6 addrconf") Suggested-by: Cathy Avery Signed-off-by: Li Tian Reviewed-by: Xin Long Link: https://patch.msgid.link/20250716002607.4927-1-litian@redhat.com Signed-off-by: Jakub Kicinski commit 17ba793f381eb813596d6de1cc6820bcbda5ed8b Author: Nathan Chancellor Date: Tue Jul 15 16:15:40 2025 -0700 phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() A new warning in clang [1] points out a place in pep_sock_accept() where dst is uninitialized then passed as a const pointer to pep_find_pipe(): net/phonet/pep.c:829:37: error: variable 'dst' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer] 829 | newsk = pep_find_pipe(&pn->hlist, &dst, pipe_handle); | ^~~: Move the call to pn_skb_get_dst_sockaddr(), which initializes dst, to before the call to pep_find_pipe(), so that dst is consistently used initialized throughout the function. Cc: stable@vger.kernel.org Fixes: f7ae8d59f661 ("Phonet: allocate sock from accept syscall rather than soft IRQ") Link: https://github.com/llvm/llvm-project/commit/00dacf8c22f065cb52efb14cd091d441f19b319e [1] Closes: https://github.com/ClangBuiltLinux/linux/issues/2101 Signed-off-by: Nathan Chancellor Link: https://patch.msgid.link/20250715-net-phonet-fix-uninit-const-pointer-v1-1-8efd1bd188b3@kernel.org Signed-off-by: Jakub Kicinski commit d24e4a7fedae121d33fb32ad785b87046527eedb Author: Luiz Augusto von Dentz Date: Wed Jul 16 09:40:49 2025 -0400 Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU Configuration request only configure the incoming direction of the peer initiating the request, so using the MTU is the other direction shall not be used, that said the spec allows the peer responding to adjust: Bluetooth Core 6.1, Vol 3, Part A, Section 4.5 'Each configuration parameter value (if any is present) in an L2CAP_CONFIGURATION_RSP packet reflects an ‘adjustment’ to a configuration parameter value that has been sent (or, in case of default values, implied) in the corresponding L2CAP_CONFIGURATION_REQ packet.' That said adjusting the MTU in the response shall be limited to ERTM channels only as for older modes the remote stack may not be able to detect the adjustment causing it to silently drop packets. Link: https://github.com/bluez/bluez/issues/1422 Link: https://gitlab.archlinux.org/archlinux/packaging/packages/linux/-/issues/149 Link: https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/4793 Fixes: 042bb9603c44 ("Bluetooth: L2CAP: Fix L2CAP MTU negotiation") Signed-off-by: Luiz Augusto von Dentz commit ed302854d0155e24a3620b92e7e9f591d510c252 Author: Xiaoyao Li Date: Thu Jul 17 10:20:09 2025 +0800 KVM: TDX: Don't report base TDVMCALLs Remove TDVMCALLINFO_GET_QUOTE from user_tdvmcallinfo_1_r11 reported to userspace to align with the direction of the GHCI spec. Recently, concern was raised about a gap in the GHCI spec that left ambiguity in how to expose to the guest that only a subset of GHCI TDVMCalls were supported. During the back and forth on the spec details[0], was moved from an individually enumerable TDVMCall, to one that is part of the 'base spec', meaning it doesn't have a specific bit in the return values. Although the spec[1] is still in draft form, the GetQoute part has been agreed by the major TDX VMMs. Unfortunately the commits that were upstreamed still treat as individually enumerable. They set bit 0 in the user_tdvmcallinfo_1_r11 which is reported to userspace to tell supported optional TDVMCalls, intending to say that is supported. So stop reporting in user_tdvmcallinfo_1_r11 to align with the direction of the spec, and allow some future TDVMCall to use that bit. [0] https://lore.kernel.org/all/aEmuKII8FGU4eQZz@google.com/ [1] https://cdrdv2.intel.com/v1/dl/getContent/858626 Fixes: 28224ef02b56 ("KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities") Signed-off-by: Xiaoyao Li Message-ID: <20250717022010.677645-1-xiaoyao.li@intel.com> Signed-off-by: Paolo Bonzini commit 348954f9b78e1515777708b6764c88f225457c40 Merge: e201c19ddeed6b 7bab1bd9fdf15b Author: Takashi Iwai Date: Thu Jul 17 14:53:38 2025 +0200 Merge tag 'asoc-fix-v6.16-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.16 A relatively large set of changes, but most of them are quirk information for various x86 systems. There is one more substantial fix for a NULL pointer dereference when removing the AVS driver, plus one for Kconfig dependencies. commit e49f95dc8cdce2a686bd13861da152e7d2c19ccb Merge: 69b1b21ab90cf8 bbc19fef578970 Author: Paolo Abeni Date: Thu Jul 17 14:52:41 2025 +0200 Merge tag 'wireless-2025-07-17' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Couple of fixes: - ath12k performance regression from -rc1 - cfg80211 counted_by() removal for scan request as it doesn't match usage and keeps complaining - iwlwifi crash with certain older devices - iwlwifi missing an error path unlock - iwlwifi compatibility with certain BIOS updates * tag 'wireless-2025-07-17' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: iwlwifi: Fix botched indexing conversion wifi: cfg80211: remove scan request n_channels counted_by wifi: ath12k: Fix packets received in WBM error ring with REO LUT enabled wifi: iwlwifi: mask reserved bits in chan_state_active_bitmap wifi: iwlwifi: pcie: fix locking on invalid TOP reset ==================== Link: https://patch.msgid.link/20250717091831.18787-5-johannes@sipsolutions.net Signed-off-by: Paolo Abeni commit 5c244eeca57ff4e47e1f60310d059346d1b86b9b Author: Michal Wajdeczko Date: Fri Jul 11 21:33:12 2025 +0200 drm/xe/pf: Resend PF provisioning after GT reset If we reload the GuC due to suspend/resume or GT reset then we have to resend not only any VFs provisioning data, but also PF configuration, like scheduling parameters (EQ, PT), as otherwise GuC will continue to use default values. Fixes: 411220808cee ("drm/xe/pf: Restart VFs provisioning after GT reset") Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Link: https://lore.kernel.org/r/20250711193316.1920-3-michal.wajdeczko@intel.com (cherry picked from commit 1c38dd6afa4a8ecce28e94da794fd1d205c30f51) Signed-off-by: Lucas De Marchi commit 81dccec448d204e448ae83e1fe60e8aaeaadadb8 Author: Michal Wajdeczko Date: Fri Jul 11 21:33:11 2025 +0200 drm/xe/pf: Prepare to stop SR-IOV support prior GT reset As part of the resume or GT reset, the PF driver schedules work which is then used to complete restarting of the SR-IOV support, including resending to the GuC configurations of provisioned VFs. However, in case of short delay between those two actions, which could be seen by triggering a GT reset on the suspened device: $ echo 1 > /sys/kernel/debug/dri/0000:00:02.0/gt0/force_reset this PF worker might be still busy, which lead to errors due to just stopped or disabled GuC CTB communication: [ ] xe 0000:00:02.0: [drm:xe_gt_resume [xe]] GT0: resumed [ ] xe 0000:00:02.0: [drm] GT0: trying reset from force_reset_show [xe] [ ] xe 0000:00:02.0: [drm] GT0: reset queued [ ] xe 0000:00:02.0: [drm] GT0: reset started [ ] xe 0000:00:02.0: [drm:guc_ct_change_state [xe]] GT0: GuC CT communication channel stopped [ ] xe 0000:00:02.0: [drm:guc_ct_send_recv [xe]] GT0: H2G request 0x5503 canceled! [ ] xe 0000:00:02.0: [drm] GT0: PF: Failed to push VF1 12 config KLVs (-ECANCELED) [ ] xe 0000:00:02.0: [drm] GT0: PF: Failed to push VF1 configuration (-ECANCELED) [ ] xe 0000:00:02.0: [drm:guc_ct_change_state [xe]] GT0: GuC CT communication channel disabled [ ] xe 0000:00:02.0: [drm] GT0: PF: Failed to push VF2 12 config KLVs (-ENODEV) [ ] xe 0000:00:02.0: [drm] GT0: PF: Failed to push VF2 configuration (-ENODEV) [ ] xe 0000:00:02.0: [drm] GT0: PF: Failed to push 2 of 2 VFs configurations [ ] xe 0000:00:02.0: [drm:pf_worker_restart_func [xe]] GT0: PF: restart completed While this VFs reprovisioning will be successful during next spin of the worker, to avoid those errors, make sure to cancel restart worker if we are about to trigger next reset. Fixes: 411220808cee ("drm/xe/pf: Restart VFs provisioning after GT reset") Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Link: https://lore.kernel.org/r/20250711193316.1920-2-michal.wajdeczko@intel.com (cherry picked from commit 9f50b729dd61dfb9f4d7c66900d22a7c7353a8c0) Signed-off-by: Lucas De Marchi commit 057a7d66f98eda9257e46fe44ee5750e0a6eec66 Author: Lucas De Marchi Date: Thu Jul 10 14:34:41 2025 -0700 drm/xe/migrate: Fix alignment check The check would fail if the address is unaligned, but not when accounting the offset. Instead of `buf | offset` it should have been `buf + offset`. To make it more readable and also drop the uintptr_t, just use the IS_ALIGNED() macro. Fixes: 270172f64b11 ("drm/xe: Update xe_ttm_access_memory to use GPU for non-visible access") Reviewed-by: Matthew Brost Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/20250710-migrate-aligned-v1-1-44003ef3c078@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 81e139db6900503a2e68009764054fad128fbf95) Signed-off-by: Lucas De Marchi commit 3155ac89251dcb5e35a3ec2f60a74a6ed22c56fd Author: Matthew Brost Date: Thu Jul 10 12:12:08 2025 -0700 drm/xe: Move page fault init after topology init We need the topology to determine GT page fault queue size, move page fault init after topology init. Cc: stable@vger.kernel.org Fixes: 3338e4f90c14 ("drm/xe: Use topology to determine page fault queue size") Signed-off-by: Matthew Brost Reviewed-by: Jonathan Cavitt Reviewed-by: Stuart Summers Link: https://lore.kernel.org/r/20250710191208.1040215-1-matthew.brost@intel.com (cherry picked from commit beb72acb5b38dbe670d8eb752d1ad7a32f9c4119) Signed-off-by: Lucas De Marchi commit 2a58b21adee3df10ca6f4491af965c4890d2d8e3 Author: Balasubramani Vivekanandan Date: Tue May 20 19:54:45 2025 +0530 drm/xe/mocs: Initialize MOCS index early MOCS uc_index is used even before it is initialized in the following callstack guc_prepare_xfer() __xe_guc_upload() xe_guc_min_load_for_hwconfig() xe_uc_init_hwconfig() xe_gt_init_hwconfig() Do MOCS index initialization earlier in the device probe. Signed-off-by: Balasubramani Vivekanandan Reviewed-by: Ravi Kumar Vodapalli Link: https://lore.kernel.org/r/20250520142445.2792824-1-balasubramani.vivekanandan@intel.com Signed-off-by: Matt Roper (cherry picked from commit 241cc827c0987d7173714fc5a95a7c8fc9bf15c0) Signed-off-by: Lucas De Marchi commit 69b1b21ab90cf8e4ac4f8bb448f1496e71559b94 Merge: 9f735b6f8a77d7 2d72afb340657f Author: Paolo Abeni Date: Thu Jul 17 14:44:54 2025 +0200 Merge tag 'nf-25-07-17' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following batch contains Netfilter fixes for net: 1) Three patches to enhance conntrack selftests for resize and clash resolution, from Florian Westphal. 2) Expand nft_concat_range.sh selftest to improve coverage from error path, from Florian Westphal. 3) Hide clash bit to userspace from netlink dumps until there is a good reason to expose, from Florian Westphal. 4) Revert notification for device registration/unregistration for nftables basechains and flowtables, we decided to go for a better way to handle this through the nfnetlink_hook infrastructure which will come via nf-next, patch from Phil Sutter. 5) Fix crash in conntrack due to race related to SLAB_TYPESAFE_BY_RCU that results in removing a recycled object that is not yet in the hashes. Move IPS_CONFIRM setting after the object is in the hashes. From Florian Westphal. netfilter pull request 25-07-17 * tag 'nf-25-07-17' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry Revert "netfilter: nf_tables: Add notifications for hook changes" netfilter: nf_tables: hide clash bit from userspace selftests: netfilter: nft_concat_range.sh: send packets to empty set selftests: netfilter: conntrack_resize.sh: also use udpclash tool selftests: netfilter: add conntrack clash resolution test case selftests: netfilter: conntrack_resize.sh: extend resize test ==================== Link: https://patch.msgid.link/20250717095808.41725-1-pablo@netfilter.org Signed-off-by: Paolo Abeni commit 1381c231c1267480f721b06528c3a230f43f2ac5 Author: Matthew Auld Date: Thu Jul 10 14:41:29 2025 +0100 drm/xe/migrate: fix copy direction in access_memory After we do the modification on the host side, ensure we write the result back to VRAM and not the other way around, otherwise the modification will be lost if treated like a read. Fixes: 270172f64b11 ("drm/xe: Update xe_ttm_access_memory to use GPU for non-visible access") Signed-off-by: Matthew Auld Cc: Matthew Brost Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250710134128.800756-2-matthew.auld@intel.com (cherry picked from commit c12fe703cab93f9d8bfe0ff32b58e7b1fd52be1f) Signed-off-by: Lucas De Marchi commit fd25fa90edcfd4db5bf69c11621021a7cfd11d53 Author: Tejas Upadhyay Date: Thu Jul 10 10:29:45 2025 +0530 drm/xe: Dont skip TLB invalidations on VF Skipping TLB invalidations on VF causing unrecoverable faults. Probable reason for skipping TLB invalidations on SRIOV could be lack of support for instruction MI_FLUSH_DW_STORE_INDEX. Add back TLB flush with some additional handling. Helps in resolving, [ 704.913454] xe 0000:00:02.1: [drm:pf_queue_work_func [xe]] ASID: 0 VFID: 0 PDATA: 0x0d92 Faulted Address: 0x0000000002fa0000 FaultType: 0 AccessType: 1 FaultLevel: 0 EngineClass: 3 bcs EngineInstance: 8 [ 704.913551] xe 0000:00:02.1: [drm:pf_queue_work_func [xe]] Fault response: Unsuccessful -22 V2: - Use Xmas tree (MichalW) Suggested-by: Matthew Brost Fixes: 97515d0b3ed92 ("drm/xe/vf: Don't emit access to Global HWSP if VF") Reviewed-by: Matthew Brost Link: https://patchwork.freedesktop.org/patch/msgid/20250710045945.1023840-1-tejas.upadhyay@intel.com Signed-off-by: Tejas Upadhyay (cherry picked from commit b528e896fa570844d654b5a4617a97fa770a1030) Signed-off-by: Lucas De Marchi commit 2680efde75ccdd745da7ae6f5e30026f70439588 Merge: c4706c5058a7bd 0523c6cc87e558 Author: Jens Axboe Date: Thu Jul 17 05:56:12 2025 -0600 Merge tag 'nvme-6.16-2025-07-17' of git://git.infradead.org/nvme into block-6.16 Pull NVMe fixes from Christoph: "- revert the cross-controller atomic write size validation that caused regressions (Christoph Hellwig) - fix endianness of command word prints in nvme_log_err_passthru() (John Garry) - fix callback lock for TLS handshake (Maurizio Lombardi) - fix misaccounting of nvme-mpath inflight I/O (Yu Kuai) - fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)" * tag 'nvme-6.16-2025-07-17' of git://git.infradead.org/nvme: nvmet-tcp: fix callback lock for TLS handshake nvme: fix misaccounting of nvme-mpath inflight I/O nvme: revert the cross-controller atomic write size validation nvme: fix endianness of command word prints in nvme_log_err_passthru() nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() commit 1918e79be908b8a2c8757640289bc196c14d928a Author: Thomas Zimmermann Date: Tue Jul 15 17:58:17 2025 +0200 Revert "drm/gem-dma: Use dma_buf from GEM object instance" This reverts commit e8afa1557f4f963c9a511bd2c6074a941c308685. The dma_buf field in struct drm_gem_object is not stable over the object instance's lifetime. The field becomes NULL when user space releases the final GEM handle on the buffer object. This resulted in a NULL-pointer deref. Workarounds in commit 5307dce878d4 ("drm/gem: Acquire references on GEM handles for framebuffers") and commit f6bfc9afc751 ("drm/framebuffer: Acquire internal references on GEM handles") only solved the problem partially. They especially don't work for buffer objects without a DRM framebuffer associated. Hence, this revert to going back to using .import_attach->dmabuf. v3: - cc stable Signed-off-by: Thomas Zimmermann Reviewed-by: Simona Vetter Acked-by: Christian König Acked-by: Zack Rusin Cc: # v6.15+ Link: https://lore.kernel.org/r/20250715155934.150656-8-tzimmermann@suse.de commit 6d496e9569983a0d7a05be6661126d0702cf94f7 Author: Thomas Zimmermann Date: Tue Jul 15 17:58:16 2025 +0200 Revert "drm/gem-shmem: Use dma_buf from GEM object instance" This reverts commit 1a148af06000e545e714fe3210af3d77ff903c11. The dma_buf field in struct drm_gem_object is not stable over the object instance's lifetime. The field becomes NULL when user space releases the final GEM handle on the buffer object. This resulted in a NULL-pointer deref. Workarounds in commit 5307dce878d4 ("drm/gem: Acquire references on GEM handles for framebuffers") and commit f6bfc9afc751 ("drm/framebuffer: Acquire internal references on GEM handles") only solved the problem partially. They especially don't work for buffer objects without a DRM framebuffer associated. Hence, this revert to going back to using .import_attach->dmabuf. v3: - cc stable Signed-off-by: Thomas Zimmermann Reviewed-by: Simona Vetter Acked-by: Christian König Acked-by: Zack Rusin Cc: # v6.15+ Link: https://lore.kernel.org/r/20250715155934.150656-7-tzimmermann@suse.de commit 2712ca878b688682ac2ce02aefc413fc76019cd9 Author: Thomas Zimmermann Date: Tue Jul 15 17:58:15 2025 +0200 Revert "drm/gem-framebuffer: Use dma_buf from GEM object instance" This reverts commit cce16fcd7446dcff7480cd9d2b6417075ed81065. The dma_buf field in struct drm_gem_object is not stable over the object instance's lifetime. The field becomes NULL when user space releases the final GEM handle on the buffer object. This resulted in a NULL-pointer deref. Workarounds in commit 5307dce878d4 ("drm/gem: Acquire references on GEM handles for framebuffers") and commit f6bfc9afc751 ("drm/framebuffer: Acquire internal references on GEM handles") only solved the problem partially. They especially don't work for buffer objects without a DRM framebuffer associated. Hence, this revert to going back to using .import_attach->dmabuf. v3: - cc stable Signed-off-by: Thomas Zimmermann Reviewed-by: Simona Vetter Acked-by: Christian König Acked-by: Zack Rusin Cc: # v6.15+ Link: https://lore.kernel.org/r/20250715155934.150656-6-tzimmermann@suse.de commit fb4ef4a52b79a22ad382bfe77332642d02aef773 Author: Thomas Zimmermann Date: Tue Jul 15 17:58:14 2025 +0200 Revert "drm/prime: Use dma_buf from GEM object instance" This reverts commit f83a9b8c7fd0557b0c50784bfdc1bbe9140c9bf8. The dma_buf field in struct drm_gem_object is not stable over the object instance's lifetime. The field becomes NULL when user space releases the final GEM handle on the buffer object. This resulted in a NULL-pointer deref. Workarounds in commit 5307dce878d4 ("drm/gem: Acquire references on GEM handles for framebuffers") and commit f6bfc9afc751 ("drm/framebuffer: Acquire internal references on GEM handles") only solved the problem partially. They especially don't work for buffer objects without a DRM framebuffer associated. Hence, this revert to going back to using .import_attach->dmabuf. v3: - cc stable Signed-off-by: Thomas Zimmermann Reviewed-by: Simona Vetter Acked-by: Christian König Acked-by: Zack Rusin Cc: # v6.15+ Link: https://lore.kernel.org/r/20250715155934.150656-5-tzimmermann@suse.de commit bb7f4972a6ff9a537b87e1b0ecf0e561f2761dd3 Author: Thomas Zimmermann Date: Tue Jul 15 17:58:13 2025 +0200 Revert "drm/etnaviv: Use dma_buf from GEM object instance" This reverts commit e91eb3ae415472b28211d7fed07fa283845b311e. The dma_buf field in struct drm_gem_object is not stable over the object instance's lifetime. The field becomes NULL when user space releases the final GEM handle on the buffer object. This resulted in a NULL-pointer deref. Workarounds in commit 5307dce878d4 ("drm/gem: Acquire references on GEM handles for framebuffers") and commit f6bfc9afc751 ("drm/framebuffer: Acquire internal references on GEM handles") only solved the problem partially. They especially don't work for buffer objects without a DRM framebuffer associated. Hence, this revert to going back to using .import_attach->dmabuf. Signed-off-by: Thomas Zimmermann Reviewed-by: Simona Vetter Acked-by: Christian König Acked-by: Zack Rusin Link: https://lore.kernel.org/r/20250715155934.150656-4-tzimmermann@suse.de commit 1e9d2aed7c2248bc5ba7d0dfea4fcc0b2f80b4f7 Author: Thomas Zimmermann Date: Tue Jul 15 17:58:12 2025 +0200 Revert "drm/vmwgfx: Use dma_buf from GEM object instance" This reverts commit aec8a40228acb385d60feec59b54573d307e60f3. The dma_buf field in struct drm_gem_object is not stable over the object instance's lifetime. The field becomes NULL when user space releases the final GEM handle on the buffer object. This resulted in a NULL-pointer deref. Workarounds in commit 5307dce878d4 ("drm/gem: Acquire references on GEM handles for framebuffers") and commit f6bfc9afc751 ("drm/framebuffer: Acquire internal references on GEM handles") only solved the problem partially. They especially don't work for buffer objects without a DRM framebuffer associated. Hence, this revert to going back to using .import_attach->dmabuf. Signed-off-by: Thomas Zimmermann Reviewed-by: Simona Vetter Acked-by: Christian König Acked-by: Zack Rusin Link: https://lore.kernel.org/r/20250715155934.150656-3-tzimmermann@suse.de commit 0ecfb8ddb953605cadd806de5b62e632c8e0e49e Author: Thomas Zimmermann Date: Tue Jul 15 17:58:11 2025 +0200 Revert "drm/virtio: Use dma_buf from GEM object instance" This reverts commit 415cb45895f43015515473fbc40563ca5eec9a7c. The dma_buf field in struct drm_gem_object is not stable over the object instance's lifetime. The field becomes NULL when user space releases the final GEM handle on the buffer object. This resulted in a NULL-pointer deref. Workarounds in commit 5307dce878d4 ("drm/gem: Acquire references on GEM handles for framebuffers") and commit f6bfc9afc751 ("drm/framebuffer: Acquire internal references on GEM handles") only solved the problem partially. They especially don't work for buffer objects without a DRM framebuffer associated. Hence, this revert to going back to using .import_attach->dmabuf. Signed-off-by: Thomas Zimmermann Reviewed-by: Simona Vetter Acked-by: Christian König Acked-by: Zack Rusin Link: https://lore.kernel.org/r/20250715155934.150656-3-tzimmermann@suse.de commit 15f77764e90a713ee3916ca424757688e4f565b9 Author: Lin.Cao Date: Thu Jul 17 16:44:53 2025 +0800 drm/sched: Remove optimization that causes hang when killing dependent jobs When application A submits jobs and application B submits a job with a dependency on A's fence, the normal flow wakes up the scheduler after processing each job. However, the optimization in drm_sched_entity_add_dependency_cb() uses a callback that only clears dependencies without waking up the scheduler. When application A is killed before its jobs can run, the callback gets triggered but only clears the dependency without waking up the scheduler, causing the scheduler to enter sleep state and application B to hang. Remove the optimization by deleting drm_sched_entity_clear_dep() and its usage, ensuring the scheduler is always woken up when dependencies are cleared. Fixes: 777dbd458c89 ("drm/amdgpu: drop a dummy wakeup scheduler") Cc: stable@vger.kernel.org # v4.6+ Signed-off-by: Lin.Cao Reviewed-by: Christian König Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250717084453.921097-1-lincao12@amd.com commit 2d72afb340657f03f7261e9243b44457a9228ac7 Author: Florian Westphal Date: Wed Jul 16 20:39:14 2025 +0200 netfilter: nf_conntrack: fix crash due to removal of uninitialised entry A crash in conntrack was reported while trying to unlink the conntrack entry from the hash bucket list: [exception RIP: __nf_ct_delete_from_lists+172] [..] #7 [ff539b5a2b043aa0] nf_ct_delete at ffffffffc124d421 [nf_conntrack] #8 [ff539b5a2b043ad0] nf_ct_gc_expired at ffffffffc124d999 [nf_conntrack] #9 [ff539b5a2b043ae0] __nf_conntrack_find_get at ffffffffc124efbc [nf_conntrack] [..] The nf_conn struct is marked as allocated from slab but appears to be in a partially initialised state: ct hlist pointer is garbage; looks like the ct hash value (hence crash). ct->status is equal to IPS_CONFIRMED|IPS_DYING, which is expected ct->timeout is 30000 (=30s), which is unexpected. Everything else looks like normal udp conntrack entry. If we ignore ct->status and pretend its 0, the entry matches those that are newly allocated but not yet inserted into the hash: - ct hlist pointers are overloaded and store/cache the raw tuple hash - ct->timeout matches the relative time expected for a new udp flow rather than the absolute 'jiffies' value. If it were not for the presence of IPS_CONFIRMED, __nf_conntrack_find_get() would have skipped the entry. Theory is that we did hit following race: cpu x cpu y cpu z found entry E found entry E E is expired nf_ct_delete() return E to rcu slab init_conntrack E is re-inited, ct->status set to 0 reply tuplehash hnnode.pprev stores hash value. cpu y found E right before it was deleted on cpu x. E is now re-inited on cpu z. cpu y was preempted before checking for expiry and/or confirm bit. ->refcnt set to 1 E now owned by skb ->timeout set to 30000 If cpu y were to resume now, it would observe E as expired but would skip E due to missing CONFIRMED bit. nf_conntrack_confirm gets called sets: ct->status |= CONFIRMED This is wrong: E is not yet added to hashtable. cpu y resumes, it observes E as expired but CONFIRMED: nf_ct_expired() -> yes (ct->timeout is 30s) confirmed bit set. cpu y will try to delete E from the hashtable: nf_ct_delete() -> set DYING bit __nf_ct_delete_from_lists Even this scenario doesn't guarantee a crash: cpu z still holds the table bucket lock(s) so y blocks: wait for spinlock held by z CONFIRMED is set but there is no guarantee ct will be added to hash: "chaintoolong" or "clash resolution" logic both skip the insert step. reply hnnode.pprev still stores the hash value. unlocks spinlock return NF_DROP In case CPU z does insert the entry into the hashtable, cpu y will unlink E again right away but no crash occurs. Without 'cpu y' race, 'garbage' hlist is of no consequence: ct refcnt remains at 1, eventually skb will be free'd and E gets destroyed via: nf_conntrack_put -> nf_conntrack_destroy -> nf_ct_destroy. To resolve this, move the IPS_CONFIRMED assignment after the table insertion but before the unlock. Pablo points out that the confirm-bit-store could be reordered to happen before hlist add resp. the timeout fixup, so switch to set_bit and before_atomic memory barrier to prevent this. It doesn't matter if other CPUs can observe a newly inserted entry right before the CONFIRMED bit was set: Such event cannot be distinguished from above "E is the old incarnation" case: the entry will be skipped. Also change nf_ct_should_gc() to first check the confirmed bit. The gc sequence is: 1. Check if entry has expired, if not skip to next entry 2. Obtain a reference to the expired entry. 3. Call nf_ct_should_gc() to double-check step 1. nf_ct_should_gc() is thus called only for entries that already failed an expiry check. After this patch, once the confirmed bit check passes ct->timeout has been altered to reflect the absolute 'best before' date instead of a relative time. Step 3 will therefore not remove the entry. Without this change to nf_ct_should_gc() we could still get this sequence: 1. Check if entry has expired. 2. Obtain a reference. 3. Call nf_ct_should_gc() to double-check step 1: 4 - entry is still observed as expired 5 - meanwhile, ct->timeout is corrected to absolute value on other CPU and confirm bit gets set 6 - confirm bit is seen 7 - valid entry is removed again First do check 6), then 4) so the gc expiry check always picks up either confirmed bit unset (entry gets skipped) or expiry re-check failure for re-inited conntrack objects. This change cannot be backported to releases before 5.19. Without commit 8a75a2c17410 ("netfilter: conntrack: remove unconfirmed list") |= IPS_CONFIRMED line cannot be moved without further changes. Cc: Razvan Cojocaru Link: https://lore.kernel.org/netfilter-devel/20250627142758.25664-1-fw@strlen.de/ Link: https://lore.kernel.org/netfilter-devel/4239da15-83ff-4ca4-939d-faef283471bb@gmail.com/ Fixes: 1397af5bfd7d ("netfilter: conntrack: remove the percpu dying list") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 9f735b6f8a77d7be7f8b0765dc93587774832cb1 Author: Felix Fietkau Date: Sat Jul 5 17:06:21 2025 +0200 net: fix segmentation after TCP/UDP fraglist GRO Since "net: gro: use cb instead of skb->network_header", the skb network header is no longer set in the GRO path. This breaks fraglist segmentation, which relies on ip_hdr()/tcp_hdr() to check for address/port changes. Fix this regression by selectively setting the network header for merged segment skbs. Fixes: 186b1ea73ad8 ("net: gro: use cb instead of skb->network_header") Signed-off-by: Felix Fietkau Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250705150622.10699-1-nbd@nbd.name Signed-off-by: Paolo Abeni commit 11ff5e06e02326a7c87aaa73dbffaed94918261d Author: André Draszik Date: Tue Jul 15 17:00:20 2025 +0100 gpiolib: devres: release GPIOs in devm_gpiod_put_array() devm_gpiod_put_array() is meant to undo the effects of devm_gpiod_get_array() - in particular, it should release the GPIOs contained in the array acquired with the latter. It is meant to be the resource-managed version of gpiod_put_array(), and it should behave similar to the non-array version devm_gpiod_put(). Since commit d1d52c6622a6 ("gpiolib: devres: Finish the conversion to use devm_add_action()") it doesn't do that anymore, it just removes the devres action and frees associated memory, but it doesn't actually release the GPIOs. Fix by switching from devm_remove_action() to devm_release_action(), which will in addition invoke the action to release the GPIOs. Fixes: d1d52c6622a6 ("gpiolib: devres: Finish the conversion to use devm_add_action()") Signed-off-by: André Draszik Reported-by: Wattson CI Reported-by: Samuel Wu Link: https://lore.kernel.org/r/20250715-gpiolib-devres-put-array-fix-v1-1-970d82a8c887@linaro.org Signed-off-by: Bartosz Golaszewski commit ae3264a25a4635531264728859dbe9c659fad554 Author: Yue Haibing Date: Mon Jul 14 22:19:57 2025 +0800 ipv6: mcast: Delay put pmc->idev in mld_del_delrec() pmc->idev is still used in ip6_mc_clear_src(), so as mld_clear_delrec() does, the reference should be put after ip6_mc_clear_src() return. Fixes: 63ed8de4be81 ("mld: add mc_lock for protecting per-interface mld data") Signed-off-by: Yue Haibing Link: https://patch.msgid.link/20250714141957.3301871-1-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski commit af90e85307241ec495c2de85854cd2e35a4df16b Merge: bf4807c89d8f92 d459dbbbfa3231 Author: Alexei Starovoitov Date: Wed Jul 16 18:32:31 2025 -0700 Merge branch 's390-bpf-fix-bpf_arch_text_poke-with-new_addr-null-again' Ilya Leoshkevich says: ==================== s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again This series fixes a regression causing perf on s390 to trigger a kernel panic. Patch 1 fixes the issue, patch 2 adds a test to make sure this doesn't happen again. ==================== Link: https://patch.msgid.link/20250716194524.48109-1-iii@linux.ibm.com Signed-off-by: Alexei Starovoitov commit d459dbbbfa323165849451edb9690a933c210bac Author: Ilya Leoshkevich Date: Wed Jul 16 21:35:07 2025 +0200 selftests/bpf: Stress test attaching a BPF prog to another BPF prog Add a test that invokes a BPF prog in a loop, while concurrently attaching and detaching another BPF prog to and from it. This helps identifying race conditions in bpf_arch_text_poke(). Signed-off-by: Ilya Leoshkevich Link: https://lore.kernel.org/r/20250716194524.48109-3-iii@linux.ibm.com Signed-off-by: Alexei Starovoitov commit 6a5abf8cf182f577c7ae6c62f14debc9754ec986 Author: Ilya Leoshkevich Date: Wed Jul 16 21:35:06 2025 +0200 s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again Commit 7ded842b356d ("s390/bpf: Fix bpf_plt pointer arithmetic") has accidentally removed the critical piece of commit c730fce7c70c ("s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL"), causing intermittent kernel panics in e.g. perf's on_switch() prog to reappear. Restore the fix and add a comment. Fixes: 7ded842b356d ("s390/bpf: Fix bpf_plt pointer arithmetic") Cc: stable@vger.kernel.org Signed-off-by: Ilya Leoshkevich Link: https://lore.kernel.org/r/20250716194524.48109-2-iii@linux.ibm.com Signed-off-by: Alexei Starovoitov commit e14fd98c6d66cb76694b12c05768e4f9e8c95664 Author: Breno Leitao Date: Wed Jul 16 10:38:48 2025 -0700 sched/ext: Prevent update_locked_rq() calls with NULL rq Avoid invoking update_locked_rq() when the runqueue (rq) pointer is NULL in the SCX_CALL_OP and SCX_CALL_OP_RET macros. Previously, calling update_locked_rq(NULL) with preemption enabled could trigger the following warning: BUG: using __this_cpu_write() in preemptible [00000000] This happens because __this_cpu_write() is unsafe to use in preemptible context. rq is NULL when an ops invoked from an unlocked context. In such cases, we don't need to store any rq, since the value should already be NULL (unlocked). Ensure that update_locked_rq() is only called when rq is non-NULL, preventing calling __this_cpu_write() on preemptible context. Suggested-by: Peter Zijlstra Fixes: 18853ba782bef ("sched_ext: Track currently locked rq") Signed-off-by: Breno Leitao Acked-by: Andrea Righi Signed-off-by: Tejun Heo Cc: stable@vger.kernel.org # v6.15 commit 69a46a5b42f9423b2536c1026518f6ff355967c4 Merge: 3cd582e7d07875 bedd0330a19b3a Author: Jakub Kicinski Date: Wed Jul 16 16:17:34 2025 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2025-07-15 (ixgbe, fm10k, i40e, ice) Arnd Bergmann resolves compile issues with large NR_CPUS for ixgbe, fm10k, and i40e. For ice: Dave adds a NULL check for LAG netdev. Michal corrects a pointer check in debugfs initialization. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ice: check correct pointer in fwlog debugfs ice: add NULL check in eswitch lag check ethernet: intel: fix building with large NR_CPUS ==================== Link: https://patch.msgid.link/20250715202948.3841437-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 3cd582e7d0787506990ef0180405eb6224fa90a6 Author: Alok Tiwari Date: Tue Jul 15 07:30:58 2025 -0700 net: airoha: fix potential use-after-free in airoha_npu_get() np->name was being used after calling of_node_put(np), which releases the node and can lead to a use-after-free bug. Previously, of_node_put(np) was called unconditionally after of_find_device_by_node(np), which could result in a use-after-free if pdev is NULL. This patch moves of_node_put(np) after the error check to ensure the node is only released after both the error and success cases are handled appropriately, preventing potential resource issues. Fixes: 23290c7bc190 ("net: airoha: Introduce Airoha NPU support") Signed-off-by: Alok Tiwari Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250715143102.3458286-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit 531d0d32de3e1b6b77a87bd37de0c2c6e17b496a Author: Christoph Paasch Date: Tue Jul 15 13:20:53 2025 -0700 net/mlx5: Correctly set gso_size when LRO is used gso_size is expected by the networking stack to be the size of the payload (thus, not including ethernet/IP/TCP-headers). However, cqe_bcnt is the full sized frame (including the headers). Dividing cqe_bcnt by lro_num_seg will then give incorrect results. For example, running a bpftrace higher up in the TCP-stack (tcp_event_data_recv), we commonly have gso_size set to 1450 or 1451 even though in reality the payload was only 1448 bytes. This can have unintended consequences: - In tcp_measure_rcv_mss() len will be for example 1450, but. rcv_mss will be 1448 (because tp->advmss is 1448). Thus, we will always recompute scaling_ratio each time an LRO-packet is received. - In tcp_gro_receive(), it will interfere with the decision whether or not to flush and thus potentially result in less gro'ed packets. So, we need to discount the protocol headers from cqe_bcnt so we can actually divide the payload by lro_num_seg to get the real gso_size. v2: - Use "(unsigned char *)tcp + tcp->doff * 4 - skb->data)" to compute header-len (Tariq Toukan ) - Improve commit-message (Gal Pressman ) Fixes: e586b3b0baee ("net/mlx5: Ethernet Datapath files") Signed-off-by: Christoph Paasch Reviewed-by: Tariq Toukan Reviewed-by: Gal Pressman Link: https://patch.msgid.link/20250715-cpaasch-pf-925-investigate-incorrect-gso_size-on-cx-7-nic-v2-1-e06c3475f3ac@openai.com Signed-off-by: Jakub Kicinski commit 89edfcf710875feedc4264a6c9c4e7fb55486422 Author: Kent Overstreet Date: Wed Jul 16 17:31:31 2025 -0400 bcachefs: Fix bch2_maybe_casefold() when CONFIG_UTF8=n maybe_casefold() shouldn't have been nooped, just bch2_casefold(). Fixes: 94426e4201fb ("bcachefs: opts.casefold_disabled") Signed-off-by: Kent Overstreet commit 40c35a0b476197419a19aaa1f76e83d0b8874921 Author: Kent Overstreet Date: Tue Jul 15 10:01:00 2025 -0400 bcachefs: Fix build when CONFIG_UNICODE=n 94426e4201fb, which added the killswitch for casefolding, accidentally removed some of the ifdefs we need to avoid build errors. It appears we need better build testing for different configurations, it took two weeks for the robots to catch this one. Fixes: 94426e4201fb ("bcachefs: opts.casefold_disabled") Signed-off-by: Kent Overstreet commit c02b943f7d127caf43f49ab6c9eaf8e1b082b9af Author: Kent Overstreet Date: Sun Jul 13 17:19:34 2025 -0400 bcachefs: Fix reference to invalid bucket in copygc Use bch2_dev_bucket_tryget() instead of bch2_dev_tryget() before checking the bucket bitmap. Reported-by: syzbot+3168625f36f4a539237e@syzkaller.appspotmail.com Signed-off-by: Kent Overstreet commit 9fe8ec866442b6ee7eac8d5ceda18f88aaa7f78d Author: Kent Overstreet Date: Sun Jul 13 13:31:33 2025 -0400 bcachefs: Don't build aux search tree when still repairing node bch2_btree_node_drop_keys_outside_node() will (re)build aux search trees, because it's also called by topology repair. bch2_btree_node_read_done() was calling it before validating individual keys; invalid ones have to be dropped. If we call drop_keys_outside_node() first, then bch2_bset_build_aux_tree() doesn't run because the node already has an aux search tree - which was invalidated by the repair. Reported-by: syzbot+c5e7a66b3b23ae65d44f@syzkaller.appspotmail.com Signed-off-by: Kent Overstreet commit 6a1c4323defd18ca732c13d9abf4204ea1a4182f Author: Kent Overstreet Date: Sat Jul 12 19:33:12 2025 -0400 bcachefs: Tweak threshold for allocator triggering discards The allocator path has a "if we're really low on free buckets, check if we should issue discards" - tweak this to also trigger discards if more than 1/128th of the device is in need_discard state. Signed-off-by: Kent Overstreet commit b4d6e204f892846b435ad5df89306a8ad56191f9 Author: Kent Overstreet Date: Sat Jul 12 19:31:49 2025 -0400 bcachefs: Fix triggering of discard by the journal path It becomes possible to do discards after a journal flush, which naturally the journal code is reponsible for. A prior refactoring seems to have broken this - which went unnoticed because the foreground allocator path can also trigger discards. Signed-off-by: Kent Overstreet commit 83261934015c434fabb980a3e613b01d9976e877 Author: Eeli Haapalainen Date: Mon Jul 14 08:13:09 2025 +0300 drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume Commit 42cdf6f687da ("drm/amdgpu/gfx8: always restore kcq MQDs") made the ring pointer always to be reset on resume from suspend. This caused compute rings to fail since the reset was done without also resetting it for the firmware. Reset wptr on the GPU to avoid a disconnect between the driver and firmware wptr. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3911 Fixes: 42cdf6f687da ("drm/amdgpu/gfx8: always restore kcq MQDs") Signed-off-by: Eeli Haapalainen Signed-off-by: Alex Deucher (cherry picked from commit 2becafc319db3d96205320f31cc0de4ee5a93747) Cc: stable@vger.kernel.org commit 86790e300d8b7bbadaad5024e308c52f1222128f Author: Lijo Lazar Date: Mon Jul 14 10:37:00 2025 +0530 drm/amdgpu: Increase reset counter only on success Increment the reset counter only if soft recovery succeeded. This is consistent with a ring hard reset behaviour where counter gets incremented only if hard reset succeeded. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 25c314aa3ec3d30e4ee282540e2096b5c66a2437) Cc: stable@vger.kernel.org commit 4c1a0fc2aeb8486956f37cad4433e4d18b45821d Author: Thomas Zimmermann Date: Tue Jul 15 11:50:54 2025 +0200 drm/radeon: Do not hold console lock during resume The function radeon_resume_kms() acquires the console lock. It is inconsistent, as it depends on the notify_client argument. That lock then covers a number of suspend operations that are unrelated to the console. Remove the calls to console_lock() and console_unlock() from the radeon function. The console lock is only required by DRM's fbdev emulation, which acquires it as necessary. Also fixes a possible circular dependency between the console lock and the client-list mutex, where the mutex is supposed to be taken first. Signed-off-by: Thomas Zimmermann Signed-off-by: Alex Deucher (cherry picked from commit fff8e0504499a929f26e2fb7cf7e2c9854e37b91) commit 5dd0b96118e09a3725e3f83543e133b1fd02c18c Author: Thomas Zimmermann Date: Tue Jul 15 11:50:53 2025 +0200 drm/radeon: Do not hold console lock while suspending clients The radeon driver holds the console lock while suspending in-kernel DRM clients. This creates a circular dependency with the client-list mutex, which is supposed to be acquired first. Reported when combining radeon with another DRM driver. Therefore, do not take the console lock in radeon, but let the fbdev DRM client acquire the lock when needed. This is what all other DRM drivers so. Signed-off-by: Thomas Zimmermann Reported-by: Jeff Johnson Closes: https://lore.kernel.org/dri-devel/0a087cfd-bd4c-48f1-aa2f-4a3b12593935@oss.qualcomm.com/ Suggested-by: Ville Syrjälä Signed-off-by: Alex Deucher (cherry picked from commit 612ec7c69d04cb58beb1332c2806da9f2f47a3ae) commit 97a0f2b5f4d4afcec34376e4428e157ce95efa71 Author: Melissa Wen Date: Mon Jul 7 16:52:05 2025 -0400 drm/amd/display: Disable CRTC degamma LUT for DCN401 In DCN401 pre-blending degamma LUT isn't affecting cursor as in previous DCN version. As this is not the behavior close to what is expected for CRTC degamma LUT, disable CRTC degamma LUT property in this HW. Link: https://gitlab.freedesktop.org/drm/amd/-/issues/4176 --- When enabling HDR on KDE, it takes the first CRTC 1D LUT available and apply a color transformation (Gamma 2.2 -> PQ). AMD driver usually advertises a CRTC degamma LUT as the first CRTC 1D LUT, but it's actually applied pre-blending. In previous HW version, it seems to work fine because the 1D LUT was applied to cursor too, but DCN401 presents a different behavior and the 1D LUT isn't affecting the hardware cursor. To address the wrong gamma on cursor with HDR (see the link), I came up with this patch that disables CRTC degamma LUT in this hw, since it presents a different behavior than others. With this KDE sees CRTC regamma LUT as the first post-blending 1D LUT available. This is actually more consistent with AMD color pipeline. It was tested by the reporter, since I don't have the HW available for local testing and debugging. Melissa --- Reviewed-by: Harry Wentland Signed-off-by: Melissa Wen Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 340231cdceec2c45995d773a358ca3c341f151aa) Cc: stable@vger.kernel.org commit b2ee9fa0fe6416e16c532f61b909c79b5d4ed282 Author: Clayton King Date: Thu Jun 19 13:54:26 2025 -0400 drm/amd/display: Free memory allocation [WHY] Free memory to avoid memory leak Reviewed-by: Joshua Aberback Signed-off-by: Clayton King Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit fa699acb8e9be2341ee318077fa119acc7d5f329) Cc: stable@vger.kernel.org commit e2291551827fe5d2d3758c435c191d32b6d1350e Merge: 4664a4ddb9211a 1ed171a3afe815 Author: Linus Torvalds Date: Wed Jul 16 13:00:38 2025 -0700 Merge tag 'probes-fixes-v6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull probes fix from Masami Hiramatsu: - fprobe-event: The @params variable was being used in an error path without being initialized. The fix to return an error code. * tag 'probes-fixes-v6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing/probes: Avoid using params uninitialized in parse_btf_arg() commit 43015955795a619f7ca4ae69b9c0ffc994c82818 Author: Zijun Hu Date: Tue Jul 15 20:40:13 2025 +0800 Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID For GF variant of WCN6855 without board ID programmed btusb_generate_qca_nvm_name() will chose wrong NVM 'qca/nvm_usb_00130201.bin' to download. Fix by choosing right NVM 'qca/nvm_usb_00130201_gf.bin'. Also simplify NVM choice logic of btusb_generate_qca_nvm_name(). Fixes: d6cba4e6d0e2 ("Bluetooth: btusb: Add support using different nvm for variant WCN6855 controller") Signed-off-by: Zijun Hu Signed-off-by: Luiz Augusto von Dentz commit 6851a0c228fc040dce8e4c393004209e7372e0a3 Author: Christian Eggers Date: Mon Jul 14 22:27:45 2025 +0200 Bluetooth: hci_dev: replace 'quirks' integer by 'quirk_flags' bitmap The 'quirks' member already ran out of bits on some platforms some time ago. Replace the integer member by a bitmap in order to have enough bits in future. Replace raw bit operations by accessor macros. Fixes: ff26b2dd6568 ("Bluetooth: Add quirk for broken READ_VOICE_SETTING") Fixes: 127881334eaa ("Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE") Suggested-by: Pauli Virtanen Tested-by: Ivan Pravdin Signed-off-by: Kiran K Signed-off-by: Christian Eggers Signed-off-by: Luiz Augusto von Dentz commit cdee6a4416b2a57c89082929cc60e2275bb32a3a Author: Christian Eggers Date: Mon Jul 14 22:27:44 2025 +0200 Bluetooth: hci_core: add missing braces when using macro parameters Macro parameters should always be put into braces when accessing it. Fixes: 4fc9857ab8c6 ("Bluetooth: hci_sync: Add check simultaneous roles support") Signed-off-by: Christian Eggers Signed-off-by: Luiz Augusto von Dentz commit dfef8d87a031ac1a46dde3de804e0fcf3c3a6afd Author: Christian Eggers Date: Mon Jul 14 22:27:43 2025 +0200 Bluetooth: hci_core: fix typos in macros The provided macro parameter is named 'dev' (rather than 'hdev', which may be a variable on the stack where the macro is used). Fixes: a9a830a676a9 ("Bluetooth: hci_event: Fix sending HCI_OP_READ_ENC_KEY_SIZE") Fixes: 6126ffabba6b ("Bluetooth: Introduce HCI_CONN_FLAG_DEVICE_PRIVACY device flag") Signed-off-by: Christian Eggers Signed-off-by: Luiz Augusto von Dentz commit 6ef99c917688a8510259e565bd1b168b7146295a Author: Luiz Augusto von Dentz Date: Wed Jul 2 11:53:40 2025 -0400 Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout This replaces the usage of HCI_ERROR_REMOTE_USER_TERM, which as the name suggest is to indicate a regular disconnection initiated by an user, with HCI_ERROR_AUTH_FAILURE to indicate the session has timeout thus any pairing shall be considered as failed. Fixes: 1e91c29eb60c ("Bluetooth: Use hci_disconnect for immediate disconnection from SMP") Signed-off-by: Luiz Augusto von Dentz commit fe4840df0bdf341f376885271b7680764fe6b34e Author: Luiz Augusto von Dentz Date: Mon Jun 30 14:42:23 2025 -0400 Bluetooth: SMP: If an unallowed command is received consider it a failure If a command is received while a bonding is ongoing consider it a pairing failure so the session is cleanup properly and the device is disconnected immediately instead of continuing with other commands that may result in the session to get stuck without ever completing such as the case bellow: > ACL Data RX: Handle 2048 flags 0x02 dlen 21 SMP: Identity Information (0x08) len 16 Identity resolving key[16]: d7e08edef97d3e62cd2331f82d8073b0 > ACL Data RX: Handle 2048 flags 0x02 dlen 21 SMP: Signing Information (0x0a) len 16 Signature key[16]: 1716c536f94e843a9aea8b13ffde477d Bluetooth: hci0: unexpected SMP command 0x0a from XX:XX:XX:XX:XX:XX > ACL Data RX: Handle 2048 flags 0x02 dlen 12 SMP: Identity Address Information (0x09) len 7 Address: XX:XX:XX:XX:XX:XX (Intel Corporate) While accourding to core spec 6.1 the expected order is always BD_ADDR first first then CSRK: When using LE legacy pairing, the keys shall be distributed in the following order: LTK by the Peripheral EDIV and Rand by the Peripheral IRK by the Peripheral BD_ADDR by the Peripheral CSRK by the Peripheral LTK by the Central EDIV and Rand by the Central IRK by the Central BD_ADDR by the Central CSRK by the Central When using LE Secure Connections, the keys shall be distributed in the following order: IRK by the Peripheral BD_ADDR by the Peripheral CSRK by the Peripheral IRK by the Central BD_ADDR by the Central CSRK by the Central According to the Core 6.1 for commands used for key distribution "Key Rejected" can be used: '3.6.1. Key distribution and generation A device may reject a distributed key by sending the Pairing Failed command with the reason set to "Key Rejected". Fixes: b28b4943660f ("Bluetooth: Add strict checks for allowed SMP PDUs") Signed-off-by: Luiz Augusto von Dentz commit 6ec3185fbc3528f2284c347fb9bd8be6fa672ed4 Author: Luiz Augusto von Dentz Date: Wed Jul 9 15:02:56 2025 -0400 Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type Due to what seem to be a bug with variant version returned by some firmwares the code may set hdev->classify_pkt_type with btintel_classify_pkt_type when in fact the controller doesn't even support ISO channels feature but may use the handle range expected from a controllers that does causing the packets to be reclassified as ISO causing several bugs. To fix the above btintel_classify_pkt_type will attempt to check if the controller really supports ISO channels and in case it doesn't don't reclassify even if the handle range is considered to be ISO, this is considered safer than trying to fix the specific controller/firmware version as that could change over time and causing similar problems in the future. Link: https://bugzilla.kernel.org/show_bug.cgi?id=219553 Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2100565 Link: https://github.com/StarLabsLtd/firmware/issues/180 Fixes: f25b7fd36cc3 ("Bluetooth: Add vendor-specific packet classification for ISO data") Cc: stable@vger.kernel.org Signed-off-by: Luiz Augusto von Dentz Tested-by: Sean Rhodes commit d85edab911a4c1fcbe3f08336eff5c7feec567d0 Author: Alessandro Gasbarroni Date: Wed Jul 9 09:53:11 2025 +0200 Bluetooth: hci_sync: fix connectable extended advertising when using static random address Currently, the connectable flag used by the setup of an extended advertising instance drives whether we require privacy when trying to pass a random address to the advertising parameters (Own Address). If privacy is not required, then it automatically falls back to using the controller's public address. This can cause problems when using controllers that do not have a public address set, but instead use a static random address. e.g. Assume a BLE controller that does not have a public address set. The controller upon powering is set with a random static address by default by the kernel. < HCI Command: LE Set Random Address (0x08|0x0005) plen 6 Address: E4:AF:26:D8:3E:3A (Static) > HCI Event: Command Complete (0x0e) plen 4 LE Set Random Address (0x08|0x0005) ncmd 1 Status: Success (0x00) Setting non-connectable extended advertisement parameters in bluetoothctl mgmt add-ext-adv-params -r 0x801 -x 0x802 -P 2M -g 1 correctly sets Own address type as Random < HCI Command: LE Set Extended Advertising Parameters (0x08|0x0036) plen 25 ... Own address type: Random (0x01) Setting connectable extended advertisement parameters in bluetoothctl mgmt add-ext-adv-params -r 0x801 -x 0x802 -P 2M -g -c 1 mistakenly sets Own address type to Public (which causes to use Public Address 00:00:00:00:00:00) < HCI Command: LE Set Extended Advertising Parameters (0x08|0x0036) plen 25 ... Own address type: Public (0x00) This causes either the controller to emit an Invalid Parameters error or to mishandle the advertising. This patch makes sure that we use the already set static random address when requesting a connectable extended advertising when we don't require privacy and our public address is not set (00:00:00:00:00:00). Fixes: 3fe318ee72c5 ("Bluetooth: move hci_get_random_address() to hci_sync") Signed-off-by: Alessandro Gasbarroni Signed-off-by: Luiz Augusto von Dentz commit a0075accbf0d76c2dad1ad3993d2e944505d99a0 Author: Kuniyuki Iwashima Date: Mon Jul 7 19:28:29 2025 +0000 Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() syzbot reported null-ptr-deref in l2cap_sock_resume_cb(). [0] l2cap_sock_resume_cb() has a similar problem that was fixed by commit 1bff51ea59a9 ("Bluetooth: fix use-after-free error in lock_sock_nested()"). Since both l2cap_sock_kill() and l2cap_sock_resume_cb() are executed under l2cap_sock_resume_cb(), we can avoid the issue simply by checking if chan->data is NULL. Let's not access to the killed socket in l2cap_sock_resume_cb(). [0]: BUG: KASAN: null-ptr-deref in instrument_atomic_write include/linux/instrumented.h:82 [inline] BUG: KASAN: null-ptr-deref in clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline] BUG: KASAN: null-ptr-deref in l2cap_sock_resume_cb+0xb4/0x17c net/bluetooth/l2cap_sock.c:1711 Write of size 8 at addr 0000000000000570 by task kworker/u9:0/52 CPU: 1 UID: 0 PID: 52 Comm: kworker/u9:0 Not tainted 6.16.0-rc4-syzkaller-g7482bb149b9f #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Workqueue: hci0 hci_rx_work Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:501 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 print_report+0x58/0x84 mm/kasan/report.c:524 kasan_report+0xb0/0x110 mm/kasan/report.c:634 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:189 __kasan_check_write+0x20/0x30 mm/kasan/shadow.c:37 instrument_atomic_write include/linux/instrumented.h:82 [inline] clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline] l2cap_sock_resume_cb+0xb4/0x17c net/bluetooth/l2cap_sock.c:1711 l2cap_security_cfm+0x524/0xea0 net/bluetooth/l2cap_core.c:7357 hci_auth_cfm include/net/bluetooth/hci_core.h:2092 [inline] hci_auth_complete_evt+0x2e8/0xa4c net/bluetooth/hci_event.c:3514 hci_event_func net/bluetooth/hci_event.c:7511 [inline] hci_event_packet+0x650/0xe9c net/bluetooth/hci_event.c:7565 hci_rx_work+0x320/0xb18 net/bluetooth/hci_core.c:4070 process_one_work+0x7e8/0x155c kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3321 [inline] worker_thread+0x958/0xed8 kernel/workqueue.c:3402 kthread+0x5fc/0x75c kernel/kthread.c:464 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:847 Fixes: d97c899bde33 ("Bluetooth: Introduce L2CAP channel callback for resuming") Reported-by: syzbot+e4d73b165c3892852d22@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/686c12bd.a70a0220.29fe6c.0b13.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima Signed-off-by: Luiz Augusto von Dentz commit b65ca21835ed615907ba231a60db80a2605b94dc Author: Nathan Chancellor Date: Tue Jul 15 20:07:01 2025 -0700 riscv: uaccess: Fix -Wuninitialized and -Wshadow in __put_user_nocheck After a recent change in clang to strengthen uninitialized warnings [1], there is a warning from val being uninitialized in __put_user_nocheck when called from futex_put_value(): kernel/futex/futex.h:326:18: warning: variable 'val' is uninitialized when used within its own initialization [-Wuninitialized] 326 | unsafe_put_user(val, to, Efault); | ~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~ arch/riscv/include/asm/uaccess.h:464:21: note: expanded from macro 'unsafe_put_user' 464 | __put_user_nocheck(x, (ptr), label) | ~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~ arch/riscv/include/asm/uaccess.h:314:36: note: expanded from macro '__put_user_nocheck' 314 | __inttype(x) val = (__inttype(x))x; \ | ~~~ ^ While not on by default, -Wshadow flags the same mistake: kernel/futex/futex.h:326:2: warning: declaration shadows a local variable [-Wshadow] 326 | unsafe_put_user(val, to, Efault); | ^ arch/riscv/include/asm/uaccess.h:464:2: note: expanded from macro 'unsafe_put_user' 464 | __put_user_nocheck(x, (ptr), label) | ^ arch/riscv/include/asm/uaccess.h:314:16: note: expanded from macro '__put_user_nocheck' 314 | __inttype(x) val = (__inttype(x))x; \ | ^ kernel/futex/futex.h:320:48: note: previous declaration is here 320 | static __always_inline int futex_put_value(u32 val, u32 __user *to) | ^ Use a three underscore prefix for the val variable in __put_user_nocheck to avoid clashing with either val or __val, which are both used within the put_user macros, clearing up all warnings. Closes: https://github.com/ClangBuiltLinux/linux/issues/2109 Fixes: ca1a66cdd685 ("riscv: uaccess: do not do misaligned accesses in get/put_user()") Link: https://github.com/llvm/llvm-project/commit/2464313eef01c5b1edf0eccf57a32cdee01472c7 [1] Signed-off-by: Nathan Chancellor Link: https://lore.kernel.org/r/20250715-riscv-uaccess-fix-self-init-val-v1-1-82b8e911f120@kernel.org Signed-off-by: Palmer Dabbelt commit c7cafd5b81cc07fb402e3068d134c21e60ea688c Author: Pavel Begunkov Date: Wed Jul 16 17:20:17 2025 +0100 io_uring/poll: fix POLLERR handling 8c8492ca64e7 ("io_uring/net: don't retry connect operation on EPOLLERR") is a little dirty hack that 1) wrongfully assumes that POLLERR equals to a failed request, which breaks all POLLERR users, e.g. all error queue recv interfaces. 2) deviates the connection request behaviour from connect(2), and 3) racy and solved at a wrong level. Nothing can be done with 2) now, and 3) is beyond the scope of the patch. At least solve 1) by moving the hack out of generic poll handling into io_connect(). Cc: stable@vger.kernel.org Fixes: 8c8492ca64e79 ("io_uring/net: don't retry connect operation on EPOLLERR") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/3dc89036388d602ebd84c28e5042e457bdfc952b.1752682444.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 5874ca4c6280d67158bf3db1ba7a5913eb3670d7 Author: Alexandre Ghiti Date: Wed Jul 16 12:05:16 2025 +0000 riscv: Stop supporting static ftrace Now that DYNAMIC_FTRACE was introduced, there is no need to support static ftrace as it is way less performant. This simplifies the code and prevents build failures as reported by kernel test robot when !DYNAMIC_FTRACE. Also make sure that FUNCTION_TRACER can only be selected if DYNAMIC_FTRACE is supported (we have a dependency on the toolchain). Co-developed-by: chenmiao Signed-off-by: chenmiao Fixes: b2137c3b6d7a ("riscv: ftrace: prepare ftrace for atomic code patching") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506191949.o3SMu8Zn-lkp@intel.com/ Signed-off-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20250716-dev-alex-static_ftrace-v1-1-ba5d2b6fc9c0@rivosinc.com Signed-off-by: Palmer Dabbelt commit b3510183ab7d63c71a3f5c89043d31686a76a34c Author: Andreas Schwab Date: Thu Jul 10 15:32:18 2025 +0200 riscv: traps_misaligned: properly sign extend value in misaligned load handler Add missing cast to signed long. Signed-off-by: Andreas Schwab Fixes: 956d705dd279 ("riscv: Unaligned load/store handling for M_MODE") Tested-by: Clément Léger Link: https://lore.kernel.org/r/mvmikk0goil.fsf@suse.de Signed-off-by: Palmer Dabbelt commit 969f028bf2c40573ef18061f702ede3ebfe12b42 Author: Nam Cao Date: Wed Jun 25 10:56:30 2025 +0200 riscv: Enable interrupt during exception handling force_sig_fault() takes a spinlock, which is a sleeping lock with CONFIG_PREEMPT_RT=y. However, exception handling calls force_sig_fault() with interrupt disabled, causing a sleeping in atomic context warning. This can be reproduced using userspace programs such as: int main() { asm ("ebreak"); } or int main() { asm ("unimp"); } There is no reason that interrupt must be disabled while handling exceptions from userspace. Enable interrupt while handling user exceptions. This also has the added benefit of avoiding unnecessary delays in interrupt handling. Fixes: f0bddf50586d ("riscv: entry: Convert to generic entry") Suggested-by: Sebastian Andrzej Siewior Signed-off-by: Nam Cao Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20250625085630.3649485-1-namcao@linutronix.de Signed-off-by: Palmer Dabbelt commit e3f16d63d54e6fcf2b18812f2dd0a8d2782b5f3a Author: Alexandre Ghiti Date: Fri Jul 11 07:38:38 2025 +0000 riscv: ftrace: Properly acquire text_mutex to fix a race condition As reported by lockdep, some patching was done without acquiring text_mutex, so there could be a race when mapping the page to patch since we use the same fixmap entry. Reported-by: Han Gao Reported-by: Vivian Wang Reported-by: Yao Zi Closes: https://lore.kernel.org/linux-riscv/aGODMpq7TGINddzM@pie.lan/ Tested-by: Yao Zi Tested-by: Han Gao Reviewed-by: Masami Hiramatsu (Google) Signed-off-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20250711-alex-fixes-v2-1-d85a5438da6c@rivosinc.com Signed-off-by: Palmer Dabbelt commit 16d743606dba05f9ad87837791fcd5c083544c43 Author: Sunil V L Date: Fri Jul 11 19:30:13 2025 +0530 ACPI: RISC-V: Remove unnecessary CPPC debug message The presence or absence of the CPPC SBI extension is currently logged on every boot. This message is not particularly useful and can clutter the boot log. Remove this debug message to reduce noise during boot. This change has no functional impact. Signed-off-by: Sunil V L Reviewed-by: Anup Patel Tested-by: Drew Fustini Link: https://lore.kernel.org/r/20250711140013.3043463-1-sunilvl@ventanamicro.com Signed-off-by: Palmer Dabbelt commit 82d369b48a6bd70947f9016cb358e278a737e919 Author: Alexandre Ghiti Date: Thu Jul 10 08:34:31 2025 +0000 riscv: Stop considering R_RISCV_NONE as bad relocations Even though those relocations should not be present in the final vmlinux, there are a lot of them. And since those relocations are considered "bad", they flood the compilation output which may hide some legitimate bad relocations. Signed-off-by: Alexandre Ghiti Tested-by: Ron Economos Link: https://lore.kernel.org/r/20250710-dev-alex-riscv_none_bad_relocs_v1-v1-1-758f2fcc6e75@rivosinc.com Signed-off-by: Palmer Dabbelt commit 2d7521aa26ec2dc8b877bb2d1f2611a2df49a3cf Author: Michael C. Pratt Date: Wed Jul 16 15:42:10 2025 +0100 nvmem: layouts: u-boot-env: remove crc32 endianness conversion On 11 Oct 2022, it was reported that the crc32 verification of the u-boot environment failed only on big-endian systems for the u-boot-env nvmem layout driver with the following error. Invalid calculated CRC32: 0x88cd6f09 (expected: 0x096fcd88) This problem has been present since the driver was introduced, and before it was made into a layout driver. The suggested fix at the time was to use further endianness conversion macros in order to have both the stored and calculated crc32 values to compare always represented in the system's endianness. This was not accepted due to sparse warnings and some disagreement on how to handle the situation. Later on in a newer revision of the patch, it was proposed to use cpu_to_le32() for both values to compare instead of le32_to_cpu() and store the values as __le32 type to remove compilation errors. The necessity of this is based on the assumption that the use of crc32() requires endianness conversion because the algorithm uses little-endian, however, this does not prove to be the case and the issue is unrelated. Upon inspecting the current kernel code, there already is an existing use of le32_to_cpu() in this driver, which suggests there already is special handling for big-endian systems, however, it is big-endian systems that have the problem. This, being the only functional difference between architectures in the driver combined with the fact that the suggested fix was to use the exact same endianness conversion for the values brings up the possibility that it was not necessary to begin with, as the same endianness conversion for two values expected to be the same is expected to be equivalent to no conversion at all. After inspecting the u-boot environment of devices of both endianness and trying to remove the existing endianness conversion, the problem is resolved in an equivalent way as the other suggested fixes. Ultimately, it seems that u-boot is agnostic to endianness at least for the purpose of environment variables. In other words, u-boot reads and writes the stored crc32 value with the same endianness that the crc32 value is calculated with in whichever endianness a certain architecture runs on. Therefore, the u-boot-env driver does not need to convert endianness. Remove the usage of endianness macros in the u-boot-env driver, and change the type of local variables to maintain the same return type. If there is a special situation in the case of endianness, it would be a corner case and should be handled by a unique "compatible". Even though it is not necessary to use endianness conversion macros here, it may be useful to use them in the future for consistent error printing. Fixes: d5542923f200 ("nvmem: add driver handling U-Boot environment variables") Reported-by: INAGAKI Hiroshi Link: https://lore.kernel.org/all/20221011024928.1807-1-musashino.open@gmail.com Cc: stable@vger.kernel.org Signed-off-by: "Michael C. Pratt" Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250716144210.4804-1-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 16ad3ee51fc95ae8e06b9934fa2f656a5e4a8f03 Author: Akshay Gupta Date: Wed Jul 16 11:07:29 2025 +0000 misc: amd-sbi: Explicitly clear in/out arg "mb_in_out" - New AMD processor will support different input/output for same command. - In some scenarios the input value is not cleared, which will be added to output before reporting the data. - Clearing input explicitly will be a cleaner and safer approach. Reviewed-by: Naveen Krishna Chatradhi Signed-off-by: Akshay Gupta Link: https://lore.kernel.org/r/20250716110729.2193725-3-akshay.gupta@amd.com Signed-off-by: Greg Kroah-Hartman commit bbb4013947fa5d9b2a65efdbfb08020abb060a18 Author: Akshay Gupta Date: Wed Jul 16 11:07:28 2025 +0000 misc: amd-sbi: Address copy_to/from_user() warning reported in smatch Smatch warnings are reported for below commit, Commit bb13a84ed6b7 ("misc: amd-sbi: Add support for CPUID protocol") from Apr 28, 2025 (linux-next), leads to the following Smatch static checker warning: drivers/misc/amd-sbi/rmi-core.c:376 apml_rmi_reg_xfer() warn: maybe return -EFAULT instead of the bytes remaining? drivers/misc/amd-sbi/rmi-core.c:394 apml_mailbox_xfer() warn: maybe return -EFAULT instead of the bytes remaining? drivers/misc/amd-sbi/rmi-core.c:411 apml_cpuid_xfer() warn: maybe return -EFAULT instead of the bytes remaining? drivers/misc/amd-sbi/rmi-core.c:428 apml_mcamsr_xfer() warn: maybe return -EFAULT instead of the bytes remaining? copy_to/from_user() returns number of bytes, not copied. In case data not copied, return "-EFAULT". Additionally, fixes the "-EPROTOTYPE" error return as intended. Fixes: 35ac2034db72 ("misc: amd-sbi: Add support for AMD_SBI IOCTL") Fixes: bb13a84ed6b7 ("misc: amd-sbi: Add support for CPUID protocol") Fixes: 69b1ba83d21c ("misc: amd-sbi: Add support for read MCA register protocol") Fixes: cf141287b774 ("misc: amd-sbi: Add support for register xfer") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/aDVyO8ByVsceybk9@stanley.mountain/ Reviewed-by: Naveen Krishna Chatradhi Signed-off-by: Akshay Gupta Link: https://lore.kernel.org/r/20250716110729.2193725-2-akshay.gupta@amd.com Signed-off-by: Greg Kroah-Hartman commit e108b0a5d339aca9661cd93eb4258b2c661e11e8 Author: Akshay Gupta Date: Wed Jul 16 11:07:27 2025 +0000 misc: amd-sbi: Address potential integer overflow issue reported in smatch Smatch warnings are reported for below commit, Commit bb13a84ed6b7 ("misc: amd-sbi: Add support for CPUID protocol") from Apr 28, 2025 (linux-next), leads to the following Smatch static checker warning: drivers/misc/amd-sbi/rmi-core.c:132 rmi_cpuid_read() warn: bitwise OR is zero '0xffffffff00000000 & 0xffff' drivers/misc/amd-sbi/rmi-core.c:132 rmi_cpuid_read() warn: potential integer overflow from user 'msg->cpu_in_out << 32' drivers/misc/amd-sbi/rmi-core.c:213 rmi_mca_msr_read() warn: bitwise OR is zero '0xffffffff00000000 & 0xffff' drivers/misc/amd-sbi/rmi-core.c:213 rmi_mca_msr_read() warn: potential integer overflow from user 'msg->mcamsr_in_out << 32' CPUID & MCAMSR thread data from input is available at byte 4 & 5, this patch fixes to copy the user data correctly in the argument. Previously, CPUID and MCAMSR data is return only for thread 0. Fixes: bb13a84ed6b7 ("misc: amd-sbi: Add support for CPUID protocol") Fixes: 69b1ba83d21c ("misc: amd-sbi: Add support for read MCA register protocol") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/aDVyO8ByVsceybk9@stanley.mountain/ Reviewed-by: Naveen Krishna Chatradhi Signed-off-by: Akshay Gupta Link: https://lore.kernel.org/r/20250716110729.2193725-1-akshay.gupta@amd.com Signed-off-by: Greg Kroah-Hartman commit 1b98304c09a0192598d0767f1eb8c83d7e793091 Author: Ian Abbott Date: Tue Jul 8 14:06:27 2025 +0100 comedi: comedi_test: Fix possible deletion of uninitialized timers In `waveform_common_attach()`, the two timers `&devpriv->ai_timer` and `&devpriv->ao_timer` are initialized after the allocation of the device private data by `comedi_alloc_devpriv()` and the subdevices by `comedi_alloc_subdevices()`. The function may return with an error between those function calls. In that case, `waveform_detach()` will be called by the Comedi core to clean up. The check that `waveform_detach()` uses to decide whether to delete the timers is incorrect. It only checks that the device private data was allocated, but that does not guarantee that the timers were initialized. It also needs to check that the subdevices were allocated. Fix it. Fixes: 73e0e4dfed4c ("staging: comedi: comedi_test: fix timer lock-up") Cc: stable@vger.kernel.org # 6.15+ Signed-off-by: Ian Abbott Link: https://lore.kernel.org/r/20250708130627.21743-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 46d8c744136ce2454aa4c35c138cc06817f92b8e Author: Ian Abbott Date: Mon Jul 7 17:14:39 2025 +0100 comedi: Fix initialization of data for instructions that write to subdevice Some Comedi subdevice instruction handlers are known to access instruction data elements beyond the first `insn->n` elements in some cases. The `do_insn_ioctl()` and `do_insnlist_ioctl()` functions allocate at least `MIN_SAMPLES` (16) data elements to deal with this, but they do not initialize all of that. For Comedi instruction codes that write to the subdevice, the first `insn->n` data elements are copied from user-space, but the remaining elements are left uninitialized. That could be a problem if the subdevice instruction handler reads the uninitialized data. Ensure that the first `MIN_SAMPLES` elements are initialized before calling these instruction handlers, filling the uncopied elements with 0. For `do_insnlist_ioctl()`, the same data buffer elements are used for handling a list of instructions, so ensure the first `MIN_SAMPLES` elements are initialized for each instruction that writes to the subdevice. Fixes: ed9eccbe8970 ("Staging: add comedi core") Cc: stable@vger.kernel.org # 5.13+ Signed-off-by: Ian Abbott Link: https://lore.kernel.org/r/20250707161439.88385-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit e9cb26291d009243a4478a7ffb37b3a9175bfce9 Author: Ian Abbott Date: Mon Jul 7 16:33:54 2025 +0100 comedi: Fix use of uninitialized data in insn_rw_emulate_bits() For Comedi `INSN_READ` and `INSN_WRITE` instructions on "digital" subdevices (subdevice types `COMEDI_SUBD_DI`, `COMEDI_SUBD_DO`, and `COMEDI_SUBD_DIO`), it is common for the subdevice driver not to have `insn_read` and `insn_write` handler functions, but to have an `insn_bits` handler function for handling Comedi `INSN_BITS` instructions. In that case, the subdevice's `insn_read` and/or `insn_write` function handler pointers are set to point to the `insn_rw_emulate_bits()` function by `__comedi_device_postconfig()`. For `INSN_WRITE`, `insn_rw_emulate_bits()` currently assumes that the supplied `data[0]` value is a valid copy from user memory. It will at least exist because `do_insnlist_ioctl()` and `do_insn_ioctl()` in "comedi_fops.c" ensure at lease `MIN_SAMPLES` (16) elements are allocated. However, if `insn->n` is 0 (which is allowable for `INSN_READ` and `INSN_WRITE` instructions, then `data[0]` may contain uninitialized data, and certainly contains invalid data, possibly from a different instruction in the array of instructions handled by `do_insnlist_ioctl()`. This will result in an incorrect value being written to the digital output channel (or to the digital input/output channel if configured as an output), and may be reflected in the internal saved state of the channel. Fix it by returning 0 early if `insn->n` is 0, before reaching the code that accesses `data[0]`. Previously, the function always returned 1 on success, but it is supposed to be the number of data samples actually read or written up to `insn->n`, which is 0 in this case. Reported-by: syzbot+cb96ec476fb4914445c9@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=cb96ec476fb4914445c9 Fixes: ed9eccbe8970 ("Staging: add comedi core") Cc: stable@vger.kernel.org # 5.13+ Signed-off-by: Ian Abbott Link: https://lore.kernel.org/r/20250707153355.82474-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 70f2b28b5243df557f51c054c20058ae207baaac Author: Ian Abbott Date: Mon Jul 7 14:57:37 2025 +0100 comedi: das6402: Fix bit shift out of bounds When checking for a supported IRQ number, the following test is used: /* IRQs 2,3,5,6,7, 10,11,15 are valid for "enhanced" mode */ if ((1 << it->options[1]) & 0x8cec) { However, `it->options[i]` is an unchecked `int` value from userspace, so the shift amount could be negative or out of bounds. Fix the test by requiring `it->options[1]` to be within bounds before proceeding with the original test. Valid `it->options[1]` values that select the IRQ will be in the range [1,15]. The value 0 explicitly disables the use of interrupts. Fixes: 79e5e6addbb1 ("staging: comedi: das6402: rewrite broken driver") Cc: stable@vger.kernel.org # 5.13+ Signed-off-by: Ian Abbott Link: https://lore.kernel.org/r/20250707135737.77448-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 66acb1586737a22dd7b78abc63213b1bcaa100e4 Author: Ian Abbott Date: Mon Jul 7 14:46:22 2025 +0100 comedi: aio_iiro_16: Fix bit shift out of bounds When checking for a supported IRQ number, the following test is used: if ((1 << it->options[1]) & 0xdcfc) { However, `it->options[i]` is an unchecked `int` value from userspace, so the shift amount could be negative or out of bounds. Fix the test by requiring `it->options[1]` to be within bounds before proceeding with the original test. Valid `it->options[1]` values that select the IRQ will be in the range [1,15]. The value 0 explicitly disables the use of interrupts. Fixes: ad7a370c8be4 ("staging: comedi: aio_iiro_16: add command support for change of state detection") Cc: stable@vger.kernel.org # 5.13+ Signed-off-by: Ian Abbott Link: https://lore.kernel.org/r/20250707134622.75403-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit b14b076ce593f72585412fc7fd3747e03a5e3632 Author: Ian Abbott Date: Mon Jul 7 14:34:29 2025 +0100 comedi: pcl812: Fix bit shift out of bounds When checking for a supported IRQ number, the following test is used: if ((1 << it->options[1]) & board->irq_bits) { However, `it->options[i]` is an unchecked `int` value from userspace, so the shift amount could be negative or out of bounds. Fix the test by requiring `it->options[1]` to be within bounds before proceeding with the original test. Valid `it->options[1]` values that select the IRQ will be in the range [1,15]. The value 0 explicitly disables the use of interrupts. Reported-by: syzbot+32de323b0addb9e114ff@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=32de323b0addb9e114ff Fixes: fcdb427bc7cf ("Staging: comedi: add pcl821 driver") Cc: stable@vger.kernel.org # 5.13+ Signed-off-by: Ian Abbott Link: https://lore.kernel.org/r/20250707133429.73202-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit ed93c6f68a3be06e4e0c331c6e751f462dee3932 Author: Ian Abbott Date: Mon Jul 7 14:09:08 2025 +0100 comedi: das16m1: Fix bit shift out of bounds When checking for a supported IRQ number, the following test is used: /* only irqs 2, 3, 4, 5, 6, 7, 10, 11, 12, 14, and 15 are valid */ if ((1 << it->options[1]) & 0xdcfc) { However, `it->options[i]` is an unchecked `int` value from userspace, so the shift amount could be negative or out of bounds. Fix the test by requiring `it->options[1]` to be within bounds before proceeding with the original test. Reported-by: syzbot+c52293513298e0fd9a94@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c52293513298e0fd9a94 Fixes: 729988507680 ("staging: comedi: das16m1: tidy up the irq support in das16m1_attach()") Tested-by: syzbot+c52293513298e0fd9a94@syzkaller.appspotmail.com Suggested-by: "Enju, Kohei" Cc: stable@vger.kernel.org # 5.13+ Signed-off-by: Ian Abbott Link: https://lore.kernel.org/r/20250707130908.70758-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit ab705c8c35e18652abc6239c07cf3441f03e2cda Author: Ian Abbott Date: Mon Jul 7 13:15:55 2025 +0100 comedi: Fix some signed shift left operations Correct some left shifts of the signed integer constant 1 by some unsigned number less than 32. Change the constant to 1U to avoid shifting a 1 into the sign bit. The corrected functions are comedi_dio_insn_config(), comedi_dio_update_state(), and __comedi_device_postconfig(). Fixes: e523c6c86232 ("staging: comedi: drivers: introduce comedi_dio_insn_config()") Fixes: 05e60b13a36b ("staging: comedi: drivers: introduce comedi_dio_update_state()") Fixes: 09567cb4373e ("staging: comedi: initialize subdevice s->io_bits in postconfig") Cc: stable@vger.kernel.org # 5.13+ Signed-off-by: Ian Abbott Link: https://lore.kernel.org/r/20250707121555.65424-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 08ae4b20f5e82101d77326ecab9089e110f224cc Author: Ian Abbott Date: Fri Jul 4 13:04:05 2025 +0100 comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large The handling of the `COMEDI_INSNLIST` ioctl allocates a kernel buffer to hold the array of `struct comedi_insn`, getting the length from the `n_insns` member of the `struct comedi_insnlist` supplied by the user. The allocation will fail with a WARNING and a stack dump if it is too large. Avoid that by failing with an `-EINVAL` error if the supplied `n_insns` value is unreasonable. Define the limit on the `n_insns` value in the `MAX_INSNS` macro. Set this to the same value as `MAX_SAMPLES` (65536), which is the maximum allowed sum of the values of the member `n` in the array of `struct comedi_insn`, and sensible comedi instructions will have an `n` of at least 1. Reported-by: syzbot+d6995b62e5ac7d79557a@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d6995b62e5ac7d79557a Fixes: ed9eccbe8970 ("Staging: add comedi core") Tested-by: Ian Abbott Cc: stable@vger.kernel.org # 5.13+ Signed-off-by: Ian Abbott Link: https://lore.kernel.org/r/20250704120405.83028-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit a88cddaaa3bf7445357a79a5c351c6b6d6f95b7d Author: Christian Brauner Date: Wed Jul 16 10:40:45 2025 +0200 MAINTAINERS: add block and fsdevel lists to iov_iter We've had multiple instances where people didn't Cc fsdevel or block which are easily the most affected subsystems by iov_iter changes. Put a stop to that and make sure both lists are Cced so we can catch stuff like [1] early. Link: https://lore.kernel.org/linux-nvme/20250715132750.9619-4-aaptel@nvidia.com [1] Link: https://lore.kernel.org/20250716-eklig-rasten-ec8c4dc05a1e@brauner Reviewed-by: Jens Axboe Signed-off-by: Christian Brauner commit c4706c5058a7bd7d7c20f3b24a8f523ecad44e83 Author: Ming Lei Date: Wed Jul 16 19:48:08 2025 +0800 loop: use kiocb helpers to fix lockdep warning The lockdep tool can report a circular lock dependency warning in the loop driver's AIO read/write path: ``` [ 6540.587728] kworker/u96:5/72779 is trying to acquire lock: [ 6540.593856] ff110001b5968440 (sb_writers#9){.+.+}-{0:0}, at: loop_process_work+0x11a/0xf70 [loop] [ 6540.603786] [ 6540.603786] but task is already holding lock: [ 6540.610291] ff110001b5968440 (sb_writers#9){.+.+}-{0:0}, at: loop_process_work+0x11a/0xf70 [loop] [ 6540.620210] [ 6540.620210] other info that might help us debug this: [ 6540.627499] Possible unsafe locking scenario: [ 6540.627499] [ 6540.634110] CPU0 [ 6540.636841] ---- [ 6540.639574] lock(sb_writers#9); [ 6540.643281] lock(sb_writers#9); [ 6540.646988] [ 6540.646988] *** DEADLOCK *** ``` This patch fixes the issue by using the AIO-specific helpers `kiocb_start_write()` and `kiocb_end_write()`. These functions are designed to be used with a `kiocb` and manage write sequencing correctly for asynchronous I/O without introducing the problematic lock dependency. The `kiocb` is already part of the `loop_cmd` struct, so this change also simplifies the completion function `lo_rw_aio_do_completion()` by using the `iocb` from the `cmd` struct directly, instead of retrieving the loop device from the request queue. Fixes: 39d86db34e41 ("loop: add file_start_write() and file_end_write()") Cc: Changhui Zhong Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250716114808.3159657-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 7bab1bd9fdf15b9fa7e6a4b0151deab93df3c80d Author: Lane Odenbach Date: Tue Jul 15 13:20:38 2025 -0500 ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx This fixes the internal microphone in the stated device Signed-off-by: Lane Odenbach Link: https://patch.msgid.link/20250715182038.10048-1-laodenbach@gmail.com Signed-off-by: Mark Brown commit 95a16160ca1d75c66bf7a1c5e0bcaffb18e7c7fc Author: Arunpravin Paneer Selvam Date: Wed Jul 16 13:21:24 2025 +0530 drm/amdgpu: Reset the clear flag in buddy during resume - Added a handler in DRM buddy manager to reset the cleared flag for the blocks in the freelist. - This is necessary because, upon resuming, the VRAM becomes cluttered with BIOS data, yet the VRAM backend manager believes that everything has been cleared. v2: - Add lock before accessing drm_buddy_clear_reset_blocks()(Matthew Auld) - Force merge the two dirty blocks.(Matthew Auld) - Add a new unit test case for this issue.(Matthew Auld) - Having this function being able to flip the state either way would be good. (Matthew Brost) v3(Matthew Auld): - Do merge step first to avoid the use of extra reset flag. Signed-off-by: Arunpravin Paneer Selvam Suggested-by: Christian König Acked-by: Christian König Reviewed-by: Matthew Auld Cc: stable@vger.kernel.org Fixes: a68c7eaa7a8f ("drm/amdgpu: Enable clear page functionality") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3812 Signed-off-by: Christian König Link: https://lore.kernel.org/r/20250716075125.240637-2-Arunpravin.PaneerSelvam@amd.com commit ec5b9c847bb8ac0f458d2b2a3fa23ee84dd99c40 Author: Bard Liao Date: Wed Jul 16 16:22:33 2025 +0800 ASoC: Intel: soc-acpi: add support for HP Omen14 ARL This platform has an RT711-sdca on link0 and RT1316 on link3. Signed-off-by: Bard Liao Reviewed-by: Peter Ujfalusi Link: https://patch.msgid.link/20250716082233.1810334-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 21b34a3a204ed616373a12ec17dc127ebe51eab3 Author: Nathan Chancellor Date: Tue Jul 15 15:56:05 2025 -0700 memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() A new warning in clang [1] points out that id_reg is uninitialized then passed to memstick_init_req() as a const pointer: drivers/memstick/core/memstick.c:330:59: error: variable 'id_reg' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer] 330 | memstick_init_req(&card->current_mrq, MS_TPC_READ_REG, &id_reg, | ^~~~~~ Commit de182cc8e882 ("drivers/memstick/core/memstick.c: avoid -Wnonnull warning") intentionally passed this variable uninitialized to avoid an -Wnonnull warning from a NULL value that was previously there because id_reg is never read from the call to memstick_init_req() in h_memstick_read_dev_id(). Just zero initialize id_reg to avoid the warning, which is likely happening in the majority of builds using modern compilers that support '-ftrivial-auto-var-init=zero'. Cc: stable@vger.kernel.org Fixes: de182cc8e882 ("drivers/memstick/core/memstick.c: avoid -Wnonnull warning") Link: https://github.com/llvm/llvm-project/commit/00dacf8c22f065cb52efb14cd091d441f19b319e [1] Closes: https://github.com/ClangBuiltLinux/linux/issues/2105 Signed-off-by: Nathan Chancellor Link: https://lore.kernel.org/r/20250715-memstick-fix-uninit-const-pointer-v1-1-f6753829c27a@kernel.org Signed-off-by: Ulf Hansson commit 2022d704014d7a5b19dfe0a1ae5c67be0498e37c Author: Ralf Lici Date: Tue Jul 1 14:47:44 2025 +0200 ovpn: reset GSO metadata after decapsulation The ovpn_netdev_write() function is responsible for injecting decapsulated and decrypted packets back into the local network stack. Prior to this patch, the skb could retain GSO metadata from the outer, encrypted tunnel packet. This original GSO metadata, relevant to the sender's transport context, becomes invalid and misleading for the tunnel/data path once the inner packet is exposed. Leaving this stale metadata intact causes internal GSO validation checks further down the kernel's network stack (validate_xmit_skb()) to fail, leading to packet drops. The reasons for these failures vary by protocol, for example: - for ICMP, no offload handler is registered; - for TCP and UDP, the respective offload handlers return errors when comparing skb->len to the outdated skb_shinfo(skb)->gso_size. By calling skb_gso_reset(skb) we ensure the inner packet is presented to gro_cells_receive() with a clean state, correctly indicating it is an individual packet from the perspective of the local stack. This change eliminates the "Driver has suspect GRO implementation, TCP performance may be compromised" warning and improves overall TCP performance by allowing GSO/GRO to function as intended on the decapsulated traffic. Fixes: 11851cbd60ea ("ovpn: implement TCP transport") Reported-by: Gert Doering Closes: https://github.com/OpenVPN/ovpn-net-next/issues/4 Tested-by: Gert Doering Signed-off-by: Ralf Lici Signed-off-by: Antonio Quartulli commit af52020fc5995dd3bcbc91b897daded755564be7 Author: Antonio Quartulli Date: Wed Jun 25 16:08:11 2025 +0200 ovpn: reject unexpected netlink attributes Netlink ops do not expect all attributes to be always set, however this condition is not explicitly coded any where, leading the user to believe that all sent attributes are somewhat processed. Fix this behaviour by introducing explicit checks. For CMD_OVPN_PEER_GET and CMD_OVPN_KEY_GET directly open-code the needed condition in the related ops handlers. While for all other ops use attribute subsets in the ovpn.yaml spec file. Fixes: b7a63391aa98 ("ovpn: add basic netlink support") Reported-by: Ralf Lici Closes: https://github.com/OpenVPN/ovpn-net-next/issues/19 Signed-off-by: Antonio Quartulli commit 4c88cfcc6738466a33778c346061f7507403276a Author: Ralf Lici Date: Wed Jun 4 15:11:58 2025 +0200 ovpn: propagate socket mark to skb in UDP OpenVPN allows users to configure a FW mark on sockets used to communicate with other peers. The mark is set by means of the `SO_MARK` Linux socket option. However, in the ovpn UDP code path, the socket's `sk_mark` value is currently ignored and it is not propagated to outgoing `skbs`. This commit ensures proper inheritance of the field by setting `skb->mark` to `sk->sk_mark` before handing the `skb` to the network stack for transmission. Fixes: 08857b5ec5d9 ("ovpn: implement basic TX path (UDP)") Reviewed-by: Sabrina Dubroca Signed-off-by: Ralf Lici Link: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg31877.html Signed-off-by: Antonio Quartulli commit 2521106fc732b0b75fd3555c689b1ed1d29d273c Author: Mathias Nyman Date: Mon Jun 23 16:39:47 2025 +0300 usb: hub: Don't try to recover devices lost during warm reset. Hub driver warm-resets ports in SS.Inactive or Compliance mode to recover a possible connected device. The port reset code correctly detects if a connection is lost during reset, but hub driver port_event() fails to take this into account in some cases. port_event() ends up using stale values and assumes there is a connected device, and will try all means to recover it, including power-cycling the port. Details: This case was triggered when xHC host was suspended with DbC (Debug Capability) enabled and connected. DbC turns one xHC port into a simple usb debug device, allowing debugging a system with an A-to-A USB debug cable. xhci DbC code disables DbC when xHC is system suspended to D3, and enables it back during resume. We essentially end up with two hosts connected to each other during suspend, and, for a short while during resume, until DbC is enabled back. The suspended xHC host notices some activity on the roothub port, but can't train the link due to being suspended, so xHC hardware sets a CAS (Cold Attach Status) flag for this port to inform xhci host driver that the port needs to be warm reset once xHC resumes. CAS is xHCI specific, and not part of USB specification, so xhci driver tells usb core that the port has a connection and link is in compliance mode. Recovery from complinace mode is similar to CAS recovery. xhci CAS driver support that fakes a compliance mode connection was added in commit 8bea2bd37df0 ("usb: Add support for root hub port status CAS") Once xHCI resumes and DbC is enabled back, all activity on the xHC roothub host side port disappears. The hub driver will anyway think port has a connection and link is in compliance mode, and hub driver will try to recover it. The port power-cycle during recovery seems to cause issues to the active DbC connection. Fix this by clearing connect_change flag if hub_port_reset() returns -ENOTCONN, thus avoiding the whole unnecessary port recovery and initialization attempt. Cc: stable@vger.kernel.org Fixes: 8bea2bd37df0 ("usb: Add support for root hub port status CAS") Tested-by: Łukasz Bartosik Signed-off-by: Mathias Nyman Acked-by: Alan Stern Link: https://lore.kernel.org/r/20250623133947.3144608-1-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit f2b8ebfb867011ddbefbdf7b04ad62626cbc2afd Author: Stefan Wahren Date: Tue Jul 15 18:11:08 2025 +0200 staging: vchiq_arm: Make vchiq_shutdown never fail Most of the users of vchiq_shutdown ignore the return value, which is bad because this could lead to resource leaks. So instead of changing all calls to vchiq_shutdown, it's easier to make vchiq_shutdown never fail. Fixes: 71bad7f08641 ("staging: add bcm2708 vchiq driver") Signed-off-by: Stefan Wahren Link: https://lore.kernel.org/r/20250715161108.3411-4-wahrenst@gmx.net Signed-off-by: Greg Kroah-Hartman commit 228af5a58524fba09ec4b7d184694db4f7fe96f5 Author: Stefan Wahren Date: Tue Jul 15 18:11:07 2025 +0200 Revert "staging: vchiq_arm: Create keep-alive thread during probe" The commit 86bc88217006 ("staging: vchiq_arm: Create keep-alive thread during probe") introduced a regression for certain configurations, which doesn't have a VCHIQ user. This results in a unused and hanging keep-alive thread: INFO: task vchiq-keep/0:85 blocked for more than 120 seconds. Not tainted 6.12.34-v8-+ #13 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:vchiq-keep/0 state:D stack:0 pid:85 tgid:85 ppid:2 Call trace: __switch_to+0x188/0x230 __schedule+0xa54/0xb28 schedule+0x80/0x120 schedule_preempt_disabled+0x30/0x50 kthread+0xd4/0x1a0 ret_from_fork+0x10/0x20 Fixes: 86bc88217006 ("staging: vchiq_arm: Create keep-alive thread during probe") Reported-by: Maíra Canal Closes: https://lore.kernel.org/linux-staging/ba35b960-a981-4671-9f7f-060da10feaa1@usp.br/ Cc: stable@kernel.org Signed-off-by: Stefan Wahren Reviewed-by: Maíra Canal Link: https://lore.kernel.org/r/20250715161108.3411-3-wahrenst@gmx.net Signed-off-by: Greg Kroah-Hartman commit ebe0b2ecb7b8285852414a0f20044432e37d9b4c Author: Stefan Wahren Date: Tue Jul 15 18:11:06 2025 +0200 Revert "staging: vchiq_arm: Improve initial VCHIQ connect" The commit 3e5def4249b9 ("staging: vchiq_arm: Improve initial VCHIQ connect") based on the assumption that in good case the VCHIQ connect always happen and therefore the keep-alive thread is guaranteed to be woken up. This is wrong, because in certain configurations there are no VCHIQ users and so the VCHIQ connect never happen. So revert it. Fixes: 3e5def4249b9 ("staging: vchiq_arm: Improve initial VCHIQ connect") Reported-by: Maíra Canal Closes: https://lore.kernel.org/linux-staging/ba35b960-a981-4671-9f7f-060da10feaa1@usp.br/ Cc: stable@kernel.org Signed-off-by: Stefan Wahren Reviewed-by: Maíra Canal Link: https://lore.kernel.org/r/20250715161108.3411-2-wahrenst@gmx.net Signed-off-by: Greg Kroah-Hartman commit 1ed171a3afe81531b3ace96bd151a372dda3ee25 Author: Nathan Chancellor Date: Tue Jul 15 20:19:44 2025 -0700 tracing/probes: Avoid using params uninitialized in parse_btf_arg() After a recent change in clang to strengthen uninitialized warnings [1], it points out that in one of the error paths in parse_btf_arg(), params is used uninitialized: kernel/trace/trace_probe.c:660:19: warning: variable 'params' is uninitialized when used here [-Wuninitialized] 660 | return PTR_ERR(params); | ^~~~~~ Match many other NO_BTF_ENTRY error cases and return -ENOENT, clearing up the warning. Link: https://lore.kernel.org/all/20250715-trace_probe-fix-const-uninit-warning-v1-1-98960f91dd04@kernel.org/ Cc: stable@vger.kernel.org Closes: https://github.com/ClangBuiltLinux/linux/issues/2110 Fixes: d157d7694460 ("tracing/probes: Support BTF field access from $retval") Link: https://github.com/llvm/llvm-project/commit/2464313eef01c5b1edf0eccf57a32cdee01472c7 [1] Signed-off-by: Nathan Chancellor Signed-off-by: Masami Hiramatsu (Google) commit dae7f9cbd1909de2b0bccc30afef95c23f93e477 Merge: 2b30a3d1ec2538 da9b2fc7b73d14 Author: Jakub Kicinski Date: Tue Jul 15 17:31:30 2025 -0700 Merge branch 'mptcp-fix-fallback-related-races' Matthieu Baerts says: ==================== mptcp: fix fallback-related races This series contains 3 fixes somewhat related to various races we have while handling fallback. The root cause of the issues addressed here is that the check for "we can fallback to tcp now" and the related action are not atomic. That also applies to fallback due to MP_FAIL -- where the window race is even wider. Address the issue introducing an additional spinlock to bundle together all the relevant events, as per patch 1 and 2. These fixes can be backported up to v5.19 and v5.15. Note that mptcp_disconnect() unconditionally clears the fallback status (zeroing msk->flags) but don't touch the `allows_infinite_fallback` flag. Such issue is addressed in patch 3, and can be backported up to v5.17. ==================== Link: https://patch.msgid.link/20250714-net-mptcp-fallback-races-v1-0-391aff963322@kernel.org Signed-off-by: Jakub Kicinski commit da9b2fc7b73d147d88abe1922de5ab72d72d7756 Author: Paolo Abeni Date: Mon Jul 14 18:41:46 2025 +0200 mptcp: reset fallback status gracefully at disconnect() time mptcp_disconnect() clears the fallback bit unconditionally, without touching the associated flags. The bit clear is safe, as no fallback operation can race with that -- all subflow are already in TCP_CLOSE status thanks to the previous FASTCLOSE -- but we need to consistently reset all the fallback related status. Also acquire the relevant lock, to avoid fouling static analyzers. Fixes: b29fcfb54cd7 ("mptcp: full disconnect implementation") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250714-net-mptcp-fallback-races-v1-3-391aff963322@kernel.org Signed-off-by: Jakub Kicinski commit def5b7b2643ebba696fc60ddf675dca13f073486 Author: Paolo Abeni Date: Mon Jul 14 18:41:45 2025 +0200 mptcp: plug races between subflow fail and subflow creation We have races similar to the one addressed by the previous patch between subflow failing and additional subflow creation. They are just harder to trigger. The solution is similar. Use a separate flag to track the condition 'socket state prevent any additional subflow creation' protected by the fallback lock. The socket fallback makes such flag true, and also receiving or sending an MP_FAIL option. The field 'allow_infinite_fallback' is now always touched under the relevant lock, we can drop the ONCE annotation on write. Fixes: 478d770008b0 ("mptcp: send out MP_FAIL when data checksum fails") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250714-net-mptcp-fallback-races-v1-2-391aff963322@kernel.org Signed-off-by: Jakub Kicinski commit f8a1d9b18c5efc76784f5a326e905f641f839894 Author: Paolo Abeni Date: Mon Jul 14 18:41:44 2025 +0200 mptcp: make fallback action and fallback decision atomic Syzkaller reported the following splat: WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 __mptcp_do_fallback net/mptcp/protocol.h:1223 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_do_fallback net/mptcp/protocol.h:1244 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 check_fully_established net/mptcp/options.c:982 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_incoming_options+0x21a8/0x2510 net/mptcp/options.c:1153 Modules linked in: CPU: 1 UID: 0 PID: 7704 Comm: syz.3.1419 Not tainted 6.16.0-rc3-gbd5ce2324dba #20 PREEMPT(voluntary) Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:__mptcp_do_fallback net/mptcp/protocol.h:1223 [inline] RIP: 0010:mptcp_do_fallback net/mptcp/protocol.h:1244 [inline] RIP: 0010:check_fully_established net/mptcp/options.c:982 [inline] RIP: 0010:mptcp_incoming_options+0x21a8/0x2510 net/mptcp/options.c:1153 Code: 24 18 e8 bb 2a 00 fd e9 1b df ff ff e8 b1 21 0f 00 e8 ec 5f c4 fc 44 0f b7 ac 24 b0 00 00 00 e9 54 f1 ff ff e8 d9 5f c4 fc 90 <0f> 0b 90 e9 b8 f4 ff ff e8 8b 2a 00 fd e9 8d e6 ff ff e8 81 2a 00 RSP: 0018:ffff8880a3f08448 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8880180a8000 RCX: ffffffff84afcf45 RDX: ffff888090223700 RSI: ffffffff84afdaa7 RDI: 0000000000000001 RBP: ffff888017955780 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff8880180a8910 R14: ffff8880a3e9d058 R15: 0000000000000000 FS: 00005555791b8500(0000) GS:ffff88811c495000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000110c2800b7 CR3: 0000000058e44000 CR4: 0000000000350ef0 Call Trace: tcp_reset+0x26f/0x2b0 net/ipv4/tcp_input.c:4432 tcp_validate_incoming+0x1057/0x1b60 net/ipv4/tcp_input.c:5975 tcp_rcv_established+0x5b5/0x21f0 net/ipv4/tcp_input.c:6166 tcp_v4_do_rcv+0x5dc/0xa70 net/ipv4/tcp_ipv4.c:1925 tcp_v4_rcv+0x3473/0x44a0 net/ipv4/tcp_ipv4.c:2363 ip_protocol_deliver_rcu+0xba/0x480 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2f1/0x500 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:317 [inline] NF_HOOK include/linux/netfilter.h:311 [inline] ip_local_deliver+0x1be/0x560 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:469 [inline] ip_rcv_finish net/ipv4/ip_input.c:447 [inline] NF_HOOK include/linux/netfilter.h:317 [inline] NF_HOOK include/linux/netfilter.h:311 [inline] ip_rcv+0x514/0x810 net/ipv4/ip_input.c:567 __netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:5975 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6088 process_backlog+0x301/0x1360 net/core/dev.c:6440 __napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7453 napi_poll net/core/dev.c:7517 [inline] net_rx_action+0xb44/0x1010 net/core/dev.c:7644 handle_softirqs+0x1d0/0x770 kernel/softirq.c:579 do_softirq+0x3f/0x90 kernel/softirq.c:480 __local_bh_enable_ip+0xed/0x110 kernel/softirq.c:407 local_bh_enable include/linux/bottom_half.h:33 [inline] inet_csk_listen_stop+0x2c5/0x1070 net/ipv4/inet_connection_sock.c:1524 mptcp_check_listen_stop.part.0+0x1cc/0x220 net/mptcp/protocol.c:2985 mptcp_check_listen_stop net/mptcp/mib.h:118 [inline] __mptcp_close+0x9b9/0xbd0 net/mptcp/protocol.c:3000 mptcp_close+0x2f/0x140 net/mptcp/protocol.c:3066 inet_release+0xed/0x200 net/ipv4/af_inet.c:435 inet6_release+0x4f/0x70 net/ipv6/af_inet6.c:487 __sock_release+0xb3/0x270 net/socket.c:649 sock_close+0x1c/0x30 net/socket.c:1439 __fput+0x402/0xb70 fs/file_table.c:465 task_work_run+0x150/0x240 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xd4/0xe0 kernel/entry/common.c:114 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline] do_syscall_64+0x245/0x360 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc92f8a36ad Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcf52802d8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffcf52803a8 RCX: 00007fc92f8a36ad RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007fc92fae7ba0 R08: 0000000000000001 R09: 0000002800000000 R10: 00007fc92f700000 R11: 0000000000000246 R12: 00007fc92fae5fac R13: 00007fc92fae5fa0 R14: 0000000000026d00 R15: 0000000000026c51 irq event stamp: 4068 hardirqs last enabled at (4076): [] __up_console_sem+0x76/0x80 kernel/printk/printk.c:344 hardirqs last disabled at (4085): [] __up_console_sem+0x5b/0x80 kernel/printk/printk.c:342 softirqs last enabled at (3096): [] local_bh_enable include/linux/bottom_half.h:33 [inline] softirqs last enabled at (3096): [] inet_csk_listen_stop+0x2c0/0x1070 net/ipv4/inet_connection_sock.c:1524 softirqs last disabled at (3097): [] do_softirq+0x3f/0x90 kernel/softirq.c:480 Since we need to track the 'fallback is possible' condition and the fallback status separately, there are a few possible races open between the check and the actual fallback action. Add a spinlock to protect the fallback related information and use it close all the possible related races. While at it also remove the too-early clearing of allow_infinite_fallback in __mptcp_subflow_connect(): the field will be correctly cleared by subflow_finish_connect() if/when the connection will complete successfully. If fallback is not possible, as per RFC, reset the current subflow. Since the fallback operation can now fail and return value should be checked, rename the helper accordingly. Fixes: 0530020a7c8f ("mptcp: track and update contiguous data status") Cc: stable@vger.kernel.org Reported-by: Matthieu Baerts Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/570 Reported-by: syzbot+5cf807c20386d699b524@syzkaller.appspotmail.com Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/555 Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250714-net-mptcp-fallback-races-v1-1-391aff963322@kernel.org Signed-off-by: Jakub Kicinski commit 2b30a3d1ec2538a1fd363fde746b9fe1d38abc77 Author: Jiawen Wu Date: Mon Jul 14 09:56:56 2025 +0800 net: libwx: fix multicast packets received count Multicast good packets received by PF rings that pass ethternet MAC address filtering are counted for rtnl_link_stats64.multicast. The counter is not cleared on read. Fix the duplicate counting on updating statistics. Fixes: 46b92e10d631 ("net: libwx: support hardware statistics") Cc: stable@vger.kernel.org Signed-off-by: Jiawen Wu Reviewed-by: Simon Horman Link: https://patch.msgid.link/DA229A4F58B70E51+20250714015656.91772-1-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit d4f9b8847989e17ae1f2f52a6702ff493548f072 Merge: e6176ab107ec6e d992ed7e1b687a Author: Jakub Kicinski Date: Tue Jul 15 17:28:28 2025 -0700 Merge branch 'fix-rx-fatal-errors' Jiawen Wu says: ==================== Fix Rx fatal errors There are some fatal errors on the Rx NAPI path, which can cause the kernel to crash. Fix known issues and potential risks. The part of the patches has been mentioned before[1]. [1]: https://lore.kernel.org/all/C8A23A11DB646E60+20250630094102.22265-1-jiawenwu@trustnetic.com/ v1: https://lore.kernel.org/20250709064025.19436-1-jiawenwu@trustnetic.com ==================== Link: https://patch.msgid.link/20250714024755.17512-1-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit d992ed7e1b687ad7df0763d3e015a5358646210b Author: Jiawen Wu Date: Mon Jul 14 10:47:55 2025 +0800 net: libwx: properly reset Rx ring descriptor When device reset is triggered by feature changes such as toggling Rx VLAN offload, wx->do_reset() is called to reinitialize Rx rings. The hardware descriptor ring may retain stale values from previous sessions. And only set the length to 0 in rx_desc[0] would result in building malformed SKBs. Fix it to ensure a clean slate after device reset. [ 549.186435] [ C16] ------------[ cut here ]------------ [ 549.186457] [ C16] kernel BUG at net/core/skbuff.c:2814! [ 549.186468] [ C16] Oops: invalid opcode: 0000 [#1] SMP NOPTI [ 549.186472] [ C16] CPU: 16 UID: 0 PID: 0 Comm: swapper/16 Kdump: loaded Not tainted 6.16.0-rc4+ #23 PREEMPT(voluntary) [ 549.186476] [ C16] Hardware name: Micro-Star International Co., Ltd. MS-7E16/X670E GAMING PLUS WIFI (MS-7E16), BIOS 1.90 12/31/2024 [ 549.186478] [ C16] RIP: 0010:__pskb_pull_tail+0x3ff/0x510 [ 549.186484] [ C16] Code: 06 f0 ff 4f 34 74 7b 4d 8b 8c 24 c8 00 00 00 45 8b 84 24 c0 00 00 00 e9 c8 fd ff ff 48 c7 44 24 08 00 00 00 00 e9 5e fe ff ff <0f> 0b 31 c0 e9 23 90 5b ff 41 f7 c6 ff 0f 00 00 75 bf 49 8b 06 a8 [ 549.186487] [ C16] RSP: 0018:ffffb391c0640d70 EFLAGS: 00010282 [ 549.186490] [ C16] RAX: 00000000fffffff2 RBX: ffff8fe7e4d40200 RCX: 00000000fffffff2 [ 549.186492] [ C16] RDX: ffff8fe7c3a4bf8e RSI: 0000000000000180 RDI: ffff8fe7c3a4bf40 [ 549.186494] [ C16] RBP: ffffb391c0640da8 R08: ffff8fe7c3a4c0c0 R09: 000000000000000e [ 549.186496] [ C16] R10: ffffb391c0640d88 R11: 000000000000000e R12: ffff8fe7e4d40200 [ 549.186497] [ C16] R13: 00000000fffffff2 R14: ffff8fe7fa01a000 R15: 00000000fffffff2 [ 549.186499] [ C16] FS: 0000000000000000(0000) GS:ffff8fef5ae40000(0000) knlGS:0000000000000000 [ 549.186502] [ C16] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 549.186503] [ C16] CR2: 00007f77d81d6000 CR3: 000000051a032000 CR4: 0000000000750ef0 [ 549.186505] [ C16] PKRU: 55555554 [ 549.186507] [ C16] Call Trace: [ 549.186510] [ C16] [ 549.186513] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5 [ 549.186517] [ C16] __skb_pad+0xc7/0xf0 [ 549.186523] [ C16] wx_clean_rx_irq+0x355/0x3b0 [libwx] [ 549.186533] [ C16] wx_poll+0x92/0x120 [libwx] [ 549.186540] [ C16] __napi_poll+0x28/0x190 [ 549.186544] [ C16] net_rx_action+0x301/0x3f0 [ 549.186548] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5 [ 549.186551] [ C16] ? __raw_spin_lock_irqsave+0x1e/0x50 [ 549.186554] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5 [ 549.186557] [ C16] ? wake_up_nohz_cpu+0x35/0x160 [ 549.186559] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5 [ 549.186563] [ C16] handle_softirqs+0xf9/0x2c0 [ 549.186568] [ C16] __irq_exit_rcu+0xc7/0x130 [ 549.186572] [ C16] common_interrupt+0xb8/0xd0 [ 549.186576] [ C16] [ 549.186577] [ C16] [ 549.186579] [ C16] asm_common_interrupt+0x22/0x40 [ 549.186582] [ C16] RIP: 0010:cpuidle_enter_state+0xc2/0x420 [ 549.186585] [ C16] Code: 00 00 e8 11 0e 5e ff e8 ac f0 ff ff 49 89 c5 0f 1f 44 00 00 31 ff e8 0d ed 5c ff 45 84 ff 0f 85 40 02 00 00 fb 0f 1f 44 00 00 <45> 85 f6 0f 88 84 01 00 00 49 63 d6 48 8d 04 52 48 8d 04 82 49 8d [ 549.186587] [ C16] RSP: 0018:ffffb391c0277e78 EFLAGS: 00000246 [ 549.186590] [ C16] RAX: ffff8fef5ae40000 RBX: 0000000000000003 RCX: 0000000000000000 [ 549.186591] [ C16] RDX: 0000007fde0faac5 RSI: ffffffff826e53f6 RDI: ffffffff826fa9b3 [ 549.186593] [ C16] RBP: ffff8fe7c3a20800 R08: 0000000000000002 R09: 0000000000000000 [ 549.186595] [ C16] R10: 0000000000000000 R11: 000000000000ffff R12: ffffffff82ed7a40 [ 549.186596] [ C16] R13: 0000007fde0faac5 R14: 0000000000000003 R15: 0000000000000000 [ 549.186601] [ C16] ? cpuidle_enter_state+0xb3/0x420 [ 549.186605] [ C16] cpuidle_enter+0x29/0x40 [ 549.186609] [ C16] cpuidle_idle_call+0xfd/0x170 [ 549.186613] [ C16] do_idle+0x7a/0xc0 [ 549.186616] [ C16] cpu_startup_entry+0x25/0x30 [ 549.186618] [ C16] start_secondary+0x117/0x140 [ 549.186623] [ C16] common_startup_64+0x13e/0x148 [ 549.186628] [ C16] Fixes: 3c47e8ae113a ("net: libwx: Support to receive packets in NAPI") Cc: stable@vger.kernel.org Signed-off-by: Jiawen Wu Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250714024755.17512-4-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 5fd77cc6bd9b368431a815a780e407b7781bcca0 Author: Jiawen Wu Date: Mon Jul 14 10:47:54 2025 +0800 net: libwx: fix the using of Rx buffer DMA The wx_rx_buffer structure contained two DMA address fields: 'dma' and 'page_dma'. However, only 'page_dma' was actually initialized and used to program the Rx descriptor. But 'dma' was uninitialized and used in some paths. This could lead to undefined behavior, including DMA errors or use-after-free, if the uninitialized 'dma' was used. Althrough such error has not yet occurred, it is worth fixing in the code. Fixes: 3c47e8ae113a ("net: libwx: Support to receive packets in NAPI") Cc: stable@vger.kernel.org Signed-off-by: Jiawen Wu Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250714024755.17512-3-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 1b7e585c04cd5f0731dd25ffd396277e55fae0e6 Author: Jiawen Wu Date: Mon Jul 14 10:47:53 2025 +0800 net: libwx: remove duplicate page_pool_put_full_page() page_pool_put_full_page() should only be invoked when freeing Rx buffers or building a skb if the size is too short. At other times, the pages need to be reused. So remove the redundant page put. In the original code, double free pages cause kernel panic: [ 876.949834] __irq_exit_rcu+0xc7/0x130 [ 876.949836] common_interrupt+0xb8/0xd0 [ 876.949838] [ 876.949838] [ 876.949840] asm_common_interrupt+0x22/0x40 [ 876.949841] RIP: 0010:cpuidle_enter_state+0xc2/0x420 [ 876.949843] Code: 00 00 e8 d1 1d 5e ff e8 ac f0 ff ff 49 89 c5 0f 1f 44 00 00 31 ff e8 cd fc 5c ff 45 84 ff 0f 85 40 02 00 00 fb 0f 1f 44 00 00 <45> 85 f6 0f 88 84 01 00 00 49 63 d6 48 8d 04 52 48 8d 04 82 49 8d [ 876.949844] RSP: 0018:ffffaa7340267e78 EFLAGS: 00000246 [ 876.949845] RAX: ffff9e3f135be000 RBX: 0000000000000002 RCX: 0000000000000000 [ 876.949846] RDX: 000000cc2dc4cb7c RSI: ffffffff89ee49ae RDI: ffffffff89ef9f9e [ 876.949847] RBP: ffff9e378f940800 R08: 0000000000000002 R09: 00000000000000ed [ 876.949848] R10: 000000000000afc8 R11: ffff9e3e9e5a9b6c R12: ffffffff8a6d8580 [ 876.949849] R13: 000000cc2dc4cb7c R14: 0000000000000002 R15: 0000000000000000 [ 876.949852] ? cpuidle_enter_state+0xb3/0x420 [ 876.949855] cpuidle_enter+0x29/0x40 [ 876.949857] cpuidle_idle_call+0xfd/0x170 [ 876.949859] do_idle+0x7a/0xc0 [ 876.949861] cpu_startup_entry+0x25/0x30 [ 876.949862] start_secondary+0x117/0x140 [ 876.949864] common_startup_64+0x13e/0x148 [ 876.949867] [ 876.949868] ---[ end trace 0000000000000000 ]--- [ 876.949869] ------------[ cut here ]------------ [ 876.949870] list_del corruption, ffffead40445a348->next is NULL [ 876.949873] WARNING: CPU: 14 PID: 0 at lib/list_debug.c:52 __list_del_entry_valid_or_report+0x67/0x120 [ 876.949875] Modules linked in: snd_hrtimer(E) bnep(E) binfmt_misc(E) amdgpu(E) squashfs(E) vfat(E) loop(E) fat(E) amd_atl(E) snd_hda_codec_realtek(E) intel_rapl_msr(E) snd_hda_codec_generic(E) intel_rapl_common(E) snd_hda_scodec_component(E) snd_hda_codec_hdmi(E) snd_hda_intel(E) edac_mce_amd(E) snd_intel_dspcfg(E) snd_hda_codec(E) snd_hda_core(E) amdxcp(E) kvm_amd(E) snd_hwdep(E) gpu_sched(E) drm_panel_backlight_quirks(E) cec(E) snd_pcm(E) drm_buddy(E) snd_seq_dummy(E) drm_ttm_helper(E) btusb(E) kvm(E) snd_seq_oss(E) btrtl(E) ttm(E) btintel(E) snd_seq_midi(E) btbcm(E) drm_exec(E) snd_seq_midi_event(E) i2c_algo_bit(E) snd_rawmidi(E) bluetooth(E) drm_suballoc_helper(E) irqbypass(E) snd_seq(E) ghash_clmulni_intel(E) sha512_ssse3(E) drm_display_helper(E) aesni_intel(E) snd_seq_device(E) rfkill(E) snd_timer(E) gf128mul(E) drm_client_lib(E) drm_kms_helper(E) snd(E) i2c_piix4(E) joydev(E) soundcore(E) wmi_bmof(E) ccp(E) k10temp(E) i2c_smbus(E) gpio_amdpt(E) i2c_designware_platform(E) gpio_generic(E) sg(E) [ 876.949914] i2c_designware_core(E) sch_fq_codel(E) parport_pc(E) drm(E) ppdev(E) lp(E) parport(E) fuse(E) nfnetlink(E) ip_tables(E) ext4 crc16 mbcache jbd2 sd_mod sfp mdio_i2c i2c_core txgbe ahci ngbe pcs_xpcs libahci libwx r8169 phylink libata realtek ptp pps_core video wmi [ 876.949933] CPU: 14 UID: 0 PID: 0 Comm: swapper/14 Kdump: loaded Tainted: G W E 6.16.0-rc2+ #20 PREEMPT(voluntary) [ 876.949935] Tainted: [W]=WARN, [E]=UNSIGNED_MODULE [ 876.949936] Hardware name: Micro-Star International Co., Ltd. MS-7E16/X670E GAMING PLUS WIFI (MS-7E16), BIOS 1.90 12/31/2024 [ 876.949936] RIP: 0010:__list_del_entry_valid_or_report+0x67/0x120 [ 876.949938] Code: 00 00 00 48 39 7d 08 0f 85 a6 00 00 00 5b b8 01 00 00 00 5d 41 5c e9 73 0d 93 ff 48 89 fe 48 c7 c7 a0 31 e8 89 e8 59 7c b3 ff <0f> 0b 31 c0 5b 5d 41 5c e9 57 0d 93 ff 48 89 fe 48 c7 c7 c8 31 e8 [ 876.949940] RSP: 0018:ffffaa73405d0c60 EFLAGS: 00010282 [ 876.949941] RAX: 0000000000000000 RBX: ffffead40445a348 RCX: 0000000000000000 [ 876.949942] RDX: 0000000000000105 RSI: 0000000000000001 RDI: 00000000ffffffff [ 876.949943] RBP: 0000000000000000 R08: 000000010006dfde R09: ffffffff8a47d150 [ 876.949944] R10: ffffffff8a47d150 R11: 0000000000000003 R12: dead000000000122 [ 876.949945] R13: ffff9e3e9e5af700 R14: ffffead40445a348 R15: ffff9e3e9e5af720 [ 876.949946] FS: 0000000000000000(0000) GS:ffff9e3f135be000(0000) knlGS:0000000000000000 [ 876.949947] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 876.949948] CR2: 00007fa58b480048 CR3: 0000000156724000 CR4: 0000000000750ef0 [ 876.949949] PKRU: 55555554 [ 876.949950] Call Trace: [ 876.949951] [ 876.949952] __rmqueue_pcplist+0x53/0x2c0 [ 876.949955] alloc_pages_bulk_noprof+0x2e0/0x660 [ 876.949958] __page_pool_alloc_pages_slow+0xa9/0x400 [ 876.949961] page_pool_alloc_pages+0xa/0x20 [ 876.949963] wx_alloc_rx_buffers+0xd7/0x110 [libwx] [ 876.949967] wx_clean_rx_irq+0x262/0x430 [libwx] [ 876.949971] wx_poll+0x92/0x130 [libwx] [ 876.949975] __napi_poll+0x28/0x190 [ 876.949977] net_rx_action+0x301/0x3f0 [ 876.949980] ? srso_alias_return_thunk+0x5/0xfbef5 [ 876.949981] ? profile_tick+0x30/0x70 [ 876.949983] ? srso_alias_return_thunk+0x5/0xfbef5 [ 876.949984] ? srso_alias_return_thunk+0x5/0xfbef5 [ 876.949986] ? timerqueue_add+0xa3/0xc0 [ 876.949988] ? srso_alias_return_thunk+0x5/0xfbef5 [ 876.949989] ? __raise_softirq_irqoff+0x16/0x70 [ 876.949991] ? srso_alias_return_thunk+0x5/0xfbef5 [ 876.949993] ? srso_alias_return_thunk+0x5/0xfbef5 [ 876.949994] ? wx_msix_clean_rings+0x41/0x50 [libwx] [ 876.949998] handle_softirqs+0xf9/0x2c0 Fixes: 3c47e8ae113a ("net: libwx: Support to receive packets in NAPI") Cc: stable@vger.kernel.org Signed-off-by: Jiawen Wu Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250714024755.17512-2-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit e6176ab107ec6e57a752a97ba9f7c34a23034262 Author: Markus Blöchl Date: Sun Jul 13 22:21:41 2025 +0200 net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback get_time_fn() callback implementations are expected to fill out the entire system_counterval_t struct as it may be initially uninitialized. This broke with the removal of convert_art_to_tsc() helper functions which left use_nsecs uninitialized. Initially assign the entire struct with default values. Fixes: f5e1d0db3f02 ("stmmac: intel: Remove convert_art_to_tsc()") Cc: stable@vger.kernel.org Signed-off-by: Markus Blöchl Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250713-stmmac_crossts-v1-1-31bfe051b5cb@blochl.de Signed-off-by: Jakub Kicinski commit ae2256f9677b3c784bad99d4198d27b1a62fabc9 Merge: 4c4ca3c4616751 0f97a7588db7a5 Author: Jakub Kicinski Date: Tue Jul 15 16:05:41 2025 -0700 Merge tag 'linux-can-fixes-for-6.16-20250715' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2025-07-15 Brett Werling's patch for the tcan4x5x glue code driver fixes the detection of chips which are held in reset/sleep and must be woken up by GPIO prior to communication. * tag 'linux-can-fixes-for-6.16-20250715' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: tcan4x5x: fix reset gpio usage during probe ==================== Link: https://patch.msgid.link/20250715101625.3202690-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit 4c4ca3c46167518f8534ed70f6e3b4bf86c4d158 Author: Oliver Neukum Date: Mon Jul 14 13:12:56 2025 +0200 usb: net: sierra: check for no status endpoint The driver checks for having three endpoints and having bulk in and out endpoints, but not that the third endpoint is interrupt input. Rectify the omission. Reported-by: syzbot+3f89ec3d1d0842e95d50@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-usb/686d5a9f.050a0220.1ffab7.0017.GAE@google.com/ Tested-by: syzbot+3f89ec3d1d0842e95d50@syzkaller.appspotmail.com Fixes: eb4fd8cd355c8 ("net/usb: add sierra_net.c driver") Signed-off-by: Oliver Neukum Link: https://patch.msgid.link/20250714111326.258378-1-oneukum@suse.com Signed-off-by: Jakub Kicinski commit b8be70ec2b47ca62ccb54dc3c2ab9a9c93653e00 Author: Sean Christopherson Date: Mon Jul 14 15:19:28 2025 -0700 KVM: VMX: Ensure unused kvm_tdx_capabilities fields are zeroed out Zero-allocate the kernel's kvm_tdx_capabilities structure and copy only the number of CPUID entries from the userspace structure. As is, KVM doesn't ensure kernel_tdvmcallinfo_1_{r11,r12} and user_tdvmcallinfo_1_r12 are zeroed, i.e. KVM will reflect whatever happens to be in the userspace structure back at userspace, and thus may report garbage to userspace. Zeroing the entire kernel structure also provides better semantics for the reserved field. E.g. if KVM extends kvm_tdx_capabilities to enumerate new information by repurposing bytes from the reserved field, userspace would be required to zero the new field in order to get useful information back (because older KVMs without support for the repurposed field would report garbage, a la the aforementioned tdvmcallinfo bugs). Fixes: 61bb28279623 ("KVM: TDX: Get system-wide info about TDX module on initialization") Suggested-by: Rick Edgecombe Reported-by: Xiaoyao Li Closes: https://lore.kernel.org/all/3ef581f1-1ff1-4b99-b216-b316f6415318@intel.com Tested-by: Xiaoyao Li Reviewed-by: Xiaoyao Li Reviewed-by: Rick Edgecombe Link: https://lore.kernel.org/r/20250714221928.1788095-1-seanjc@google.com Signed-off-by: Sean Christopherson commit bedd0330a19b3a4448e67941732153ce04d3fb9b Author: Michal Swiatkowski Date: Tue Jun 24 11:26:36 2025 +0200 ice: check correct pointer in fwlog debugfs pf->ice_debugfs_pf_fwlog should be checked for an error here. Fixes: 96a9a9341cda ("ice: configure FW logging") Reviewed-by: Przemek Kitszel Signed-off-by: Michal Swiatkowski Reviewed-by: Paul Menzel Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 3ce58b01ada408b372f15b7c992ed0519840e3cf Author: Dave Ertman Date: Thu May 22 13:16:57 2025 -0400 ice: add NULL check in eswitch lag check The function ice_lag_is_switchdev_running() is being called from outside of the LAG event handler code. This results in the lag->upper_netdev being NULL sometimes. To avoid a NULL-pointer dereference, there needs to be a check before it is dereferenced. Fixes: 776fe19953b0 ("ice: block default rule setting on LAG interface") Signed-off-by: Dave Ertman Reviewed-by: Aleksandr Loktionov Tested-by: Sujai Buvaneswaran Signed-off-by: Tony Nguyen commit 24171a5a4a952c26568ff0d2a0bc8c4708a95e1d Author: Arnd Bergmann Date: Fri Jun 20 19:31:24 2025 +0200 ethernet: intel: fix building with large NR_CPUS With large values of CONFIG_NR_CPUS, three Intel ethernet drivers fail to compile like: In function ‘i40e_free_q_vector’, inlined from ‘i40e_vsi_alloc_q_vectors’ at drivers/net/ethernet/intel/i40e/i40e_main.c:12112:3: 571 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) include/linux/rcupdate.h:1084:17: note: in expansion of macro ‘BUILD_BUG_ON’ 1084 | BUILD_BUG_ON(offsetof(typeof(*(ptr)), rhf) >= 4096); \ drivers/net/ethernet/intel/i40e/i40e_main.c:5113:9: note: in expansion of macro ‘kfree_rcu’ 5113 | kfree_rcu(q_vector, rcu); | ^~~~~~~~~ The problem is that the 'rcu' member in 'q_vector' is too far from the start of the structure. Move this member before the CPU mask instead, in all three drivers. Signed-off-by: Arnd Bergmann Acked-by: David S. Miller Reviewed-by: Aleksandr Loktionov Reviewed-by: Alexander Lobakin Tested-by: Sunitha Mekala (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 495a4f0dce9c8c4478c242209748f1ee9e4d5820 Author: Marius Zachmann Date: Thu Jun 19 15:27:47 2025 +0200 hwmon: (corsair-cpro) Validate the size of the received input buffer Add buffer_recv_size to store the size of the received bytes. Validate buffer_recv_size in send_usb_cmd(). Reported-by: syzbot+3bbbade4e1a7ab45ca3b@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-hwmon/61233ba1-e5ad-4d7a-ba31-3b5d0adcffcc@roeck-us.net Fixes: 40c3a4454225 ("hwmon: add Corsair Commander Pro driver") Signed-off-by: Marius Zachmann Link: https://lore.kernel.org/r/20250619132817.39764-5-mail@mariuszachmann.de Signed-off-by: Guenter Roeck commit 709ea4a8661c731328c1f084dd7a4f0a510932a8 Merge: be8543845da599 4cec89db80ba81 Author: Paolo Bonzini Date: Tue Jul 15 19:32:31 2025 +0200 Merge tag 'kvm-riscv-fixes-6.16-2' of https://github.com/kvm-riscv/linux into HEAD KVM/riscv fixes for 6.16, take #2 - Disable vstimecmp before exiting to user-space - Move HGEI[E|P] CSR access to IMSIC virtualization commit be8543845da59901a8326a0df5e3630684ac028b Merge: 8a73c8dbb23010 2265c08ec393ef Author: Paolo Bonzini Date: Tue Jul 15 19:32:23 2025 +0200 Merge tag 'kvmarm-fixes-6.16-6' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 6.16, take #6 - Fix use of u64_replace_bits() in adjusting the guest's view of MDCR_EL2.HPMN. commit 8a73c8dbb23010561c9bc78a7342c3ad0da11188 Author: Paolo Bonzini Date: Thu Jul 10 12:17:11 2025 +0200 KVM: Documentation: document how KVM is tested Proper testing greatly simplifies both patch development and review, but it can be unclear what kind of userspace or guest support should accompany new features. Clarify maintainer expectations in terms of testing expectations; additionally, list the cases in which open-source userspace support is pretty much a necessity and its absence can only be mitigated by selftests. While these ideas have long been followed implicitly by KVM contributors and maintainers, formalize them in writing to provide consistent (though not universal) guidelines. Suggested-by: Rick Edgecombe Signed-off-by: Paolo Bonzini commit 83131d84694a85627f595b5ecd480f6ecb98b5aa Author: Paolo Bonzini Date: Thu Jul 10 12:14:17 2025 +0200 KVM: Documentation: minimal updates to review-checklist.rst While the file could stand a larger update, these are the bare minimum changes needed to make it more widely applicable. Signed-off-by: Paolo Bonzini commit 4664a4ddb9211a3513aa769453e3a1095fc806d0 Merge: e003ef2cb1de41 8f0837fdc5d832 Author: Linus Torvalds Date: Tue Jul 15 09:26:33 2025 -0700 Merge tag 'soc-fixes-6.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "There are 18 devicetree fixes for three arm64 plaforms: Qualcomm Snapdragon, Rockchips and NXP i.MX. These get updated to more correctly describe the hardware, fixing issues with: - real-time clock on Snapdragon based laptops - SD card detection, PCI probing and HDMI/DDC communication on Rockchips - ethernet and SPI probing on certain i.MX based boards - a regression with the i.MX watchdog Aside from the devicetree fixes, there are two additional fixes for the merged ASPEED LPC snoop driver that saw some changes in 6.16, and one additional driver enabled in arm64 defconfig to fix CPU frequency scaling" * tag 'soc-fixes-6.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (21 commits) arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled soc: aspeed: lpc-snoop: Cleanup resources in stack-order arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep arm64: dts: rockchip: Add missing fan-supply to rk3566-quartz64-a arm64: dts: rockchip: use cs-gpios for spi1 on ringneck arm64: dts: add big-endian property back into watchdog node arm64: dts: imx95-15x15-evk: fix the overshoot issue of NETC arm64: dts: imx95-19x19-evk: fix the overshoot issue of NETC arm64: dts: rockchip: list all CPU supplies on ArmSoM Sige5 arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency arm64: dts: qcom: x1e80100: describe uefi rtc offset arm64: dts: qcom: sc8280xp-x13s: describe uefi rtc offset arm64: defconfig: Enable Qualcomm CPUCP mailbox driver arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 arm64: dts: rockchip: Adjust the HDMI DDC IO driver strength for rk3588 ... commit e003ef2cb1de41edda508ea1fdb21974f9f18dfb Merge: 155a3c003e555a 3a1d22bd85381c Author: Linus Torvalds Date: Tue Jul 15 09:20:44 2025 -0700 Merge tag 'hid-for-linus-2025071501' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Benjamin Tissoires: - one warning cleanup introduced in the last PR (Andy Shevchenko) - a nasty syzbot buffer underflow fix co-debugged with Alan Stern (Benjamin Tissoires) * tag 'hid-for-linus-2025071501' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: selftests/hid: add a test case for the recent syzbot underflow HID: core: do not bypass hid_hw_raw_request HID: core: ensure __hid_request reserves the report ID as the first byte HID: core: ensure the allocated report buffer can contain the reserved report ID HID: debug: Remove duplicate entry (BTN_WHEEL) commit 3df63fa8f2afd051848e37ef1b8299dee28d4f87 Author: Abinash Singh Date: Sat Jul 5 21:30:55 2025 +0530 dma: dw-edma: Fix build warning in dw_edma_pcie_probe() The function dw_edma_pcie_probe() in dw-edma-pcie.c triggered a frame size warning: ld.lld:warning: drivers/dma/dw-edma/dw-edma-pcie.c:162:0: stack frame size (1040) exceeds limit (1024) in function 'dw_edma_pcie_probe' This patch reduces the stack usage by dynamically allocating the `vsec_data` structure using kmalloc(), rather than placing it on the stack. This eliminates the overflow warning and improves kernel robustness. Signed-off-by: Abinash Singh Acked-by: Manivannan Sadhasivam Link: https://lore.kernel.org/r/20250705160055.808165-1-abinashsinghlalotra@gmail.com Signed-off-by: Vinod Koul commit 188c6ba1dd925849c5d94885c8bbdeb0b3dcf510 Author: Dan Carpenter Date: Tue Jul 1 17:31:40 2025 -0500 dmaengine: nbpfaxi: Fix memory corruption in probe() The nbpf->chan[] array is allocated earlier in the nbpf_probe() function and it has "num_channels" elements. These three loops iterate one element farther than they should and corrupt memory. The changes to the second loop are more involved. In this case, we're copying data from the irqbuf[] array into the nbpf->chan[] array. If the data in irqbuf[i] is the error IRQ then we skip it, so the iterators are not in sync. I added a check to ensure that we don't go beyond the end of the irqbuf[] array. I'm pretty sure this can't happen, but it seemed harmless to add a check. On the other hand, after the loop has ended there is a check to ensure that the "chan" iterator is where we expect it to be. In the original code we went one element beyond the end of the array so the iterator wasn't in the correct place and it would always return -EINVAL. However, now it will always be in the correct place. I deleted the check since we know the result. Cc: stable@vger.kernel.org Fixes: b45b262cefd5 ("dmaengine: add a driver for AMBA AXI NBPF DMAC IP cores") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/b13c5225-7eff-448c-badc-a2c98e9bcaca@sabinyo.mountain Signed-off-by: Vinod Koul commit b7acfeab8af9ee661c933522132f3d1d92ed12d6 Author: Harshit Mogalapalli Date: Thu Jul 10 10:24:02 2025 -0700 phy: qcom: fix error code in snps_eusb2_hsphy_probe() When phy->ref_clk is NULL PTR_ERR(NULL) will be a success. Fix this by using -ENOENT when phy->ref_clk is NULL instead. Fixes: 80090810f5d3 ("phy: qcom: Add QCOM SNPS eUSB2 driver") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/aDCbeuCTy9zyWJAM@stanley.mountain/ Signed-off-by: Harshit Mogalapalli Link: https://lore.kernel.org/r/20250710172403.2593193-1-harshit.m.mogalapalli@oracle.com Signed-off-by: Vinod Koul commit b24bbb534c2da4a9a99a23525e9c24a0be7ec6f4 Author: Kai Huang Date: Mon Jul 14 10:20:20 2025 +1200 KVM: x86: Reject KVM_SET_TSC_KHZ vCPU ioctl for TSC protected guest Reject KVM_SET_TSC_KHZ vCPU ioctl if guest's TSC is protected and not changeable by KVM, and update the documentation to reflect it. For such TSC protected guests, e.g. TDX guests, typically the TSC is configured once at VM level before any vCPU are created and remains unchanged during VM's lifetime. KVM provides the KVM_SET_TSC_KHZ VM scope ioctl to allow the userspace VMM to configure the TSC of such VM. After that the userspace VMM is not supposed to call the KVM_SET_TSC_KHZ vCPU scope ioctl anymore when creating the vCPU. The de facto userspace VMM Qemu does this for TDX guests. The upcoming SEV-SNP guests with Secure TSC should follow. Note, TDX support hasn't been fully released as of the "buggy" commit, i.e. there is no established ABI to break. Fixes: adafea110600 ("KVM: x86: Add infrastructure for secure TSC") Suggested-by: Sean Christopherson Signed-off-by: Kai Huang Reviewed-by: Xiaoyao Li Reviewed-by: Nikunj A Dadhania Link: https://lore.kernel.org/r/71bbdf87fdd423e3ba3a45b57642c119ee2dd98c.1752444335.git.kai.huang@intel.com Signed-off-by: Sean Christopherson commit d34d6feaf4a76833effcec0b148b65946b04cde8 Author: Imre Deak Date: Wed Jul 9 00:23:31 2025 +0300 drm/dp: Change AUX DPCD probe address from LANE0_1_STATUS to TRAINING_PATTERN_SET Commit a3ef3c2da675 ("drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS") stopped using the DPCD_REV register for DPCD probing, since this results in link training failures at least when using an Intel Barlow Ridge TBT hub at UHBR link rates (the DP_INTRA_HOP_AUX_REPLY_INDICATION never getting cleared after the failed link training). Since accessing DPCD_REV during link training is prohibited by the DP Standard, LANE0_1_STATUS (0x202) was used instead, as it falls within the Standard's valid register address range (0x102-0x106, 0x202-0x207, 0x200c-0x200f, 0x2216) and it fixed the link training on the above TBT hub. However, reading the LANE0_1_STATUS register also has a side-effect at least on a Novatek eDP panel, as reported on the Closes: link below, resulting in screen flickering on that panel. One clear side-effect when doing the 1-byte probe reads from LANE0_1_STATUS during link training before reading out the full 6 byte link status starting at the same address is that the panel will report the link training as completed with voltage swing 0. This is different from the normal, flicker-free scenario when no DPCD probing is done, the panel reporting the link training complete with voltage swing 2. Using the TRAINING_PATTERN_SET register for DPCD probing doesn't have the above side-effect, the panel will link train with voltage swing 2 as expected and it will stay flicker-free. This register is also in the above valid register range and is unlikely to have a side-effect as that of LANE0_1_STATUS: Reading LANE0_1_STATUS is part of the link training CR/EQ sequences and so it may cause a state change in the sink - even if inadvertently as I suspect in the case of the above Novatek panel. As opposed to this, reading TRAINING_PATTERN_SET is not part of the link training sequence (it must be only written once at the beginning of the CR/EQ sequences), so it's unlikely to cause any state change in the sink. As a side-note, this Novatek panel also lacks support for TPS3, while claiming support for HBR2, which violates the DP Standard (the Standard mandating TPS3 for HBR2). Besides the Novatek panel (PSR 1), which this change fixes, I also verified the change on a Samsung (PSR 1) and an Analogix (PSR 2) eDP panel as well as on the Intel Barlow Ridge TBT hub. Note that in the drm-tip tree (targeting the v6.17 kernel version) the i915 and xe drivers keep DPCD probing enabled only for the panel known to require this (HP ZR24w), hence those drivers in drm-tip are not affected by the above problem. Cc: Ville Syrjälä Cc: Jani Nikula Fixes: a3ef3c2da675 ("drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS") Reported-and-tested-by: Paul Menzel Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14558 Reviewed-by: Jonathan Cavitt Acked-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250708212331.112898-1-imre.deak@intel.com (cherry picked from commit bba9aa41654036534d86b198f5647a9ce15ebd7f) [Imre: Rebased on drm-intel-fixes] Signed-off-by: Imre Deak Signed-off-by: Rodrigo Vivi [Rodrigo: Changed original commit hash to match with the one propagated in fixes] commit 0e9418961f897be59b1fab6e31ae1b09a0bae902 Author: Paolo Abeni Date: Thu Jul 10 18:04:50 2025 +0200 selftests: net: increase inter-packet timeout in udpgro.sh The mentioned test is not very stable when running on top of debug kernel build. Increase the inter-packet timeout to allow more slack in such environments. Fixes: 3327a9c46352 ("selftests: add functionals test for UDP GRO") Reviewed-by: Simon Horman Link: https://patch.msgid.link/b0370c06ddb3235debf642c17de0284b2cd3c652.1752163107.git.pabeni@redhat.com Signed-off-by: Paolo Abeni commit ebd6884167eac94bae9f92793fcd84069d9e4415 Author: Rafael J. Wysocki Date: Mon Jul 14 19:45:31 2025 +0200 PM: sleep: Update power.completion for all devices on errors After commit aa7a9275ab81 ("PM: sleep: Suspend async parents after suspending children"), the following scenario is possible: 1. Device A is async and it depends on device B that is sync. 2. Async suspend is scheduled for A before the processing of B is started. 3. A is waiting for B. 4. In the meantime, an unrelated device fails to suspend and returns an error. 5. The processing of B doesn't start at all and its power.completion is not updated. 6. A is still waiting for B when async_synchronize_full() is called. 7. Deadlock ensues. To prevent this from happening, update power.completion for all devices on errors in all suspend phases, but do not do it directly for devices that are already being processed or are waiting for the processing to start because in those cases it may be necessary to wait for the processing to actually complete before updating power.completion for the device. Fixes: aa7a9275ab81 ("PM: sleep: Suspend async parents after suspending children") Fixes: 443046d1ad66 ("PM: sleep: Make suspend of devices more asynchronous") Closes: https://lore.kernel.org/linux-pm/e13740a0-88f3-4a6f-920f-15805071a7d6@linaro.org/ Reported-and-tested-by: Tudor Ambarus Signed-off-by: Rafael J. Wysocki Reviewed-by: Ulf Hansson Link: https://patch.msgid.link/6191258.lOV4Wx5bFT@rjwysocki.net commit 228b9deded0011482149cdb474e3ad15aeeb4a97 Author: Zihuan Zhang Date: Sat Jul 12 11:08:24 2025 +0800 PM: suspend: clean up redundant filesystems_freeze/thaw() handling The recently introduced support for freezing filesystems during system suspend included calls to filesystems_freeze() in both suspend_prepare() and enter_state(), as well as calls to filesystems_thaw() in both suspend_finish() and the Unlock path in enter_state(). These are redundant. Moreover, calling filesystems_freeze() twice, from both suspend_prepare() and enter_state(), leads to a black screen and makes the system unable to resume in some cases. Address this as follows: - filesystems_freeze() is already called in suspend_prepare(), which is the proper and consistent place to handle pre-suspend operations. The second call in enter_state() is unnecessary and so remove it. - filesystems_thaw() is invoked in suspend_finish(), which covers successful suspend/resume paths. In the failure case, add a call to filesystems_thaw() only when needed, avoiding the duplicate call in the general Unlock path. This change simplifies the suspend code and avoids repeated freeze/thaw calls, while preserving correct ordering and behavior. Fixes: eacfbf74196f ("power: freeze filesystems during suspend/resume") Signed-off-by: Zihuan Zhang Link: https://patch.msgid.link/20250712030824.81474-1-zhangzihuan@kylinos.cn [ rjw: Changelog edits ] Signed-off-by: Rafael J. Wysocki commit 75b63ce2c98b41c45ee3ff14c76f27c3238bc6d2 Author: Rafael J. Wysocki Date: Thu Jul 10 10:43:26 2025 +0200 PM: suspend: Drop a misplaced pm_restore_gfp_mask() call The pm_restore_gfp_mask() call added by commit 12ffc3b1513e ("PM: Restrict swap use to later in the suspend sequence") to suspend_devices_and_enter() is done too early because it takes place before calling dpm_resume() in dpm_resume_end() and some swap-backing devices may not be ready at that point. Moreover, dpm_resume_end() called subsequently in the same code path invokes pm_restore_gfp_mask() again and calling it twice in a row is pointless. Drop the misplaced pm_restore_gfp_mask() call from suspend_devices_and_enter() to address this issue. Fixes: 12ffc3b1513e ("PM: Restrict swap use to later in the suspend sequence") Signed-off-by: Rafael J. Wysocki Reviewed-by: Mario Limonciello Link: https://patch.msgid.link/2810409.mvXUDI8C0e@rjwysocki.net [ rjw: Changelog edits ] Signed-off-by: Rafael J. Wysocki commit 834bce6a715ae9a9c4dce7892454a19adf22b013 Author: Amit Pundir Date: Wed Jul 9 23:19:49 2025 +0530 soundwire: Revert "soundwire: qcom: Add set_channel_map api support" This reverts commit 7796c97df6b1b2206681a07f3c80f6023a6593d5. This patch broke Dragonboard 845c (sdm845). I see: Unexpected kernel BRK exception at EL1 Internal error: BRK handler: 00000000f20003e8 [#1] SMP pc : qcom_swrm_set_channel_map+0x7c/0x80 [soundwire_qcom] lr : snd_soc_dai_set_channel_map+0x34/0x78 Call trace: qcom_swrm_set_channel_map+0x7c/0x80 [soundwire_qcom] (P) sdm845_dai_init+0x18c/0x2e0 [snd_soc_sdm845] snd_soc_link_init+0x28/0x6c snd_soc_bind_card+0x5f4/0xb0c snd_soc_register_card+0x148/0x1a4 devm_snd_soc_register_card+0x50/0xb0 sdm845_snd_platform_probe+0x124/0x148 [snd_soc_sdm845] platform_probe+0x6c/0xd0 really_probe+0xc0/0x2a4 __driver_probe_device+0x7c/0x130 driver_probe_device+0x40/0x118 __device_attach_driver+0xc4/0x108 bus_for_each_drv+0x8c/0xf0 __device_attach+0xa4/0x198 device_initial_probe+0x18/0x28 bus_probe_device+0xb8/0xbc deferred_probe_work_func+0xac/0xfc process_one_work+0x244/0x658 worker_thread+0x1b4/0x360 kthread+0x148/0x228 ret_from_fork+0x10/0x20 Kernel panic - not syncing: BRK handler: Fatal exception Dan has also reported following issues with the original patch https://lore.kernel.org/all/33fe8fe7-719a-405a-9ed2-d9f816ce1d57@sabinyo.mountain/ Bug #1: The zeroeth element of ctrl->pconfig[] is supposed to be unused. We start counting at 1. However this code sets ctrl->pconfig[0].ch_mask = 128. Bug #2: There are SLIM_MAX_TX_PORTS (16) elements in tx_ch[] array but only QCOM_SDW_MAX_PORTS + 1 (15) in the ctrl->pconfig[] array so it corrupts memory like Yongqin Liu pointed out. Bug 3: Like Jie Gan pointed out, it erases all the tx information with the rx information. Cc: stable@vger.kernel.org # v6.15+ Signed-off-by: Amit Pundir Acked-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250709174949.8541-1-amit.pundir@linaro.org Signed-off-by: Vinod Koul commit 949ddec3728f3a793a13c1c9003028b9b159aefc Author: Adam Queler Date: Mon Jul 14 23:14:24 2025 -0400 ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx This model requires an additional detection quirk to enable the internal microphone. Signed-off-by: Adam Queler Link: https://patch.msgid.link/20250715031434.222062-1-queler+k@gmail.com Signed-off-by: Mark Brown commit fdfa018c6962c86d2faa183187669569be4d513f Merge: 5724ff190b22bd 252f4ac08cd2f1 Author: Greg Kroah-Hartman Date: Tue Jul 15 13:13:53 2025 +0200 Merge tag 'usb-serial-6.16-rc7' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB serial device ids for 6.16-rc7 Here are some more device ids for 6.16-rc7. All have been in linux-next with no reported issues. * tag 'usb-serial-6.16-rc7' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI commit bbc19fef578970158847a41d9b6b6b218034b8c2 Merge: 444020f4bf06fb 46345ed36296d9 Author: Johannes Berg Date: Tue Jul 15 13:07:24 2025 +0200 Merge tag 'iwlwifi-fixes-2025-07-15' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next Miri Korenblit says: ==================== iwlwifi-fixes - missing unlock in error path - Avoid FW assert on bad command values - fix kernel panic due to incorrect index calculation ==================== Signed-off-by: Johannes Berg commit 0f97a7588db7a545ea07ee0d512789bfad4931d8 Author: Brett Werling Date: Fri Jul 11 09:17:28 2025 -0500 can: tcan4x5x: fix reset gpio usage during probe Fixes reset GPIO usage during probe by ensuring we retrieve the GPIO and take the device out of reset (if it defaults to being in reset) before we attempt to communicate with the device. This is achieved by moving the call to tcan4x5x_get_gpios() before tcan4x5x_find_version() and avoiding any device communication while getting the GPIOs. Once we determine the version, we can then take the knowledge of which GPIOs we obtained and use it to decide whether we need to disable the wake or state pin functions within the device. This change is necessary in a situation where the reset GPIO is pulled high externally before the CPU takes control of it, meaning we need to explicitly bring the device out of reset before we can start communicating with it at all. This also has the effect of fixing an issue where a reset of the device would occur after having called tcan4x5x_disable_wake(), making the original behavior not actually disable the wake. This patch should now disable wake or state pin functions well after the reset occurs. Signed-off-by: Brett Werling Link: https://patch.msgid.link/20250711141728.1826073-1-brett.werling@garmin.com Cc: Markus Schneider-Pargmann Fixes: 142c6dc6d9d7 ("can: tcan4x5x: Add support for tcan4552/4553") Signed-off-by: Marc Kleine-Budde commit e31c8f1db9c1df91af43012cb482e05a9339bbdf Merge: 347e9f5043c896 9ab29ed505557b Author: Bartosz Golaszewski Date: Tue Jul 15 11:40:25 2025 +0200 Merge tag 'intel-gpio-v6.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-gpio-intel into gpio/for-current intel-gpio for v6.16-2 * Add a quirk for Acer Nitro V15 against wakeup capability The following is an automated git shortlog grouped by driver: gpiolib: - acpi: Add a quirk for Acer Nitro V15 commit 46345ed36296d965af1b6e68e62076d67521c55d Author: Ville Syrjälä Date: Fri Jul 11 23:57:44 2025 +0300 wifi: iwlwifi: Fix botched indexing conversion The conversion from compiler assisted indexing to manual indexing wasn't done correctly. The array is still made up of __le16 elements so multiplying the outer index by the element size is not what we want. Fix it up. This causes the kernel to oops when trying to transfer any significant amount of data over wifi: BUG: unable to handle page fault for address: ffffc900009f5282 PGD 100000067 P4D 100000067 PUD 1000fb067 PMD 102e82067 PTE 0 Oops: Oops: 0002 [#1] SMP CPU: 1 UID: 0 PID: 99 Comm: kworker/u8:3 Not tainted 6.15.0-rc2-cl-bisect3-00604-g6204d5130a64-dirty #78 PREEMPT Hardware name: Dell Inc. Latitude E5400 /0D695C, BIOS A19 06/13/2013 Workqueue: events_unbound cfg80211_wiphy_work [cfg80211] RIP: 0010:iwl_trans_pcie_tx+0x4dd/0xe60 [iwlwifi] Code: 00 00 66 81 fa ff 0f 0f 87 42 09 00 00 3d ff 00 00 00 0f 8f 37 09 00 00 41 c1 e0 0c 41 09 d0 48 8d 14 b6 48 c1 e2 07 48 01 ca <66> 44 89 04 57 48 8d 0c 12 83 f8 3f 0f 8e 84 01 00 00 41 8b 85 80 RSP: 0018:ffffc900001c3b50 EFLAGS: 00010206 RAX: 00000000000000c1 RBX: ffff88810b180028 RCX: 00000000000000c1 RDX: 0000000000002141 RSI: 000000000000000d RDI: ffffc900009f1000 RBP: 0000000000000002 R08: 0000000000000025 R09: ffffffffa050fa60 R10: 00000000fbdbf4bc R11: 0000000000000082 R12: ffff88810e5ade40 R13: ffff88810af81588 R14: 000000000000001a R15: ffff888100dfe0c8 FS: 0000000000000000(0000) GS:ffff8881998c3000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc900009f5282 CR3: 0000000001e39000 CR4: 00000000000426f0 Call Trace: ? rcu_is_watching+0xd/0x40 ? __iwl_dbg+0xb1/0xe0 [iwlwifi] iwlagn_tx_skb+0x8e2/0xcb0 [iwldvm] iwlagn_mac_tx+0x18/0x30 [iwldvm] ieee80211_handle_wake_tx_queue+0x6c/0xc0 [mac80211] ieee80211_agg_start_txq+0x140/0x2e0 [mac80211] ieee80211_agg_tx_operational+0x126/0x210 [mac80211] ieee80211_process_addba_resp+0x27b/0x2a0 [mac80211] ieee80211_iface_work+0x4bd/0x4d0 [mac80211] ? _raw_spin_unlock_irq+0x1f/0x40 cfg80211_wiphy_work+0x117/0x1f0 [cfg80211] process_one_work+0x1ee/0x570 worker_thread+0x1c5/0x3b0 ? bh_worker+0x240/0x240 kthread+0x110/0x220 ? kthread_queue_delayed_work+0x90/0x90 ret_from_fork+0x28/0x40 ? kthread_queue_delayed_work+0x90/0x90 ret_from_fork_asm+0x11/0x20 Modules linked in: ctr aes_generic ccm sch_fq_codel bnep xt_tcpudp xt_multiport xt_state iptable_filter iptable_nat nf_nat nf_conntrack nf_defrag_ipv4 ip_tables x_tables btusb btrtl btintel btbcm bluetooth ecdh_generic ecc libaes hid_generic usbhid hid binfmt_misc joydev mousedev snd_hda_codec_hdmi iwldvm snd_hda_codec_idt snd_hda_codec_generic mac80211 coretemp iTCO_wdt watchdog kvm_intel i2c_dev snd_hda_intel libarc4 kvm snd_intel_dspcfg sdhci_pci sdhci_uhs2 snd_hda_codec iwlwifi sdhci irqbypass cqhci snd_hwdep snd_hda_core cfg80211 firewire_ohci mmc_core psmouse snd_pcm i2c_i801 firewire_core pcspkr led_class uhci_hcd i2c_smbus tg3 crc_itu_t iosf_mbi snd_timer rfkill libphy ehci_pci snd ehci_hcd lpc_ich mfd_core usbcore video intel_agp usb_common soundcore intel_gtt evdev agpgart parport_pc wmi parport backlight CR2: ffffc900009f5282 ---[ end trace 0000000000000000 ]--- RIP: 0010:iwl_trans_pcie_tx+0x4dd/0xe60 [iwlwifi] Code: 00 00 66 81 fa ff 0f 0f 87 42 09 00 00 3d ff 00 00 00 0f 8f 37 09 00 00 41 c1 e0 0c 41 09 d0 48 8d 14 b6 48 c1 e2 07 48 01 ca <66> 44 89 04 57 48 8d 0c 12 83 f8 3f 0f 8e 84 01 00 00 41 8b 85 80 RSP: 0018:ffffc900001c3b50 EFLAGS: 00010206 RAX: 00000000000000c1 RBX: ffff88810b180028 RCX: 00000000000000c1 RDX: 0000000000002141 RSI: 000000000000000d RDI: ffffc900009f1000 RBP: 0000000000000002 R08: 0000000000000025 R09: ffffffffa050fa60 R10: 00000000fbdbf4bc R11: 0000000000000082 R12: ffff88810e5ade40 R13: ffff88810af81588 R14: 000000000000001a R15: ffff888100dfe0c8 FS: 0000000000000000(0000) GS:ffff8881998c3000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc900009f5282 CR3: 0000000001e39000 CR4: 00000000000426f0 Kernel panic - not syncing: Fatal exception in interrupt Kernel Offset: disabled ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- Cc: Miri Korenblit Fixes: 6204d5130a64 ("wifi: iwlwifi: use bc entries instead of bc table also for pre-ax210") Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20250711205744.28723-1-ville.syrjala@linux.intel.com Signed-off-by: Miri Korenblit commit 444020f4bf06fb86805ee7e7ceec0375485fd94d Author: Johannes Berg Date: Mon Jul 14 14:21:30 2025 +0200 wifi: cfg80211: remove scan request n_channels counted_by This reverts commit e3eac9f32ec0 ("wifi: cfg80211: Annotate struct cfg80211_scan_request with __counted_by"). This really has been a completely failed experiment. There were no actual bugs found, and yet at this point we already have four "fixes" to it, with nothing to show for but code churn, and it never even made the code any safer. In all of the cases that ended up getting "fixed", the structure is also internally inconsistent after the n_channels setting as the channel list isn't actually filled yet. You cannot scan with such a structure, that's just wrong. In mac80211, the struct is also reused multiple times, so initializing it once is no good. Some previous "fixes" (e.g. one in brcm80211) are also just setting n_channels before accessing the array, under the assumption that the code is correct and the array can be accessed, further showing that the whole thing is just pointless when the allocation count and use count are not separate. If we really wanted to fix it, we'd need to separately track the number of channels allocated and the number of channels currently used, but given that no bugs were found despite the numerous syzbot reports, that'd just be a waste of time. Remove the __counted_by() annotation. We really should also remove a number of the n_channels settings that are setting up a structure that's inconsistent, but that can wait. Reported-by: syzbot+e834e757bd9b3d3e1251@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=e834e757bd9b3d3e1251 Fixes: e3eac9f32ec0 ("wifi: cfg80211: Annotate struct cfg80211_scan_request with __counted_by") Link: https://patch.msgid.link/20250714142130.9b0bbb7e1f07.I09112ccde72d445e11348fc2bef68942cb2ffc94@changeid Signed-off-by: Johannes Berg commit 2aec790e666bf1f11d39bb50aa9df8febd58a548 Merge: c7979c3917fa13 afcefc58fdfd68 Author: Johannes Berg Date: Tue Jul 15 10:26:03 2025 +0200 Merge tag 'ath-current-20250714' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git update for v6.16-rc7 Fix an ath12k performance regression introduce in v6.16-rc1 ================== Signed-off-by: Johannes Berg commit 6b995d01683feae619aa3263d18a6aa19bface16 Author: Ard Biesheuvel Date: Mon Jul 14 09:34:03 2025 +0200 x86/sev: Work around broken noinstr on GCC Forcibly disable KCSAN for the sev-nmi.c source file, which only contains functions annotated as 'noinstr' but is emitted with calls to KCSAN instrumentation nonetheless. E.g., vmlinux.o: error: objtool: __sev_es_nmi_complete+0x58: call to __kcsan_check_access() leaves .noinstr.text section make[2]: *** [/usr/local/google/home/ardb/linux/scripts/Makefile.vmlinux_o:72: vmlinux.o] Error 1 Fixes: a3cbbb4717e1 ("x86/boot: Move SEV startup code into startup/") Reported-by: Randy Dunlap Signed-off-by: Ard Biesheuvel Signed-off-by: Borislav Petkov (AMD) Acked-by: Randy Dunlap Tested-by: Randy Dunlap Link: https://lore.kernel.org/20250714073402.4107091-2-ardb+git@google.com commit 0523c6cc87e558c50ff4489c87c54c55068b1169 Author: Maurizio Lombardi Date: Fri Jul 4 16:44:54 2025 +0200 nvmet-tcp: fix callback lock for TLS handshake When restoring the default socket callbacks during a TLS handshake, we need to acquire a write lock on sk_callback_lock. Previously, a read lock was used, which is insufficient for modifying sk_user_data and sk_data_ready. Fixes: 675b453e0241 ("nvmet-tcp: enable TLS handshake upcall") Signed-off-by: Maurizio Lombardi Signed-off-by: Christoph Hellwig commit 71257925e83eae1cb6913d65ca71927d2220e6d1 Author: Yu Kuai Date: Tue Jul 15 09:28:12 2025 +0800 nvme: fix misaccounting of nvme-mpath inflight I/O Procedures for nvme-mpath IO accounting: 1) initialize nvme_request and clear flags; 2) set NVME_MPATH_IO_STATS and increase inflight counter when IO started; 3) check NVME_MPATH_IO_STATS and decrease inflight counter when IO is done; However, for the case nvme_fail_nonready_command(), both step 1) and 2) are skipped, and if old nvme_request set NVME_MPATH_IO_STATS and then request is reused, step 3) will still be executed, causing inflight I/O counter to be negative. Fix the problem by clearing nvme_request in nvme_fail_nonready_command(). Fixes: ea5e5f42cd2c ("nvme-fabrics: avoid double completions in nvmf_fail_nonready_command") Reported-by: Yi Zhang Closes: https://lore.kernel.org/all/CAHj4cs_+dauobyYyP805t33WMJVzOWj=7+51p4_j9rA63D9sog@mail.gmail.com/ Signed-off-by: Yu Kuai Signed-off-by: Christoph Hellwig commit 1fc09f2961f5c6d8bb53bc989f17b12fdc6bc93d Author: Christoph Hellwig Date: Wed Jul 9 11:54:08 2025 +0200 nvme: revert the cross-controller atomic write size validation This was originally added by commit 8695f060a029 ("nvme: all namespaces in a subsystem must adhere to a common atomic write size") to check the all controllers in a subsystem report the same atomic write size, but the check wasn't quite correct and caused problems for devices with multiple namespaces that report different LBA sizes. Commit f46d273449ba ("nvme: fix atomic write size validation") tried to fix this, but then caused problems for namespace rediscovery after a format with an LBA size change that changes the AWUPF value. This drops the validation and essentially reverts those two commits while keeping the cleanup that went in between the two. We'll need to figure out how to properly check for the mouse trap that nvme left us, but for now revert the check to keep devices working for users who couldn't care less about the atomic write feature. Fixes: 8695f060a029 ("nvme: all namespaces in a subsystem must adhere to a common atomic write size") Fixes: f46d273449ba ("nvme: fix atomic write size validation") Signed-off-by: Christoph Hellwig Reviewed-by: Alan Adamson Reviewed-by: Keith Busch Reviewed-by: John Garry Reviewed-by: Chaitanya Kulkarni Tested-by: Alan Adamson commit e201c19ddeed6b37f05617e529d8efa079657ed7 Author: Takashi Iwai Date: Tue Jul 15 08:29:04 2025 +0200 ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS ASUS ROG Strix G712LWS (PCI SSID 1043:1a83) requires the quirk for ALC294 headset mode in order to make the speaker and headset I/O working properly. Cc: Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220334 Link: https://patch.msgid.link/20250715062906.11857-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit a4131a50d072b369bfed0b41e741c41fd8048641 Author: Naman Jain Date: Fri Jul 11 11:38:46 2025 +0530 tools/hv: fcopy: Fix irregularities with size of ring buffer Size of ring buffer, as defined in uio_hv_generic driver, is no longer fixed to 16 KB. This creates a problem in fcopy, since this size was hardcoded. With the change in place to make ring sysfs node actually reflect the size of underlying ring buffer, it is safe to get the size of ring sysfs file and use it for ring buffer size in fcopy daemon. Fix the issue of disparity in ring buffer size, by making it dynamic in fcopy uio daemon. Cc: stable@vger.kernel.org Fixes: 0315fef2aff9 ("uio_hv_generic: Align ring size to system page") Signed-off-by: Naman Jain Reviewed-by: Saurabh Sengar Reviewed-by: Long Li Link: https://lore.kernel.org/r/20250711060846.9168-1-namjain@linux.microsoft.com Signed-off-by: Wei Liu Message-ID: <20250711060846.9168-1-namjain@linux.microsoft.com> commit 6f490bb4a982f7455576d6cf409bef10aebd07b8 Author: Stanislav Kinsburskii Date: Fri Jul 11 12:18:52 2025 -0700 PCI: hv: Use the correct hypercall for unmasking interrupts on nested Running as nested root on MSHV imposes a different requirement for the pci-hyperv controller. In this setup, the interrupt will first come to the L1 (nested) hypervisor, which will deliver it to the appropriate root CPU. Instead of issuing the RETARGET hypercall, issue the MAP_DEVICE_INTERRUPT hypercall to L1 to complete the setup. Rename hv_arch_irq_unmask() to hv_irq_retarget_interrupt(). Co-developed-by: Jinank Jain Signed-off-by: Jinank Jain Signed-off-by: Stanislav Kinsburskii Signed-off-by: Nuno Das Neves Reviewed-by: Roman Kisel Reviewed-by: Michael Kelley Acked-by: Bjorn Helgaas Link: https://lore.kernel.org/r/1752261532-7225-4-git-send-email-nunodasneves@linux.microsoft.com Signed-off-by: Wei Liu Message-ID: <1752261532-7225-4-git-send-email-nunodasneves@linux.microsoft.com> commit 52a45f870e271d6d55ef26c17e8c6c82a22312a7 Author: Stanislav Kinsburskii Date: Fri Jul 11 12:18:51 2025 -0700 x86/hyperv: Expose hv_map_msi_interrupt() Move some of the logic of hv_irq_compose_irq_message() into hv_map_msi_interrupt(). Make hv_map_msi_interrupt() a globally-available helper function, which will be used to map PCI interrupts when running in the root partition. Signed-off-by: Stanislav Kinsburskii Signed-off-by: Nuno Das Neves Reviewed-by: Roman Kisel Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/1752261532-7225-3-git-send-email-nunodasneves@linux.microsoft.com Signed-off-by: Wei Liu Message-ID: <1752261532-7225-3-git-send-email-nunodasneves@linux.microsoft.com> commit 36c46e64c55061623daf214d26e634ae2cfe4a49 Author: Nuno Das Neves Date: Fri Jul 11 12:18:50 2025 -0700 Drivers: hv: Use nested hypercall for post message and signal event When running nested, these hypercalls must be sent to the L0 hypervisor or VMBus will fail. Remove hv_do_nested_hypercall() and hv_do_fast_nested_hypercall8() altogether and open-code these cases, since there are only 2 and all they do is add the nested bit. Signed-off-by: Nuno Das Neves Reviewed-by: Roman Kisel Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/1752261532-7225-2-git-send-email-nunodasneves@linux.microsoft.com Signed-off-by: Wei Liu Message-ID: <1752261532-7225-2-git-send-email-nunodasneves@linux.microsoft.com> commit 155a3c003e555a7300d156a5252c004c392ec6b0 Merge: 347e9f5043c896 b1bf1a782fdf5c Author: Linus Torvalds Date: Mon Jul 14 19:25:28 2025 -0700 Merge tag 'for-6.16/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fix from Mikulas Patocka: - dm-bufio: fix scheduling in atomic * tag 'for-6.16/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm-bufio: fix sched in atomic context commit f0f2b992d8185a0366be951685e08643aae17d6d Author: Sean Anderson Date: Mon Jul 7 15:58:03 2025 -0400 net: phy: Don't register LEDs for genphy If a PHY has no driver, the genphy driver is probed/removed directly in phy_attach/detach. If the PHY's ofnode has an "leds" subnode, then the LEDs will be (un)registered when probing/removing the genphy driver. This could occur if the leds are for a non-generic driver that isn't loaded for whatever reason. Synchronously removing the PHY device in phy_detach leads to the following deadlock: rtnl_lock() ndo_close() ... phy_detach() phy_remove() phy_leds_unregister() led_classdev_unregister() led_trigger_set() netdev_trigger_deactivate() unregister_netdevice_notifier() rtnl_lock() There is a corresponding deadlock on the open/register side of things (and that one is reported by lockdep), but it requires a race while this one is deterministic. Generic PHYs do not support LEDs anyway, so don't bother registering them. Fixes: 01e5b728e9e4 ("net: phy: Add a binding for PHY LEDs") Signed-off-by: Sean Anderson Link: https://patch.msgid.link/20250707195803.666097-1-sean.anderson@linux.dev Signed-off-by: Jakub Kicinski commit e18f348632ec4ee25d9172cdff273f0e939241c7 Author: Victor Nogueira Date: Sat Jul 12 11:50:35 2025 -0300 selftests/tc-testing: Create test cases for adding qdiscs to invalid qdisc parents As described in a previous commit [1], Lion's patch [2] revealed an ancient bug in the qdisc API. Whenever a user tries to add a qdisc to an invalid parent (not a class, root, or ingress qdisc), the qdisc API will detect this after qdisc_create is called. Some qdiscs (like fq_codel, pie, and sfq) call functions (on their init callback) which assume the parent is valid, so qdisc_create itself may have caused a NULL pointer dereference in such cases. This commit creates 3 TDC tests that attempt to add fq_codel, pie and sfq qdiscs to invalid parents - Attempts to add an fq_codel qdisc to an hhf qdisc parent - Attempts to add a pie qdisc to a drr qdisc parent - Attempts to add an sfq qdisc to an inexistent hfsc classid (which would belong to a valid hfsc qdisc) [1] https://lore.kernel.org/all/20250707210801.372995-1-victor@mojatatu.com/ [2] https://lore.kernel.org/netdev/d912cbd7-193b-4269-9857-525bee8bbb6a@gmail.com/ Signed-off-by: Victor Nogueira Link: https://patch.msgid.link/20250712145035.705156-1-victor@mojatatu.com Signed-off-by: Jakub Kicinski commit 60ada4fe644edaa6c2da97364184b0425e8aeaf5 Author: Kuniyuki Iwashima Date: Fri Jul 11 06:07:52 2025 +0000 smc: Fix various oops due to inet_sock type confusion. syzbot reported weird splats [0][1] in cipso_v4_sock_setattr() while freeing inet_sk(sk)->inet_opt. The address was freed multiple times even though it was read-only memory. cipso_v4_sock_setattr() did nothing wrong, and the root cause was type confusion. The cited commit made it possible to create smc_sock as an INET socket. The issue is that struct smc_sock does not have struct inet_sock as the first member but hijacks AF_INET and AF_INET6 sk_family, which confuses various places. In this case, inet_sock.inet_opt was actually smc_sock.clcsk_data_ready(), which is an address of a function in the text segment. $ pahole -C inet_sock vmlinux struct inet_sock { ... struct ip_options_rcu * inet_opt; /* 784 8 */ $ pahole -C smc_sock vmlinux struct smc_sock { ... void (*clcsk_data_ready)(struct sock *); /* 784 8 */ The same issue for another field was reported before. [2][3] At that time, an ugly hack was suggested [4], but it makes both INET and SMC code error-prone and hard to change. Also, yet another variant was fixed by a hacky commit 98d4435efcbf3 ("net/smc: prevent NULL pointer dereference in txopt_get"). Instead of papering over the root cause by such hacks, we should not allow non-INET socket to reuse the INET infra. Let's add inet_sock as the first member of smc_sock. [0]: kvfree_call_rcu(): Double-freed call. rcu_head 000000006921da73 WARNING: CPU: 0 PID: 6718 at mm/slab_common.c:1956 kvfree_call_rcu+0x94/0x3f0 mm/slab_common.c:1955 Modules linked in: CPU: 0 UID: 0 PID: 6718 Comm: syz.0.17 Tainted: G W 6.16.0-rc4-syzkaller-g7482bb149b9f #0 PREEMPT Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : kvfree_call_rcu+0x94/0x3f0 mm/slab_common.c:1955 lr : kvfree_call_rcu+0x94/0x3f0 mm/slab_common.c:1955 sp : ffff8000a03a7730 x29: ffff8000a03a7730 x28: 00000000fffffff5 x27: 1fffe000184823d3 x26: dfff800000000000 x25: ffff0000c2411e9e x24: ffff0000dd88da00 x23: ffff8000891ac9a0 x22: 00000000ffffffea x21: ffff8000891ac9a0 x20: ffff8000891ac9a0 x19: ffff80008afc2480 x18: 00000000ffffffff x17: 0000000000000000 x16: ffff80008ae642c8 x15: ffff700011ede14c x14: 1ffff00011ede14c x13: 0000000000000004 x12: ffffffffffffffff x11: ffff700011ede14c x10: 0000000000ff0100 x9 : 5fa3c1ffaf0ff000 x8 : 5fa3c1ffaf0ff000 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000a03a7078 x4 : ffff80008f766c20 x3 : ffff80008054d360 x2 : 0000000000000000 x1 : 0000000000000201 x0 : 0000000000000000 Call trace: kvfree_call_rcu+0x94/0x3f0 mm/slab_common.c:1955 (P) cipso_v4_sock_setattr+0x2f0/0x3f4 net/ipv4/cipso_ipv4.c:1914 netlbl_sock_setattr+0x240/0x334 net/netlabel/netlabel_kapi.c:1000 smack_netlbl_add+0xa8/0x158 security/smack/smack_lsm.c:2581 smack_inode_setsecurity+0x378/0x430 security/smack/smack_lsm.c:2912 security_inode_setsecurity+0x118/0x3c0 security/security.c:2706 __vfs_setxattr_noperm+0x174/0x5c4 fs/xattr.c:251 __vfs_setxattr_locked+0x1ec/0x218 fs/xattr.c:295 vfs_setxattr+0x158/0x2ac fs/xattr.c:321 do_setxattr fs/xattr.c:636 [inline] file_setxattr+0x1b8/0x294 fs/xattr.c:646 path_setxattrat+0x2ac/0x320 fs/xattr.c:711 __do_sys_fsetxattr fs/xattr.c:761 [inline] __se_sys_fsetxattr fs/xattr.c:758 [inline] __arm64_sys_fsetxattr+0xc0/0xdc fs/xattr.c:758 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x180 arch/arm64/kernel/entry-common.c:879 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 [1]: Unable to handle kernel write to read-only memory at virtual address ffff8000891ac9a8 KASAN: probably user-memory-access in range [0x0000000448d64d40-0x0000000448d64d47] Mem abort info: ESR = 0x000000009600004e EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x0e: level 2 permission fault Data abort info: ISV = 0, ISS = 0x0000004e, ISS2 = 0x00000000 CM = 0, WnR = 1, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000207144000 [ffff8000891ac9a8] pgd=0000000000000000, p4d=100000020f950003, pud=100000020f951003, pmd=0040000201000781 Internal error: Oops: 000000009600004e [#1] SMP Modules linked in: CPU: 0 UID: 0 PID: 6946 Comm: syz.0.69 Not tainted 6.16.0-rc4-syzkaller-g7482bb149b9f #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : kvfree_call_rcu+0x31c/0x3f0 mm/slab_common.c:1971 lr : add_ptr_to_bulk_krc_lock mm/slab_common.c:1838 [inline] lr : kvfree_call_rcu+0xfc/0x3f0 mm/slab_common.c:1963 sp : ffff8000a28a7730 x29: ffff8000a28a7730 x28: 00000000fffffff5 x27: 1fffe00018b09bb3 x26: 0000000000000001 x25: ffff80008f66e000 x24: ffff00019beaf498 x23: ffff00019beaf4c0 x22: 0000000000000000 x21: ffff8000891ac9a0 x20: ffff8000891ac9a0 x19: 0000000000000000 x18: 00000000ffffffff x17: ffff800093363000 x16: ffff80008052c6e4 x15: ffff700014514ecc x14: 1ffff00014514ecc x13: 0000000000000004 x12: ffffffffffffffff x11: ffff700014514ecc x10: 0000000000000001 x9 : 0000000000000001 x8 : ffff00019beaf7b4 x7 : ffff800080a94154 x6 : 0000000000000000 x5 : ffff8000935efa60 x4 : 0000000000000008 x3 : ffff80008052c7fc x2 : 0000000000000001 x1 : ffff8000891ac9a0 x0 : 0000000000000001 Call trace: kvfree_call_rcu+0x31c/0x3f0 mm/slab_common.c:1967 (P) cipso_v4_sock_setattr+0x2f0/0x3f4 net/ipv4/cipso_ipv4.c:1914 netlbl_sock_setattr+0x240/0x334 net/netlabel/netlabel_kapi.c:1000 smack_netlbl_add+0xa8/0x158 security/smack/smack_lsm.c:2581 smack_inode_setsecurity+0x378/0x430 security/smack/smack_lsm.c:2912 security_inode_setsecurity+0x118/0x3c0 security/security.c:2706 __vfs_setxattr_noperm+0x174/0x5c4 fs/xattr.c:251 __vfs_setxattr_locked+0x1ec/0x218 fs/xattr.c:295 vfs_setxattr+0x158/0x2ac fs/xattr.c:321 do_setxattr fs/xattr.c:636 [inline] file_setxattr+0x1b8/0x294 fs/xattr.c:646 path_setxattrat+0x2ac/0x320 fs/xattr.c:711 __do_sys_fsetxattr fs/xattr.c:761 [inline] __se_sys_fsetxattr fs/xattr.c:758 [inline] __arm64_sys_fsetxattr+0xc0/0xdc fs/xattr.c:758 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x180 arch/arm64/kernel/entry-common.c:879 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 Code: aa1f03e2 52800023 97ee1e8d b4000195 (f90006b4) Fixes: d25a92ccae6b ("net/smc: Introduce IPPROTO_SMC") Reported-by: syzbot+40bf00346c3fe40f90f2@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/686d9b50.050a0220.1ffab7.0020.GAE@google.com/ Tested-by: syzbot+40bf00346c3fe40f90f2@syzkaller.appspotmail.com Reported-by: syzbot+f22031fad6cbe52c70e7@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/686da0f3.050a0220.1ffab7.0022.GAE@google.com/ Reported-by: syzbot+271fed3ed6f24600c364@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=271fed3ed6f24600c364 # [2] Link: https://lore.kernel.org/netdev/99f284be-bf1d-4bc4-a629-77b268522fff@huawei.com/ # [3] Link: https://lore.kernel.org/netdev/20250331081003.1503211-1-wangliang74@huawei.com/ # [4] Signed-off-by: Kuniyuki Iwashima Reviewed-by: D. Wythe Reviewed-by: Wang Liang Link: https://patch.msgid.link/20250711060808.2977529-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 7498159226772d66f150dd406be462d75964a366 Author: Miguel Ojeda Date: Sat Jul 12 18:01:03 2025 +0200 rust: use `#[used(compiler)]` to fix build and `modpost` with Rust >= 1.89.0 Starting with Rust 1.89.0 (expected 2025-08-07), the Rust compiler fails to build the `rusttest` target due to undefined references such as: kernel...-cgu.0:(.text....+0x116): undefined reference to `rust_helper_kunit_get_current_test' Moreover, tooling like `modpost` gets confused: WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/gpu/drm/nova/nova.o ERROR: modpost: missing MODULE_LICENSE() in drivers/gpu/nova-core/nova_core.o The reason behind both issues is that the Rust compiler will now [1] treat `#[used]` as `#[used(linker)]` instead of `#[used(compiler)]` for our targets. This means that the retain section flag (`R`, `SHF_GNU_RETAIN`) will be used and that they will be marked as `unique` too, with different IDs. In turn, that means we end up with undefined references that did not get discarded in `rusttest` and that multiple `.modinfo` sections are generated, which confuse tooling like `modpost` because they only expect one. Thus start using `#[used(compiler)]` to keep the previous behavior and to be explicit about what we want. Sadly, it is an unstable feature (`used_with_arg`) [2] -- we will talk to upstream Rust about it. The good news is that it has been available for a long time (Rust >= 1.60) [3]. The changes should also be fine for previous Rust versions, since they behave the same way as before [4]. Alternatively, we could use `#[no_mangle]` or `#[export_name = ...]` since those still behave like `#[used(compiler)]`, but of course it is not really what we want to express, and it requires other changes to avoid symbol conflicts. Cc: David Wood Cc: Wesley Wiser Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs). Link: https://github.com/rust-lang/rust/pull/140872 [1] Link: https://github.com/rust-lang/rust/issues/93798 [2] Link: https://github.com/rust-lang/rust/pull/91504 [3] Link: https://godbolt.org/z/sxzWTMfzW [4] Reviewed-by: Alice Ryhl Acked-by: Björn Roy Baron Link: https://lore.kernel.org/r/20250712160103.1244945-3-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit aa7b65c2a29e8b07057b13624102c6810597c0d5 Author: Miguel Ojeda Date: Sat Jul 12 18:01:02 2025 +0200 objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 Starting with Rust 1.89.0 (expected 2025-08-07), under `CONFIG_RUST_DEBUG_ASSERTIONS=y`, `objtool` may report: rust/kernel.o: warning: objtool: _R..._6kernel4pageNtB5_4Page8read_raw() falls through to next function _R..._6kernel4pageNtB5_4Page9write_raw() (and many others) due to calls to the `noreturn` symbol: core::panicking::panic_nounwind_fmt Thus add the mangled one to the list so that `objtool` knows it is actually `noreturn`. See commit 56d680dd23c3 ("objtool/rust: list `noreturn` Rust functions") for more details. Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs). Cc: Josh Poimboeuf Cc: Peter Zijlstra Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250712160103.1244945-2-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit cb345f954eacd162601e7d07ca2f0f0a17b54ee3 Author: Philipp Stanner Date: Wed Jul 9 12:29:58 2025 +0200 drm/panfrost: Fix scheduler workqueue bug When the GPU scheduler was ported to using a struct for its initialization parameters, it was overlooked that panfrost creates a distinct workqueue for timeout handling. The pointer to this new workqueue is not initialized to the struct, resulting in NULL being passed to the scheduler, which then uses the system_wq for timeout handling. Set the correct workqueue to the init args struct. Cc: stable@vger.kernel.org # 6.15+ Fixes: 796a9f55a8d1 ("drm/sched: Use struct for drm_sched_init() params") Reported-by: Tvrtko Ursulin Closes: https://lore.kernel.org/dri-devel/b5d0921c-7cbf-4d55-aa47-c35cd7861c02@igalia.com/ Signed-off-by: Philipp Stanner Reviewed-by: Tvrtko Ursulin Reviewed-by: Steven Price Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20250709102957.100849-2-phasta@kernel.org commit 08ca1409c4fa37ec93de08b9963390ed68a5ae8c Author: Pavel Begunkov Date: Mon Jul 14 11:57:23 2025 +0100 io_uring/zcrx: disallow user selected dmabuf offset and size zcrx shouldn't be so frivolous about cutting a dmabuf sgtable and taking a subrange into it, the dmabuf layer might be not expecting that. It shouldn't be a problem for now, but since the zcrx dmabuf support is new and there shouldn't be any real users, let's play safe and reject user provided ranges into dmabufs. Also, it shouldn't be needed as userspace should size them appropriately. Fixes: a5c98e9424573 ("io_uring/zcrx: dmabuf backed zerocopy receive") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/be899f1afed32053eb2e2079d0da241514674aca.1752443579.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit dd8e34afd6709cb2f9c0e63340f567e6c066ed8e Author: John Garry Date: Mon Jun 30 16:21:53 2025 +0000 nvme: fix endianness of command word prints in nvme_log_err_passthru() The command word members of struct nvme_common_command are __le32 type, so use helper le32_to_cpu() to read them properly. Fixes: 9f079dda1433 ("nvme: allow passthru cmd error logging") Signed-off-by: John Garry Reviewed-by: Alan Adamson Reviewed-by: Keith Busch Signed-off-by: Christoph Hellwig commit 80d7762e0a42307ee31b21f090e21349b98c14f6 Author: Zheng Qixing Date: Tue Jul 1 15:17:17 2025 +0800 nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() When inserting a namespace into the controller's namespace list, the function uses list_add_rcu() when the namespace is inserted in the middle of the list, but falls back to a regular list_add() when adding at the head of the list. This inconsistency could lead to race conditions during concurrent access, as users might observe a partially updated list. Fix this by consistently using list_add_rcu() in both code paths to ensure proper RCU protection throughout the entire function. Fixes: be647e2c76b2 ("nvme: use srcu for iterating namespace list") Signed-off-by: Zheng Qixing Signed-off-by: Christoph Hellwig commit 710505212e3272396394f8cf78e3ddfd05df3f22 Author: Cheng Ming Lin Date: Mon Jul 14 11:10:23 2025 +0800 spi: Add check for 8-bit transfer with 8 IO mode support The current SPI framework does not verify if the SPI device supports 8 IO mode when doing an 8-bit transfer. This patch adds a check to ensure that if the transfer tx_nbits or rx_nbits is 8, the SPI mode must support 8 IO. If not, an error is returned, preventing undefined behavior. Fixes: d6a711a898672 ("spi: Fix OCTAL mode support") Cc: stable@vger.kernel.org Signed-off-by: Cheng Ming Lin Link: https://patch.msgid.link/20250714031023.504752-1-linchengming884@gmail.com Signed-off-by: Mark Brown commit 36a686c0784fcccdaa4f38b498a9ef0d42ea7cb8 Author: Phil Sutter Date: Thu Jul 10 18:43:42 2025 +0200 Revert "netfilter: nf_tables: Add notifications for hook changes" This reverts commit 465b9ee0ee7bc268d7f261356afd6c4262e48d82. Such notifications fit better into core or nfnetlink_hook code, following the NFNL_MSG_HOOK_GET message format. Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso commit 6ac86ac74e3a0608424240cc1ce813ad6e8a73dd Author: Florian Westphal Date: Mon Jul 7 22:32:44 2025 +0200 netfilter: nf_tables: hide clash bit from userspace Its a kernel implementation detail, at least at this time: We can later decide to revert this patch if there is a compelling reason, but then we should also remove the ifdef that prevents exposure of ip_conntrack_status enum IPS_NAT_CLASH value in the uapi header. Clash entries are not included in dumps (true for both old /proc and ctnetlink) either. So for now exclude the clash bit when dumping. Fixes: 7e5c6aa67e6f ("netfilter: nf_tables: add packets conntrack state to debug trace info") Link: https://lore.kernel.org/netfilter-devel/aGwf3dCggwBlRKKC@strlen.de/ Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 6dc2fae7f8a2384304ef48b7cdcb988222102a54 Author: Florian Westphal Date: Tue Jul 1 14:41:37 2025 +0200 selftests: netfilter: nft_concat_range.sh: send packets to empty set The selftest doesn't cover this error path: scratch = *raw_cpu_ptr(m->scratch); if (unlikely(!scratch)) { // here cover this too. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit aa085ea1a68d27d34f14db1f4026c35aa6b1ecc8 Author: Florian Westphal Date: Fri Jun 27 16:27:52 2025 +0200 selftests: netfilter: conntrack_resize.sh: also use udpclash tool Previous patch added a new clash resolution test case. Also use this during conntrack resize stress test in addition to icmp ping flood. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 78a58836358783995884784cb20021db6f6a29df Author: Florian Westphal Date: Fri Jun 27 16:27:51 2025 +0200 selftests: netfilter: add conntrack clash resolution test case Add a dedicated test to exercise conntrack clash resolution path. Test program emits 128 identical udp packets in parallel, then reads back replies from socat echo server. Also check (via conntrack -S) that the clash path was hit at least once. Due to the racy nature of the test its possible that despite the threaded program all packets were processed in-order or on same cpu, emit a SKIP warning in this case. Two tests are added: - one to test the simpler, non-nat case - one to exercise clash resolution where packets might have different nat transformations attached to them. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit b08590559f4b6954f1bf2510445aba346044c91b Author: Florian Westphal Date: Fri Jun 27 16:27:50 2025 +0200 selftests: netfilter: conntrack_resize.sh: extend resize test Extend the resize test: - continuously dump table both via /proc and ctnetlink interfaces while table is resized in a loop. - if socat is available, send udp packets in additon to ping requests. - increase/decrease the icmp and udp timeouts while resizes are happening. This makes sure we also exercise the 'ct has expired' check that happens on conntrack lookup. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 40b1c2f9b299295ed0482e1fee6f46521e6e79e5 Author: Richard Fitzgerald Date: Mon Jul 14 12:01:54 2025 +0100 ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX The Lenovo Yoga Book 9i GenX has the wrong values in the cirrus,dev-index _DSD property. Add a fixup for this model to ignore the property and hardcode the index from the I2C bus address. The error in the cirrus,dev-index property would prevent the second amp instance from probing. The component binding would never see all the required instances and so there would not be a binding between patch_realtek.c and the cs35l56 driver. Signed-off-by: Richard Fitzgerald Reported-by: Brian Howard Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220228 Link: https://patch.msgid.link/20250714110154.204740-1-rf@opensource.cirrus.com Signed-off-by: Takashi Iwai commit 621a88dbfe9006c318a0cafbd12e677ccfe006e7 Author: Daniel Lezcano Date: Wed Jul 9 17:47:28 2025 +0200 cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y Currently cpu hotplug with the PREEMPT_RT option set in the kernel is not supported because the underlying generic power domain functions used in the cpu hotplug callbacks are incompatible from a lock point of view. This situation prevents the suspend to idle to reach the deepest idle state for the "cluster" as identified in the undermentioned commit. Use the compatible ones when PREEMPT_RT is enabled and remove the boolean disabling the hotplug callbacks with this option. With this change the platform can reach the deepest idle state allowing at suspend time to consume less power. Tested-on Lenovo T14s with the following script: echo 0 > /sys/devices/system/cpu/cpu3/online BEFORE=$(cat /sys/kernel/debug/pm_genpd/power-domain-cpu-cluster0/idle_states | grep S0 | awk '{ print $3 }') ; rtcwake -s 1 -m mem; AFTER=$(cat /sys/kernel/debug/pm_genpd/power-domain-cpu-cluster0/idle_states | grep S0 | awk '{ print $3 }'); if [ $BEFORE -lt $AFTER ]; then echo "Test successful" else echo "Test failed" fi echo 1 > /sys/devices/system/cpu/cpu3/online Fixes: 1c4b2932bd62 ("cpuidle: psci: Enable the hierarchical topology for s2idle on PREEMPT_RT") Cc: Raghavendra Kakarla Signed-off-by: Daniel Lezcano Reviewed-by: Sudeep Holla Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250709154728.733920-1-daniel.lezcano@linaro.org Signed-off-by: Ulf Hansson commit 4722727373533b53489b66d3436b50ac156f23bf Author: Jackie Dong Date: Mon Jul 14 17:46:55 2025 +0800 ALSA: hda/realtek: Support mute LED for Yoga with ALC287 Support mute LED on keyboard for Lenovo Yoga series products with Realtek ALC287 chipset. Tested on Lenovo Slim Pro 7 14APH8. [ slight comment cleanup by tiwai ] Signed-off-by: Jackie Dong Link: https://patch.msgid.link/20250714094655.4657-1-xy-jackie@139.com Signed-off-by: Takashi Iwai commit 86ab0c10090b26e789b7bf477d4b673b5e18e55b Merge: fdfe0133473a52 89635eae076cd8 Author: Christian Brauner Date: Mon Jul 14 11:05:07 2025 +0200 Merge patch series "netfs: Fix use of fscache with ceph" David Howells says: Here are a couple of patches that fix the use of fscaching with ceph: (1) Fix the read collector to mark the write request that it creates to copy data to the cache with NETFS_RREQ_OFFLOAD_COLLECTION so that it will run the write collector on a workqueue as it's meant to run in the background and the app isn't going to wait for it. (2) Fix the read collector to wake up the copy-to-cache write request after it sets NETFS_RREQ_ALL_QUEUED if the write request doesn't have any subrequests left on it. ALL_QUEUED indicates that there won't be any more subreqs coming and the collector should clean up - except that an event is needed to trigger that, but it only gets events from subreq termination and so the last event can beat us to setting ALL_QUEUED. * patches from https://lore.kernel.org/20250711151005.2956810-1-dhowells@redhat.com: netfs: Fix race between cache write completion and ALL_QUEUED being set netfs: Fix copy-to-cache so that it performs collection with ceph+fscache Link: https://lore.kernel.org/20250711151005.2956810-1-dhowells@redhat.com Signed-off-by: Christian Brauner commit 89635eae076cd8eaa5cb752f66538c9dc6c9fdc3 Author: David Howells Date: Fri Jul 11 16:10:01 2025 +0100 netfs: Fix race between cache write completion and ALL_QUEUED being set When netfslib is issuing subrequests, the subrequests start processing immediately and may complete before we reach the end of the issuing function. At the end of the issuing function we set NETFS_RREQ_ALL_QUEUED to indicate to the collector that we aren't going to issue any more subreqs and that it can do the final notifications and cleanup. Now, this isn't a problem if the request is synchronous (NETFS_RREQ_OFFLOAD_COLLECTION is unset) as the result collection will be done in-thread and we're guaranteed an opportunity to run the collector. However, if the request is asynchronous, collection is primarily triggered by the termination of subrequests queuing it on a workqueue. Now, a race can occur here if the app thread sets ALL_QUEUED after the last subrequest terminates. This can happen most easily with the copy2cache code (as used by Ceph) where, in the collection routine of a read request, an asynchronous write request is spawned to copy data to the cache. Folios are added to the write request as they're unlocked, but there may be a delay before ALL_QUEUED is set as the write subrequests may complete before we get there. If all the write subreqs have finished by the ALL_QUEUED point, no further events happen and the collection never happens, leaving the request hanging. Fix this by queuing the collector after setting ALL_QUEUED. This is a bit heavy-handed and it may be sufficient to do it only if there are no extant subreqs. Also add a tracepoint to cross-reference both requests in a copy-to-request operation and add a trace to the netfs_rreq tracepoint to indicate the setting of ALL_QUEUED. Fixes: e2d46f2ec332 ("netfs: Change the read result collector to only use one work item") Reported-by: Max Kellermann Link: https://lore.kernel.org/r/CAKPOu+8z_ijTLHdiCYGU_Uk7yYD=shxyGLwfe-L7AV3DhebS3w@mail.gmail.com/ Signed-off-by: David Howells Link: https://lore.kernel.org/20250711151005.2956810-3-dhowells@redhat.com Reviewed-by: Paulo Alcantara (Red Hat) cc: Paulo Alcantara cc: Viacheslav Dubeyko cc: Alex Markuze cc: Ilya Dryomov cc: netfs@lists.linux.dev cc: ceph-devel@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: stable@vger.kernel.org Signed-off-by: Christian Brauner commit 4c238e30774e3022a505fa54311273add7570f13 Author: David Howells Date: Fri Jul 11 16:10:00 2025 +0100 netfs: Fix copy-to-cache so that it performs collection with ceph+fscache The netfs copy-to-cache that is used by Ceph with local caching sets up a new request to write data just read to the cache. The request is started and then left to look after itself whilst the app continues. The request gets notified by the backing fs upon completion of the async DIO write, but then tries to wake up the app because NETFS_RREQ_OFFLOAD_COLLECTION isn't set - but the app isn't waiting there, and so the request just hangs. Fix this by setting NETFS_RREQ_OFFLOAD_COLLECTION which causes the notification from the backing filesystem to put the collection onto a work queue instead. Fixes: e2d46f2ec332 ("netfs: Change the read result collector to only use one work item") Reported-by: Max Kellermann Link: https://lore.kernel.org/r/CAKPOu+8z_ijTLHdiCYGU_Uk7yYD=shxyGLwfe-L7AV3DhebS3w@mail.gmail.com/ Signed-off-by: David Howells Link: https://lore.kernel.org/20250711151005.2956810-2-dhowells@redhat.com Reviewed-by: Paulo Alcantara (Red Hat) cc: Paulo Alcantara cc: Viacheslav Dubeyko cc: Alex Markuze cc: Ilya Dryomov cc: netfs@lists.linux.dev cc: ceph-devel@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: stable@vger.kernel.org Signed-off-by: Christian Brauner commit 36569780b0d64de283f9d6c2195fd1a43e221ee8 Author: Aruna Ramakrishna Date: Wed Jul 9 17:33:28 2025 +0000 sched: Change nr_uninterruptible type to unsigned long The commit e6fe3f422be1 ("sched: Make multiple runqueue task counters 32-bit") changed nr_uninterruptible to an unsigned int. But the nr_uninterruptible values for each of the CPU runqueues can grow to large numbers, sometimes exceeding INT_MAX. This is valid, if, over time, a large number of tasks are migrated off of one CPU after going into an uninterruptible state. Only the sum of all nr_interruptible values across all CPUs yields the correct result, as explained in a comment in kernel/sched/loadavg.c. Change the type of nr_uninterruptible back to unsigned long to prevent overflows, and thus the miscalculation of load average. Fixes: e6fe3f422be1 ("sched: Make multiple runqueue task counters 32-bit") Signed-off-by: Aruna Ramakrishna Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20250709173328.606794-1-aruna.ramakrishna@oracle.com commit fdfe0133473a528e3f5da69c35419ce6711d6b89 Author: Al Viro Date: Sat Jul 12 18:18:43 2025 +0100 fix a leak in fcntl_dirnotify() [into #fixes, unless somebody objects] Lifetime of new_dn_mark is controlled by that of its ->fsn_mark, pointed to by new_fsn_mark. Unfortunately, a failure exit had been inserted between the allocation of new_dn_mark and the call of fsnotify_init_mark(), ending up with a leak. Fixes: 1934b212615d "file: reclaim 24 bytes from f_owner" Signed-off-by: Al Viro Link: https://lore.kernel.org/20250712171843.GB1880847@ZenIV Signed-off-by: Christian Brauner commit a8780906ca2604c9d5128507e34285043b943410 Merge: d7b8f8e20813f0 6aae87fe7f180c Author: Wolfram Sang Date: Mon Jul 14 09:02:25 2025 +0200 Merge tag 'i2c-host-fixes-6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current i2c-host-fixes for v6.16-rc6 omap: add missing error check and fix PM disable in probe error path. stm32: unmap DMA buffer on transfer failure and use correct device when mapping and unmapping during transfers. commit 28712d6ed32028b0f2e0defe6681411496971ca3 Merge: a90b2a1aaacbcf 2a198bbec6913a Author: Steffen Klassert Date: Mon Jul 14 08:59:48 2025 +0200 Merge branch 'ipsec: fix splat due to ipcomp fallback tunnel' Sabrina Dubroca says: ==================== IPcomp tunnel states have an associated fallback tunnel, a keep a reference on the corresponding xfrm_state, to allow deleting that extra state when it's not needed anymore. These states cause issues during netns deletion. Commit f75a2804da39 ("xfrm: destroy xfrm_state synchronously on net exit path") tried to address these problems but doesn't fully solve them, and slowed down netns deletion by adding one synchronize_rcu per deleted state. The first patch solves the problem by moving the fallback state deletion earlier (when we delete the user state, rather than at destruction), then we can revert the previous fix. ==================== Signed-off-by: Steffen Klassert commit 83898e4a858387c88cd7456f713cb8fd49440cf9 Author: Bharath SM Date: Tue Jul 1 00:23:03 2025 +0530 smb: invalidate and close cached directory when creating child entries When a parent lease key is passed to the server during a create operation while holding a directory lease, the server may not send a lease break to the client. In such cases, it becomes the client’s responsibility to ensure cache consistency. This led to a problem where directory listings (e.g., `ls` or `readdir`) could return stale results after a new file is created. eg: ls /mnt/share/ touch /mnt/share/file1 ls /mnt/share/ In this scenario, the final `ls` may not show `file1` due to the stale directory cache. For now, fix this by marking the cached directory as invalid if using the parent lease key during create, and explicitly closing the cached directory after successful file creation. Fixes: 037e1bae588eacf ("smb: client: use ParentLeaseKey in cifs_do_create") Signed-off-by: Bharath SM Signed-off-by: Steve French commit b220bed63330c0e1733dc06ea8e75d5b9962b6b6 Author: Wang Zhaolong Date: Sat Jul 5 10:51:18 2025 +0800 smb: client: fix use-after-free in crypt_message when using async crypto The CVE-2024-50047 fix removed asynchronous crypto handling from crypt_message(), assuming all crypto operations are synchronous. However, when hardware crypto accelerators are used, this can cause use-after-free crashes: crypt_message() // Allocate the creq buffer containing the req creq = smb2_get_aead_req(..., &req); // Async encryption returns -EINPROGRESS immediately rc = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req); // Free creq while async operation is still in progress kvfree_sensitive(creq, ...); Hardware crypto modules often implement async AEAD operations for performance. When crypto_aead_encrypt/decrypt() returns -EINPROGRESS, the operation completes asynchronously. Without crypto_wait_req(), the function immediately frees the request buffer, leading to crashes when the driver later accesses the freed memory. This results in a use-after-free condition when the hardware crypto driver later accesses the freed request structure, leading to kernel crashes with NULL pointer dereferences. The issue occurs because crypto_alloc_aead() with mask=0 doesn't guarantee synchronous operation. Even without CRYPTO_ALG_ASYNC in the mask, async implementations can be selected. Fix by restoring the async crypto handling: - DECLARE_CRYPTO_WAIT(wait) for completion tracking - aead_request_set_callback() for async completion notification - crypto_wait_req() to wait for operation completion This ensures the request buffer isn't freed until the crypto operation completes, whether synchronous or asynchronous, while preserving the CVE-2024-50047 fix. Fixes: b0abcd65ec54 ("smb: client: fix UAF in async decryption") Link: https://lore.kernel.org/all/8b784a13-87b0-4131-9ff9-7a8993538749@huaweicloud.com/ Cc: stable@vger.kernel.org Reviewed-by: Paulo Alcantara (Red Hat) Signed-off-by: Wang Zhaolong Signed-off-by: Steve French commit 705c79101ccf9edea5a00d761491a03ced314210 Author: Wang Zhaolong Date: Mon Jul 7 09:09:26 2025 +0800 smb: client: fix use-after-free in cifs_oplock_break A race condition can occur in cifs_oplock_break() leading to a use-after-free of the cinode structure when unmounting: cifs_oplock_break() _cifsFileInfo_put(cfile) cifsFileInfo_put_final() cifs_sb_deactive() [last ref, start releasing sb] kill_sb() kill_anon_super() generic_shutdown_super() evict_inodes() dispose_list() evict() destroy_inode() call_rcu(&inode->i_rcu, i_callback) spin_lock(&cinode->open_file_lock) <- OK [later] i_callback() cifs_free_inode() kmem_cache_free(cinode) spin_unlock(&cinode->open_file_lock) <- UAF cifs_done_oplock_break(cinode) <- UAF The issue occurs when umount has already released its reference to the superblock. When _cifsFileInfo_put() calls cifs_sb_deactive(), this releases the last reference, triggering the immediate cleanup of all inodes under RCU. However, cifs_oplock_break() continues to access the cinode after this point, resulting in use-after-free. Fix this by holding an extra reference to the superblock during the entire oplock break operation. This ensures that the superblock and its inodes remain valid until the oplock break completes. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220309 Fixes: b98749cac4a6 ("CIFS: keep FileInfo handle live during oplock break") Reviewed-by: Paulo Alcantara (Red Hat) Signed-off-by: Wang Zhaolong Signed-off-by: Steve French commit b640daa2822a39ff76e70200cb2b7b892b896dce Author: Kuniyuki Iwashima Date: Fri Jul 11 18:21:19 2025 +0000 rpl: Fix use-after-free in rpl_do_srh_inline(). Running lwt_dst_cache_ref_loop.sh in selftest with KASAN triggers the splat below [0]. rpl_do_srh_inline() fetches ipv6_hdr(skb) and accesses it after skb_cow_head(), which is illegal as the header could be freed then. Let's fix it by making oldhdr to a local struct instead of a pointer. [0]: [root@fedora net]# ./lwt_dst_cache_ref_loop.sh ... TEST: rpl (input) [ 57.631529] ================================================================== BUG: KASAN: slab-use-after-free in rpl_do_srh_inline.isra.0 (net/ipv6/rpl_iptunnel.c:174) Read of size 40 at addr ffff888122bf96d8 by task ping6/1543 CPU: 50 UID: 0 PID: 1543 Comm: ping6 Not tainted 6.16.0-rc5-01302-gfadd1e6231b1 #23 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: dump_stack_lvl (lib/dump_stack.c:122) print_report (mm/kasan/report.c:409 mm/kasan/report.c:521) kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:636) kasan_check_range (mm/kasan/generic.c:175 (discriminator 1) mm/kasan/generic.c:189 (discriminator 1)) __asan_memmove (mm/kasan/shadow.c:94 (discriminator 2)) rpl_do_srh_inline.isra.0 (net/ipv6/rpl_iptunnel.c:174) rpl_input (net/ipv6/rpl_iptunnel.c:201 net/ipv6/rpl_iptunnel.c:282) lwtunnel_input (net/core/lwtunnel.c:459) ipv6_rcv (./include/net/dst.h:471 (discriminator 1) ./include/net/dst.h:469 (discriminator 1) net/ipv6/ip6_input.c:79 (discriminator 1) ./include/linux/netfilter.h:317 (discriminator 1) ./include/linux/netfilter.h:311 (discriminator 1) net/ipv6/ip6_input.c:311 (discriminator 1)) __netif_receive_skb_one_core (net/core/dev.c:5967) process_backlog (./include/linux/rcupdate.h:869 net/core/dev.c:6440) __napi_poll.constprop.0 (net/core/dev.c:7452) net_rx_action (net/core/dev.c:7518 net/core/dev.c:7643) handle_softirqs (kernel/softirq.c:579) do_softirq (kernel/softirq.c:480 (discriminator 20)) __local_bh_enable_ip (kernel/softirq.c:407) __dev_queue_xmit (net/core/dev.c:4740) ip6_finish_output2 (./include/linux/netdevice.h:3358 ./include/net/neighbour.h:526 ./include/net/neighbour.h:540 net/ipv6/ip6_output.c:141) ip6_finish_output (net/ipv6/ip6_output.c:215 net/ipv6/ip6_output.c:226) ip6_output (./include/linux/netfilter.h:306 net/ipv6/ip6_output.c:248) ip6_send_skb (net/ipv6/ip6_output.c:1983) rawv6_sendmsg (net/ipv6/raw.c:588 net/ipv6/raw.c:918) __sys_sendto (net/socket.c:714 (discriminator 1) net/socket.c:729 (discriminator 1) net/socket.c:2228 (discriminator 1)) __x64_sys_sendto (net/socket.c:2231) do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) RIP: 0033:0x7f68cffb2a06 Code: 5d e8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 75 19 83 e2 39 83 fa 08 75 11 e8 26 ff ff ff 66 0f 1f 44 00 00 48 8b 45 10 0f 05 <48> 8b 5d f8 c9 c3 0f 1f 40 00 f3 0f 1e fa 55 48 89 e5 48 83 ec 08 RSP: 002b:00007ffefb7c53d0 EFLAGS: 00000202 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000564cd69f10a0 RCX: 00007f68cffb2a06 RDX: 0000000000000040 RSI: 0000564cd69f10a4 RDI: 0000000000000003 RBP: 00007ffefb7c53f0 R08: 0000564cd6a032ac R09: 000000000000001c R10: 0000000000000000 R11: 0000000000000202 R12: 0000564cd69f10a4 R13: 0000000000000040 R14: 00007ffefb7c66e0 R15: 0000564cd69f10a0 Allocated by task 1543: kasan_save_stack (mm/kasan/common.c:48) kasan_save_track (mm/kasan/common.c:60 (discriminator 1) mm/kasan/common.c:69 (discriminator 1)) __kasan_slab_alloc (mm/kasan/common.c:319 mm/kasan/common.c:345) kmem_cache_alloc_node_noprof (./include/linux/kasan.h:250 mm/slub.c:4148 mm/slub.c:4197 mm/slub.c:4249) kmalloc_reserve (net/core/skbuff.c:581 (discriminator 88)) __alloc_skb (net/core/skbuff.c:669) __ip6_append_data (net/ipv6/ip6_output.c:1672 (discriminator 1)) ip6_append_data (net/ipv6/ip6_output.c:1859) rawv6_sendmsg (net/ipv6/raw.c:911) __sys_sendto (net/socket.c:714 (discriminator 1) net/socket.c:729 (discriminator 1) net/socket.c:2228 (discriminator 1)) __x64_sys_sendto (net/socket.c:2231) do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Freed by task 1543: kasan_save_stack (mm/kasan/common.c:48) kasan_save_track (mm/kasan/common.c:60 (discriminator 1) mm/kasan/common.c:69 (discriminator 1)) kasan_save_free_info (mm/kasan/generic.c:579 (discriminator 1)) __kasan_slab_free (mm/kasan/common.c:271) kmem_cache_free (mm/slub.c:4643 (discriminator 3) mm/slub.c:4745 (discriminator 3)) pskb_expand_head (net/core/skbuff.c:2274) rpl_do_srh_inline.isra.0 (net/ipv6/rpl_iptunnel.c:158 (discriminator 1)) rpl_input (net/ipv6/rpl_iptunnel.c:201 net/ipv6/rpl_iptunnel.c:282) lwtunnel_input (net/core/lwtunnel.c:459) ipv6_rcv (./include/net/dst.h:471 (discriminator 1) ./include/net/dst.h:469 (discriminator 1) net/ipv6/ip6_input.c:79 (discriminator 1) ./include/linux/netfilter.h:317 (discriminator 1) ./include/linux/netfilter.h:311 (discriminator 1) net/ipv6/ip6_input.c:311 (discriminator 1)) __netif_receive_skb_one_core (net/core/dev.c:5967) process_backlog (./include/linux/rcupdate.h:869 net/core/dev.c:6440) __napi_poll.constprop.0 (net/core/dev.c:7452) net_rx_action (net/core/dev.c:7518 net/core/dev.c:7643) handle_softirqs (kernel/softirq.c:579) do_softirq (kernel/softirq.c:480 (discriminator 20)) __local_bh_enable_ip (kernel/softirq.c:407) __dev_queue_xmit (net/core/dev.c:4740) ip6_finish_output2 (./include/linux/netdevice.h:3358 ./include/net/neighbour.h:526 ./include/net/neighbour.h:540 net/ipv6/ip6_output.c:141) ip6_finish_output (net/ipv6/ip6_output.c:215 net/ipv6/ip6_output.c:226) ip6_output (./include/linux/netfilter.h:306 net/ipv6/ip6_output.c:248) ip6_send_skb (net/ipv6/ip6_output.c:1983) rawv6_sendmsg (net/ipv6/raw.c:588 net/ipv6/raw.c:918) __sys_sendto (net/socket.c:714 (discriminator 1) net/socket.c:729 (discriminator 1) net/socket.c:2228 (discriminator 1)) __x64_sys_sendto (net/socket.c:2231) do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) The buggy address belongs to the object at ffff888122bf96c0 which belongs to the cache skbuff_small_head of size 704 The buggy address is located 24 bytes inside of freed 704-byte region [ffff888122bf96c0, ffff888122bf9980) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x122bf8 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x200000000000040(head|node=0|zone=2) page_type: f5(slab) raw: 0200000000000040 ffff888101fc0a00 ffffea000464dc00 0000000000000002 raw: 0000000000000000 0000000080270027 00000000f5000000 0000000000000000 head: 0200000000000040 ffff888101fc0a00 ffffea000464dc00 0000000000000002 head: 0000000000000000 0000000080270027 00000000f5000000 0000000000000000 head: 0200000000000003 ffffea00048afe01 00000000ffffffff 00000000ffffffff head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888122bf9580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888122bf9600: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc >ffff888122bf9680: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb ^ ffff888122bf9700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888122bf9780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Fixes: a7a29f9c361f8 ("net: ipv6: add rpl sr tunnel") Signed-off-by: Kuniyuki Iwashima Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 30792947c6f33175e53ae3b8de3f6971c26505b9 Author: Kent Overstreet Date: Thu Jul 10 16:27:29 2025 -0400 bcachefs: io_read: remove from async obj list in rbio_done() Previously, only split rbios allocated in io_read.c would be removed from the async obj list. Signed-off-by: Kent Overstreet commit e837b59f8b411b5baf5e3de7a5aea10b1c545a63 Author: Arnd Bergmann Date: Wed Jul 9 16:56:07 2025 +0200 ASoC: Intel: fix SND_SOC_SOF dependencies It is currently possible to configure a kernel with all Intel SoC configs as loadable modules, but the board config as built-in. This causes a link failure in the reference to the snd_soc_sof.ko module: x86_64-linux-ld: sound/soc/intel/boards/sof_rt5682.o: in function `sof_rt5682_hw_params': sof_rt5682.c:(.text+0x1f9): undefined reference to `sof_dai_get_mclk' x86_64-linux-ld: sof_rt5682.c:(.text+0x234): undefined reference to `sof_dai_get_bclk' x86_64-linux-ld: sound/soc/intel/boards/sof_rt5682.o: in function `sof_rt5682_codec_init': sof_rt5682.c:(.text+0x3e0): undefined reference to `sof_dai_get_mclk' x86_64-linux-ld: sound/soc/intel/boards/sof_cs42l42.o: in function `sof_cs42l42_hw_params': sof_cs42l42.c:(.text+0x2a): undefined reference to `sof_dai_get_bclk' x86_64-linux-ld: sound/soc/intel/boards/sof_nau8825.o: in function `sof_nau8825_hw_params': sof_nau8825.c:(.text+0x7f): undefined reference to `sof_dai_get_bclk' x86_64-linux-ld: sound/soc/intel/boards/sof_da7219.o: in function `da7219_codec_init': sof_da7219.c:(.text+0xbf): undefined reference to `sof_dai_get_mclk' x86_64-linux-ld: sound/soc/intel/boards/sof_maxim_common.o: in function `max_98373_hw_params': sof_maxim_common.c:(.text+0x6f9): undefined reference to `sof_dai_get_tdm_slots' x86_64-linux-ld: sound/soc/intel/boards/sof_realtek_common.o: in function `rt1015_hw_params': sof_realtek_common.c:(.text+0x54c): undefined reference to `sof_dai_get_bclk' x86_64-linux-ld: sound/soc/intel/boards/sof_realtek_common.o: in function `rt1308_hw_params': sof_realtek_common.c:(.text+0x702): undefined reference to `sof_dai_get_mclk' x86_64-linux-ld: sound/soc/intel/boards/sof_cirrus_common.o: in function `cs35l41_hw_params': sof_cirrus_common.c:(.text+0x2f): undefined reference to `sof_dai_get_bclk' Add an optional dependency on SND_SOC_SOF_INTEL_COMMON, to ensure that whenever the SOF support is in a loadable module, none of the board code can be built-in. This may be be a little heavy-handed, but I also don't see a reason why one would want the boards to be built-in but not the SoC, so it shouldn't actually cause any usability problems. Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20250709145626.64125-1-arnd@kernel.org Signed-off-by: Mark Brown commit d235538723e6c95f354b49a8c4760be43c234579 Author: Oder Chiou Date: Fri Jul 11 11:48:13 2025 +0800 ASoC: rt5660: Fix the dmic data source from GPIO2 The patch fixes an issue with the dmic data pin connected to GPIO2. Signed-off-by: Oder Chiou Link: https://patch.msgid.link/20250711034813.3278989-1-oder_chiou@realtek.com Signed-off-by: Mark Brown commit 347e9f5043c89695b01e66b3ed111755afcf1911 Author: Linus Torvalds Date: Sun Jul 13 14:25:58 2025 -0700 Linux 6.16-rc6 commit 3cd752194e2ec2573d0e740f4a1edbfcc28257f5 Merge: 5d5d62298b8b50 a42b4dcc4f9f30 Author: Linus Torvalds Date: Sun Jul 13 11:37:35 2025 -0700 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Fixes for a few clk drivers and bindings: - Add a missing property to the Mediatek MT8188 clk binding to keep binding checks happy - Avoid an OOB by setting the correct number of parents in dispmix_csr_clk_dev_data - Allocate clk_hw structs early in probe to avoid an ordering issue where clk_parent_data points to an unallocated clk_hw when the child clk is registered before the parent clk in the SCMI clk driver * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: dt-bindings: clock: mediatek: Add #reset-cells property for MT8188 clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data clk: scmi: Handle case where child clocks are initialized before their parents commit 5d5d62298b8b5017d6677af28e021f7ad13f7a62 Merge: 41998eeb29a187 cb73e53f7c0700 Author: Linus Torvalds Date: Sun Jul 13 10:41:19 2025 -0700 Merge tag 'x86_urgent_for_v6.16_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: - Update Kirill's email address - Allow hugetlb PMD sharing only on 64-bit as it doesn't make a whole lotta sense on 32-bit - Add fixes for a misconfigured AMD Zen2 client which wasn't even supposed to run Linux * tag 'x86_urgent_for_v6.16_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: MAINTAINERS: Update Kirill Shutemov's email address for TDX x86/mm: Disable hugetlb page table sharing on 32-bit x86/CPU/AMD: Disable INVLPGB on Zen2 x86/rdrand: Disable RDSEED on AMD Cyan Skillfish commit 41998eeb29a187d66eec7699741cc278ce53d65b Merge: 0a197b757690ec a8b289f0f2dcba Author: Linus Torvalds Date: Sun Jul 13 10:36:55 2025 -0700 Merge tag 'irq_urgent_for_v6.16_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Borislav Petkov: - Fix a case of recursive locking in the MSI code - Fix a randconfig build failure in armada-370-xp irqchip * tag 'irq_urgent_for_v6.16_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/irq-msi-lib: Fix build with PCI disabled PCI/MSI: Prevent recursive locking in pci_msix_write_tph_tag() commit 0a197b757690ecdd60601bbc977b66bf38f2297d Merge: 3f31a806a62e44 3da6bb419750f3 Author: Linus Torvalds Date: Sun Jul 13 10:34:47 2025 -0700 Merge tag 'perf_urgent_for_v6.16_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fix from Borislav Petkov: - Prevent perf_sigtrap() from observing an exiting task and warning about it * tag 'perf_urgent_for_v6.16_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/core: Fix WARN in perf_sigtrap() commit 2aa4ad626ee7f817a8f4715a47b318cfdc1714c9 Author: Steffen Bätz Date: Sat Jul 12 19:17:27 2025 +0100 nvmem: imx-ocotp: fix MAC address byte length The commit "13bcd440f2ff nvmem: core: verify cell's raw_len" caused an extension of the "mac-address" cell from 6 to 8 bytes due to word_size of 4 bytes. This led to a required byte swap of the full buffer length, which caused truncation of the mac-address when read. Previously, the mac-address was incorrectly truncated from 70:B3:D5:14:E9:0E to 00:00:70:B3:D5:14. Fix the issue by swapping only the first 6 bytes to correctly pass the mac-address to the upper layers. Fixes: 13bcd440f2ff ("nvmem: core: verify cell's raw_len") Cc: stable@vger.kernel.org Signed-off-by: Steffen Bätz Tested-by: Alexander Stein Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250712181729.6495-3-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 5724ff190b22bd04fcfd7287a39c6e5494e40f0b Author: Minas Harutyunyan Date: Mon Jul 7 09:54:19 2025 +0000 usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY For UTMI+ PHY, according to programming guide, first should be set PMUACTV bit then STOPPCLK bit. Otherwise, when the device issues Remote Wakeup, then host notices disconnect instead. For ULPI PHY, above mentioned bits must be set in reversed order: STOPPCLK then PMUACTV. Fixes: 4483ef3c1685 ("usb: dwc2: Add hibernation updates for ULPI PHY") Cc: stable Signed-off-by: Minas Harutyunyan Link: https://lore.kernel.org/r/692110d3c3d9bb2a91cedf24528a7710adc55452.1751881374.git.Minas.Harutyunyan@synopsys.com Signed-off-by: Greg Kroah-Hartman commit ef8abc0ba49ce717e6bc4124e88e59982671f3b5 Author: Krishna Kurapati Date: Wed Jul 9 18:59:00 2025 +0530 usb: dwc3: qcom: Don't leave BCR asserted Leaving the USB BCR asserted prevents the associated GDSC to turn on. This blocks any subsequent attempts of probing the device, e.g. after a probe deferral, with the following showing in the log: [ 1.332226] usb30_prim_gdsc status stuck at 'off' Leave the BCR deasserted when exiting the driver to avoid this issue. Cc: stable Fixes: a4333c3a6ba9 ("usb: dwc3: Add Qualcomm DWC3 glue driver") Acked-by: Thinh Nguyen Reviewed-by: Konrad Dybcio Signed-off-by: Krishna Kurapati Link: https://lore.kernel.org/r/20250709132900.3408752-1-krishna.kurapati@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 3a1d22bd85381c4e358fc3340e776c3a3223a1d0 Author: Benjamin Tissoires Date: Thu Jul 10 16:01:36 2025 +0200 selftests/hid: add a test case for the recent syzbot underflow Syzbot found a buffer underflow in __hid_request(). Add a related test case for it. It's not perfect, but it allows to catch a corner case when a report descriptor is crafted so that it has a size of 0. Link: https://patch.msgid.link/20250710-report-size-null-v2-4-ccf922b7c4e5@kernel.org Signed-off-by: Benjamin Tissoires commit c2ca42f190b6714d6c481dfd3d9b62ea091c946b Author: Benjamin Tissoires Date: Thu Jul 10 16:01:35 2025 +0200 HID: core: do not bypass hid_hw_raw_request hid_hw_raw_request() is actually useful to ensure the provided buffer and length are valid. Directly calling in the low level transport driver function bypassed those checks and allowed invalid paramto be used. Reported-by: Alan Stern Closes: https://lore.kernel.org/linux-input/c75433e0-9b47-4072-bbe8-b1d14ea97b13@rowland.harvard.edu/ Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250710-report-size-null-v2-3-ccf922b7c4e5@kernel.org Signed-off-by: Benjamin Tissoires commit 0d0777ccaa2d46609d05b66ba0096802a2746193 Author: Benjamin Tissoires Date: Thu Jul 10 16:01:34 2025 +0200 HID: core: ensure __hid_request reserves the report ID as the first byte The low level transport driver expects the first byte to be the report ID, even when the report ID is not use (in which case they just shift the buffer). However, __hid_request() whas not offsetting the buffer it used by one in this case, meaning that the raw_request() callback emitted by the transport driver would be stripped of the first byte. Note: this changes the API for uhid devices when a request is made through hid_hw_request. However, several considerations makes me think this is fine: - every request to a HID device made through hid_hw_request() would see that change, but every request made through hid_hw_raw_request() already has the new behaviour. So that means that the users are already facing situations where they might have or not the first byte being the null report ID when it is 0. We are making things more straightforward in the end. - uhid is mainly used for BLE devices - uhid is also used for testing, but I don't see that change a big issue - for BLE devices, we can check which kernel module is calling hid_hw_request() - and in those modules, we can check which are using a Bluetooth device - and then we can check if the command is used with a report ID or not. - surprise: none of the kernel module are using a report ID 0 - and finally, bluez, in its function set_report()[0], does the same shift if the report ID is 0 and the given buffer has a size > 0. [0] https://git.kernel.org/pub/scm/bluetooth/bluez.git/tree/profiles/input/hog-lib.c#n879 Reported-by: Alan Stern Closes: https://lore.kernel.org/linux-input/c75433e0-9b47-4072-bbe8-b1d14ea97b13@rowland.harvard.edu/ Reported-by: syzbot+8258d5439c49d4c35f43@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=8258d5439c49d4c35f43 Tested-by: syzbot+8258d5439c49d4c35f43@syzkaller.appspotmail.com Fixes: 4fa5a7f76cc7 ("HID: core: implement generic .request()") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250710-report-size-null-v2-2-ccf922b7c4e5@kernel.org Signed-off-by: Benjamin Tissoires commit 4f15ee98304b96e164ff2340e1dfd6181c3f42aa Author: Benjamin Tissoires Date: Thu Jul 10 16:01:33 2025 +0200 HID: core: ensure the allocated report buffer can contain the reserved report ID When the report ID is not used, the low level transport drivers expect the first byte to be 0. However, currently the allocated buffer not account for that extra byte, meaning that instead of having 8 guaranteed bytes for implement to be working, we only have 7. Reported-by: Alan Stern Closes: https://lore.kernel.org/linux-input/c75433e0-9b47-4072-bbe8-b1d14ea97b13@rowland.harvard.edu/ Cc: stable@vger.kernel.org Suggested-by: Alan Stern Link: https://patch.msgid.link/20250710-report-size-null-v2-1-ccf922b7c4e5@kernel.org Signed-off-by: Benjamin Tissoires commit a059ef8e888941d6c2dc3e94f5f7c98db232ea5d Merge: 5e28d5a3f774f1 55f0bfc0370539 Author: David S. Miller Date: Sun Jul 13 01:28:52 2025 +0100 Merge branch 'tpacket_snd-bugs' into main Yun Lu says: ==================== fix two issues and optimize code on tpacket_snd() This series fix two issues and optimize the code on tpacket_snd(): 1, fix the SO_SNDTIMEO constraint not effective due to the changes in commit 581073f626e3; 2, fix a soft lockup issue on a specific edge case, and also optimize the loop logic to be clearer and more obvious; --- Changes in v5: - Still combine fix and optimization together, change to while(1). Thanks: Willem de Bruijn. - Link to v4: https://lore.kernel.org/all/20250710102639.280932-1-luyun_611@163.com/ Changes in v4: - Fix a typo and add the missing semicolon. Thanks: Simon Horman. - Split the second patch into two, one to fix, another to optimize. Thanks: Willem de Bruijn - Link to v3: https://lore.kernel.org/all/20250709095653.62469-1-luyun_611@163.com/ Changes in v3: - Split in two different patches. - Simplify the code and reuse ph to continue. Thanks: Eric Dumazet. - Link to v2: https://lore.kernel.org/all/20250708020642.27838-1-luyun_611@163.com/ Changes in v2: - Add a Fixes tag. - Link to v1: https://lore.kernel.org/all/20250707081629.10344-1-luyun_611@163.com/ ==================== Signed-off-by: David S. Miller commit 55f0bfc0370539213202f4ce1a07615327ac4713 Author: Yun Lu Date: Fri Jul 11 17:33:00 2025 +0800 af_packet: fix soft lockup issue caused by tpacket_snd() When MSG_DONTWAIT is not set, the tpacket_snd operation will wait for pending_refcnt to decrement to zero before returning. The pending_refcnt is decremented by 1 when the skb->destructor function is called, indicating that the skb has been successfully sent and needs to be destroyed. If an error occurs during this process, the tpacket_snd() function will exit and return error, but pending_refcnt may not yet have decremented to zero. Assuming the next send operation is executed immediately, but there are no available frames to be sent in tx_ring (i.e., packet_current_frame returns NULL), and skb is also NULL, the function will not execute wait_for_completion_interruptible_timeout() to yield the CPU. Instead, it will enter a do-while loop, waiting for pending_refcnt to be zero. Even if the previous skb has completed transmission, the skb->destructor function can only be invoked in the ksoftirqd thread (assuming NAPI threading is enabled). When both the ksoftirqd thread and the tpacket_snd operation happen to run on the same CPU, and the CPU trapped in the do-while loop without yielding, the ksoftirqd thread will not get scheduled to run. As a result, pending_refcnt will never be reduced to zero, and the do-while loop cannot exit, eventually leading to a CPU soft lockup issue. In fact, skb is true for all but the first iterations of that loop, and as long as pending_refcnt is not zero, even if incremented by a previous call, wait_for_completion_interruptible_timeout() should be executed to yield the CPU, allowing the ksoftirqd thread to be scheduled. Therefore, the execution condition of this function should be modified to check if pending_refcnt is not zero, instead of check skb. - if (need_wait && skb) { + if (need_wait && packet_read_pending(&po->tx_ring)) { As a result, the judgment conditions are duplicated with the end code of the while loop, and packet_read_pending() is a very expensive function. Actually, this loop can only exit when ph is NULL, so the loop condition can be changed to while (1), and in the "ph = NULL" branch, if the subsequent condition of if is not met, the loop can break directly. Now, the loop logic remains the same as origin but is clearer and more obvious. Fixes: 89ed5b519004 ("af_packet: Block execution of tasks waiting for transmit to complete in AF_PACKET") Cc: stable@kernel.org Suggested-by: LongJun Tang Signed-off-by: Yun Lu Reviewed-by: Willem de Bruijn Signed-off-by: David S. Miller commit c1ba3c0cbdb5e53a8ec5d708e99cd4c497028a13 Author: Yun Lu Date: Fri Jul 11 17:32:59 2025 +0800 af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() Due to the changes in commit 581073f626e3 ("af_packet: do not call packet_read_pending() from tpacket_destruct_skb()"), every time tpacket_destruct_skb() is executed, the skb_completion is marked as completed. When wait_for_completion_interruptible_timeout() returns completed, the pending_refcnt has not yet been reduced to zero. Therefore, when ph is NULL, the wait function may need to be called multiple times until packet_read_pending() finally returns zero. We should call sock_sndtimeo() only once, otherwise the SO_SNDTIMEO constraint could be way off. Fixes: 581073f626e3 ("af_packet: do not call packet_read_pending() from tpacket_destruct_skb()") Cc: stable@kernel.org Suggested-by: Eric Dumazet Signed-off-by: Yun Lu Reviewed-by: Eric Dumazet Reviewed-by: Willem de Bruijn Signed-off-by: David S. Miller commit 5e28d5a3f774f118896aec17a3a20a9c5c9dfc64 Author: Xiang Mei Date: Thu Jul 10 03:09:42 2025 -0700 net/sched: sch_qfq: Fix race condition on qfq_aggregate A race condition can occur when 'agg' is modified in qfq_change_agg (called during qfq_enqueue) while other threads access it concurrently. For example, qfq_dump_class may trigger a NULL dereference, and qfq_delete_class may cause a use-after-free. This patch addresses the issue by: 1. Moved qfq_destroy_class into the critical section. 2. Added sch_tree_lock protection to qfq_dump_class and qfq_dump_class_stats. Fixes: 462dbc9101ac ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost") Signed-off-by: Xiang Mei Reviewed-by: Cong Wang Signed-off-by: David S. Miller commit 3f31a806a62e44f7498e2d17719c03f816553f11 Merge: 3b428e1cfcc4c5 db6cc3f4ac2e6c Author: Linus Torvalds Date: Sat Jul 12 10:30:47 2025 -0700 Merge tag 'mm-hotfixes-stable-2025-07-11-16-16' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "19 hotfixes. A whopping 16 are cc:stable and the remainder address post-6.15 issues or aren't considered necessary for -stable kernels. 14 are for MM. Three gdb-script fixes and a kallsyms build fix" * tag 'mm-hotfixes-stable-2025-07-11-16-16' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: Revert "sched/numa: add statistics of numa balance task" mm: fix the inaccurate memory statistics issue for users mm/damon: fix divide by zero in damon_get_intervals_score() samples/damon: fix damon sample mtier for start failure samples/damon: fix damon sample wsse for start failure samples/damon: fix damon sample prcl for start failure kasan: remove kasan_find_vm_area() to prevent possible deadlock scripts: gdb: vfs: support external dentry names mm/migrate: fix do_pages_stat in compat mode mm/damon/core: handle damon_call_control as normal under kdmond deactivation mm/rmap: fix potential out-of-bounds page table access during batched unmap mm/hugetlb: don't crash when allocating a folio if there are no resv scripts/gdb: de-reference per-CPU MCE interrupts scripts/gdb: fix interrupts.py after maple tree conversion maple_tree: fix mt_destroy_walk() on root leaf node mm/vmalloc: leave lazy MMU mode on PTE mapping error scripts/gdb: fix interrupts display after MCP on x86 lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() kallsyms: fix build without execinfo commit 3b428e1cfcc4c5f063bb8b367beb71ee06470d4b Merge: 4412b8b23de24a b44686c8391b42 Author: Linus Torvalds Date: Sat Jul 12 10:20:03 2025 -0700 Merge tag 'erofs-for-6.16-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs fixes from Gao Xiang: "Fix for a cache aliasing issue by adding missing flush_dcache_folio(), which causes execution failures on some arm32 setups. Fix for large compressed fragments, which could be generated by -Eall-fragments option (but should be rare) and was rejected by mistake due to an on-disk hardening commit. The remaining ones are small fixes. Summary: - Address cache aliasing for mappable page cache folios - Allow readdir() to be interrupted - Fix large fragment handling which was errored out by mistake - Add missing tracepoints - Use memcpy_to_folio() to replace copy_to_iter() for inline data" * tag 'erofs-for-6.16-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: fix large fragment handling erofs: allow readdir() to be interrupted erofs: address D-cache aliasing erofs: use memcpy_to_folio() to replace copy_to_iter() erofs: fix to add missing tracepoint in erofs_read_folio() erofs: fix to add missing tracepoint in erofs_readahead() commit 4412b8b23de24a94a0b78ac283db043c833a3975 Merge: 2632d81f5a02b6 fec5e6f97dae5f Author: Linus Torvalds Date: Sat Jul 12 10:13:27 2025 -0700 Merge tag 'bcachefs-2025-07-11' of git://evilpiepirate.org/bcachefs Pull bcachefs fixes from Kent Overstreet. * tag 'bcachefs-2025-07-11' of git://evilpiepirate.org/bcachefs: bcachefs: Don't set BCH_FS_error on transaction restart bcachefs: Fix additional misalignment in journal space calculations bcachefs: Don't schedule non persistent passes persistently bcachefs: Fix bch2_btree_transactions_read() synchronization bcachefs: btree read retry fixes bcachefs: btree node scan no longer uses btree cache bcachefs: Tweak btree cache helpers for use by btree node scan bcachefs: Fix btree for nonexistent tree depth bcachefs: Fix bch2_io_failures_to_text() bcachefs: bch2_fpunch_snapshot() commit 2632d81f5a02b65e6131cd57ba092bd321446e91 Merge: 379f604cc3dc2c 50f930db223657 Author: Linus Torvalds Date: Sat Jul 12 10:06:06 2025 -0700 Merge tag 'v6.16-rc5-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - fix use after free in lease break - small fix for freeing rdma transport (fixes missing logging of cm_qp_destroy) - fix write count leak * tag 'v6.16-rc5-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: fix potential use-after-free in oplock/lease break ack ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() smb: server: make use of rdma_destroy_qp() commit 3051247e4faa32a3d90c762a243c2c62dde310db Author: Ming Lei Date: Fri Jul 11 16:30:09 2025 +0800 block: fix kobject leak in blk_unregister_queue The kobject for the queue, `disk->queue_kobj`, is initialized with a reference count of 1 via `kobject_init()` in `blk_register_queue()`. While `kobject_del()` is called during the unregister path to remove the kobject from sysfs, the initial reference is never released. Add a call to `kobject_put()` in `blk_unregister_queue()` to properly decrement the reference count and fix the leak. Fixes: 2bd85221a625 ("block: untangle request_queue refcounting from sysfs") Cc: Christoph Hellwig Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250711083009.2574432-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 379f604cc3dc2c865dc2b13d81faa166b6df59ec Merge: 3c2fe27971c3c9 ba74278c638df7 Author: Linus Torvalds Date: Fri Jul 11 17:24:36 2025 -0700 Merge tag 'pci-v6.16-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull PCI fixes from Bjorn Helgaas: - Track apple Root Ports explicitly and look up the driver data from the struct device instead of using dev->driver_data, which is used by pci_host_common_init() for the generic host bridge pointer (Marc Zyngier) - Set dev->driver_data before pci_host_common_init() calls gen_pci_init() because some drivers need it to set up ECAM mappings; this fixes a regression on MicroChip MPFS Icicle (Geert Uytterhoeven) - Revert the now-unnecessary use of ECAM pci_config_window.priv to store a copy of dev->driver_data (Marc Zyngier) * tag 'pci-v6.16-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: Revert "PCI: ecam: Allow cfg->priv to be pre-populated from the root port device" PCI: host-generic: Set driver_data before calling gen_pci_init() PCI: apple: Add tracking of probed root ports commit 3c2fe27971c3c9cc27de6e369385f6428db6c0b5 Merge: 5f02b80c21e151 b7dc79a6332fe6 Author: Linus Torvalds Date: Fri Jul 11 17:18:40 2025 -0700 Merge tag 'drm-fixes-2025-07-12' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Simona Vetter: "Cross-subsystem Changes: - agp/amd64 binding dmesg noise regression fix Core Changes: - fix race in gem_handle_create_tail - fixup handle_count fb refcount regression from -rc5, popular with reports ... - call rust dtor for drm_device release Driver Changes: - nouveau: magic 50ms suspend fix, acpi leak fix - tegra: dma api error in nvdec - pvr: fix device reset - habanalbs maintainer update - intel display: fix some dsi mipi sequences - xe fixes: SRIOV fixes, small GuC fixes, disable indirect ring due to issues, compression fix for fragmented BO, doc update * tag 'drm-fixes-2025-07-12' of https://gitlab.freedesktop.org/drm/kernel: (22 commits) drm/xe/guc: Default log level to non-verbose drm/xe/bmg: Don't use WA 16023588340 and 22019338487 on VF drm/xe/guc: Recommend GuC v70.46.2 for BMG, LNL, DG2 drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() drm/xe: Release runtime pm for error path of xe_devcoredump_read() drm/xe/pm: Restore display pm if there is error after display suspend drm/i915/bios: Apply vlv_fixup_mipi_sequences() to v2 mipi-sequences too drm/gem: Fix race in drm_gem_handle_create_tail() drm/framebuffer: Acquire internal references on GEM handles agp/amd64: Check AGP Capability before binding to unsupported devices drm/xe/bmg: fix compressed VRAM handling Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" drm/xe: Allocate PF queue size on pow2 boundary drm/xe/pf: Clear all LMTT pages on alloc drm/nouveau/gsp: fix potential leak of memory used during acpi init rust: drm: remove unnecessary imports MAINTAINERS: Change habanalabs maintainer drm/imagination: Fix kernel crash when hard resetting the GPU drm/tegra: nvdec: Fix dma_alloc_coherent error check rust: drm: device: drop_in_place() the drm::Device in release() ... commit 5f02b80c21e1511c32a37f642497751041069076 Author: Linus Torvalds Date: Fri Jul 11 17:10:32 2025 -0700 Revert "eventpoll: Fix priority inversion problem" This reverts commit 8c44dac8add7503c345c0f6c7962e4863b88ba42. I haven't figured out what the actual bug in this commit is, but I did spend a lot of time chasing it down and eventually succeeded in bisecting it down to this. For some reason, this eventpoll commit ends up causing delays and stuck user space processes, but it only happens on one of my machines, and only during early boot or during the flurry of initial activity when logging in. I must be triggering some very subtle timing issue, but once I figured out the behavior pattern that made it reasonably reliable to trigger, it did bisect right to this, and reverting the commit fixes the problem. Of course, that was only after I had failed at bisecting it several times, and had flailed around blaming both the drm people and the netlink people for the odd problems. The most obvious of which happened at the time of the first graphical login (the most common symptom being that some gnome app aborted due to a 30s timeout, often leading to the whole session then failing if it was some critical component like gnome-shell or similar). Acked-by: Nam Cao Cc: Frederic Weisbecker Cc: Valentin Schneider Cc: Christian Brauner Signed-off-by: Linus Torvalds commit 7727ec1523d7973defa1dff8f9c0aad288d04008 Author: Alok Tiwari Date: Thu Jul 10 10:38:46 2025 -0700 net: emaclite: Fix missing pointer increment in aligned_read() Add missing post-increment operators for byte pointers in the loop that copies remaining bytes in xemaclite_aligned_read(). Without the increment, the same byte was written repeatedly to the destination. This update aligns with xemaclite_aligned_write() Fixes: bb81b2ddfa19 ("net: add Xilinx emac lite device driver") Signed-off-by: Alok Tiwari Link: https://patch.msgid.link/20250710173849.2381003-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit b44686c8391b427fb1c85a31c35077e6947c6d90 Author: Gao Xiang Date: Sat Jul 12 03:58:26 2025 +0800 erofs: fix large fragment handling Fragments aren't limited by Z_EROFS_PCLUSTER_MAX_DSIZE. However, if a fragment's logical length is larger than Z_EROFS_PCLUSTER_MAX_DSIZE but the fragment is not the whole inode, it currently returns -EOPNOTSUPP because m_flags has the wrong EROFS_MAP_ENCODED flag set. It is not intended by design but should be rare, as it can only be reproduced by mkfs with `-Eall-fragments` in a specific case. Let's normalize fragment m_flags using the new EROFS_MAP_FRAGMENT. Reported-by: Axel Fontaine Closes: https://github.com/erofs/erofs-utils/issues/23 Fixes: 7c3ca1838a78 ("erofs: restrict pcluster size limitations") Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20250711195826.3601157-1-hsiangkao@linux.alibaba.com commit e5478166dffb51fa64e76cdbb5c24421f22f2d43 Author: Arnd Bergmann Date: Fri Jul 11 09:24:53 2025 +0200 drm/nouveau: check ioctl command codes better nouveau_drm_ioctl() only checks the _IOC_NR() bits in the DRM_NOUVEAU_NVIF command, but ignores the type and direction bits, so any command with '7' in the low eight bits gets passed into nouveau_abi16_ioctl() instead of drm_ioctl(). Check for all the bits except the size that is handled inside of the handler. Fixes: 27111a23d01c ("drm/nouveau: expose the full object/event interfaces to userspace") Signed-off-by: Arnd Bergmann [ Fix up two checkpatch warnings and a typo. - Danilo ] Signed-off-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250711072458.2665325-1-arnd@kernel.org commit 40f92e79b0aabbf3575e371f9054657a421a3e79 Merge: cb3002e0e977a6 4cdf1bdd45ac78 Author: Linus Torvalds Date: Fri Jul 11 10:35:54 2025 -0700 Merge tag 'block-6.16-20250710' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: - MD changes via Yu: - fix UAF due to stack memory used for bio mempool (Jinchao) - fix raid10/raid1 nowait IO error path (Nigel and Qixing) - fix kernel crash from reading bitmap sysfs entry (Håkon) - Fix for a UAF in the nbd connect error path - Fix for blocksize being bigger than pagesize, if THP isn't enabled * tag 'block-6.16-20250710' of git://git.kernel.dk/linux: block: reject bs > ps block devices when THP is disabled nbd: fix uaf in nbd_genl_connect() error path md/md-bitmap: fix GPF in bitmap_get_stats() md/raid1,raid10: strip REQ_NOWAIT from member bios raid10: cleanup memleak at raid10_make_request md/raid1: Fix stack memory use after return in raid1_reshape commit cb3002e0e977a6342c19ba957b971f7ce17ef958 Merge: c7979c3917fa13 9dff55ebaef7e9 Author: Linus Torvalds Date: Fri Jul 11 10:29:30 2025 -0700 Merge tag 'io_uring-6.16-20250710' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: - Remove a pointless warning in the zcrx code - Fix for MSG_RING commands, where the allocated io_kiocb needs to be freed under RCU as well - Revert the work-around we had in place for the anon inodes pretending to be regular files. Since that got reworked upstream, the work-around is no longer needed * tag 'io_uring-6.16-20250710' of git://git.kernel.dk/linux: Revert "io_uring: gate REQ_F_ISREG on !S_ANON_INODE as well" io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU io_uring/zcrx: fix pp destruction warnings commit c7979c3917fa1326dae3607e1c6a04c12057b194 Merge: 5265593a28d91a a215b5723922f8 Author: Linus Torvalds Date: Fri Jul 11 10:18:51 2025 -0700 Merge tag 'net-6.16-rc6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull more networking fixes from Jakub Kicinski "Big chunk of fixes for WiFi, Johannes says probably the last for the release. The Netlink fixes (on top of the tree) restore operation of iw (WiFi CLI) which uses sillily small recv buffer, and is the reason for this 'emergency PR'. The GRE multicast fix also stands out among the user-visible regressions. Current release - fix to a fix: - netlink: make sure we always allow at least one skb to be queued, even if the recvbuf is (mis)configured to be tiny Previous releases - regressions: - gre: fix IPv6 multicast route creation Previous releases - always broken: - wifi: prevent A-MSDU attacks in mesh networks - wifi: cfg80211: fix S1G beacon head validation and detection - wifi: mac80211: - always clear frame buffer to prevent stack leak in cases which hit a WARN() - fix monitor interface in device restart - wifi: mwifiex: discard erroneous disassoc frames on STA interface - wifi: mt76: - prevent null-deref in mt7925_sta_set_decap_offload() - add missing RCU annotations, and fix sleep in atomic - fix decapsulation offload - fixes for scanning - phy: microchip: improve link establishment and reset handling - eth: mlx5e: fix race between DIM disable and net_dim() - bnxt_en: correct DMA unmap len for XDP_REDIRECT" * tag 'net-6.16-rc6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (44 commits) netlink: make sure we allow at least one dump skb netlink: Fix rmem check in netlink_broadcast_deliver(). bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT bnxt_en: Flush FW trace before copying to the coredump bnxt_en: Fix DCB ETS validation net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() net/mlx5e: Add new prio for promiscuous mode net/mlx5e: Fix race between DIM disable and net_dim() net/mlx5: Reset bw_share field when changing a node's parent can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level selftests: net: lib: fix shift count out of range selftests: Add IPv6 multicast route generation tests for GRE devices. gre: Fix IPv6 multicast route creation. net: phy: microchip: limit 100M workaround to link-down events on LAN88xx net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof net: appletalk: Fix device refcount leak in atrtr_create() netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() wifi: mac80211: add the virtual monitor after reconfig complete wifi: mac80211: always initialize sdata::key_list ... commit 5265593a28d91aed5529c31e720be8d3e78e0695 Merge: 87cf461cd30bc3 edb471108cf147 Author: Linus Torvalds Date: Fri Jul 11 10:15:50 2025 -0700 Merge tag 'gpio-fixes-for-v6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix performance regression when setting values of multiple GPIO lines at once - make sure the GPIO OF xlate code doesn't end up passing an uninitialized local variable to GPIO core - update MAINTAINERS * tag 'gpio-fixes-for-v6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: MAINTAINERS: remove bouncing address for Nandor Han gpio: of: initialize local variable passed to the .of_xlate() callback gpiolib: fix performance regression when using gpio_chip_get_multiple() commit 87cf461cd30bc3e0ae48936a96590de8db747f54 Merge: a0f8361c3ce4cf ec3cae639482a8 Author: Linus Torvalds Date: Fri Jul 11 09:19:33 2025 -0700 Merge tag 'pm-6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "Fix a coding mistake in a previous fix related to system suspend and hibernation merged recently" * tag 'pm-6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM: sleep: Call pm_restore_gfp_mask() after dpm_resume() commit aef9da333823f70b074e36a94c6e85f5c55e5477 Author: Jan-Niklas Burfeind Date: Thu Jul 10 21:09:19 2025 +0200 platform/x86: dell-lis3lv02d: Add Precision 3551 This marks 0x29 as accelerometer address on Dell Precision 3551. I followed previous works of Paul Menzel and Hans de Goede to verify it: $ cd /sys/bus/pci/drivers/i801_smbus/0000\:00\:1f.4 $ ls -d i2c-? i2c-0 $ sudo modprobe i2c-dev $ sudo i2cdetect 0 WARNING! This program can confuse your I2C bus, cause data loss and worse! I will probe file /dev/i2c-0. I will probe address range 0x08-0x77. Continue? [Y/n] Y 0 1 2 3 4 5 6 7 8 9 a b c d e f 00: 08 -- -- -- -- -- -- -- 10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 20: -- -- -- -- -- -- -- -- -- 29 -- -- -- -- -- -- 30: 30 -- -- -- -- 35 UU UU -- -- -- -- -- -- -- -- 40: -- -- -- -- 44 -- -- -- -- -- -- -- -- -- -- -- 50: UU -- 52 -- -- -- -- -- -- -- -- -- -- -- -- -- 60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 70: -- -- -- -- -- -- -- -- $ echo lis3lv02d 0x29 > sudo tee /sys/bus/i2c/devices/i2c-0/new_device lis3lv02d 0x29 $ sudo dmesg [ 0.000000] Linux version 6.12.28 (nixbld@localhost) (gcc (GCC) 14.2.1 20250322, GNU ld (GNU Binutils) 2.44) #1-NixOS SMP PREEMPT_DYNAMIC Fri May 9 07:50:53 UTC 2025 [...] [ 0.000000] DMI: Dell Inc. Precision 3551/07YHW8, BIOS 1.18.0 10/03/2022 [...] [ 3749.077624] lis3lv02d_i2c 0-0029: supply Vdd not found, using dummy regulator [ 3749.077732] lis3lv02d_i2c 0-0029: supply Vdd_IO not found, using dummy regulator [ 3749.098674] lis3lv02d: 8 bits 3DC sensor found [ 3749.182480] input: ST LIS3LV02DL Accelerometer as /devices/platform/lis3lv02d/input/input28 [ 3749.182899] i2c i2c-0: new_device: Instantiated device lis3lv02d at 0x29 Signed-off-by: Jan-Niklas Burfeind Reviewed-by: Paul Menzel Link: https://lore.kernel.org/r/20250710190919.37842-1-kernel@aiyionpri.me Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit dbfb567f4ae86f4acc4644984ec5b59086060b99 Author: Kurt Borja Date: Thu Jul 10 00:11:12 2025 -0300 platform/x86: alieneware-wmi-wmax: Add AWCC support to more laptops Add support to Alienware Area-51m and Alienware m15 R5. Signed-off-by: Kurt Borja Link: https://lore.kernel.org/r/20250710-m15_r5-v1-1-2c6ad44e5987@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 2bfe3ae1aa45f8b61cb0dc462114fd0c9636ad32 Author: Torsten Hilbrich Date: Fri Jul 11 12:32:54 2025 +0200 platform/x86: Fix initialization order for firmware_attributes_class The think-lmi driver uses the firwmare_attributes_class. But this class is registered after think-lmi, causing the "think-lmi" directory in "/sys/class/firmware-attributes" to be missing when the driver is compiled as builtin. Fixes: 55922403807a ("platform/x86: think-lmi: Directly use firmware_attributes_class") Signed-off-by: Torsten Hilbrich Link: https://lore.kernel.org/r/7dce5f7f-c348-4350-ac53-d14a8e1e8034@secunet.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a0f8361c3ce4cf706608edb81c4334783cb093cf Merge: bc9ff192a6c940 aa807b9f22df2e Author: Linus Torvalds Date: Fri Jul 11 08:49:25 2025 -0700 Merge tag 'dma-mapping-6.16-2025-07-11' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping fix from Marek Szyprowski: - small fix relevant to arm64 server and custom CMA configuration (Feng Tang) * tag 'dma-mapping-6.16-2025-07-11' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: dma-contiguous: hornor the cma address limit setup by user commit bc48d79a1829ac5a79cc3d1eb8bf30c0ae9b3bcd Author: Johan Hovold Date: Tue Jul 8 10:53:58 2025 +0200 platform: arm64: huawei-gaokun-ec: fix OF node leak Make sure to drop the OF node reference taken when creating the Gaokun auxiliary devices when the devices are later released. Fixes: 7636f090d02e ("platform: arm64: add Huawei Matebook E Go EC driver") Cc: Pengyu Luo Signed-off-by: Johan Hovold Reviewed-by: Pengyu Luo Link: https://lore.kernel.org/r/20250708085358.15657-1-johan@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit afcefc58fdfd687e3a9a9bef0be5846b96f710b7 Author: Nithyanantham Paramasivam Date: Thu Jul 10 06:47:54 2025 +0530 wifi: ath12k: Fix packets received in WBM error ring with REO LUT enabled Currently, packets are being received into the WBM error ring when REO queue lookup is enabled, resulting in degraded RX performance. The issue arises because the REO queue LUT TID memory reference is set to zero-it's being assigned before the memory is allocated. Fix this by assigning the REO queue TID memory reference in the LUT immediately after memory allocation to ensure correct packet processing. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Reported-by: Tanguy Serrat Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220282 Fixes: 3b9cbce6fdd3 ("wifi: ath12k: alloc REO queue per station") Signed-off-by: Nithyanantham Paramasivam Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250710011754.559817-1-nithyanantham.paramasivam@oss.qualcomm.com Signed-off-by: Jeff Johnson commit a215b5723922f8099078478122f02100e489cb80 Author: Jakub Kicinski Date: Thu Jul 10 17:11:21 2025 -0700 netlink: make sure we allow at least one dump skb Commit under Fixes tightened up the memory accounting for Netlink sockets. Looks like the accounting is too strict for some existing use cases, Marek reported issues with nl80211 / WiFi iw CLI. To reduce number of iterations Netlink dumps try to allocate messages based on the size of the buffer passed to previous recvmsg() calls. If user space uses a larger buffer in recvmsg() than sk_rcvbuf we will allocate an skb we won't be able to queue. Make sure we always allow at least one skb to be queued. Same workaround is already present in netlink_attachskb(). Alternative would be to cap the allocation size to rcvbuf - rmem_alloc but as I said, the workaround is already present in other places. Reported-by: Marek Szyprowski Link: https://lore.kernel.org/9794af18-4905-46c6-b12c-365ea2f05858@samsung.com Fixes: ae8f160e7eb2 ("netlink: Fix wraparounds of sk->sk_rmem_alloc.") Tested-by: Marek Szyprowski Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250711001121.3649033-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit a3c4a125ec725cefb40047eb05ff9eafd57830b4 Author: Kuniyuki Iwashima Date: Fri Jul 11 05:32:07 2025 +0000 netlink: Fix rmem check in netlink_broadcast_deliver(). We need to allow queuing at least one skb even when skb is larger than sk->sk_rcvbuf. The cited commit made a mistake while converting a condition in netlink_broadcast_deliver(). Let's correct the rmem check for the allow-one-skb rule. Fixes: ae8f160e7eb24 ("netlink: Fix wraparounds of sk->sk_rmem_alloc.") Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250711053208.2965945-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 52c14ea7d7580de164deab1e756eaf854dac85b2 Merge: e81750b4e3826f 3cdf199d4755d4 Author: Jakub Kicinski Date: Fri Jul 11 07:28:36 2025 -0700 Merge branch 'bnxt_en-3-bug-fixes' Michael Chan says: ==================== bnxt_en: 3 bug fixes The first one fixes a possible failure when setting DCB ETS. The second one fixes the ethtool coredump (-W 2) not containing all the FW traces. The third one fixes the DMA unmap length when transmitting XDP_REDIRECT packets. ==================== Link: https://patch.msgid.link/20250710213938.1959625-1-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 3cdf199d4755d477972ee87110b2aebc88b3cfad Author: Somnath Kotur Date: Thu Jul 10 14:39:38 2025 -0700 bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT When transmitting an XDP_REDIRECT packet, call dma_unmap_len_set() with the proper length instead of 0. This bug triggers this warning on a system with IOMMU enabled: WARNING: CPU: 36 PID: 0 at drivers/iommu/dma-iommu.c:842 __iommu_dma_unmap+0x159/0x170 RIP: 0010:__iommu_dma_unmap+0x159/0x170 Code: a8 00 00 00 00 48 c7 45 b0 00 00 00 00 48 c7 45 c8 00 00 00 00 48 c7 45 a0 ff ff ff ff 4c 89 45 b8 4c 89 45 c0 e9 77 ff ff ff <0f> 0b e9 60 ff ff ff e8 8b bf 6a 00 66 66 2e 0f 1f 84 00 00 00 00 RSP: 0018:ff22d31181150c88 EFLAGS: 00010206 RAX: 0000000000002000 RBX: 00000000e13a0000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ff22d31181150cf0 R08: ff22d31181150ca8 R09: 0000000000000000 R10: 0000000000000000 R11: ff22d311d36c9d80 R12: 0000000000001000 R13: ff13544d10645010 R14: ff22d31181150c90 R15: ff13544d0b2bac00 FS: 0000000000000000(0000) GS:ff13550908a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005be909dacff8 CR3: 0008000173408003 CR4: 0000000000f71ef0 PKRU: 55555554 Call Trace: ? show_regs+0x6d/0x80 ? __warn+0x89/0x160 ? __iommu_dma_unmap+0x159/0x170 ? report_bug+0x17e/0x1b0 ? handle_bug+0x46/0x90 ? exc_invalid_op+0x18/0x80 ? asm_exc_invalid_op+0x1b/0x20 ? __iommu_dma_unmap+0x159/0x170 ? __iommu_dma_unmap+0xb3/0x170 iommu_dma_unmap_page+0x4f/0x100 dma_unmap_page_attrs+0x52/0x220 ? srso_alias_return_thunk+0x5/0xfbef5 ? xdp_return_frame+0x2e/0xd0 bnxt_tx_int_xdp+0xdf/0x440 [bnxt_en] __bnxt_poll_work_done+0x81/0x1e0 [bnxt_en] bnxt_poll+0xd3/0x1e0 [bnxt_en] Fixes: f18c2b77b2e4 ("bnxt_en: optimized XDP_REDIRECT support") Signed-off-by: Somnath Kotur Signed-off-by: Michael Chan Link: https://patch.msgid.link/20250710213938.1959625-4-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 100c08c89d173b7fdf953e7d9f9ca8f69f80d1c5 Author: Shruti Parab Date: Thu Jul 10 14:39:37 2025 -0700 bnxt_en: Flush FW trace before copying to the coredump bnxt_fill_drv_seg_record() calls bnxt_dbg_hwrm_log_buffer_flush() to flush the FW trace buffer. This needs to be done before we call bnxt_copy_ctx_mem() to copy the trace data. Without this fix, the coredump may not contain all the FW traces. Fixes: 3c2179e66355 ("bnxt_en: Add FW trace coredump segments to the coredump") Reviewed-by: Kalesh AP Signed-off-by: Shruti Parab Signed-off-by: Michael Chan Link: https://patch.msgid.link/20250710213938.1959625-3-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit b74c2a2e9cc471e847abd87e50a2354c07e02040 Author: Shravya KN Date: Thu Jul 10 14:39:36 2025 -0700 bnxt_en: Fix DCB ETS validation In bnxt_ets_validate(), the code incorrectly loops over all possible traffic classes to check and add the ETS settings. Fix it to loop over the configured traffic classes only. The unconfigured traffic classes will default to TSA_ETS with 0 bandwidth. Looping over these unconfigured traffic classes may cause the validation to fail and trigger this error message: "rejecting ETS config starving a TC\n" The .ieee_setets() will then fail. Fixes: 7df4ae9fe855 ("bnxt_en: Implement DCBNL to support host-based DCBX.") Reviewed-by: Sreekanth Reddy Signed-off-by: Shravya KN Signed-off-by: Michael Chan Link: https://patch.msgid.link/20250710213938.1959625-2-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit e81750b4e3826fedce7362dad839cb40384d60ae Author: Alok Tiwari Date: Thu Jul 10 11:06:17 2025 -0700 net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() The function ll_temac_ethtools_set_ringparam() incorrectly checked rx_pending twice, once correctly for RX and once mistakenly in place of tx_pending. This caused tx_pending to be left unchecked against TX_BD_NUM_MAX. As a result, invalid TX ring sizes may have been accepted or valid ones wrongly rejected based on the RX limit, leading to potential misconfiguration or unexpected results. This patch corrects the condition to properly validate tx_pending. Fixes: f7b261bfc35e ("net: ll_temac: Make RX/TX ring sizes configurable") Signed-off-by: Alok Tiwari Link: https://patch.msgid.link/20250710180621.2383000-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit 5b81d59f02a075cd318e898dd1f3644a261bb9c4 Merge: 71b976db8c6e68 4c9fce56fa7020 Author: Jakub Kicinski Date: Fri Jul 11 07:26:49 2025 -0700 Merge branch 'mlx5-misc-fixes-2025-07-10' Tariq Toukan says: ==================== mlx5 misc fixes 2025-07-10 This small patchset provides misc bug fixes from the team to the mlx5 core and EN drivers. ==================== Link: https://patch.msgid.link/1752155624-24095-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 4c9fce56fa702059bbc5ab737265b68f79cbaac4 Author: Jianbo Liu Date: Thu Jul 10 16:53:44 2025 +0300 net/mlx5e: Add new prio for promiscuous mode An optimization for promiscuous mode adds a high-priority steering table with a single catch-all rule to steer all traffic directly to the TTC table. However, a gap exists between the creation of this table and the insertion of the catch-all rule. Packets arriving in this brief window would miss as no rule was inserted yet, unnecessarily incrementing the 'rx_steer_missed_packets' counter and dropped. This patch resolves the issue by introducing a new prio for this table, placing it between MLX5E_TC_PRIO and MLX5E_NIC_PRIO. By doing so, packets arriving during the window now fall through to the next prio (at MLX5E_NIC_PRIO) instead of being dropped. Fixes: 1c46d7409f30 ("net/mlx5e: Optimize promiscuous mode") Signed-off-by: Jianbo Liu Reviewed-by: Mark Bloch Signed-off-by: Tariq Toukan Reviewed-by: Jacob Keller Link: https://patch.msgid.link/1752155624-24095-4-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit eb41a264a3a576dc040ee37c3d9d6b7e2d9be968 Author: Carolina Jubran Date: Thu Jul 10 16:53:43 2025 +0300 net/mlx5e: Fix race between DIM disable and net_dim() There's a race between disabling DIM and NAPI callbacks using the dim pointer on the RQ or SQ. If NAPI checks the DIM state bit and sees it still set, it assumes `rq->dim` or `sq->dim` is valid. But if DIM gets disabled right after that check, the pointer might already be set to NULL, leading to a NULL pointer dereference in net_dim(). Fix this by calling `synchronize_net()` before freeing the DIM context. This ensures all in-progress NAPI callbacks are finished before the pointer is cleared. Kernel log: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... RIP: 0010:net_dim+0x23/0x190 ... Call Trace: ? __die+0x20/0x60 ? page_fault_oops+0x150/0x3e0 ? common_interrupt+0xf/0xa0 ? sysvec_call_function_single+0xb/0x90 ? exc_page_fault+0x74/0x130 ? asm_exc_page_fault+0x22/0x30 ? net_dim+0x23/0x190 ? mlx5e_poll_ico_cq+0x41/0x6f0 [mlx5_core] ? sysvec_apic_timer_interrupt+0xb/0x90 mlx5e_handle_rx_dim+0x92/0xd0 [mlx5_core] mlx5e_napi_poll+0x2cd/0xac0 [mlx5_core] ? mlx5e_poll_ico_cq+0xe5/0x6f0 [mlx5_core] busy_poll_stop+0xa2/0x200 ? mlx5e_napi_poll+0x1d9/0xac0 [mlx5_core] ? mlx5e_trigger_irq+0x130/0x130 [mlx5_core] __napi_busy_loop+0x345/0x3b0 ? sysvec_call_function_single+0xb/0x90 ? asm_sysvec_call_function_single+0x16/0x20 ? sysvec_apic_timer_interrupt+0xb/0x90 ? pcpu_free_area+0x1e4/0x2e0 napi_busy_loop+0x11/0x20 xsk_recvmsg+0x10c/0x130 sock_recvmsg+0x44/0x70 __sys_recvfrom+0xbc/0x130 ? __schedule+0x398/0x890 __x64_sys_recvfrom+0x20/0x30 do_syscall_64+0x4c/0x100 entry_SYSCALL_64_after_hwframe+0x4b/0x53 ... ---[ end trace 0000000000000000 ]--- ... ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- Fixes: 445a25f6e1a2 ("net/mlx5e: Support updating coalescing configuration without resetting channels") Signed-off-by: Carolina Jubran Reviewed-by: Cosmin Ratiu Signed-off-by: Tariq Toukan Reviewed-by: Jacob Keller Link: https://patch.msgid.link/1752155624-24095-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit f7b76466894083c8f518cf29fef75fcd3ec670e5 Author: Carolina Jubran Date: Thu Jul 10 16:53:42 2025 +0300 net/mlx5: Reset bw_share field when changing a node's parent When changing a node's parent, its scheduling element is destroyed and re-created with bw_share 0. However, the node's bw_share field was not updated accordingly. Set the node's bw_share to 0 after re-creation to keep the software state in sync with the firmware configuration. Fixes: 9c7bbf4c3304 ("net/mlx5: Add support for setting parent of nodes") Signed-off-by: Carolina Jubran Reviewed-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Jacob Keller Link: https://patch.msgid.link/1752155624-24095-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit cb73e53f7c0700285d743e7afbe37cba9f7df8f3 Author: Kirill A. Shutemov Date: Tue Jul 8 13:19:22 2025 +0300 MAINTAINERS: Update Kirill Shutemov's email address for TDX Update MAINTAINERS to use my @kernel.org email address. Signed-off-by: Kirill A. Shutemov Signed-off-by: Dave Hansen Link: https://lore.kernel.org/all/20250708101922.50560-4-kirill.shutemov%40linux.intel.com commit 71b976db8c6e683831e1492efdf1fe0a8487adef Merge: 47c84997c686b4 58805e9cbc6f6a Author: Jakub Kicinski Date: Fri Jul 11 07:07:56 2025 -0700 Merge tag 'linux-can-fixes-for-6.16-20250711' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2025-07-11 Sean Nyekjaer's patch targets the m_can driver and demotes the "msg lost in rx" message to debug level to prevent flooding the kernel log with error messages. * tag 'linux-can-fixes-for-6.16-20250711' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level ==================== Link: https://patch.msgid.link/20250711102451.2828802-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit 4cec89db80ba81fa4524c6449c0494b8ae08eeb0 Author: Anup Patel Date: Mon Jul 7 09:23:44 2025 +0530 RISC-V: KVM: Move HGEI[E|P] CSR access to IMSIC virtualization Currently, the common AIA functions kvm_riscv_vcpu_aia_has_interrupts() and kvm_riscv_aia_wakeon_hgei() lookup HGEI line using an array of VCPU pointers before accessing HGEI[E|P] CSR which is slow and prone to race conditions because there is a separate per-hart lock for the VCPU pointer array and a separate per-VCPU rwlock for IMSIC VS-file (including HGEI line) used by the VCPU. Due to these race conditions, it is observed on QEMU RISC-V host that Guest VCPUs sleep in WFI and never wakeup even with interrupt pending in the IMSIC VS-file because VCPUs were waiting for HGEI wakeup on the wrong host CPU. The IMSIC virtualization already keeps track of the HGEI line and the associated IMSIC VS-file used by each VCPU so move the HGEI[E|P] CSR access to IMSIC virtualization so that costly HGEI line lookup can be avoided and likelihood of race-conditions when updating HGEI[E|P] CSR is also reduced. Reviewed-by: Atish Patra Tested-by: Atish Patra Tested-by: Heinrich Schuchardt Fixes: 3385339296d1 ("RISC-V: KVM: Use IMSIC guest files when available") Signed-off-by: Anup Patel Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/20250707035345.17494-3-apatel@ventanamicro.com Signed-off-by: Anup Patel commit 57f576e860d3a3582edb5064db9f0c95558ca5f4 Author: Anup Patel Date: Mon Jul 7 09:23:43 2025 +0530 RISC-V: KVM: Disable vstimecmp before exiting to user-space If VS-timer expires when no VCPU running on a host CPU then WFI executed by such host CPU will be effective NOP resulting in no power savings. This is as-per RISC-V Privileged specificaiton which says: "WFI is also required to resume execution for locally enabled interrupts pending at any privilege level, regardless of the global interrupt enable at each privilege level." To address the above issue, vstimecmp CSR must be set to -1UL over here when VCPU is scheduled-out or exits to user space. Reviewed-by: Atish Patra Tested-by: Atish Patra Tested-by: Heinrich Schuchardt Fixes: 8f5cb44b1bae ("RISC-V: KVM: Support sstc extension") Fixes: cea8896bd936 ("RISC-V: KVM: Fix kvm_riscv_vcpu_timer_pending() for Sstc") Reported-by: Heinrich Schuchardt Closes: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2112578 Signed-off-by: Anup Patel Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/20250707035345.17494-2-apatel@ventanamicro.com Signed-off-by: Anup Patel commit b7dc79a6332fe6f58f2e6b2a631bad101dc79107 Merge: 14e85fabee2b3e bd46cece51a36e Author: Simona Vetter Date: Fri Jul 11 14:11:18 2025 +0200 Merge tag 'drm-misc-fixes-2025-07-10' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes drm-misc-fixes for v6.16-rc6 or final: - Fix nouveau fail on debugfs errors. - Magic 50 ms to fix nouveau suspend. - Call rust destructor on drm device release. - Fix DMA api error handling in tegra/nvdec. - Fix PVR device reset. - Habanalabs maintainer update. - Small memory leak fix when nouveau acpi init fails. - Do not attempt to bind to any PCI device with AGP capability. - Make FB's acquire handles on backing object, same as i915/xe already does. - Fix race in drm_gem_handle_create_tail. Signed-off-by: Simona Vetter From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/e522cdc7-1787-48f2-97e5-0f94783970ab@linux.intel.com commit 8f0837fdc5d832f0cd953f66db0cbfb2fa8909d2 Merge: f2ebacd34eeb73 3871b51a684275 Author: Arnd Bergmann Date: Fri Jul 11 13:41:08 2025 +0200 Merge tag 'qcom-arm64-defconfig-fixes-for-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes Qualcomm Arm64 defconfig fixes for v6.16 The v6.16 driver and DeviceTree updates described and implemented CPU frequency scaling for the Qualcomm X Elite platform. But the necessary CPUCP mailbox driver was not enabled, resulting in a series of error messages being logged during boot (and no CPU frequency scaling). Enable the missing drivers to silence the errors, and enable CPU frequency scaling on this platform. * tag 'qcom-arm64-defconfig-fixes-for-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: defconfig: Enable Qualcomm CPUCP mailbox driver Signed-off-by: Arnd Bergmann commit f2ebacd34eeb73081eadfba5e6e99ea967365911 Merge: 07d45e80960a6f e8d3dc45f2d3b0 Author: Arnd Bergmann Date: Fri Jul 11 13:39:12 2025 +0200 Merge tag 'qcom-arm64-fixes-for-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes Qualcomm DeviceTree fixes for v6.16 The RTC DeviceTree binding was changed in v6.16, to require an explicit flag indicating that we store RTC offset in in an UEFI variable. The result sent X Elite and Lenovo Thinkpad X13s users back to 1970, add the flag to explicitly select the correct configuration for these devices. * tag 'qcom-arm64-fixes-for-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: dts: qcom: x1e80100: describe uefi rtc offset arm64: dts: qcom: sc8280xp-x13s: describe uefi rtc offset Signed-off-by: Arnd Bergmann commit 07d45e80960a6f3e51d62104e2083eaa0cda86a6 Merge: fec3103b580994 56448e78a6bb4e Author: Arnd Bergmann Date: Fri Jul 11 13:38:35 2025 +0200 Merge tag 'aspeed-6.16-fixes-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into arm/fixes ASPEED SoC driver fixes for 6.16 Address concerns in the ASPEED LPC snoop driver identified in the first two patches of the cleanup series at [1]. [1]: https://lore.kernel.org/all/20250616-aspeed-lpc-snoop-fixes-v2-0-3cdd59c934d3@codeconstruct.com.au/ * tag 'aspeed-6.16-fixes-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux: soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled soc: aspeed: lpc-snoop: Cleanup resources in stack-order Signed-off-by: Arnd Bergmann commit fec3103b5809940b3fe2b66e5167cb9eebcedf5d Merge: 1e7c8c54c5138f 9037532ab89363 Author: Arnd Bergmann Date: Fri Jul 11 13:17:23 2025 +0200 Merge tag 'v6.16-rockchip-dtsfixes1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/fixes Switch to the gpio variant for spi-cs and mmc-detect for some boards as the in-controller functionality does not work as intended for them. HDMI drive strength adjustment for better ddc communication and some missing supplies. * tag 'v6.16-rockchip-dtsfixes1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: arm64: dts: rockchip: Add missing fan-supply to rk3566-quartz64-a arm64: dts: rockchip: use cs-gpios for spi1 on ringneck arm64: dts: rockchip: list all CPU supplies on ArmSoM Sige5 arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 arm64: dts: rockchip: Adjust the HDMI DDC IO driver strength for rk3588 arm64: dts: rockchip: fix rk3576 pcie1 linux,pci-domain Link: https://lore.kernel.org/r/5108768.AiC22s8V5E@diego Signed-off-by: Arnd Bergmann commit 58805e9cbc6f6a28f35d90e740956e983a0e036e Author: Sean Nyekjaer Date: Fri Jul 11 12:12:02 2025 +0200 can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level Downgrade the "msg lost in rx" message to debug level, to prevent flooding the kernel log with error messages. Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support") Reviewed-by: Vincent Mailhol Signed-off-by: Sean Nyekjaer Link: https://patch.msgid.link/20250711-mcan_ratelimit-v3-1-7413e8e21b84@geanix.com [mkl: enhance commit message] Signed-off-by: Marc Kleine-Budde commit 177bb4cba97aae951b910d8ca248480715d09009 Author: Jinliang Zheng Date: Fri Jul 11 16:12:07 2025 +0800 iomap: avoid unnecessary ifs_set_range_uptodate() with locks In the buffer write path, iomap_set_range_uptodate() is called every time iomap_end_write() is called. But if folio_test_uptodate() holds, we know that all blocks in this folio are already in the uptodate state, so there is no need to go deep into the critical section of state_lock to execute bitmap_set(). This is because the folios always creep towards ifs_is_fully_uptodate() state and once they've gotten there folio_mark_uptodate() is called, which means the folio is uptodate. Then once a folio is uptodate, there is no route back to !uptodate without going through the removal of the folio from the page cache. Therefore, it's fine to use folio_test_uptodate() to short-circuit unnecessary code paths. Although state_lock may not have significant lock contention due to folio lock, this patch at least reduces the number of instructions, especially the expensive lock-prefixed instructions. Signed-off-by: Jinliang Zheng Link: https://lore.kernel.org/20250711081207.1782667-1-alexjlzheng@tencent.com Reviewed-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Reviewed-by: Christoph Hellwig Signed-off-by: Christian Brauner commit 0a9e7405131380b57e155f10242b2e25d2e51852 Author: Jan Kara Date: Wed Jul 9 11:55:46 2025 +0200 isofs: Verify inode mode when loading from disk Verify that the inode mode is sane when loading it from the disk to avoid complaints from VFS about setting up invalid inodes. Reported-by: syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com CC: stable@vger.kernel.org Signed-off-by: Jan Kara Link: https://lore.kernel.org/20250709095545.31062-2-jack@suse.cz Acked-by: Christian Brauner Signed-off-by: Christian Brauner commit 14e85fabee2b3e0e7055ab4c38b2a541ecd9c823 Merge: 3638e6a84b7368 74806f69b8668e Author: Simona Vetter Date: Fri Jul 11 11:35:39 2025 +0200 Merge tag 'drm-xe-fixes-2025-07-11' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Driver Changes: - Clear LMTT page to avoid leaking data from one VF to another - Align PF queue size to power of 2 - Disable Indirect Ring State to avoid intermittent issues on context switch: feature is not currently needed, so can be disabled for now. - Fix compression handling when the BO pages are very fragmented - Restore display pm on error path - Fix runtime pm handling in xe devcoredump - Fix xe_pm_set_vram_threshold() doc - Recommend new minor versions of GuC firmware - Drop some workarounds on VF - Do not use verbose GuC logging by default: it should be only for debugging Signed-off-by: Simona Vetter From: Lucas De Marchi Link: https://patchwork.freedesktop.org/patch/msgid/s6jyd24mimbzb4vxtgc5vupvbyqplfep2c6eupue7znnlbhuxy@lmvzexfzhrnn commit 3638e6a84b7368a4fb222f05c2febc06c434a10a Merge: d7b8f8e20813f0 e778689390c714 Author: Simona Vetter Date: Fri Jul 11 11:28:41 2025 +0200 Merge tag 'drm-intel-fixes-2025-07-10' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes Short summary of fixes: - DSI panel's version 2 mipi-sequences fix (Hans) Signed-off-by: Simona Vetter From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/aHA_eR0G7X2P6_ib@intel.com commit 1e7c8c54c5138fe7226f8a7a9fb8e93e24243a01 Merge: 3f3fb973743089 fbe94be09fa813 Author: Arnd Bergmann Date: Fri Jul 11 11:26:57 2025 +0200 Merge tag 'imx-fixes-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 6.16: - Keep LDO5 always on for imx8mm-verdin to fix broken Ethernet support - Add big-endian property back for LS1046A watchdog, as the removal was an accident - Fix DMA interrupter number of i.MX95 pcie0_ep device - A set of changes from Tim Harvey to fix TPM SPI frequency on imx8mp-venice devices - A couple of changes from Wei Fang to fix NETC overshoot issue on i.MX95 EVK boards * tag 'imx-fixes-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep arm64: dts: add big-endian property back into watchdog node arm64: dts: imx95-15x15-evk: fix the overshoot issue of NETC arm64: dts: imx95-19x19-evk: fix the overshoot issue of NETC arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency Link: https://lore.kernel.org/r/aGzNeZ7KtsRsUkZT@dragon Signed-off-by: Arnd Bergmann commit edb471108cf1477c44b95e87e8cec261825eb079 Author: Bartosz Golaszewski Date: Wed Jul 9 09:18:24 2025 +0200 MAINTAINERS: remove bouncing address for Nandor Han Nandor's address has been bouncing for some time now. Remove it from MAINTAINERS. The affected driver falls under the wider umbrella of GPIO modules. Link: https://lore.kernel.org/r/20250709071825.16212-1-brgl@bgdev.pl Signed-off-by: Bartosz Golaszewski commit 74806f69b8668ea0e98cd9d461b7803ffa1fcdf3 Author: Lucas De Marchi Date: Fri Jun 13 13:00:37 2025 -0700 drm/xe/guc: Default log level to non-verbose Currently xe sets the guc log level to a verbose level since it's useful to debug hangs and general development. However the verbose level may already be too much and affect performance. Michal Mrozek did some tests with the L0 compute stack for submission latency with ULLS disabled. Below are the normalized numbers with log level 3 (the current default) as baseline for each test: Test \ Log Level 3 0 1 2 ----------------------------------------------------------- ------ ------ ------ ------ BestWalkerNthCommandListSubmission(CmdListCount=2) 1.00 0.63 0.63 0.96 BestWalkerNthSubmission(KernelCount=2) 1.00 0.62 0.63 0.96 BestWalkerNthSubmissionImmediate(KernelCount=2) 1.00 0.58 0.58 0.85 BestWalkerSubmission 1.00 0.62 0.62 0.96 BestWalkerSubmissionImmediate 1.00 0.63 0.62 0.96 BestWalkerSubmissionImmediateMultiCmdlists(cmdlistCount=2) 1.00 0.58 0.58 0.86 BestWalkerSubmissionImmediateMultiCmdlists(cmdlistCount=4) 1.00 0.70 0.70 0.83 BestWalkerSubmissionImmediateMultiCmdlists(cmdlistCount=8) 1.00 0.53 0.52 0.78 Log level 2 is the first "verbose level" for GuC, where the biggest difference happens. Keep log level 3 for CONFIG_DRM_XE_DEBUG, but switch to 1, i.e. GUC_LOG_LEVEL_NON_VERBOSE, for "normal" builds. Cc: Michal Mrozek Cc: John Harrison Reviewed-by: John Harrison Link: https://lore.kernel.org/r/20250613-guc-log-level-v2-1-cb84a63e49fe@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit a37128ba613ad6a5f81f382fa3cfe5c4a6527310) Signed-off-by: Lucas De Marchi commit 7a10175a4220b3f77d74a61ef767f6c43bf39a3e Author: Michal Wajdeczko Date: Thu Jul 10 10:30:39 2025 +0000 drm/xe/bmg: Don't use WA 16023588340 and 22019338487 on VF These workarounds are not applicable for use by the VFs. Signed-off-by: Michal Wajdeczko Tested-by: Jakub Kolakowski Reviewed-by: Satyanarayana K V P Signed-off-by: Jakub Kolakowski Link: https://lore.kernel.org/r/20250710103040.375610-2-jakub1.kolakowski@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 1d2e2503e506ddc499cbb7afdc8b70bcf6fe241f) Signed-off-by: Lucas De Marchi commit 8c018805097f52d0d35fbc273b4e6dd154811638 Author: Julia Filipchuk Date: Thu Jun 26 11:28:10 2025 -0700 drm/xe/guc: Recommend GuC v70.46.2 for BMG, LNL, DG2 UAPI compatibility version 1.22.2 Resolves various bugs. Recommend newer version. Signed-off-by: Julia Filipchuk Reviewed-by: Daniele Ceraolo Spurio Signed-off-by: Daniele Ceraolo Spurio Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250626182805.1701096-13-daniele.ceraolospurio@intel.com (cherry picked from commit 0b64addcae7f04745bc5f62d41e27268052f812e) Signed-off-by: Lucas De Marchi commit 0539c5eaf81f3f844213bf6b3137a53e5b04b083 Author: Shuicheng Lin Date: Tue Jul 8 02:14:51 2025 +0000 drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() The parameter threshold is with size in MiB, not in bits. Correct it to avoid any confusion. v2: s/mb/MiB, s/vram/VRAM, fix return section. (Michal) Fixes: 30c399529f4c ("drm/xe: Document Xe PM component") Cc: Michal Wajdeczko Cc: Rodrigo Vivi Signed-off-by: Shuicheng Lin Link: https://lore.kernel.org/r/20250708021450.3602087-2-shuicheng.lin@intel.com Reviewed-by: Stuart Summers Signed-off-by: Rodrigo Vivi (cherry picked from commit 0efec0500117947f924e5ac83be40f96378af85a) Signed-off-by: Lucas De Marchi commit 253a174c06f8c37aa71521623205b890022b6987 Author: Shuicheng Lin Date: Mon Jul 7 00:49:14 2025 +0000 drm/xe: Release runtime pm for error path of xe_devcoredump_read() xe_pm_runtime_put() is missed to be called for the error path in xe_devcoredump_read(). Add function description comments for xe_devcoredump_read() to help understand it. v2: more detail function comments and refine goto logic (Matt) Fixes: c4a2e5f865b7 ("drm/xe: Add devcoredump chunking") Cc: stable@vger.kernel.org Reviewed-by: Matthew Brost Signed-off-by: Shuicheng Lin Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250707004911.3502904-6-shuicheng.lin@intel.com (cherry picked from commit 017ef1228d735965419ff118fe1b89089e772c42) Signed-off-by: Lucas De Marchi commit 6d33df611a39a1b4ad9f2b609ded5d6efa04d97e Author: Shuicheng Lin Date: Tue Jul 8 03:54:25 2025 +0000 drm/xe/pm: Restore display pm if there is error after display suspend xe_bo_evict_all() is called after xe_display_pm_suspend(). So if there is error with xe_bo_evict_all(), display pm should be restored. Fixes: 51462211f4a9 ("drm/xe/pxp: add PXP PM support") Fixes: cb8f81c17531 ("drm/xe/display: Make display suspend/resume work on discrete") Cc: Maarten Lankhorst Cc: Daniele Ceraolo Spurio Cc: John Harrison Signed-off-by: Shuicheng Lin Reviewed-by: Daniele Ceraolo Spurio Link: https://lore.kernel.org/r/20250708035424.3608190-2-shuicheng.lin@intel.com Signed-off-by: Rodrigo Vivi (cherry picked from commit 83dcee17855c4e5af037ae3262809036de127903) Signed-off-by: Lucas De Marchi commit 47c84997c686b4d43b225521b732492552b84758 Author: Hangbin Liu Date: Wed Jul 9 09:12:44 2025 +0000 selftests: net: lib: fix shift count out of range I got the following warning when writing other tests: + handle_test_result_pass 'bond 802.3ad' '(lacp_active off)' + local 'test_name=bond 802.3ad' + shift + local 'opt_str=(lacp_active off)' + shift + log_test_result 'bond 802.3ad' '(lacp_active off)' ' OK ' + local 'test_name=bond 802.3ad' + shift + local 'opt_str=(lacp_active off)' + shift + local 'result= OK ' + shift + local retmsg= + shift /net/tools/testing/selftests/net/forwarding/../lib.sh: line 315: shift: shift count out of range This happens because an extra shift is executed even after all arguments have been consumed. Remove the last shift in log_test_result() to avoid this warning. Fixes: a923af1ceee7 ("selftests: forwarding: Convert log_test() to recognize RET values") Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20250709091244.88395-1-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski commit ce913b2292e9bdf2661af6e584ddfb4ed5978893 Merge: 2dfa4e31768bd7 4d61a8a7334399 Author: Jakub Kicinski Date: Thu Jul 10 18:10:48 2025 -0700 Merge branch 'gre-fix-default-ipv6-multicast-route-creation' Guillaume Nault says: ==================== gre: Fix default IPv6 multicast route creation. When fixing IPv6 link-local address generation on GRE devices with commit 3e6a0243ff00 ("gre: Fix again IPv6 link-local address generation."), I accidentally broke the default IPv6 multicast route creation on these GRE devices. Fix that in patch 1, making the GRE specific code yet a bit closer to the generic code used by most other network interface types. Then extend the selftest in patch 2 to cover this case. ==================== Link: https://patch.msgid.link/cover.1752070620.git.gnault@redhat.com Signed-off-by: Jakub Kicinski commit 4d61a8a7334399f457867442445a4f916b40cddb Author: Guillaume Nault Date: Wed Jul 9 16:30:17 2025 +0200 selftests: Add IPv6 multicast route generation tests for GRE devices. The previous patch fixes a bug that prevented the creation of the default IPv6 multicast route (ff00::/8) for some GRE devices. Now let's extend the GRE IPv6 selftests to cover this case. Also, rename check_ipv6_ll_addr() to check_ipv6_device_config() and adapt comments and script output to take into account the fact that we're not limited to link-local address generation. Signed-off-by: Guillaume Nault Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/65a89583bde3bf866a1922c2e5158e4d72c520e2.1752070620.git.gnault@redhat.com Signed-off-by: Jakub Kicinski commit 4e914ef063de40397e25a025c70d9737a9e45a8c Author: Guillaume Nault Date: Wed Jul 9 16:30:10 2025 +0200 gre: Fix IPv6 multicast route creation. Use addrconf_add_dev() instead of ipv6_find_idev() in addrconf_gre_config() so that we don't just get the inet6_dev, but also install the default ff00::/8 multicast route. Before commit 3e6a0243ff00 ("gre: Fix again IPv6 link-local address generation."), the multicast route was created at the end of the function by addrconf_add_mroute(). But this code path is now only taken in one particular case (gre devices not bound to a local IP address and in EUI64 mode). For all other cases, the function exits early and addrconf_add_mroute() is not called anymore. Using addrconf_add_dev() instead of ipv6_find_idev() in addrconf_gre_config(), fixes the problem as it will create the default multicast route for all gre devices. This also brings addrconf_gre_config() a bit closer to the normal netdevice IPv6 configuration code (addrconf_dev_config()). Cc: stable@vger.kernel.org Fixes: 3e6a0243ff00 ("gre: Fix again IPv6 link-local address generation.") Reported-by: Aiden Yang Closes: https://lore.kernel.org/netdev/CANR=AhRM7YHHXVxJ4DmrTNMeuEOY87K2mLmo9KMed1JMr20p6g@mail.gmail.com/ Reviewed-by: Gary Guo Tested-by: Gary Guo Signed-off-by: Guillaume Nault Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/027a923dcb550ad115e6d93ee8bb7d310378bd01.1752070620.git.gnault@redhat.com Signed-off-by: Jakub Kicinski commit 2dfa4e31768bd73bc02a69f8f2cd11dd95f062bf Merge: 01b8114b432d7b dd4360c0e8504f Author: Jakub Kicinski Date: Thu Jul 10 18:08:18 2025 -0700 Merge branch 'net-phy-microchip-lan88xx-reliability-fixes' Oleksij Rempel says: ==================== net: phy: microchip: LAN88xx reliability fixes This patch series improves the reliability of the Microchip LAN88xx PHYs, particularly in edge cases involving fixed link configurations or forced speed modes. Patch 1 assigns genphy_soft_reset() to the .soft_reset hook to ensure that stale link partner advertisement (LPA) bits are properly cleared during reconfiguration. Without this, outdated autonegotiation bits may remain visible in some parallel detection cases. Patch 2 restricts the 100 Mbps workaround (originally intended to handle cable length switching) to only run when the link transitions to the PHY_NOLINK state. This prevents repeated toggling that can confuse autonegotiating link partners such as the Intel i350, leading to unstable link cycles. Both patches were tested on a LAN7850 (with integrated LAN88xx PHY) against an Intel I350 NIC. The full test suite - autonegotiation, fixed link, and parallel detection - passed successfully. ==================== Link: https://patch.msgid.link/20250709130753.3994461-1-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit dd4360c0e8504f2f7639c7f5d07c93cfd6a98333 Author: Oleksij Rempel Date: Wed Jul 9 15:07:53 2025 +0200 net: phy: microchip: limit 100M workaround to link-down events on LAN88xx Restrict the 100Mbit forced-mode workaround to link-down transitions only, to prevent repeated link reset cycles in certain configurations. The workaround was originally introduced to improve signal reliability when switching cables between long and short distances. It temporarily forces the PHY into 10 Mbps before returning to 100 Mbps. However, when used with autonegotiating link partners (e.g., Intel i350), executing this workaround on every link change can confuse the partner and cause constant renegotiation loops. This results in repeated link down/up transitions and the PHY never reaching a stable state. Limit the workaround to only run during the PHY_NOLINK state. This ensures it is triggered only once per link drop, avoiding disruptive toggling while still preserving its intended effect. Note: I am not able to reproduce the original issue that this workaround addresses. I can only confirm that 100 Mbit mode works correctly in my test setup. Based on code inspection, I assume the workaround aims to reset some internal state machine or signal block by toggling speeds. However, a PHY reset is already performed earlier in the function via phy_init_hw(), which may achieve a similar effect. Without a reproducer, I conservatively keep the workaround but restrict its conditions. Fixes: e57cf3639c32 ("net: lan78xx: fix accessing the LAN7800's internal phy specific registers from the MAC driver") Signed-off-by: Oleksij Rempel Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250709130753.3994461-3-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit b4517c363e0e005c7f81ae3be199eec68e87f122 Author: Oleksij Rempel Date: Wed Jul 9 15:07:52 2025 +0200 net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits Enable .soft_reset for the LAN88xx PHY driver by assigning genphy_soft_reset() to ensure that the phylib core performs a proper soft reset during reconfiguration. Previously, the driver left .soft_reset unimplemented, so calls to phy_init_hw() (e.g., from lan88xx_link_change_notify()) did not fully reset the PHY. As a result, stale contents in the Link Partner Ability (LPA) register could persist, causing the PHY to incorrectly report that the link partner advertised autonegotiation even when it did not. Using genphy_soft_reset() guarantees a clean reset of the PHY and corrects the false autoneg reporting in these scenarios. Fixes: ccb989e4d1ef ("net: phy: microchip: Reset LAN88xx PHY to ensure clean link state on LAN7800/7850") Signed-off-by: Oleksij Rempel Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250709130753.3994461-2-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 01b8114b432d7baaa5e51ab229c12c4f36b8e2c6 Author: Mingming Cao Date: Wed Jul 9 08:33:32 2025 -0700 ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof The previous hardcoded definitions of NUM_RX_STATS and NUM_TX_STATS were not updated when new fields were added to the ibmvnic_{rx,tx}_queue_stats structures. Specifically, commit 2ee73c54a615 ("ibmvnic: Add stat for tx direct vs tx batched") added a fourth TX stat, but NUM_TX_STATS remained 3, leading to a mismatch. This patch replaces the static defines with dynamic sizeof-based calculations to ensure the stat arrays are correctly sized. This fixes incorrect indexing and prevents incomplete stat reporting in tools like ethtool. Fixes: 2ee73c54a615 ("ibmvnic: Add stat for tx direct vs tx batched") Signed-off-by: Mingming Cao Reviewed-by: Dave Marquardt Reviewed-by: Haren Myneni Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250709153332.73892-1-mmc@linux.ibm.com Signed-off-by: Jakub Kicinski commit 711c80f7d8b163d3ecd463cd96f07230f488e750 Author: Kito Xu Date: Wed Jul 9 03:52:51 2025 +0000 net: appletalk: Fix device refcount leak in atrtr_create() When updating an existing route entry in atrtr_create(), the old device reference was not being released before assigning the new device, leading to a device refcount leak. Fix this by calling dev_put() to release the old device reference before holding the new one. Fixes: c7f905f0f6d4 ("[ATALK]: Add missing dev_hold() to atrtr_create().") Signed-off-by: Kito Xu Link: https://patch.msgid.link/tencent_E1A26771CDAB389A0396D1681A90A49E5D09@qq.com Signed-off-by: Jakub Kicinski commit 7ac5cc2616257cf80d32a8814e44474f07efed62 Merge: 18cdb3d982da89 c07981af55d3ba Author: Jakub Kicinski Date: Thu Jul 10 17:13:46 2025 -0700 Merge tag 'wireless-2025-07-10' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Quite a number of fixes still: - mt76 (hadn't sent any fixes so far) - RCU - scanning - decapsulation offload - interface combinations - rt2x00: build fix (bad function pointer prototype) - cfg80211: prevent A-MSDU flipping attacks in mesh - zd1211rw: prevent race ending with NULL ptr deref - cfg80211/mac80211: more S1G fixes - mwifiex: avoid WARN on certain RX frames - mac80211: - avoid stack data leak in WARN cases - fix non-transmitted BSSID search (on certain multi-BSSID APs) - always initialize key list so driver iteration won't crash - fix monitor interface in device restart - fix __free() annotation usage * tag 'wireless-2025-07-10' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: (26 commits) wifi: mac80211: add the virtual monitor after reconfig complete wifi: mac80211: always initialize sdata::key_list wifi: mac80211: Fix uninitialized variable with __free() in ieee80211_ml_epcs() wifi: mt76: mt792x: Limit the concurrent STA and SoftAP to operate on the same channel wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() wifi: mt76: fix queue assignment for deauth packets wifi: mt76: add a wrapper for wcid access with validation wifi: mt76: mt7921: prevent decap offload config before STA initialization wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() wifi: mt76: mt7925: fix incorrect scan probe IE handling for hw_scan wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan wifi: mt76: mt7925: fix the wrong config for tx interrupt wifi: mt76: Remove RCU section in mt7996_mac_sta_rc_work() wifi: mt76: Move RCU section in mt7996_mcu_add_rate_ctrl() wifi: mt76: Move RCU section in mt7996_mcu_add_rate_ctrl_fixed() wifi: mt76: Move RCU section in mt7996_mcu_set_fixed_field() wifi: mt76: Assume __mt76_connac_mcu_alloc_sta_req runs in atomic context wifi: prevent A-MSDU attacks in mesh networks wifi: rt2x00: fix remove callback type mismatch wifi: mac80211: reject VHT opmode for unsupported channel widths ... ==================== Link: https://patch.msgid.link/20250710122212.24272-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 18cdb3d982da8976b28d57691eb256ec5688fad2 Author: Eric Dumazet Date: Mon Jul 7 12:45:17 2025 +0000 netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() syzbot found a potential access to uninit-value in nf_flow_pppoe_proto() Blamed commit forgot the Ethernet header. BUG: KMSAN: uninit-value in nf_flow_offload_inet_hook+0x7e4/0x940 net/netfilter/nf_flow_table_inet.c:27 nf_flow_offload_inet_hook+0x7e4/0x940 net/netfilter/nf_flow_table_inet.c:27 nf_hook_entry_hookfn include/linux/netfilter.h:157 [inline] nf_hook_slow+0xe1/0x3d0 net/netfilter/core.c:623 nf_hook_ingress include/linux/netfilter_netdev.h:34 [inline] nf_ingress net/core/dev.c:5742 [inline] __netif_receive_skb_core+0x4aff/0x70c0 net/core/dev.c:5837 __netif_receive_skb_one_core net/core/dev.c:5975 [inline] __netif_receive_skb+0xcc/0xac0 net/core/dev.c:6090 netif_receive_skb_internal net/core/dev.c:6176 [inline] netif_receive_skb+0x57/0x630 net/core/dev.c:6235 tun_rx_batched+0x1df/0x980 drivers/net/tun.c:1485 tun_get_user+0x4ee0/0x6b40 drivers/net/tun.c:1938 tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1984 new_sync_write fs/read_write.c:593 [inline] vfs_write+0xb4b/0x1580 fs/read_write.c:686 ksys_write fs/read_write.c:738 [inline] __do_sys_write fs/read_write.c:749 [inline] Reported-by: syzbot+bf6ed459397e307c3ad2@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/686bc073.a00a0220.c7b3.0086.GAE@google.com/T/#u Fixes: 87b3593bed18 ("netfilter: flowtable: validate pppoe header") Signed-off-by: Eric Dumazet Reviewed-by: Pablo Neira Ayuso Link: https://patch.msgid.link/20250707124517.614489-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit a8b289f0f2dcbadd8c207ad8f33cf7ba2b4eb088 Author: Arnd Bergmann Date: Thu Jul 10 10:00:12 2025 +0200 irqchip/irq-msi-lib: Fix build with PCI disabled The armada-370-xp irqchip fails in some randconfig builds because of a missing declaration: In file included from drivers/irqchip/irq-armada-370-xp.c:23: include/linux/irqchip/irq-msi-lib.h:25:39: error: 'struct msi_domain_info' declared inside parameter list will not be visible outside of this definition or declaration [-Werror] Add a forward declaration for the msi_domain_info structure. [ tglx: Fixed up the subsystem prefix. Is it really that hard to get right? ] Fixes: e51b27438a10 ("irqchip: Make irq-msi-lib.h globally available") Signed-off-by: Arnd Bergmann Signed-off-by: Thomas Gleixner Acked-by: Marc Zyngier Link: https://lore.kernel.org/all/20250710080021.2303640-1-arnd@kernel.org commit 68ea85df15d111d82fc474cbe104174791169355 Author: Himanshu Madhani Date: Tue Jul 8 22:25:30 2025 +0000 PCI/MSI: Prevent recursive locking in pci_msix_write_tph_tag() pci_msix_write_tph_tag() takes the per device MSI descriptor mutex and then invokes msi_domain_get_virq(), which takes the same mutex again. That obviously results in a system hang which is exposed by a softlockup or lockdep warning. Move the lock guard after the invocation of msi_domain_get_virq() to fix this. [ tglx: Massage changelog by adding a proper explanation and removing the not really useful stacktrace ] Fixes: d5124a9957b2 ("PCI/MSI: Provide a sane mechanism for TPH") Reported-by: Jorge Lopez Suggested-by: Thomas Gleixner Signed-off-by: Himanshu Madhani Signed-off-by: Thomas Gleixner Tested-by: Jorge Lopez Link: https://lore.kernel.org/all/20250708222530.1041477-1-himanshu.madhani@oracle.com commit 073b3eca08f915d9b92818ed8c30123c54058206 Author: Binbin Wu Date: Tue Jul 1 09:25:36 2025 +0800 Documentation: KVM: Fix unexpected unindent warning Add proper indentations to bullet list item to resolve the warning: "Bullet list ends without a blank line; unexpected unindent." Closes:https://lore.kernel.org/kvm/20250623162110.6e2f4241@canb.auug.org.au Fixes: 4580dbef5ce0 ("KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt") Reported-by: Stephen Rothwell Signed-off-by: Binbin Wu Link: https://lore.kernel.org/r/20250701012536.1281367-1-binbin.wu@linux.intel.com Signed-off-by: Sean Christopherson commit bc9ff192a6c940d9a26e21a0a82f2667067aaf5f Merge: 73d7cf07109e79 dd831ac8221e69 Author: Linus Torvalds Date: Thu Jul 10 09:18:53 2025 -0700 Merge tag 'net-6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from Bluetooth. Current release - regressions: - tcp: refine sk_rcvbuf increase for ooo packets - bluetooth: fix attempting to send HCI_Disconnect to BIS handle - rxrpc: fix over large frame size warning - eth: bcmgenet: initialize u64 stats seq counter Previous releases - regressions: - tcp: correct signedness in skb remaining space calculation - sched: abort __tc_modify_qdisc if parent class does not exist - vsock: fix transport_{g2h,h2g} TOCTOU - rxrpc: fix bug due to prealloc collision - tipc: fix use-after-free in tipc_conn_close(). - bluetooth: fix not marking Broadcast Sink BIS as connected - phy: qca808x: fix WoL issue by utilizing at8031_set_wol() - eth: am65-cpsw-nuss: fix skb size by accounting for skb_shared_info Previous releases - always broken: - netlink: fix wraparounds of sk->sk_rmem_alloc. - atm: fix infinite recursive call of clip_push(). - eth: - stmmac: fix interrupt handling for level-triggered mode in DWC_XGMAC2 - rtsn: fix a null pointer dereference in rtsn_probe()" * tag 'net-6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (37 commits) net/sched: sch_qfq: Fix null-deref in agg_dequeue rxrpc: Fix oops due to non-existence of prealloc backlog struct rxrpc: Fix bug due to prealloc collision MAINTAINERS: remove myself as netronome maintainer selftests/net: packetdrill: add tcp_ooo-before-and-after-accept.pkt tcp: refine sk_rcvbuf increase for ooo packets net/sched: Abort __tc_modify_qdisc if parent class does not exist net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info net: thunderx: avoid direct MTU assignment after WRITE_ONCE() selftests/tc-testing: Create test case for UAF scenario with DRR/NETEM/BLACKHOLE chain atm: clip: Fix NULL pointer dereference in vcc_sendmsg() atm: clip: Fix infinite recursive call of clip_push(). atm: clip: Fix memory leak of struct clip_vcc. atm: clip: Fix potential null-ptr-deref in to_atmarpd(). net: phy: smsc: Fix link failure in forced mode with Auto-MDIX net: phy: smsc: Force predictable MDI-X state on LAN87xx net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 rxrpc: Fix over large frame size warning net: airoha: Fix an error handling path in airoha_probe() ... commit 73d7cf07109e79b093d1a1fb57a88d4048cd9b4b Merge: 8c2e52ebbe885c 4578a747f3c795 Author: Linus Torvalds Date: Thu Jul 10 09:06:53 2025 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM fixes from Paolo Bonzini: "Many patches, pretty much all of them small, that accumulated while I was on vacation. ARM: - Remove the last leftovers of the ill-fated FPSIMD host state mapping at EL2 stage-1 - Fix unexpected advertisement to the guest of unimplemented S2 base granule sizes - Gracefully fail initialising pKVM if the interrupt controller isn't GICv3 - Also gracefully fail initialising pKVM if the carveout allocation fails - Fix the computing of the minimum MMIO range required for the host on stage-2 fault - Fix the generation of the GICv3 Maintenance Interrupt in nested mode x86: - Reject SEV{-ES} intra-host migration if one or more vCPUs are actively being created, so as not to create a non-SEV{-ES} vCPU in an SEV{-ES} VM - Use a pre-allocated, per-vCPU buffer for handling de-sparsification of vCPU masks in Hyper-V hypercalls; fixes a "stack frame too large" issue - Allow out-of-range/invalid Xen event channel ports when configuring IRQ routing, to avoid dictating a specific ioctl() ordering to userspace - Conditionally reschedule when setting memory attributes to avoid soft lockups when userspace converts huge swaths of memory to/from private - Add back MWAIT as a required feature for the MONITOR/MWAIT selftest - Add a missing field in struct sev_data_snp_launch_start that resulted in the guest-visible workarounds field being filled at the wrong offset - Skip non-canonical address when processing Hyper-V PV TLB flushes to avoid VM-Fail on INVVPID - Advertise supported TDX TDVMCALLs to userspace - Pass SetupEventNotifyInterrupt arguments to userspace - Fix TSC frequency underflow" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: x86: avoid underflow when scaling TSC frequency KVM: arm64: Remove kvm_arch_vcpu_run_map_fp() KVM: arm64: Fix handling of FEAT_GTG for unimplemented granule sizes KVM: arm64: Don't free hyp pages with pKVM on GICv2 KVM: arm64: Fix error path in init_hyp_mode() KVM: arm64: Adjust range correctly during host stage-2 faults KVM: arm64: nv: Fix MI line level calculation in vgic_v3_nested_update_mi() KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush KVM: SVM: Add missing member in SNP_LAUNCH_START command structure Documentation: KVM: Fix unexpected unindent warnings KVM: selftests: Add back the missing check of MONITOR/MWAIT availability KVM: Allow CPU to reschedule while setting per-page memory attributes KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. KVM: x86/hyper-v: Use preallocated per-vCPU buffer for de-sparsified vCPU masks KVM: SVM: Initialize vmsa_pa in VMCB to INVALID_PAGE if VMSA page is NULL KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt commit e778689390c71462a099b5d6e56d71c316486184 Author: Hans de Goede Date: Mon Jul 7 23:14:12 2025 +0200 drm/i915/bios: Apply vlv_fixup_mipi_sequences() to v2 mipi-sequences too It turns out that the fixup from vlv_fixup_mipi_sequences() is necessary for some DSI panel's with version 2 mipi-sequences too. Specifically the Acer Iconia One 8 A1-840 (not to be confused with the A1-840FHD which is different) has the following sequences: BDB block 53 (1284 bytes) - MIPI sequence block: Sequence block version v2 Panel 0 * Sequence 2 - MIPI_SEQ_INIT_OTP GPIO index 9, source 0, set 0 (0x00) Delay: 50000 us GPIO index 9, source 0, set 1 (0x01) Delay: 6000 us GPIO index 9, source 0, set 0 (0x00) Delay: 6000 us GPIO index 9, source 0, set 1 (0x01) Delay: 25000 us Send DCS: Port A, VC 0, LP, Type 39, Length 5, Data ff aa 55 a5 80 Send DCS: Port A, VC 0, LP, Type 39, Length 3, Data 6f 11 00 ... Send DCS: Port A, VC 0, LP, Type 05, Length 1, Data 29 Delay: 120000 us Sequence 4 - MIPI_SEQ_DISPLAY_OFF Send DCS: Port A, VC 0, LP, Type 05, Length 1, Data 28 Delay: 105000 us Send DCS: Port A, VC 0, LP, Type 05, Length 2, Data 10 00 Delay: 10000 us Sequence 5 - MIPI_SEQ_ASSERT_RESET Delay: 10000 us GPIO index 9, source 0, set 0 (0x00) Notice how there is no MIPI_SEQ_DEASSERT_RESET, instead the deassert is done at the beginning of MIPI_SEQ_INIT_OTP, which is exactly what the fixup from vlv_fixup_mipi_sequences() fixes up. Extend it to also apply to v2 sequences, this fixes the panel not working on the Acer Iconia One 8 A1-840. Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14605 Signed-off-by: Hans de Goede Acked-by: Jani Nikula Link: https://lore.kernel.org/r/20250703143824.7121-1-hansg@kernel.org Signed-off-by: Rodrigo Vivi (cherry picked from commit 11895f375939d60efe7ed5dddc1cffe2e79f976c) Signed-off-by: Rodrigo Vivi commit b1bf1a782fdf5c482215c0c661b5da98b8e75773 Author: Sheng Yong Date: Thu Jul 10 14:48:55 2025 +0800 dm-bufio: fix sched in atomic context If "try_verify_in_tasklet" is set for dm-verity, DM_BUFIO_CLIENT_NO_SLEEP is enabled for dm-bufio. However, when bufio tries to evict buffers, there is a chance to trigger scheduling in spin_lock_bh, the following warning is hit: BUG: sleeping function called from invalid context at drivers/md/dm-bufio.c:2745 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 123, name: kworker/2:2 preempt_count: 201, expected: 0 RCU nest depth: 0, expected: 0 4 locks held by kworker/2:2/123: #0: ffff88800a2d1548 ((wq_completion)dm_bufio_cache){....}-{0:0}, at: process_one_work+0xe46/0x1970 #1: ffffc90000d97d20 ((work_completion)(&dm_bufio_replacement_work)){....}-{0:0}, at: process_one_work+0x763/0x1970 #2: ffffffff8555b528 (dm_bufio_clients_lock){....}-{3:3}, at: do_global_cleanup+0x1ce/0x710 #3: ffff88801d5820b8 (&c->spinlock){....}-{2:2}, at: do_global_cleanup+0x2a5/0x710 Preemption disabled at: [<0000000000000000>] 0x0 CPU: 2 UID: 0 PID: 123 Comm: kworker/2:2 Not tainted 6.16.0-rc3-g90548c634bd0 #305 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 Workqueue: dm_bufio_cache do_global_cleanup Call Trace: dump_stack_lvl+0x53/0x70 __might_resched+0x360/0x4e0 do_global_cleanup+0x2f5/0x710 process_one_work+0x7db/0x1970 worker_thread+0x518/0xea0 kthread+0x359/0x690 ret_from_fork+0xf3/0x1b0 ret_from_fork_asm+0x1a/0x30 That can be reproduced by: veritysetup format --data-block-size=4096 --hash-block-size=4096 /dev/vda /dev/vdb SIZE=$(blockdev --getsz /dev/vda) dmsetup create myverity -r --table "0 $SIZE verity 1 /dev/vda /dev/vdb 4096 4096 1 sha256 1 try_verify_in_tasklet" mount /dev/dm-0 /mnt -o ro echo 102400 > /sys/module/dm_bufio/parameters/max_cache_size_bytes [read files in /mnt] Cc: stable@vger.kernel.org # v6.4+ Fixes: 450e8dee51aa ("dm bufio: improve concurrent IO performance") Signed-off-by: Wang Shuai Signed-off-by: Sheng Yong Signed-off-by: Mikulas Patocka commit d9b99eb3d76a603442311926617654f0e35581d4 Author: Edip Hazuri Date: Thu Jul 10 16:18:12 2025 +0300 ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx The mute led on this laptop is using ALC245 but requires a quirk to work This patch enables the existing quirk for the device. Tested on Victus 16-r0xxx Laptop. The LED behaviour works as intended. Cc: Signed-off-by: Edip Hazuri Link: https://patch.msgid.link/20250710131812.27509-1-edip@medip.dev Signed-off-by: Takashi Iwai commit 252f4ac08cd2f16ecd20e4c5e41ac2a17dd86942 Author: Fabio Porcedda Date: Thu Jul 10 14:16:38 2025 +0200 USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition Add Telit Cinterion FE910C04 (ECM) composition: 0x10c7: ECM + tty (AT) + tty (AT) + tty (diag) usb-devices output: T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 7 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c7 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms Cc: stable@vger.kernel.org Signed-off-by: Fabio Porcedda Signed-off-by: Johan Hovold commit c980666b6958d9a841597331b38115a29a32250e Author: Ryan Mann (NDI) Date: Thu Jul 10 13:08:00 2025 +0000 USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI NDI (Northern Digital Inc.) is introducing a new product called the EMGUIDE GEMINI that will use an FTDI chip for USB serial communications. Add the NDI EMGUIDE GEMINI product ID that uses the NDI Vendor ID rather than the FTDI Vendor ID, unlike older products. Signed-off-by: Ryan Mann Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit c07981af55d3ba3ec3be880cfe4a0cc10f1f7138 Author: Miri Korenblit Date: Wed Jul 9 23:34:56 2025 +0300 wifi: mac80211: add the virtual monitor after reconfig complete In reconfig we add the virtual monitor in 2 cases: 1. If we are resuming (it was deleted on suspend) 2. If it was added after an error but before the reconfig (due to the last non-monitor interface removal). In the second case, the removal of the non-monitor interface will succeed but the addition of the virtual monitor will fail, so we add it in the reconfig. The problem is that we mislead the driver to think that this is an existing interface that is getting re-added - while it is actually a completely new interface from the drivers' point of view. Some drivers act differently when a interface is re-added. For example, it might not initialize things because they were already initialized. Such drivers will - in this case - be left with a partialy initialized vif. To fix it, add the virtual monitor after reconfig_complete, so the driver will know that this is a completely new interface. Fixes: 3c3e21e7443b ("mac80211: destroy virtual monitor interface across suspend") Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709233451.648d39b041e8.I2e37b68375278987e303d6c00cc5f3d8334d2f96@changeid Signed-off-by: Johannes Berg commit d7a54d02db41f72f0581a3c77c75b0993ed3f6e2 Author: Miri Korenblit Date: Wed Jul 9 23:34:10 2025 +0300 wifi: mac80211: always initialize sdata::key_list This is currently not initialized for a virtual monitor, leading to a NULL pointer dereference when - for example - iterating over all the keys of all the vifs. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709233400.8dcefe578497.I4c90a00ae3256520e063199d7f6f2580d5451acf@changeid Signed-off-by: Johannes Berg commit 04515e08bca9b5a1f9729b8d99d8b322e56d7454 Author: Andy Shevchenko Date: Thu Jul 10 12:41:20 2025 +0300 HID: debug: Remove duplicate entry (BTN_WHEEL) BTN_WHEEL is duplicated (by value) and compiler is not happy about that: drivers/hid/hid-debug.c:3302:16: error: initializer overrides prior initialization of this subobject [-Werror,-Winitializer-overrides] 3302 | [BTN_WHEEL] = "BtnWheel", [KEY_OK] = "Ok", | ^~~~~~~~~~ drivers/hid/hid-debug.c:3301:20: note: previous initialization is here 3301 | [BTN_GEAR_DOWN] = "BtnGearDown", [BTN_GEAR_UP] = "BtnGearUp", | ^~~~~~~~~~~~~ Remove it again, as the commit 7b2daa648eb7 ("HID: debug: Remove duplicates from 'keys'") already did this once in the past. Fixes: 194808a1ea39 ("HID: Fix debug name for BTN_GEAR_DOWN, BTN_GEAR_UP, BTN_WHEEL") Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20250710094120.753358-1-andriy.shevchenko@linux.intel.com Signed-off-by: Benjamin Tissoires commit 04f9196ba981c9f23fa0c3c30bb290fb81848cec Merge: 19c4096ccdd809 a609bd74b8680d Author: Takashi Iwai Date: Thu Jul 10 11:59:31 2025 +0200 Merge tag 'asoc-fix-v6.16-rc5' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.16 Two patches here, one quirk for an AMD system and a fix for an issue on remove of the AVS driver. commit 6aae87fe7f180cd93a74466cdb6cf2aa9bb28798 Author: Clément Le Goffic Date: Fri Jul 4 10:39:15 2025 +0200 i2c: stm32f7: unmap DMA mapped buffer Before each I2C transfer using DMA, the I2C buffer is DMA'pped to make sure the memory buffer is DMA'able. This is handle in the function `stm32_i2c_prep_dma_xfer()`. If the transfer fails for any reason the I2C buffer must be unmap. Use the dma_callback to factorize the code and fix this issue. Note that the `stm32f7_i2c_dma_callback()` is now called in case of DMA transfer success and error and that the `complete()` on the dma_complete completion structure is done inconditionnally in case of transfer success or error as well as the `dmaengine_terminate_async()`. This is allowed as a `complete()` in case transfer error has no effect as well as a `dmaengine_terminate_async()` on a transfer success. Also fix the unneeded cast and remove not more needed variables. Fixes: 7ecc8cfde553 ("i2c: i2c-stm32f7: Add DMA support") Signed-off-by: Clément Le Goffic Cc: # v4.18+ Acked-by: Alain Volmat Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250704-i2c-upstream-v4-2-84a095a2c728@foss.st.com commit c870cbbd71fccda71d575f0acd4a8d2b7cd88861 Author: Clément Le Goffic Date: Fri Jul 4 10:39:14 2025 +0200 i2c: stm32: fix the device used for the DMA map If the DMA mapping failed, it produced an error log with the wrong device name: "stm32-dma3 40400000.dma-controller: rejecting DMA map of vmalloc memory" Fix this issue by replacing the dev with the I2C dev. Fixes: bb8822cbbc53 ("i2c: i2c-stm32: Add generic DMA API") Signed-off-by: Clément Le Goffic Cc: # v4.18+ Acked-by: Alain Volmat Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250704-i2c-upstream-v4-1-84a095a2c728@foss.st.com commit 60c016afccac7acb78a43b9c75480887ed3ce48e Author: Christophe JAILLET Date: Sat Jul 5 09:57:38 2025 +0200 i2c: omap: Fix an error handling path in omap_i2c_probe() If an error occurs after pm_runtime_use_autosuspend(), a corresponding pm_runtime_dont_use_autosuspend() should be called. In case of error in pm_runtime_resume_and_get(), it is not the case because the error handling path is wrongly ordered. Fix it. Fixes: 780f62974125 ("i2c: omap: fix reference leak when pm_runtime_get_sync fails") Signed-off-by: Christophe JAILLET Cc: # v5.13+ Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/af8a9b62996bebbaaa7c02986aa2a8325ef11596.1751701715.git.christophe.jaillet@wanadoo.fr commit a9503a2ecd95e23d7243bcde7138192de8c1c281 Author: Christophe JAILLET Date: Sat Jul 5 09:57:37 2025 +0200 i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() omap_i2c_init() can fail. Handle this error in omap_i2c_probe(). Fixes: 010d442c4a29 ("i2c: New bus driver for TI OMAP boards") Signed-off-by: Christophe JAILLET Cc: # v2.6.19+ Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/565311abf9bafd7291ca82bcecb48c1fac1e727b.1751701715.git.christophe.jaillet@wanadoo.fr commit dd831ac8221e691e9e918585b1003c7071df0379 Author: Xiang Mei Date: Sat Jul 5 14:21:43 2025 -0700 net/sched: sch_qfq: Fix null-deref in agg_dequeue To prevent a potential crash in agg_dequeue (net/sched/sch_qfq.c) when cl->qdisc->ops->peek(cl->qdisc) returns NULL, we check the return value before using it, similar to the existing approach in sch_hfsc.c. To avoid code duplication, the following changes are made: 1. Changed qdisc_warn_nonwc(include/net/pkt_sched.h) into a static inline function. 2. Moved qdisc_peek_len from net/sched/sch_hfsc.c to include/net/pkt_sched.h so that sch_qfq can reuse it. 3. Applied qdisc_peek_len in agg_dequeue to avoid crashing. Signed-off-by: Xiang Mei Reviewed-by: Cong Wang Link: https://patch.msgid.link/20250705212143.3982664-1-xmei5@asu.edu Signed-off-by: Paolo Abeni commit d31fbdc4c7252846ea80235db8c1a8c932da9d39 Author: Chao Yu Date: Thu Jul 10 15:36:18 2025 +0800 erofs: allow readdir() to be interrupted In a quick slow device, readdir() may loop for long time in large directory, let's give a chance to allow it to be interrupted by userspace. Signed-off-by: Chao Yu Reviewed-by: Gao Xiang Link: https://lore.kernel.org/r/20250710073619.4083422-1-chao@kernel.org [ Gao Xiang: move cond_resched() to the end of the while loop. ] Signed-off-by: Gao Xiang commit 27917e8194f91dffd8b4825350c63cb68e98ce58 Author: Gao Xiang Date: Wed Jul 9 11:46:14 2025 +0800 erofs: address D-cache aliasing Flush the D-cache before unlocking folios for compressed inodes, as they are dirtied during decompression. Avoid calling flush_dcache_folio() on every CPU write, since it's more like playing whack-a-mole without real benefit. It has no impact on x86 and arm64/risc-v: on x86, flush_dcache_folio() is a no-op, and on arm64/risc-v, PG_dcache_clean (PG_arch_1) is clear for new page cache folios. However, certain ARM boards are affected, as reported. Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support") Closes: https://lore.kernel.org/r/c1e51e16-6cc6-49d0-a63e-4e9ff6c4dd53@pengutronix.de Closes: https://lore.kernel.org/r/38d43fae-1182-4155-9c5b-ffc7382d9917@siemens.com Tested-by: Jan Kiszka Tested-by: Stefan Kerkmann Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20250709034614.2780117-2-hsiangkao@linux.alibaba.com commit f5443d0d1ad775927f1473b1c256ef68f2515b9c Author: Gao Xiang Date: Wed Jul 9 11:46:13 2025 +0800 erofs: use memcpy_to_folio() to replace copy_to_iter() Using copy_to_iter() here is overkill and even messy. Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20250709034614.2780117-1-hsiangkao@linux.alibaba.com commit 99f7619a77a0a2e3e2bcae676d0f301769167754 Author: Chao Yu Date: Tue Jul 8 19:19:42 2025 +0800 erofs: fix to add missing tracepoint in erofs_read_folio() Commit 771c994ea51f ("erofs: convert all uncompressed cases to iomap") converts to use iomap interface, it removed trace_erofs_readpage() tracepoint in the meantime, let's add it back. Fixes: 771c994ea51f ("erofs: convert all uncompressed cases to iomap") Signed-off-by: Chao Yu Reviewed-by: Gao Xiang Link: https://lore.kernel.org/r/20250708111942.3120926-1-chao@kernel.org Signed-off-by: Gao Xiang commit d53238b614e01266a3d36b417b60a502e0698504 Author: Chao Yu Date: Mon Jul 7 16:48:32 2025 +0800 erofs: fix to add missing tracepoint in erofs_readahead() Commit 771c994ea51f ("erofs: convert all uncompressed cases to iomap") converts to use iomap interface, it removed trace_erofs_readahead() tracepoint in the meantime, let's add it back. Fixes: 771c994ea51f ("erofs: convert all uncompressed cases to iomap") Signed-off-by: Chao Yu Reviewed-by: Gao Xiang Link: https://lore.kernel.org/r/20250707084832.2725677-1-chao@kernel.org Signed-off-by: Gao Xiang commit 19c4096ccdd809c6213e2e62b0d4f57c880138cd Author: Arnd Bergmann Date: Thu Jul 10 08:30:49 2025 +0200 ALSA: compress_offload: tighten ioctl command number checks The snd_compr_ioctl() ignores the upper 24 bits of the ioctl command number and only compares the number of the ioctl command, which can cause unintended behavior if an application tries to use an unsupprted command that happens to have the same _IOC_NR() value. Remove the truncation to the low bits and compare the entire ioctl command code like every other driver does. Fixes: b21c60a4edd2 ("ALSA: core: add support for compress_offload") Signed-off-by: Arnd Bergmann Acked-by: Vinod Koul Link: https://patch.msgid.link/20250710063059.2683476-1-arnd@kernel.org Signed-off-by: Takashi Iwai commit 6b89819b06d8d339da414f06ef3242f79508be5e Author: Zizhi Wo Date: Thu Jul 3 10:44:18 2025 +0800 cachefiles: Fix the incorrect return value in __cachefiles_write() In __cachefiles_write(), if the return value of the write operation > 0, it is set to 0. This makes it impossible to distinguish scenarios where a partial write has occurred, and will affect the outer calling functions: 1) cachefiles_write_complete() will call "term_func" such as netfs_write_subrequest_terminated(). When "ret" in __cachefiles_write() is used as the "transferred_or_error" of this function, it can not distinguish the amount of data written, makes the WARN meaningless. 2) cachefiles_ondemand_fd_write_iter() can only assume all writes were successful by default when "ret" is 0, and unconditionally return the full length specified by user space. Fix it by modifying "ret" to reflect the actual number of bytes written. Furthermore, returning a value greater than 0 from __cachefiles_write() does not affect other call paths, such as cachefiles_issue_write() and fscache_write(). Fixes: 047487c947e8 ("cachefiles: Implement the I/O routines") Signed-off-by: Zizhi Wo Link: https://lore.kernel.org/20250703024418.2809353-1-wozizhi@huaweicloud.com Signed-off-by: Christian Brauner commit db6cc3f4ac2e6cdc898fc9cbc8b32ae1bf56bdad Author: Chen Yu Date: Fri Jul 4 21:56:20 2025 +0800 Revert "sched/numa: add statistics of numa balance task" This reverts commit ad6b26b6a0a79166b53209df2ca1cf8636296382. This commit introduces per-memcg/task NUMA balance statistics, but unfortunately it introduced a NULL pointer exception due to the following race condition: After a swap task candidate was chosen, its mm_struct pointer was set to NULL due to task exit. Later, when performing the actual task swapping, the p->mm caused the problem. CPU0 CPU1 : ... task_numa_migrate task_numa_find_cpu task_numa_compare # a normal task p is chosen env->best_task = p # p exit: exit_signals(p); p->flags |= PF_EXITING exit_mm p->mm = NULL; migrate_swap_stop __migrate_swap_task((arg->src_task, arg->dst_cpu) count_memcg_event_mm(p->mm, NUMA_TASK_SWAP)# p->mm is NULL task_lock() should be held and the PF_EXITING flag needs to be checked to prevent this from happening. After discussion, the conclusion was that adding a lock is not worthwhile for some statistics calculations. Revert the change and rely on the tracepoint for this purpose. Link: https://lkml.kernel.org/r/20250704135620.685752-1-yu.c.chen@intel.com Link: https://lkml.kernel.org/r/20250708064917.BBD13C4CEED@smtp.kernel.org Fixes: ad6b26b6a0a7 ("sched/numa: add statistics of numa balance task") Signed-off-by: Chen Yu Reported-by: Jirka Hladky Closes: https://lore.kernel.org/all/CAE4VaGBLJxpd=NeRJXpSCuw=REhC5LWJpC29kDy-Zh2ZDyzQZA@mail.gmail.com/ Reported-by: Srikanth Aithal Reported-by: Suneeth D Acked-by: Michal Hocko Cc: Borislav Petkov Cc: Ingo Molnar Cc: Jiri Hladky Cc: Libo Chen Cc: Peter Zijlstra Cc: Thomas Gleixner Signed-off-by: Andrew Morton commit 82241a83cd15aaaf28200a40ad1a8b480012edaf Author: Baolin Wang Date: Thu Jun 5 20:58:29 2025 +0800 mm: fix the inaccurate memory statistics issue for users On some large machines with a high number of CPUs running a 64K pagesize kernel, we found that the 'RES' field is always 0 displayed by the top command for some processes, which will cause a lot of confusion for users. PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 875525 root 20 0 12480 0 0 R 0.3 0.0 0:00.08 top 1 root 20 0 172800 0 0 S 0.0 0.0 0:04.52 systemd The main reason is that the batch size of the percpu counter is quite large on these machines, caching a significant percpu value, since converting mm's rss stats into percpu_counter by commit f1a7941243c1 ("mm: convert mm's rss stats into percpu_counter"). Intuitively, the batch number should be optimized, but on some paths, performance may take precedence over statistical accuracy. Therefore, introducing a new interface to add the percpu statistical count and display it to users, which can remove the confusion. In addition, this change is not expected to be on a performance-critical path, so the modification should be acceptable. In addition, the 'mm->rss_stat' is updated by using add_mm_counter() and dec/inc_mm_counter(), which are all wrappers around percpu_counter_add_batch(). In percpu_counter_add_batch(), there is percpu batch caching to avoid 'fbc->lock' contention. This patch changes task_mem() and task_statm() to get the accurate mm counters under the 'fbc->lock', but this should not exacerbate kernel 'mm->rss_stat' lock contention due to the percpu batch caching of the mm counters. The following test also confirm the theoretical analysis. I run the stress-ng that stresses anon page faults in 32 threads on my 32 cores machine, while simultaneously running a script that starts 32 threads to busy-loop pread each stress-ng thread's /proc/pid/status interface. From the following data, I did not observe any obvious impact of this patch on the stress-ng tests. w/o patch: stress-ng: info: [6848] 4,399,219,085,152 CPU Cycles 67.327 B/sec stress-ng: info: [6848] 1,616,524,844,832 Instructions 24.740 B/sec (0.367 instr. per cycle) stress-ng: info: [6848] 39,529,792 Page Faults Total 0.605 M/sec stress-ng: info: [6848] 39,529,792 Page Faults Minor 0.605 M/sec w/patch: stress-ng: info: [2485] 4,462,440,381,856 CPU Cycles 68.382 B/sec stress-ng: info: [2485] 1,615,101,503,296 Instructions 24.750 B/sec (0.362 instr. per cycle) stress-ng: info: [2485] 39,439,232 Page Faults Total 0.604 M/sec stress-ng: info: [2485] 39,439,232 Page Faults Minor 0.604 M/sec On comparing a very simple app which just allocates & touches some memory against v6.1 (which doesn't have f1a7941243c1) and latest Linus tree (4c06e63b9203) I can see that on latest Linus tree the values for VmRSS, RssAnon and RssFile from /proc/self/status are all zeroes while they do report values on v6.1 and a Linus tree with this patch. Link: https://lkml.kernel.org/r/f4586b17f66f97c174f7fd1f8647374fdb53de1c.1749119050.git.baolin.wang@linux.alibaba.com Fixes: f1a7941243c1 ("mm: convert mm's rss stats into percpu_counter") Signed-off-by: Baolin Wang Reviewed-by: Aboorva Devarajan Tested-by: Aboorva Devarajan Tested-by Donet Tom Acked-by: Shakeel Butt Acked-by: SeongJae Park Acked-by: Michal Hocko Reviewed-by: Vlastimil Babka Cc: David Hildenbrand Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Signed-off-by: Andrew Morton commit bd225b9591442065beb876da72656f4a2d627d03 Author: Honggyu Kim Date: Wed Jul 2 09:02:04 2025 +0900 mm/damon: fix divide by zero in damon_get_intervals_score() The current implementation allows having zero size regions with no special reasons, but damon_get_intervals_score() gets crashed by divide by zero when the region size is zero. [ 29.403950] Oops: divide error: 0000 [#1] SMP NOPTI This patch fixes the bug, but does not disallow zero size regions to keep the backward compatibility since disallowing zero size regions might be a breaking change for some users. In addition, the same crash can happen when intervals_goal.access_bp is zero so this should be fixed in stable trees as well. Link: https://lkml.kernel.org/r/20250702000205.1921-5-honggyu.kim@sk.com Fixes: f04b0fedbe71 ("mm/damon/core: implement intervals auto-tuning") Signed-off-by: Honggyu Kim Reviewed-by: SeongJae Park Cc: Signed-off-by: Andrew Morton commit ddba1b6cf4791824f8b614ff8878353a6c6f79f5 Author: Honggyu Kim Date: Wed Jul 2 09:02:03 2025 +0900 samples/damon: fix damon sample mtier for start failure The damon_sample_mtier_start() can fail so we must reset the "enable" parameter to "false" again for proper rollback. In such cases, setting Y to "enable" then N triggers the similar crash with mtier because damon sample start failed but the "enable" stays as Y. Link: https://lkml.kernel.org/r/20250702000205.1921-4-honggyu.kim@sk.com Fixes: 82a08bde3cf7 ("samples/damon: implement a DAMON module for memory tiering") Signed-off-by: Honggyu Kim Reviewed-by: SeongJae Park Cc: Signed-off-by: Andrew Morton commit f1221c8442616a6927aff836327777144545cb29 Author: Honggyu Kim Date: Wed Jul 2 09:02:02 2025 +0900 samples/damon: fix damon sample wsse for start failure The damon_sample_wsse_start() can fail so we must reset the "enable" parameter to "false" again for proper rollback. In such cases, setting Y to "enable" then N triggers the similar crash with wsse because damon sample start failed but the "enable" stays as Y. Link: https://lkml.kernel.org/r/20250702000205.1921-3-honggyu.kim@sk.com Fixes: b757c6cfc696 ("samples/damon/wsse: start and stop DAMON as the user requests") Signed-off-by: Honggyu Kim Reviewed-by: SeongJae Park Cc: Signed-off-by: Andrew Morton commit d9e01c62b7a0c258a7481c083f84c766a8f5597c Author: Honggyu Kim Date: Wed Jul 2 09:02:01 2025 +0900 samples/damon: fix damon sample prcl for start failure Patch series "mm/damon: fix divide by zero and its samples", v3. This series includes fixes against damon and its samples to make it safer when damon sample starting fails. It includes the following changes. - fix unexpected divide by zero crash for zero size regions - fix bugs for damon samples in case of start failures This patch (of 4): The damon_sample_prcl_start() can fail so we must reset the "enable" parameter to "false" again for proper rollback. In such cases, setting Y to "enable" then N triggers the following crash because damon sample start failed but the "enable" stays as Y. [ 2441.419649] damon_sample_prcl: start [ 2454.146817] damon_sample_prcl: stop [ 2454.146862] ------------[ cut here ]------------ [ 2454.146865] kernel BUG at mm/slub.c:546! [ 2454.148183] Oops: invalid opcode: 0000 [#1] SMP NOPTI ... [ 2454.167555] Call Trace: [ 2454.167822] [ 2454.168061] damon_destroy_ctx+0x78/0x140 [ 2454.168454] damon_sample_prcl_enable_store+0x8d/0xd0 [ 2454.168932] param_attr_store+0xa1/0x120 [ 2454.169315] module_attr_store+0x20/0x50 [ 2454.169695] sysfs_kf_write+0x72/0x90 [ 2454.170065] kernfs_fop_write_iter+0x150/0x1e0 [ 2454.170491] vfs_write+0x315/0x440 [ 2454.170833] ksys_write+0x69/0xf0 [ 2454.171162] __x64_sys_write+0x19/0x30 [ 2454.171525] x64_sys_call+0x18b2/0x2700 [ 2454.171900] do_syscall_64+0x7f/0x680 [ 2454.172258] ? exit_to_user_mode_loop+0xf6/0x180 [ 2454.172694] ? clear_bhb_loop+0x30/0x80 [ 2454.173067] ? clear_bhb_loop+0x30/0x80 [ 2454.173439] entry_SYSCALL_64_after_hwframe+0x76/0x7e Link: https://lkml.kernel.org/r/20250702000205.1921-1-honggyu.kim@sk.com Link: https://lkml.kernel.org/r/20250702000205.1921-2-honggyu.kim@sk.com Fixes: 2aca254620a8 ("samples/damon: introduce a skeleton of a smaple DAMON module for proactive reclamation") Signed-off-by: Honggyu Kim Reviewed-by: SeongJae Park Cc: Signed-off-by: Andrew Morton commit 6ee9b3d84775944fb8c8a447961cd01274ac671c Author: Yeoreum Yun Date: Thu Jul 3 19:10:18 2025 +0100 kasan: remove kasan_find_vm_area() to prevent possible deadlock find_vm_area() couldn't be called in atomic_context. If find_vm_area() is called to reports vm area information, kasan can trigger deadlock like: CPU0 CPU1 vmalloc(); alloc_vmap_area(); spin_lock(&vn->busy.lock) spin_lock_bh(&some_lock); spin_lock(&some_lock); kasan_report(); print_report(); print_address_description(); kasan_find_vm_area(); find_vm_area(); spin_lock(&vn->busy.lock) // deadlock! To prevent possible deadlock while kasan reports, remove kasan_find_vm_area(). Link: https://lkml.kernel.org/r/20250703181018.580833-1-yeoreum.yun@arm.com Fixes: c056a364e954 ("kasan: print virtual mapping info in reports") Signed-off-by: Yeoreum Yun Reported-by: Yunseong Kim Reviewed-by: Andrey Ryabinin Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Byungchul Park Cc: Dmitriy Vyukov Cc: Sebastian Andrzej Siewior Cc: Steven Rostedt Cc: Vincenzo Frascino Cc: Signed-off-by: Andrew Morton commit e6d3e653b084f003977bf2e33820cb84d2e4541f Author: Illia Ostapyshyn Date: Sun Jun 29 02:38:11 2025 +0200 scripts: gdb: vfs: support external dentry names d_shortname of struct dentry only reserves D_NAME_INLINE_LEN characters and contains garbage for longer names. Use d_name instead, which always references the valid name. Link: https://lore.kernel.org/all/20250525213709.878287-2-illia@yshyn.com/ Link: https://lkml.kernel.org/r/20250629003811.2420418-1-illia@yshyn.com Fixes: 79300ac805b6 ("scripts/gdb: fix dentry_name() lookup") Signed-off-by: Illia Ostapyshyn Tested-by: Florian Fainelli Reviewed-by: Florian Fainelli Cc: Al Viro Cc: Christian Brauner Cc: Jan Kara Cc: Jan Kiszka Cc: Kieran Bingham Cc: Signed-off-by: Andrew Morton commit 10d04c26ab2b7da31dd66973f5a09d6fd8ff2a46 Author: Christoph Berg Date: Tue Jun 24 16:44:27 2025 +0200 mm/migrate: fix do_pages_stat in compat mode For arrays with more than 16 entries, the old code would incorrectly advance the pages pointer by 16 words instead of 16 compat_uptr_t. Fix by doing the pointer arithmetic inside get_compat_pages_array where pages32 is already a correctly-typed pointer. Discovered while working on PostgreSQL 18's new NUMA introspection code. Link: https://lkml.kernel.org/r/aGREU0XTB48w9CwN@msg.df7cb.de Fixes: 5b1b561ba73c ("mm: simplify compat_sys_move_pages") Signed-off-by: Christoph Berg Acked-by: David Hildenbrand Suggested-by: David Hildenbrand Reported-by: Bertrand Drouvot Reported-by: Tomas Vondra Closes: https://www.postgresql.org/message-id/flat/6342f601-77de-4ee0-8c2a-3deb50ceac5b%40vondra.me#86402e3d80c031788f5f55b42c459471 Cc: Alistair Popple Cc: Byungchul Park Cc: Gregory Price Cc: "Huang, Ying" Cc: Joshua Hahn Cc: Mathew Brost Cc: Rakie Kim Cc: Zi Yan Signed-off-by: Andrew Morton commit bb1b5929b4279b136816f95ce1e8f1fa689bf4a1 Author: SeongJae Park Date: Sun Jun 29 13:49:14 2025 -0700 mm/damon/core: handle damon_call_control as normal under kdmond deactivation DAMON sysfs interface internally uses damon_call() to update DAMON parameters as users requested, online. However, DAMON core cancels any damon_call() requests when it is deactivated by DAMOS watermarks. As a result, users cannot change DAMON parameters online while DAMON is deactivated. Note that users can turn DAMON off and on with different watermarks to work around. Since deactivated DAMON is nearly same to stopped DAMON, the work around should have no big problem. Anyway, a bug is a bug. There is no real good reason to cancel the damon_call() request under DAMOS deactivation. Fix it by simply handling the request as normal, rather than cancelling under the situation. Link: https://lkml.kernel.org/r/20250629204914.54114-1-sj@kernel.org Fixes: 42b7491af14c ("mm/damon/core: introduce damon_call()") Signed-off-by: SeongJae Park Cc: [6.14+] Signed-off-by: Andrew Morton commit ddd05742b45b083975a0855ef6ebbf88cf1f532a Author: Lance Yang Date: Fri Jun 27 14:23:19 2025 +0800 mm/rmap: fix potential out-of-bounds page table access during batched unmap As pointed out by David[1], the batched unmap logic in try_to_unmap_one() may read past the end of a PTE table when a large folio's PTE mappings are not fully contained within a single page table. While this scenario might be rare, an issue triggerable from userspace must be fixed regardless of its likelihood. This patch fixes the out-of-bounds access by refactoring the logic into a new helper, folio_unmap_pte_batch(). The new helper correctly calculates the safe batch size by capping the scan at both the VMA and PMD boundaries. To simplify the code, it also supports partial batching (i.e., any number of pages from 1 up to the calculated safe maximum), as there is no strong reason to special-case for fully mapped folios. Link: https://lkml.kernel.org/r/20250701143100.6970-1-lance.yang@linux.dev Link: https://lkml.kernel.org/r/20250630011305.23754-1-lance.yang@linux.dev Link: https://lkml.kernel.org/r/20250627062319.84936-1-lance.yang@linux.dev Link: https://lore.kernel.org/linux-mm/a694398c-9f03-4737-81b9-7e49c857fcbe@redhat.com [1] Fixes: 354dffd29575 ("mm: support batched unmap for lazyfree large folios during reclamation") Signed-off-by: Lance Yang Suggested-by: David Hildenbrand Reported-by: David Hildenbrand Closes: https://lore.kernel.org/linux-mm/a694398c-9f03-4737-81b9-7e49c857fcbe@redhat.com Suggested-by: Barry Song Acked-by: Barry Song Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Reviewed-by: Harry Yoo Cc: Baolin Wang Cc: Chris Li Cc: "Huang, Ying" Cc: Kairui Song Cc: Lance Yang Cc: Liam Howlett Cc: Mingzhe Yang Cc: Rik van Riel Cc: Ryan Roberts Cc: Tangquan Zheng Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit c39b87456411a7e4d97a0f6384ca31f2abb1a4b7 Author: Vivek Kasireddy Date: Thu Jun 26 12:11:16 2025 -0700 mm/hugetlb: don't crash when allocating a folio if there are no resv There are cases when we try to pin a folio but discover that it has not been faulted-in. So, we try to allocate it in memfd_alloc_folio() but there is a chance that we might encounter a fatal crash/failure (VM_BUG_ON(!h->resv_huge_pages) in alloc_hugetlb_folio_reserve()) if there are no active reservations at that instant. This issue was reported by syzbot: kernel BUG at mm/hugetlb.c:2403! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5315 Comm: syz.0.0 Not tainted 6.13.0-rc5-syzkaller-00161-g63676eefb7a0 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:alloc_hugetlb_folio_reserve+0xbc/0xc0 mm/hugetlb.c:2403 Code: 1f eb 05 e8 56 18 a0 ff 48 c7 c7 40 56 61 8e e8 ba 21 cc 09 4c 89 f0 5b 41 5c 41 5e 41 5f 5d c3 cc cc cc cc e8 35 18 a0 ff 90 <0f> 0b 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f RSP: 0018:ffffc9000d3d77f8 EFLAGS: 00010087 RAX: ffffffff81ff6beb RBX: 0000000000000000 RCX: 0000000000100000 RDX: ffffc9000e51a000 RSI: 00000000000003ec RDI: 00000000000003ed RBP: 1ffffffff34810d9 R08: ffffffff81ff6ba3 R09: 1ffffd4000093005 R10: dffffc0000000000 R11: fffff94000093006 R12: dffffc0000000000 R13: dffffc0000000000 R14: ffffea0000498000 R15: ffffffff9a4086c8 FS: 00007f77ac12e6c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f77ab54b170 CR3: 0000000040b70000 CR4: 0000000000352ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: memfd_alloc_folio+0x1bd/0x370 mm/memfd.c:88 memfd_pin_folios+0xf10/0x1570 mm/gup.c:3750 udmabuf_pin_folios drivers/dma-buf/udmabuf.c:346 [inline] udmabuf_create+0x70e/0x10c0 drivers/dma-buf/udmabuf.c:443 udmabuf_ioctl_create drivers/dma-buf/udmabuf.c:495 [inline] udmabuf_ioctl+0x301/0x4e0 drivers/dma-buf/udmabuf.c:526 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Therefore, prevent the above crash by removing the VM_BUG_ON() as there is no need to crash the system in this situation and instead we could just fail the allocation request. Furthermore, as described above, the specific situation where this happens is when we try to pin memfd folios before they are faulted-in. Although, this is a valid thing to do, it is not the regular or the common use-case. Let us consider the following scenarios: 1) hugetlbfs_file_mmap() memfd_alloc_folio() hugetlb_fault() 2) memfd_alloc_folio() hugetlbfs_file_mmap() hugetlb_fault() 3) hugetlbfs_file_mmap() hugetlb_fault() alloc_hugetlb_folio() 3) is the most common use-case where first a memfd is allocated followed by mmap(), user writes/updates and then the relevant folios are pinned (memfd_pin_folios()). The BUG this patch is fixing occurs in 2) because we try to pin the folios before hugetlbfs_file_mmap() is called. So, in this situation we try to allocate the folios before pinning them but since we did not make any reservations, resv_huge_pages would be 0, leading to this issue. Link: https://lkml.kernel.org/r/20250626191116.1377761-1-vivek.kasireddy@intel.com Fixes: 26a8ea80929c ("mm/hugetlb: fix memfd_pin_folios resv_huge_pages leak") Reported-by: syzbot+a504cb5bae4fe117ba94@syzkaller.appspotmail.com Signed-off-by: Vivek Kasireddy Closes: https://syzkaller.appspot.com/bug?extid=a504cb5bae4fe117ba94 Closes: https://lore.kernel.org/all/677928b5.050a0220.3b53b0.004d.GAE@google.com/T/ Acked-by: Oscar Salvador Cc: Steve Sistare Cc: Muchun Song Cc: David Hildenbrand Cc: Anshuman Khandual Signed-off-by: Andrew Morton commit 50f4d2ba26d5c3a4687ae0569be3bbf1c8f0cbed Author: Florian Fainelli Date: Mon Jun 23 20:00:19 2025 -0700 scripts/gdb: de-reference per-CPU MCE interrupts The per-CPU MCE interrupts are looked up by reference and need to be de-referenced before printing, otherwise we print the addresses of the variables instead of their contents: MCE: 18379471554386948492 Machine check exceptions MCP: 18379471554386948488 Machine check polls The corrected output looks like this instead now: MCE: 0 Machine check exceptions MCP: 1 Machine check polls Link: https://lkml.kernel.org/r/20250625021109.1057046-1-florian.fainelli@broadcom.com Link: https://lkml.kernel.org/r/20250624030020.882472-1-florian.fainelli@broadcom.com Fixes: b0969d7687a7 ("scripts/gdb: print interrupts") Signed-off-by: Florian Fainelli Cc: Jan Kiszka Cc: Kieran Bingham Cc: Signed-off-by: Andrew Morton commit a02b0cde8ee515ee0c8efd33e7fbe6830c282e69 Author: Florian Fainelli Date: Tue Jun 24 19:10:20 2025 -0700 scripts/gdb: fix interrupts.py after maple tree conversion In commit 721255b9826b ("genirq: Use a maple tree for interrupt descriptor management"), the irq_desc_tree was replaced with a sparse_irqs tree using a maple tree structure. Since the script looked for the irq_desc_tree symbol which is no longer available, no interrupts would be printed and the script output would not be useful anymore. In addition to looking up the correct symbol (sparse_irqs), a new module (mapletree.py) is added whose mtree_load() implementation is largely copied after the C version and uses the same variable and intermediate function names wherever possible to ensure that both the C and Python version be updated in the future. This restores the scripts' output to match that of /proc/interrupts. Link: https://lkml.kernel.org/r/20250625021020.1056930-1-florian.fainelli@broadcom.com Fixes: 721255b9826b ("genirq: Use a maple tree for interrupt descriptor management") Signed-off-by: Florian Fainelli Cc: Jan Kiszka Cc: Kieran Bingham Cc: Shanker Donthineni Cc: Thomas Gleinxer Cc: Signed-off-by: Andrew Morton commit ea9b77f98d94c4d5c1bd1ac1db078f78b40e8bf5 Author: Wei Yang Date: Tue Jun 24 15:18:40 2025 -0400 maple_tree: fix mt_destroy_walk() on root leaf node On destroy, we should set each node dead. But current code miss this when the maple tree has only the root node. The reason is mt_destroy_walk() leverage mte_destroy_descend() to set node dead, but this is skipped since the only root node is a leaf. Fixes this by setting the node dead if it is a leaf. Link: https://lore.kernel.org/all/20250407231354.11771-1-richard.weiyang@gmail.com/ Link: https://lkml.kernel.org/r/20250624191841.64682-1-Liam.Howlett@oracle.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Wei Yang Signed-off-by: Liam R. Howlett Reviewed-by: Dev Jain Cc: Signed-off-by: Andrew Morton commit fea18c686320a53fce7ad62a87a3e1d10ad02f31 Author: Alexander Gordeev Date: Mon Jun 23 09:57:21 2025 +0200 mm/vmalloc: leave lazy MMU mode on PTE mapping error vmap_pages_pte_range() enters the lazy MMU mode, but fails to leave it in case an error is encountered. Link: https://lkml.kernel.org/r/20250623075721.2817094-1-agordeev@linux.ibm.com Fixes: 2ba3e6947aed ("mm/vmalloc: track which page-table levels were modified") Signed-off-by: Alexander Gordeev Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202506132017.T1l1l6ME-lkp@intel.com/ Reviewed-by: Ryan Roberts Cc: Signed-off-by: Andrew Morton commit 7627b459aa0737bdd62a8591a1481cda467f20e3 Author: Florian Fainelli Date: Mon Jun 23 09:41:52 2025 -0700 scripts/gdb: fix interrupts display after MCP on x86 The text line would not be appended to as it should have, it should have been a '+=' but ended up being a '==', fix that. Link: https://lkml.kernel.org/r/20250623164153.746359-1-florian.fainelli@broadcom.com Fixes: b0969d7687a7 ("scripts/gdb: print interrupts") Signed-off-by: Florian Fainelli Cc: Jan Kiszka Cc: Kieran Bingham Cc: Signed-off-by: Andrew Morton commit 99af22cd34688cc0d535a1919e0bea4cbc6c1ea1 Author: Harry Yoo Date: Sat Jun 21 04:53:05 2025 +0900 lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() alloc_tag_top_users() attempts to lock alloc_tag_cttype->mod_lock even when the alloc_tag_cttype is not allocated because: 1) alloc tagging is disabled because mem profiling is disabled (!alloc_tag_cttype) 2) alloc tagging is enabled, but not yet initialized (!alloc_tag_cttype) 3) alloc tagging is enabled, but failed initialization (!alloc_tag_cttype or IS_ERR(alloc_tag_cttype)) In all cases, alloc_tag_cttype is not allocated, and therefore alloc_tag_top_users() should not attempt to acquire the semaphore. This leads to a crash on memory allocation failure by attempting to acquire a non-existent semaphore: Oops: general protection fault, probably for non-canonical address 0xdffffc000000001b: 0000 [#3] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x00000000000000d8-0x00000000000000df] CPU: 2 UID: 0 PID: 1 Comm: systemd Tainted: G D 6.16.0-rc2 #1 VOLUNTARY Tainted: [D]=DIE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:down_read_trylock+0xaa/0x3b0 Code: d0 7c 08 84 d2 0f 85 a0 02 00 00 8b 0d df 31 dd 04 85 c9 75 29 48 b8 00 00 00 00 00 fc ff df 48 8d 6b 68 48 89 ea 48 c1 ea 03 <80> 3c 02 00 0f 85 88 02 00 00 48 3b 5b 68 0f 85 53 01 00 00 65 ff RSP: 0000:ffff8881002ce9b8 EFLAGS: 00010016 RAX: dffffc0000000000 RBX: 0000000000000070 RCX: 0000000000000000 RDX: 000000000000001b RSI: 000000000000000a RDI: 0000000000000070 RBP: 00000000000000d8 R08: 0000000000000001 R09: ffffed107dde49d1 R10: ffff8883eef24e8b R11: ffff8881002cec20 R12: 1ffff11020059d37 R13: 00000000003fff7b R14: ffff8881002cec20 R15: dffffc0000000000 FS: 00007f963f21d940(0000) GS:ffff888458ca6000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f963f5edf71 CR3: 000000010672c000 CR4: 0000000000350ef0 Call Trace: codetag_trylock_module_list+0xd/0x20 alloc_tag_top_users+0x369/0x4b0 __show_mem+0x1cd/0x6e0 warn_alloc+0x2b1/0x390 __alloc_frozen_pages_noprof+0x12b9/0x21a0 alloc_pages_mpol+0x135/0x3e0 alloc_slab_page+0x82/0xe0 new_slab+0x212/0x240 ___slab_alloc+0x82a/0xe00 As David Wang points out, this issue became easier to trigger after commit 780138b12381 ("alloc_tag: check mem_profiling_support in alloc_tag_init"). Before the commit, the issue occurred only when it failed to allocate and initialize alloc_tag_cttype or if a memory allocation fails before alloc_tag_init() is called. After the commit, it can be easily triggered when memory profiling is compiled but disabled at boot. To properly determine whether alloc_tag_init() has been called and its data structures initialized, verify that alloc_tag_cttype is a valid pointer before acquiring the semaphore. If the variable is NULL or an error value, it has not been properly initialized. In such a case, just skip and do not attempt to acquire the semaphore. [harry.yoo@oracle.com: v3] Link: https://lkml.kernel.org/r/20250624072513.84219-1-harry.yoo@oracle.com Link: https://lkml.kernel.org/r/20250620195305.1115151-1-harry.yoo@oracle.com Fixes: 780138b12381 ("alloc_tag: check mem_profiling_support in alloc_tag_init") Fixes: 1438d349d16b ("lib: add memory allocations report in show_mem()") Signed-off-by: Harry Yoo Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202506181351.bba867dd-lkp@intel.com Acked-by: Suren Baghdasaryan Tested-by: Raghavendra K T Cc: Casey Chen Cc: David Wang <00107082@163.com> Cc: Kent Overstreet Cc: Yuanyuan Zhong Cc: Signed-off-by: Andrew Morton commit a95743b53031b015e8949e845a9f6fdfb2656347 Author: Achill Gilgenast Date: Sun Jun 22 03:45:49 2025 +0200 kallsyms: fix build without execinfo Some libc's like musl libc don't provide execinfo.h since it's not part of POSIX. In order to fix compilation on musl, only include execinfo.h if available (HAVE_BACKTRACE_SUPPORT) This was discovered with c104c16073b7 ("Kunit to check the longest symbol length") which starts to include linux/kallsyms.h with Alpine Linux' configs. Link: https://lkml.kernel.org/r/20250622014608.448718-1-fossdd@pwned.life Fixes: c104c16073b7 ("Kunit to check the longest symbol length") Signed-off-by: Achill Gilgenast Cc: Luis Henriques Cc: Greg Kroah-Hartman Cc: Signed-off-by: Andrew Morton commit 0fda5ccf5425c7b92eaca868a3fba8a3c9f8b746 Merge: ee48b0abeca9af 880a88f318cf1d Author: Jakub Kicinski Date: Wed Jul 9 19:41:45 2025 -0700 Merge branch 'rxrpc-miscellaneous-fixes' David Howells says: ==================== rxrpc: Miscellaneous fixes Here are some miscellaneous fixes for rxrpc: (1) Fix assertion failure due to preallocation collision. (2) Fix oops due to prealloc backlog struct not yet having been allocated if no service calls have yet been preallocated. ==================== Link: https://patch.msgid.link/20250708211506.2699012-1-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit 880a88f318cf1d2a0f4c0a7ff7b07e2062b434a4 Author: David Howells Date: Tue Jul 8 22:15:04 2025 +0100 rxrpc: Fix oops due to non-existence of prealloc backlog struct If an AF_RXRPC service socket is opened and bound, but calls are preallocated, then rxrpc_alloc_incoming_call() will oops because the rxrpc_backlog struct doesn't get allocated until the first preallocation is made. Fix this by returning NULL from rxrpc_alloc_incoming_call() if there is no backlog struct. This will cause the incoming call to be aborted. Reported-by: Junvyyang, Tencent Zhuque Lab Suggested-by: Junvyyang, Tencent Zhuque Lab Signed-off-by: David Howells cc: LePremierHomme cc: Marc Dionne cc: Willy Tarreau cc: Simon Horman cc: linux-afs@lists.infradead.org Link: https://patch.msgid.link/20250708211506.2699012-3-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit 69e4186773c6445b258fb45b6e1df18df831ec45 Author: David Howells Date: Tue Jul 8 22:15:03 2025 +0100 rxrpc: Fix bug due to prealloc collision When userspace is using AF_RXRPC to provide a server, it has to preallocate incoming calls and assign to them call IDs that will be used to thread related recvmsg() and sendmsg() together. The preallocated call IDs will automatically be attached to calls as they come in until the pool is empty. To the kernel, the call IDs are just arbitrary numbers, but userspace can use the call ID to hold a pointer to prepared structs. In any case, the user isn't permitted to create two calls with the same call ID (call IDs become available again when the call ends) and EBADSLT should result from sendmsg() if an attempt is made to preallocate a call with an in-use call ID. However, the cleanup in the error handling will trigger both assertions in rxrpc_cleanup_call() because the call isn't marked complete and isn't marked as having been released. Fix this by setting the call state in rxrpc_service_prealloc_one() and then marking it as being released before calling the cleanup function. Fixes: 00e907127e6f ("rxrpc: Preallocate peers, conns and calls for incoming service requests") Reported-by: Junvyyang, Tencent Zhuque Lab Signed-off-by: David Howells cc: LePremierHomme cc: Marc Dionne cc: Simon Horman cc: linux-afs@lists.infradead.org Link: https://patch.msgid.link/20250708211506.2699012-2-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit ee48b0abeca9afcd5a8bcb92345002d2667893ba Author: Louis Peens Date: Tue Jul 8 10:20:51 2025 +0200 MAINTAINERS: remove myself as netronome maintainer I am moving on from Corigine to different things, for the moment slightly removed from kernel development. Right now there is nobody I can in good conscience recommend to take over the maintainer role, but there are still people available for review, so put the driver state to 'Odd Fixes'. Additionally add Simon Horman as reviewer - thanks Simon. Signed-off-by: Louis Peens Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit 95253dc7002408aec7cbb7281478f03797ca2519 Merge: ffdde7bf5a439a b939c074efc160 Author: Jakub Kicinski Date: Wed Jul 9 19:24:12 2025 -0700 Merge branch 'tcp-better-memory-control-for-not-yet-accepted-sockets' Eric Dumazet says: ==================== tcp: better memory control for not-yet-accepted sockets Address a possible OOM condition caused by a recent change. Add a new packetdrill test checking the expected behavior. ==================== Link: https://patch.msgid.link/20250707213900.1543248-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit b939c074efc160648de884a41aeb5e857f2c5c68 Author: Eric Dumazet Date: Mon Jul 7 21:39:00 2025 +0000 selftests/net: packetdrill: add tcp_ooo-before-and-after-accept.pkt Test how new passive flows react to ooo incoming packets. Their sk_rcvbuf can increase only after accept(). Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250707213900.1543248-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 1a03edeb84e6e3b9c6ca5a642557bced93d54434 Author: Eric Dumazet Date: Mon Jul 7 21:38:59 2025 +0000 tcp: refine sk_rcvbuf increase for ooo packets When a passive flow has not been accepted yet, it is not wise to increase sk_rcvbuf when receiving ooo packets. A very busy server might tune down tcp_rmem[1] to better control how much memory can be used by sockets waiting in its listeners accept queues. Fixes: 63ad7dfedfae ("tcp: adjust rcvbuf in presence of reorders") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250707213900.1543248-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit ffdde7bf5a439aaa1955ebd581f5c64ab1533963 Author: Victor Nogueira Date: Mon Jul 7 18:08:01 2025 -0300 net/sched: Abort __tc_modify_qdisc if parent class does not exist Lion's patch [1] revealed an ancient bug in the qdisc API. Whenever a user creates/modifies a qdisc specifying as a parent another qdisc, the qdisc API will, during grafting, detect that the user is not trying to attach to a class and reject. However grafting is performed after qdisc_create (and thus the qdiscs' init callback) is executed. In qdiscs that eventually call qdisc_tree_reduce_backlog during init or change (such as fq, hhf, choke, etc), an issue arises. For example, executing the following commands: sudo tc qdisc add dev lo root handle a: htb default 2 sudo tc qdisc add dev lo parent a: handle beef fq Qdiscs such as fq, hhf, choke, etc unconditionally invoke qdisc_tree_reduce_backlog() in their control path init() or change() which then causes a failure to find the child class; however, that does not stop the unconditional invocation of the assumed child qdisc's qlen_notify with a null class. All these qdiscs make the assumption that class is non-null. The solution is ensure that qdisc_leaf() which looks up the parent class, and is invoked prior to qdisc_create(), should return failure on not finding the class. In this patch, we leverage qdisc_leaf to return ERR_PTRs whenever the parentid doesn't correspond to a class, so that we can detect it earlier on and abort before qdisc_create is called. [1] https://lore.kernel.org/netdev/d912cbd7-193b-4269-9857-525bee8bbb6a@gmail.com/ Fixes: 5e50da01d0ce ("[NET_SCHED]: Fix endless loops (part 2): "simple" qdiscs") Reported-by: syzbot+d8b58d7b0ad89a678a16@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68663c93.a70a0220.5d25f.0857.GAE@google.com/ Reported-by: syzbot+5eccb463fa89309d8bdc@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68663c94.a70a0220.5d25f.0858.GAE@google.com/ Reported-by: syzbot+1261670bbdefc5485a06@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/686764a5.a00a0220.c7b3.0013.GAE@google.com/ Reported-by: syzbot+15b96fc3aac35468fe77@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/686764a5.a00a0220.c7b3.0014.GAE@google.com/ Reported-by: syzbot+4dadc5aecf80324d5a51@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68679e81.a70a0220.29cf51.0016.GAE@google.com/ Acked-by: Jamal Hadi Salim Reviewed-by: Cong Wang Signed-off-by: Victor Nogueira Link: https://patch.msgid.link/20250707210801.372995-1-victor@mojatatu.com Signed-off-by: Jakub Kicinski commit 02c4d6c26f1f662da8885b299c224ca6628ad232 Author: Chintan Vankar Date: Mon Jul 7 14:22:01 2025 +0530 net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info While transitioning from netdev_alloc_ip_align() to build_skb(), memory for the "skb_shared_info" member of an "skb" was not allocated. Fix this by allocating "PAGE_SIZE" as the skb length, accounting for the packet length, headroom and tailroom, thereby including the required memory space for skb_shared_info. Fixes: 8acacc40f733 ("net: ethernet: ti: am65-cpsw: Add minimal XDP support") Reviewed-by: Siddharth Vadapalli Signed-off-by: Chintan Vankar Link: https://patch.msgid.link/20250707085201.1898818-1-c-vankar@ti.com Signed-off-by: Jakub Kicinski commit 849704b8b2115647e12436e5076b8e7a4944f21a Author: Alok Tiwari Date: Sun Jul 6 12:43:21 2025 -0700 net: thunderx: avoid direct MTU assignment after WRITE_ONCE() The current logic in nicvf_change_mtu() writes the new MTU to netdev->mtu using WRITE_ONCE() before verifying if the hardware update succeeds. However on hardware update failure, it attempts to revert to the original MTU using a direct assignment (netdev->mtu = orig_mtu) which violates the intended of WRITE_ONCE protection introduced in commit 1eb2cded45b3 ("net: annotate writes on dev->mtu from ndo_change_mtu()") Additionally, WRITE_ONCE(netdev->mtu, new_mtu) is unnecessarily performed even when the device is not running. Fix this by: Only writing netdev->mtu after successfully updating the hardware. Skipping hardware update when the device is down, and setting MTU directly. Remove unused variable orig_mtu. This ensures that all writes to netdev->mtu are consistent with WRITE_ONCE expectations and avoids unintended state corruption on failure paths. Signed-off-by: Alok Tiwari Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250706194327.1369390-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit d55683866c79a3af1e334126f32841d05e7e4143 Author: Victor Nogueira Date: Sat Jul 5 17:36:38 2025 -0300 selftests/tc-testing: Create test case for UAF scenario with DRR/NETEM/BLACKHOLE chain Create a tdc test for the UAF scenario with DRR/NETEM/BLACKHOLE chain shared by Lion on his report [1]. [1] https://lore.kernel.org/netdev/45876f14-cf28-4177-8ead-bb769fd9e57a@gmail.com/ Signed-off-by: Victor Nogueira Acked-by: Cong Wang Link: https://patch.msgid.link/20250705203638.246350-1-victor@mojatatu.com Signed-off-by: Jakub Kicinski commit 22fc46cea91df3dce140a7dc6847c6fcf0354505 Author: Yue Haibing Date: Sat Jul 5 16:52:28 2025 +0800 atm: clip: Fix NULL pointer dereference in vcc_sendmsg() atmarpd_dev_ops does not implement the send method, which may cause crash as bellow. BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: Oops: 0010 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted 6.15.0-rc6-syzkaller-00346-g5723cc3450bc #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:0x0 Code: Unable to access opcode bytes at 0xffffffffffffffd6. RSP: 0018:ffffc9000d3cf778 EFLAGS: 00010246 RAX: 1ffffffff1910dd1 RBX: 00000000000000c0 RCX: dffffc0000000000 RDX: ffffc9000dc82000 RSI: ffff88803e4c4640 RDI: ffff888052cd0000 RBP: ffffc9000d3cf8d0 R08: ffff888052c9143f R09: 1ffff1100a592287 R10: dffffc0000000000 R11: 0000000000000000 R12: 1ffff92001a79f00 R13: ffff888052cd0000 R14: ffff88803e4c4640 R15: ffffffff8c886e88 FS: 00007fbc762566c0(0000) GS:ffff88808d6c2000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 0000000041f1b000 CR4: 0000000000352ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: vcc_sendmsg+0xa10/0xc50 net/atm/common.c:644 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:727 ____sys_sendmsg+0x52d/0x830 net/socket.c:2566 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2620 __sys_sendmmsg+0x227/0x430 net/socket.c:2709 __do_sys_sendmmsg net/socket.c:2736 [inline] __se_sys_sendmmsg net/socket.c:2733 [inline] __x64_sys_sendmmsg+0xa0/0xc0 net/socket.c:2733 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+e34e5e6b5eddb0014def@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/682f82d5.a70a0220.1765ec.0143.GAE@google.com/T Signed-off-by: Yue Haibing Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250705085228.329202-1-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski commit 3aaea88f7dd1631301878231e6bf218d0124b9ca Merge: 3c78f91e82d65d c489f3283dbfc0 Author: Jakub Kicinski Date: Wed Jul 9 17:52:30 2025 -0700 Merge branch 'atm-clip-fix-infinite-recursion-potential-null-ptr-deref-and-memleak' Kuniyuki Iwashima says: ==================== atm: clip: Fix infinite recursion, potential null-ptr-deref, and memleak. Patch 1 fixes racy access to atmarpd found while checking RTNL usage in clip.c. Patch 2 fixes memory leak by ioctl(ATMARP_MKIP) and ioctl(ATMARPD_CTRL). Patch 3 fixes infinite recursive call of clip_vcc->old_push(), which was reported by syzbot. v1: https://lore.kernel.org/20250702020437.703698-1-kuniyu@google.com ==================== Link: https://patch.msgid.link/20250704062416.1613927-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit c489f3283dbfc0f3c00c312149cae90d27552c45 Author: Kuniyuki Iwashima Date: Fri Jul 4 06:23:53 2025 +0000 atm: clip: Fix infinite recursive call of clip_push(). syzbot reported the splat below. [0] This happens if we call ioctl(ATMARP_MKIP) more than once. During the first call, clip_mkip() sets clip_push() to vcc->push(), and the second call copies it to clip_vcc->old_push(). Later, when the socket is close()d, vcc_destroy_socket() passes NULL skb to clip_push(), which calls clip_vcc->old_push(), triggering the infinite recursion. Let's prevent the second ioctl(ATMARP_MKIP) by checking vcc->user_back, which is allocated by the first call as clip_vcc. Note also that we use lock_sock() to prevent racy calls. [0]: BUG: TASK stack guard page was hit at ffffc9000d66fff8 (stack is ffffc9000d670000..ffffc9000d678000) Oops: stack guard page: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted 6.16.0-rc4-syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:clip_push+0x5/0x720 net/atm/clip.c:191 Code: e0 8f aa 8c e8 1c ad 5b fa eb ae 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 <41> 57 41 56 41 55 41 54 53 48 83 ec 20 48 89 f3 49 89 fd 48 bd 00 RSP: 0018:ffffc9000d670000 EFLAGS: 00010246 RAX: 1ffff1100235a4a5 RBX: ffff888011ad2508 RCX: ffff8880003c0000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888037f01000 RBP: dffffc0000000000 R08: ffffffff8fa104f7 R09: 1ffffffff1f4209e R10: dffffc0000000000 R11: ffffffff8a99b300 R12: ffffffff8a99b300 R13: ffff888037f01000 R14: ffff888011ad2500 R15: ffff888037f01578 FS: 000055557ab6d500(0000) GS:ffff88808d250000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc9000d66fff8 CR3: 0000000043172000 CR4: 0000000000352ef0 Call Trace: clip_push+0x6dc/0x720 net/atm/clip.c:200 clip_push+0x6dc/0x720 net/atm/clip.c:200 clip_push+0x6dc/0x720 net/atm/clip.c:200 ... clip_push+0x6dc/0x720 net/atm/clip.c:200 clip_push+0x6dc/0x720 net/atm/clip.c:200 clip_push+0x6dc/0x720 net/atm/clip.c:200 vcc_destroy_socket net/atm/common.c:183 [inline] vcc_release+0x157/0x460 net/atm/common.c:205 __sock_release net/socket.c:647 [inline] sock_close+0xc0/0x240 net/socket.c:1391 __fput+0x449/0xa70 fs/file_table.c:465 task_work_run+0x1d1/0x260 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xec/0x110 kernel/entry/common.c:114 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline] do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff31c98e929 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fffb5aa1f78 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 0000000000012747 RCX: 00007ff31c98e929 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007ff31cbb7ba0 R08: 0000000000000001 R09: 0000000db5aa226f R10: 00007ff31c7ff030 R11: 0000000000000246 R12: 00007ff31cbb608c R13: 00007ff31cbb6080 R14: ffffffffffffffff R15: 00007fffb5aa2090 Modules linked in: Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+0c77cccd6b7cd917b35a@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2371d94d248d126c1eb1 Signed-off-by: Kuniyuki Iwashima Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250704062416.1613927-4-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 62dba28275a9a3104d4e33595c7b3328d4032d8d Author: Kuniyuki Iwashima Date: Fri Jul 4 06:23:52 2025 +0000 atm: clip: Fix memory leak of struct clip_vcc. ioctl(ATMARP_MKIP) allocates struct clip_vcc and set it to vcc->user_back. The code assumes that vcc_destroy_socket() passes NULL skb to vcc->push() when the socket is close()d, and then clip_push() frees clip_vcc. However, ioctl(ATMARPD_CTRL) sets NULL to vcc->push() in atm_init_atmarp(), resulting in memory leak. Let's serialise two ioctl() by lock_sock() and check vcc->push() in atm_init_atmarp() to prevent memleak. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250704062416.1613927-3-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 706cc36477139c1616a9b2b96610a8bb520b7119 Author: Kuniyuki Iwashima Date: Fri Jul 4 06:23:51 2025 +0000 atm: clip: Fix potential null-ptr-deref in to_atmarpd(). atmarpd is protected by RTNL since commit f3a0592b37b8 ("[ATM]: clip causes unregister hang"). However, it is not enough because to_atmarpd() is called without RTNL, especially clip_neigh_solicit() / neigh_ops->solicit() is unsleepable. Also, there is no RTNL dependency around atmarpd. Let's use a private mutex and RCU to protect access to atmarpd in to_atmarpd(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250704062416.1613927-2-kuniyu@google.com Signed-off-by: Jakub Kicinski commit faab52b59b09721edeb8f92eabad3f4d320fb522 Author: Nuno Das Neves Date: Thu Jul 3 15:44:35 2025 -0700 x86/hyperv: Clean up hv_map/unmap_interrupt() return values Fix the return values of these hypercall helpers so they return a negated errno either directly or via hv_result_to_errno(). Update the callers to check for errno instead of using hv_status_success(), and remove redundant error printing. While at it, rearrange some variable declarations to adhere to style guidelines i.e. "reverse fir tree order". Signed-off-by: Nuno Das Neves Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/1751582677-30930-5-git-send-email-nunodasneves@linux.microsoft.com Signed-off-by: Wei Liu Message-ID: <1751582677-30930-5-git-send-email-nunodasneves@linux.microsoft.com> commit bb169f80ed5a156ec3405e0e49c6b8e9ae264718 Author: Nuno Das Neves Date: Thu Jul 3 15:44:34 2025 -0700 x86/hyperv: Fix usage of cpu_online_mask to get valid cpu Accessing cpu_online_mask here is problematic because the cpus read lock is not held in this context. However, cpu_online_mask isn't needed here since the effective affinity mask is guaranteed to be valid in this callback. So, just use cpumask_first() to get the cpu instead of ANDing it with cpus_online_mask unnecessarily. Fixes: e39397d1fd68 ("x86/hyperv: implement an MSI domain for root partition") Reported-by: Michael Kelley Closes: https://lore.kernel.org/linux-hyperv/SN6PR02MB4157639630F8AD2D8FD8F52FD475A@SN6PR02MB4157.namprd02.prod.outlook.com/ Suggested-by: Thomas Gleixner Signed-off-by: Nuno Das Neves Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/1751582677-30930-4-git-send-email-nunodasneves@linux.microsoft.com Signed-off-by: Wei Liu Message-ID: <1751582677-30930-4-git-send-email-nunodasneves@linux.microsoft.com> commit f84b21da3624d9c8514db409d254a22b84fac66a Author: Mukesh Rathor Date: Thu Jul 3 15:44:32 2025 -0700 PCI: hv: Don't load the driver for baremetal root partition The root partition only uses VMBus when running nested. When running on baremetal the Hyper-V PCI driver is not needed, so do not initialize it. Signed-off-by: Mukesh Rathor Signed-off-by: Nuno Das Neves Reviewed-by: Roman Kisel Reviewed-by: Michael Kelley Acked-by: Bjorn Helgaas Link: https://lore.kernel.org/r/1751582677-30930-2-git-send-email-nunodasneves@linux.microsoft.com Signed-off-by: Wei Liu Message-ID: <1751582677-30930-2-git-send-email-nunodasneves@linux.microsoft.com> commit 9669ddda18fbe7f1e28cd0bfc1218e746fae6c50 Author: Naman Jain Date: Wed Jun 11 15:34:59 2025 +0530 net: mana: Fix warnings for missing export.h header inclusion Fix below warning in Hyper-V's MANA drivers that comes when kernel is compiled with W=1 option. Include export.h in driver files to fix it. * warning: EXPORT_SYMBOL() is used, but #include is missing Signed-off-by: Naman Jain Reviewed-by: Saurabh Sengar Link: https://lore.kernel.org/r/20250611100459.92900-7-namjain@linux.microsoft.com Signed-off-by: Wei Liu Message-ID: <20250611100459.92900-7-namjain@linux.microsoft.com> commit 4a4f15170b63bd3b8a6534b39330e981704c7369 Author: Naman Jain Date: Wed Jun 11 15:34:58 2025 +0530 PCI: hv: Fix warnings for missing export.h header inclusion Fix below warning in Hyper-V PCI driver that comes when kernel is compiled with W=1 option. Include export.h in driver files to fix it. * warning: EXPORT_SYMBOL() is used, but #include is missing Signed-off-by: Naman Jain Reviewed-by: Saurabh Sengar Link: https://lore.kernel.org/r/20250611100459.92900-6-namjain@linux.microsoft.com Signed-off-by: Wei Liu Message-ID: <20250611100459.92900-6-namjain@linux.microsoft.com> commit 5b187e9a31547d63a1a4078b79f7fb3fdbca92cd Author: Naman Jain Date: Wed Jun 11 15:34:57 2025 +0530 clocksource: hyper-v: Fix warnings for missing export.h header inclusion Fix below warning in Hyper-V clocksource driver that comes when kernel is compiled with W=1 option. Include export.h in driver files to fix it. * warning: EXPORT_SYMBOL() is used, but #include is missing Signed-off-by: Naman Jain Reviewed-by: Saurabh Sengar Link: https://lore.kernel.org/r/20250611100459.92900-5-namjain@linux.microsoft.com Signed-off-by: Wei Liu Message-ID: <20250611100459.92900-5-namjain@linux.microsoft.com> commit 0271e72bc0f7cf180dce3f6d145c83f2d5709a25 Author: Naman Jain Date: Wed Jun 11 15:34:55 2025 +0530 x86/hyperv: Fix warnings for missing export.h header inclusion Fix below warning in Hyper-V drivers that comes when kernel is compiled with W=1 option. Include export.h in driver files to fix it. * warning: EXPORT_SYMBOL() is used, but #include is missing Signed-off-by: Naman Jain Reviewed-by: Saurabh Sengar Link: https://lore.kernel.org/r/20250611100459.92900-3-namjain@linux.microsoft.com Signed-off-by: Wei Liu Message-ID: <20250611100459.92900-3-namjain@linux.microsoft.com> commit 2b206d3468236047d71d4ab6110b1f5b70448e0e Author: Naman Jain Date: Wed Jun 11 15:34:54 2025 +0530 Drivers: hv: Fix warnings for missing export.h header inclusion Fix below warning in Hyper-V drivers that comes when kernel is compiled with W=1 option. Include export.h in driver files to fix it. * warning: EXPORT_SYMBOL() is used, but #include is missing Signed-off-by: Naman Jain Reviewed-by: Nuno Das Neves Reviewed-by: Saurabh Sengar Link: https://lore.kernel.org/r/20250611100459.92900-2-namjain@linux.microsoft.com Signed-off-by: Wei Liu Message-ID: <20250611100459.92900-2-namjain@linux.microsoft.com> commit b0871aa0f8df55dbf0aad55d2ab2100c23071b4b Author: Naman Jain Date: Mon Jul 7 14:13:22 2025 +0530 Drivers: hv: Fix the check for HYPERVISOR_CALLBACK_VECTOR __is_defined(HYPERVISOR_CALLBACK_VECTOR) would return 1, only if HYPERVISOR_CALLBACK_VECTOR macro is defined as 1. However its value is 0xf3 and this leads to __is_defined() returning 0. The expectation was to just check whether this MACRO is defined or not and get 1 if it's defined. Replace __is_defined with #ifdef blocks instead to fix it. Fixes: 1dc5df133b98 ("Drivers: hv: vmbus: Get the IRQ number from DeviceTree") Cc: stable@kernel.org Signed-off-by: Naman Jain Reviewed-by: Roman Kisel Link: https://lore.kernel.org/r/20250707084322.1763-1-namjain@linux.microsoft.com Signed-off-by: Wei Liu Message-ID: <20250707084322.1763-1-namjain@linux.microsoft.com> commit 0d86a8d65c1e69610bfe1a7a774f71ff111ed8c1 Author: Yasumasa Suenaga Date: Sat Jun 28 11:22:17 2025 +0900 tools/hv: fcopy: Fix incorrect file path conversion The hv_fcopy_uio_daemon fails to correctly handle file copy requests from Windows hosts (e.g. via Copy-VMFile) due to wchar_t size differences between Windows and Linux. On Linux, wchar_t is 32 bit, whereas Windows uses 16 bit wide characters. Fix this by ensuring that file transfers from host to Linux guest succeed with correctly decoded file names and paths. - Treats file name and path as __u16 arrays, not wchar_t*. - Allocates fixed-size buffers (W_MAX_PATH) for converted strings instead of using malloc. - Adds a check for target path length to prevent snprintf() buffer overflow. Fixes: 82b0945ce2c2 ("tools: hv: Add new fcopy application based on uio driver") Signed-off-by: Yasumasa Suenaga Reviewed-by: Naman Jain Link: https://lore.kernel.org/r/20250628022217.1514-2-yasuenag@gmail.com Signed-off-by: Wei Liu Message-ID: <20250628022217.1514-2-yasuenag@gmail.com> commit 7b89a44b2e8c7ba548e3ad5d5155a17279625335 Author: Michael Kelley Date: Fri Jun 13 16:00:59 2025 -0700 Drivers: hv: Select CONFIG_SYSFB only if EFI is enabled Commit 96959283a58d ("Drivers: hv: Always select CONFIG_SYSFB for Hyper-V guests") selects CONFIG_SYSFB for Hyper-V guests so that screen_info is available to the VMBus driver to get the location of the framebuffer in Generation 2 VMs. However, if CONFIG_HYPERV is enabled but CONFIG_EFI is not, a kernel link error results in ARM64 builds because screen_info is provided by the EFI firmware interface. While configuring an ARM64 Hyper-V guest without EFI isn't useful since EFI is required to boot, the configuration is still possible and the link error should be prevented. Fix this by making the selection of CONFIG_SYSFB conditional on CONFIG_EFI being defined. For Generation 1 VMs on x86/x64, which don't use EFI, the additional condition is OK because such VMs get the framebuffer information via a mechanism that doesn't use screen_info. Fixes: 96959283a58d ("Drivers: hv: Always select CONFIG_SYSFB for Hyper-V guests") Reported-by: Arnd Bergmann Closes: https://lore.kernel.org/linux-hyperv/20250610091810.2638058-1-arnd@kernel.org/ Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506080820.1wmkQufc-lkp@intel.com/ Signed-off-by: Michael Kelley Link: https://lore.kernel.org/stable/20250613230059.380483-1-mhklinux%40outlook.com Reviewed-by: Roman Kisel Link: https://lore.kernel.org/r/20250613230059.380483-1-mhklinux@outlook.com Signed-off-by: Wei Liu Message-ID: <20250613230059.380483-1-mhklinux@outlook.com> commit ec3cae639482a8da11a3ae30d28ceceb9d6a3f56 Author: Rafael J. Wysocki Date: Wed Jul 9 19:12:47 2025 +0200 PM: sleep: Call pm_restore_gfp_mask() after dpm_resume() Commit 12ffc3b1513e ("PM: Restrict swap use to later in the suspend sequence") changed two pm_restore_gfp_mask() calls in enter_state() and hibernation_restore() into one pm_restore_gfp_mask() call in dpm_resume_end(), but it put that call before the dpm_resume() invocation which is too early (some swap-backing devices may not be ready at that point). Moreover, this code ordering change was not even mentioned in the changelog of the commit mentioned above. Address this by moving that call after the dpm_resume() one. Fixes: 12ffc3b1513e ("PM: Restrict swap use to later in the suspend sequence") Signed-off-by: Rafael J. Wysocki Reviewed-by: Mario Limonciello Link: https://patch.msgid.link/2797018.mvXUDI8C0e@rjwysocki.net commit 4578a747f3c7950be3feb93c2db32eb597a3e55b Author: Paolo Bonzini Date: Wed Jul 9 13:45:14 2025 -0400 KVM: x86: avoid underflow when scaling TSC frequency In function kvm_guest_time_update(), __scale_tsc() is used to calculate a TSC *frequency* rather than a TSC value. With low-enough ratios, a TSC value that is less than 1 would underflow to 0 and to an infinite while loop in kvm_get_time_scale(): kvm_guest_time_update(struct kvm_vcpu *v) if (kvm_caps.has_tsc_control) tgt_tsc_khz = kvm_scale_tsc(tgt_tsc_khz, v->arch.l1_tsc_scaling_ratio); __scale_tsc(u64 ratio, u64 tsc) ratio=122380531, tsc=2299998, N=48 ratio*tsc >> N = 0.999... -> 0 Later in the function: Call Trace: kvm_get_time_scale arch/x86/kvm/x86.c:2458 [inline] kvm_guest_time_update+0x926/0xb00 arch/x86/kvm/x86.c:3268 vcpu_enter_guest.constprop.0+0x1e70/0x3cf0 arch/x86/kvm/x86.c:10678 vcpu_run+0x129/0x8d0 arch/x86/kvm/x86.c:11126 kvm_arch_vcpu_ioctl_run+0x37a/0x13d0 arch/x86/kvm/x86.c:11352 kvm_vcpu_ioctl+0x56b/0xe60 virt/kvm/kvm_main.c:4188 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl+0x12d/0x190 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x59/0x110 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x78/0xe2 This can really happen only when fuzzing, since the TSC frequency would have to be nonsensically low. Fixes: 35181e86df97 ("KVM: x86: Add a common TSC scaling function") Reported-by: Yuntao Liu Suggested-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 8c2e52ebbe885c7eeaabd3b7ddcdc1246fc400d2 Author: Linus Torvalds Date: Wed Jul 9 10:38:29 2025 -0700 eventpoll: don't decrement ep refcount while still holding the ep mutex Jann Horn points out that epoll is decrementing the ep refcount and then doing a mutex_unlock(&ep->mtx); afterwards. That's very wrong, because it can lead to a use-after-free. That pattern is actually fine for the very last reference, because the code in question will delay the actual call to "ep_free(ep)" until after it has unlocked the mutex. But it's wrong for the much subtler "next to last" case when somebody *else* may also be dropping their reference and free the ep while we're still using the mutex. Note that this is true even if that other user is also using the same ep mutex: mutexes, unlike spinlocks, can not be used for object ownership, even if they guarantee mutual exclusion. A mutex "unlock" operation is not atomic, and as one user is still accessing the mutex as part of unlocking it, another user can come in and get the now released mutex and free the data structure while the first user is still cleaning up. See our mutex documentation in Documentation/locking/mutex-design.rst, in particular the section [1] about semantics: "mutex_unlock() may access the mutex structure even after it has internally released the lock already - so it's not safe for another context to acquire the mutex and assume that the mutex_unlock() context is not using the structure anymore" So if we drop our ep ref before the mutex unlock, but we weren't the last one, we may then unlock the mutex, another user comes in, drops _their_ reference and releases the 'ep' as it now has no users - all while the mutex_unlock() is still accessing it. Fix this by simply moving the ep refcount dropping to outside the mutex: the refcount itself is atomic, and doesn't need mutex protection (that's the whole _point_ of refcounts: unlike mutexes, they are inherently about object lifetimes). Reported-by: Jann Horn Link: https://docs.kernel.org/locking/mutex-design.html#semantics [1] Cc: Alexander Viro Cc: Christian Brauner Cc: Jan Kara Signed-off-by: Linus Torvalds commit f69f5aab1fad379bbef9339f66bc8323daffe56e Merge: 9adf143357bf5e 9dd17574934163 Author: Linus Torvalds Date: Wed Jul 9 08:37:48 2025 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: - Fix bogus KASAN splat on EFI runtime stack - Select JUMP_LABEL unconditionally to avoid boot failure with pKVM and the legacy implementation of static keys - Avoid touching GCS registers when 'arm64.nogcs' has been passed on the command-line - Move a 'cpumask_t' off the stack in smp_send_stop() - Don't advertise SME-related hwcaps to userspace when ID_AA64PFR1_EL1 indicates that SME is not implemented - Always check the VMA when handling an Overlay fault - Avoid corrupting TCR2_EL1 during boot * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64/mm: Drop wrong writes into TCR2_EL1 arm64: poe: Handle spurious Overlay faults arm64: Filter out SME hwcaps when FEAT_SME isn't implemented arm64: move smp_send_stop() cpu mask off stack arm64/gcs: Don't try to access GCS registers if arm64.nogcs is enabled arm64: Unconditionally select CONFIG_JUMP_LABEL arm64: efi: Fix KASAN false positive for EFI runtime stack commit 9adf143357bf5ea6400f276ca60bfbc7cd92c19a Merge: 733923397fd954 5285b5ed04ab6a Author: Linus Torvalds Date: Wed Jul 9 08:33:08 2025 -0700 Merge tag 'pinctrl-v6.16-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: - Mark som pins as invalid for IRQ use in the Qualcomm driver - Fix up the use of device properties on the MA35DX Nuvoton, apparently something went sidewise - Clear the GPIO debounce settings when going down for suspend in the AMD driver. Very good for some AMD laptops that now wake up from suspend again! - Add the compulsory .can_sleep bool flag in the AW9523 driver, should have been there from the beginning, now there are users finding the bug - Drop some bouncing email address from MAINTAINERS * tag 'pinctrl-v6.16-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: aw9523: fix can_sleep flag for GPIO chip pinctrl: amd: Clear GPIO debounce for suspend pinctrl: nuvoton: Fix boot on ma35dx platforms MAINTAINERS: drop bouncing Lakshmi Sowjanya D pinctrl: qcom: msm: mark certain pins as invalid for interrupts commit 76303ee8d54bff6d9a6d55997acd88a6c2ba63cf Author: Jann Horn Date: Wed Jul 2 10:32:04 2025 +0200 x86/mm: Disable hugetlb page table sharing on 32-bit Only select ARCH_WANT_HUGE_PMD_SHARE on 64-bit x86. Page table sharing requires at least three levels because it involves shared references to PMD tables; 32-bit x86 has either two-level paging (without PAE) or three-level paging (with PAE), but even with three-level paging, having a dedicated PGD entry for hugetlb is only barely possible (because the PGD only has four entries), and it seems unlikely anyone's actually using PMD sharing on 32-bit. Having ARCH_WANT_HUGE_PMD_SHARE enabled on non-PAE 32-bit X86 (which has 2-level paging) became particularly problematic after commit 59d9094df3d7 ("mm: hugetlb: independent PMD page table shared count"), since that changes `struct ptdesc` such that the `pt_mm` (for PGDs) and the `pt_share_count` (for PMDs) share the same union storage - and with 2-level paging, PMDs are PGDs. (For comparison, arm64 also gates ARCH_WANT_HUGE_PMD_SHARE on the configuration of page tables such that it is never enabled with 2-level paging.) Closes: https://lore.kernel.org/r/srhpjxlqfna67blvma5frmy3aa@altlinux.org Fixes: cfe28c5d63d8 ("x86: mm: Remove x86 version of huge_pmd_share.") Reported-by: Vitaly Chikunov Suggested-by: Dave Hansen Signed-off-by: Jann Horn Signed-off-by: Dave Hansen Acked-by: Oscar Salvador Acked-by: David Hildenbrand Tested-by: Vitaly Chikunov Cc:stable@vger.kernel.org Link: https://lore.kernel.org/all/20250702-x86-2level-hugetlb-v2-1-1a98096edf92%40google.com commit d563e7f95c933816efe531c3a48e22bc099c0f55 Author: Alexander Stein Date: Tue Jul 8 10:38:29 2025 +0200 gpio: of: initialize local variable passed to the .of_xlate() callback of_flags is passed down to GPIO chip's xlate function, so ensure this one is properly initialized as - if the xlate callback does nothing with it - we may end up with various configuration errors like: gpio-720 (enable): multiple pull-up, pull-down or pull-disable enabled, invalid configuration Signed-off-by: Alexander Stein Link: https://lore.kernel.org/r/20250708083829.658051-1-alexander.stein@ew.tq-group.com [Bartosz: tweaked the commit message] Signed-off-by: Bartosz Golaszewski commit bd46cece51a36ef088f22ef0416ac13b0a46d5b0 Author: Simona Vetter Date: Mon Jul 7 17:18:13 2025 +0200 drm/gem: Fix race in drm_gem_handle_create_tail() Object creation is a careful dance where we must guarantee that the object is fully constructed before it is visible to other threads, and GEM buffer objects are no difference. Final publishing happens by calling drm_gem_handle_create(). After that the only allowed thing to do is call drm_gem_object_put() because a concurrent call to the GEM_CLOSE ioctl with a correctly guessed id (which is trivial since we have a linear allocator) can already tear down the object again. Luckily most drivers get this right, the very few exceptions I've pinged the relevant maintainers for. Unfortunately we also need drm_gem_handle_create() when creating additional handles for an already existing object (e.g. GETFB ioctl or the various bo import ioctl), and hence we cannot have a drm_gem_handle_create_and_put() as the only exported function to stop these issues from happening. Now unfortunately the implementation of drm_gem_handle_create() isn't living up to standards: It does correctly finishe object initialization at the global level, and hence is safe against a concurrent tear down. But it also sets up the file-private aspects of the handle, and that part goes wrong: We fully register the object in the drm_file.object_idr before calling drm_vma_node_allow() or obj->funcs->open, which opens up races against concurrent removal of that handle in drm_gem_handle_delete(). Fix this with the usual two-stage approach of first reserving the handle id, and then only registering the object after we've completed the file-private setup. Jacek reported this with a testcase of concurrently calling GEM_CLOSE on a freshly-created object (which also destroys the object), but it should be possible to hit this with just additional handles created through import or GETFB without completed destroying the underlying object with the concurrent GEM_CLOSE ioctl calls. Note that the close-side of this race was fixed in f6cd7daecff5 ("drm: Release driver references to handle before making it available again"), which means a cool 9 years have passed until someone noticed that we need to make this symmetry or there's still gaps left :-/ Without the 2-stage close approach we'd still have a race, therefore that's an integral part of this bugfix. More importantly, this means we can have NULL pointers behind allocated id in our drm_file.object_idr. We need to check for that now: - drm_gem_handle_delete() checks for ERR_OR_NULL already - drm_gem.c:object_lookup() also chekcs for NULL - drm_gem_release() should never be called if there's another thread still existing that could call into an IOCTL that creates a new handle, so cannot race. For paranoia I added a NULL check to drm_gem_object_release_handle() though. - most drivers (etnaviv, i915, msm) are find because they use idr_find(), which maps both ENOENT and NULL to NULL. - drivers using idr_for_each_entry() should also be fine, because idr_get_next does filter out NULL entries and continues the iteration. - The same holds for drm_show_memory_stats(). v2: Use drm_WARN_ON (Thomas) Reported-by: Jacek Lawrynowicz Tested-by: Jacek Lawrynowicz Reviewed-by: Thomas Zimmermann Cc: stable@vger.kernel.org Cc: Jacek Lawrynowicz Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: Thomas Zimmermann Cc: David Airlie Cc: Simona Vetter Signed-off-by: Simona Vetter Signed-off-by: Simona Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20250707151814.603897-1-simona.vetter@ffwll.ch commit 2265c08ec393ef1f5ef5019add0ab1e3a7ee0b79 Author: Ben Horgan Date: Wed Jul 9 10:38:07 2025 +0100 KVM: arm64: Fix enforcement of upper bound on MDCR_EL2.HPMN Previously, u64_replace_bits() was used to no effect as the return value was ignored. Convert to u64p_replace_bits() so the value is updated in place. Reviewed-by: Zenghui Yu Signed-off-by: Ben Horgan Fixes: efff9dd2fee7 ("KVM: arm64: Handle out-of-bound write to MDCR_EL2.HPMN") Link: https://lore.kernel.org/r/20250709093808.920284-2-ben.horgan@arm.com Signed-off-by: Marc Zyngier commit f6bfc9afc7510cb5e6fbe0a17c507917b0120280 Author: Thomas Zimmermann Date: Mon Jul 7 15:11:55 2025 +0200 drm/framebuffer: Acquire internal references on GEM handles Acquire GEM handles in drm_framebuffer_init() and release them in the corresponding drm_framebuffer_cleanup(). Ties the handle's lifetime to the framebuffer. Not all GEM buffer objects have GEM handles. If not set, no refcounting takes place. This is the case for some fbdev emulation. This is not a problem as these GEM objects do not use dma-bufs and drivers will not release them while fbdev emulation is running. Framebuffer flags keep a bit per color plane of which the framebuffer holds a GEM handle reference. As all drivers use drm_framebuffer_init(), they will now all hold dma-buf references as fixed in commit 5307dce878d4 ("drm/gem: Acquire references on GEM handles for framebuffers"). In the GEM framebuffer helpers, restore the original ref counting on buffer objects. As the helpers for handle refcounting are now no longer called from outside the DRM core, unexport the symbols. v3: - don't mix internal flags with mode flags (Christian) v2: - track framebuffer handle refs by flag - drop gma500 cleanup (Christian) Signed-off-by: Thomas Zimmermann Fixes: 5307dce878d4 ("drm/gem: Acquire references on GEM handles for framebuffers") Reported-by: Bert Karwatzki Closes: https://lore.kernel.org/dri-devel/20250703115915.3096-1-spasswolf@web.de/ Tested-by: Bert Karwatzki Tested-by: Mario Limonciello Tested-by: Borislav Petkov (AMD) Cc: Thomas Zimmermann Cc: Anusha Srivatsa Cc: Christian König Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: Sumit Semwal Cc: "Christian König" Cc: linux-media@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Cc: linaro-mm-sig@lists.linaro.org Cc: Reviewed-by: Christian König Link: https://lore.kernel.org/r/20250707131224.249496-1-tzimmermann@suse.de commit 6c0e9f05c9d7875995b0e92ace71be947f280bbd Author: Thomas Fourier Date: Tue Jul 1 13:34:52 2025 +0200 pch_uart: Fix dma_sync_sg_for_device() nents value The dma_sync_sg_for_device() functions should be called with the same nents as the dma_map_sg(), not the value the map function returned according to the documentation in Documentation/core-api/dma-api.rst:450: With the sync_sg API, all the parameters must be the same as those passed into the sg mapping API. Fixes: da3564ee027e ("pch_uart: add multi-scatter processing") Cc: stable Signed-off-by: Thomas Fourier Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250701113452.18590-2-fourier.thomas@gmail.com Signed-off-by: Greg Kroah-Hartman commit 273cc3406c8d4e830ed45967c70d08d20ca1380e Author: Johan Hovold Date: Tue Jul 8 10:58:17 2025 +0200 serial: core: fix OF node leak Make sure to drop the OF node reference taken when initialising the control and port devices when the devices are later released. Fixes: d36f0e9a0002 ("serial: core: restore of_node information in sysfs") Cc: Aidan Stewart Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20250708085817.16070-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 3da6bb419750f3ad834786d6ba7c9d5d062c770b Author: Tetsuo Handa Date: Wed Jul 9 20:27:52 2025 +0900 perf/core: Fix WARN in perf_sigtrap() Since exit_task_work() runs after perf_event_exit_task_context() updated ctx->task to TASK_TOMBSTONE, perf_sigtrap() from perf_pending_task() might observe event->ctx->task == TASK_TOMBSTONE. Swap the early exit tests in order not to hit WARN_ON_ONCE(). Closes: https://syzkaller.appspot.com/bug?extid=2fe61cb2a86066be6985 Reported-by: syzbot Signed-off-by: Tetsuo Handa Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/b1c224bd-97f9-462c-a3e3-125d5e19c983@I-love.SAKURA.ne.jp commit cd0f8649d0e1c747d1bf6290201f38474fc23925 Merge: 3014168731b793 08f49cdb71f375 Author: Greg Kroah-Hartman Date: Wed Jul 9 12:43:12 2025 +0200 Merge tag 'usb-serial-6.16-rc6' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB serial device id for 6.16-rc6 Here's a new modem device id. Everything has been in linux-next with no reported issues. * tag 'usb-serial-6.16-rc6' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: add Foxconn T99W640 commit 500ba33284416255b9a5b50ace24470b6fe77ea5 Author: Maulik Shah Date: Wed Jul 9 14:00:11 2025 +0530 pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov pm_domain_cpu_gov is selecting a cluster idle state but does not consider latency tolerance of child CPUs. This results in deeper cluster idle state whose latency does not meet latency tolerance requirement. Select deeper idle state only if global and device latency tolerance of all child CPUs meet. Test results on SM8750 with 300 usec PM-QoS on CPU0 which is less than domain idle state entry (2150) + exit (1983) usec latency mentioned in devicetree, demonstrate the issue. # echo 300 > /sys/devices/system/cpu/cpu0/power/pm_qos_resume_latency_us Before: (Usage is incrementing) ====== # cat /sys/kernel/debug/pm_genpd/power-domain-cluster0/idle_states State Time Spent(ms) Usage Rejected Above Below S0 29817 537 8 270 0 # cat /sys/kernel/debug/pm_genpd/power-domain-cluster0/idle_states State Time Spent(ms) Usage Rejected Above Below S0 30348 542 8 271 0 After: (Usage is not incrementing due to latency tolerance) ====== # cat /sys/kernel/debug/pm_genpd/power-domain-cluster0/idle_states State Time Spent(ms) Usage Rejected Above Below S0 39319 626 14 307 0 # cat /sys/kernel/debug/pm_genpd/power-domain-cluster0/idle_states State Time Spent(ms) Usage Rejected Above Below S0 39319 626 14 307 0 Signed-off-by: Maulik Shah Fixes: e94999688e3a ("PM / Domains: Add genpd governor for CPUs") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250709-pmdomain_qos-v2-1-976b12257899@oss.qualcomm.com Signed-off-by: Ulf Hansson commit 3014168731b7930300aab656085af784edc861f6 Author: Xinyu Liu <1171169449@qq.com> Date: Wed Jul 9 11:55:33 2025 +0800 usb: gadget: configfs: Fix OOB read on empty string write When writing an empty string to either 'qw_sign' or 'landingPage' sysfs attributes, the store functions attempt to access page[l - 1] before validating that the length 'l' is greater than zero. This patch fixes the vulnerability by adding a check at the beginning of os_desc_qw_sign_store() and webusb_landingPage_store() to handle the zero-length input case gracefully by returning immediately. Signed-off-by: Xinyu Liu Cc: stable Link: https://lore.kernel.org/r/tencent_B1C9481688D0E95E7362AB2E999DE8048207@qq.com Signed-off-by: Greg Kroah-Hartman commit a066917360ed5000c4f73fb190773cfac004c885 Author: Pagadala Yesu Anjaneyulu Date: Mon Jun 9 21:35:14 2025 +0300 wifi: mac80211: Fix uninitialized variable with __free() in ieee80211_ml_epcs() The cleanup attribute runs kfree() when the variable goes out of scope. There is a possibility that the link_elems variable is uninitialized if the loop ends before an assignment is made to this variable. This leads to uninitialized variable bug. Fix this by assigning link_elems to NULL. Signed-off-by: Pagadala Yesu Anjaneyulu Reviewed-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250609213231.eeacd3738a7b.I0f876fa1359daeec47ab3aef098255a9c23efd70@changeid Signed-off-by: Johannes Berg commit c86f7bb92f1ffbacb18634356bf0573047eab6a0 Author: Jackie Dong Date: Wed Jul 9 11:57:16 2025 +0800 lenovo-wmi-hotkey: Avoid triggering error -5 due to missing mute LED Not all of Lenovo non-ThinkPad devices support both mic mute LED (on F4) and audio mute LED (on F1). Some of them only support one mute LED, some of them don't have any mute LEDs. If any of the mute LEDs is missing, the driver reports error -5. Check if the device supports a mute LED or not. Do not trigger error -5 message from missing a mute LED if it is not supported on the device. Signed-off-by: Jackie Dong Suggested-by: Hans de Goede Link: https://lore.kernel.org/r/20250709035716.36267-1-xy-jackie@139.com [ij: major edits to the changelog.] Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d88dfb756d557e40e88406e8c962c0684bc9eb87 Author: Lukas Wunner Date: Wed Jul 2 07:02:15 2025 +0200 agp/amd64: Check AGP Capability before binding to unsupported devices Since commit 172efbb40333 ("AGP: Try unsupported AGP chipsets on x86-64 by default"), the AGP driver for AMD Opteron/Athlon64 CPUs has attempted to bind to any PCI device possessing an AGP Capability. Commit 6fd024893911 ("amd64-agp: Probe unknown AGP devices the right way") subsequently reworked the driver to perform a bind attempt to any PCI device (regardless of AGP Capability) and reject a device in the driver's ->probe() hook if it lacks the AGP Capability. On modern CPUs exposing an AMD IOMMU, this subtle change results in an annoying message with KERN_CRIT severity: pci 0000:00:00.2: Resources present before probing The message is emitted by the driver core prior to invoking a driver's ->probe() hook. The check for an AGP Capability in the ->probe() hook happens too late to prevent the message. The message has appeared only recently with commit 3be5fa236649 (Revert "iommu/amd: Prevent binding other PCI drivers to IOMMU PCI devices"). Prior to the commit, no driver could bind to AMD IOMMUs. The reason for the message is that an MSI is requested early on for the AMD IOMMU, which results in a call from msi_sysfs_create_group() to devm_device_add_group(). A devres resource is thus attached to the driver-less AMD IOMMU, which is normally not allowed, but presumably cannot be avoided because requesting the MSI from a regular PCI driver might be too late. Avoid the message by once again checking for an AGP Capability *before* binding to an unsupported device. Achieve that by way of the PCI core's dynid functionality. pci_add_dynid() can fail only with -ENOMEM (on allocation failure) or -EINVAL (on bus_to_subsys() failure). It doesn't seem worth the extra code to propagate those error codes out of the for_each_pci_dev() loop, so simply error out with -ENODEV if there was no successful bind attempt. In the -ENOMEM case, a splat is emitted anyway, and the -EINVAL case can never happen because it requires failure of bus_register(&pci_bus_type), in which case there's no driver probing of PCI devices. Hans has voiced a preference to no longer probe unsupported devices by default (i.e. set agp_try_unsupported = 0). In fact, the help text for CONFIG_AGP_AMD64 pretends this to be the default. Alternatively, he proposes probing only devices with PCI_CLASS_BRIDGE_HOST. However these approaches risk regressing users who depend on the existing behavior. Fixes: 3be5fa236649 (Revert "iommu/amd: Prevent binding other PCI drivers to IOMMU PCI devices") Reported-by: Fedor Pchelkin Closes: https://lore.kernel.org/r/wpoivftgshz5b5aovxbkxl6ivvquinukqfvb5z6yi4mv7d25ew@edtzr2p74ckg/ Reported-by: Hans de Goede Closes: https://lore.kernel.org/r/20250625112411.4123-1-hansg@kernel.org/ Tested-by: Hans de Goede Signed-off-by: Lukas Wunner Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/b29e7fbfc6d146f947603d0ebaef44cbd2f0d754.1751468802.git.lukas@wunner.de commit 5fde0fcbd7608dd5f97a5c0c23a316074d6f17f5 Author: Pagadala Yesu Anjaneyulu Date: Wed Jul 9 06:56:39 2025 +0300 wifi: iwlwifi: mask reserved bits in chan_state_active_bitmap Mask the reserved bits as firmware will assert if reserved bits are set. Fixes: ef7ddf4e2f94 ("wifi: iwlwifi: Add support for LARI_CONFIG_CHANGE_CMD v12") Signed-off-by: Pagadala Yesu Anjaneyulu Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709065608.7a72c70bdc9d.Ic9be0a3fc3aabde0c4b88568f3bb7b76e375f8d4@changeid commit 3c78f91e82d65d8927dc7976636bc5fae666370a Merge: 78b7920a03351a 9dfe110cc0f6ef Author: Jakub Kicinski Date: Tue Jul 8 18:12:55 2025 -0700 Merge branch 'net-phy-smsc-robustness-fixes-for-lan87xx-lan9500' Oleksij Rempel says: ==================== net: phy: smsc: robustness fixes for LAN87xx/LAN9500 The SMSC 10/100 PHYs (LAN87xx family) found in smsc95xx (lan95xx) USB-Ethernet adapters show several quirks around the Auto-MDIX feature: - A hardware strap (AUTOMDIX_EN) may boot the PHY in fixed-MDI mode, and the current driver cannot always override it. - When Auto-MDIX is left enabled while autonegotiation is forced off, the PHY endlessly swaps the TX/RX pairs and never links up. - The driver sets the enable bit for Auto-MDIX but forgets the override bit, so userspace requests are silently ignored. - Rapid configuration changes can wedge the link if PHY IRQs are enabled. The four patches below make the MDIX state fully predictable and prevent link failures in every tested strap / autoneg / MDI-X permutation. Tested on LAN9512 Eval board. ==================== Link: https://patch.msgid.link/20250703114941.3243890-1-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 9dfe110cc0f6ef42af8e81ce52aef34a647d0b8a Author: Oleksij Rempel Date: Thu Jul 3 13:49:41 2025 +0200 net: phy: smsc: Fix link failure in forced mode with Auto-MDIX Force a fixed MDI-X mode when auto-negotiation is disabled to prevent link instability. When forcing the link speed and duplex on a LAN9500 PHY (e.g., with `ethtool -s eth0 autoneg off ...`) while leaving MDI-X control in auto mode, the PHY fails to establish a stable link. This occurs because the PHY's Auto-MDIX algorithm is not designed to operate when auto-negotiation is disabled. In this state, the PHY continuously toggles the TX/RX signal pairs, which prevents the link partner from synchronizing. This patch resolves the issue by detecting when auto-negotiation is disabled. If the MDI-X control mode is set to 'auto', the driver now forces a specific, stable mode (ETH_TP_MDI) to prevent the pair toggling. This choice of a fixed MDI mode mirrors the behavior the hardware would exhibit if the AUTOMDIX_EN strap were configured for a fixed MDI connection. Fixes: 05b35e7eb9a1 ("smsc95xx: add phylib support") Signed-off-by: Oleksij Rempel Cc: Andre Edich Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250703114941.3243890-4-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 0713e55533c88a20edb53eea6517dc56786a0078 Author: Oleksij Rempel Date: Thu Jul 3 13:49:40 2025 +0200 net: phy: smsc: Force predictable MDI-X state on LAN87xx Override the hardware strap configuration for MDI-X mode to ensure a predictable initial state for the driver. The initial mode of the LAN87xx PHY is determined by the AUTOMDIX_EN strap pin, but the driver has no documented way to read its latched status. This unpredictability means the driver cannot know if the PHY has initialized with Auto-MDIX enabled or disabled, preventing it from providing a reliable interface to the user. This patch introduces a `config_init` hook that forces the PHY into a known state by explicitly enabling Auto-MDIX. Fixes: 05b35e7eb9a1 ("smsc95xx: add phylib support") Signed-off-by: Oleksij Rempel Cc: Andre Edich Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250703114941.3243890-3-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit a141af8eb2272ab0f677a7f2653874840bc9b214 Author: Oleksij Rempel Date: Thu Jul 3 13:49:39 2025 +0200 net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap Correct the Auto-MDIX configuration to ensure userspace settings are respected when the feature is disabled by the AUTOMDIX_EN hardware strap. The LAN9500 PHY allows its default MDI-X mode to be configured via a hardware strap. If this strap sets the default to "MDI-X off", the driver was previously unable to enable Auto-MDIX from userspace. When handling the ETH_TP_MDI_AUTO case, the driver would set the SPECIAL_CTRL_STS_AMDIX_ENABLE_ bit but neglected to set the required SPECIAL_CTRL_STS_OVRRD_AMDIX_ bit. Without the override flag, the PHY falls back to its hardware strap default, ignoring the software request. This patch corrects the behavior by also setting the override bit when enabling Auto-MDIX. This ensures that the userspace configuration takes precedence over the hardware strap, allowing Auto-MDIX to be enabled correctly in all scenarios. Fixes: 05b35e7eb9a1 ("smsc95xx: add phylib support") Signed-off-by: Oleksij Rempel Cc: Andre Edich Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20250703114941.3243890-2-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 78b7920a03351a8402de2f81914c1d2e2bdf24b7 Author: EricChan Date: Thu Jul 3 10:04:49 2025 +0800 net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 According to the Synopsys Controller IP XGMAC-10G Ethernet MAC Databook v3.30a (section 2.7.2), when the INTM bit in the DMA_Mode register is set to 2, the sbd_perch_tx_intr_o[] and sbd_perch_rx_intr_o[] signals operate in level-triggered mode. However, in this configuration, the DMA does not assert the XGMAC_NIS status bit for Rx or Tx interrupt events. This creates a functional regression where the condition if (likely(intr_status & XGMAC_NIS)) in dwxgmac2_dma_interrupt() will never evaluate to true, preventing proper interrupt handling for level-triggered mode. The hardware specification explicitly states that "The DMA does not assert the NIS status bit for the Rx or Tx interrupt events" (Synopsys DWC_XGMAC2 Databook v3.30a, sec. 2.7.2). The fix ensures correct handling of both edge and level-triggered interrupts while maintaining backward compatibility with existing configurations. It has been tested on the hardware device (not publicly available), and it can properly trigger the RX and TX interrupt handling in both the INTM=0 and INTM=2 configurations. Fixes: d6ddfacd95c7 ("net: stmmac: Add DMA related callbacks for XGMAC2") Tested-by: EricChan Signed-off-by: EricChan Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250703020449.105730-1-chenchuangyu@xiaomi.com Signed-off-by: Jakub Kicinski commit 733923397fd95405a48f165c9b1fbc8c4b0a4681 Merge: 72782127388d96 505b730ede7f5c Author: Linus Torvalds Date: Tue Jul 8 13:31:29 2025 -0700 Merge tag 'pwm/for-6.16-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux Pull pwm fixes from Uwe Kleine-König: "Two fixes for v6.16-rc6 The first patch fixes an embarrassing bug in the pwm core. I really wonder this wasn't found earlier since it's introduction in v6.11-rc1 as it greatly disturbs driving a PWM via sysfs. The second and last patch fixes a clock balance issue in an error path of the Mediatek PWM driver" * tag 'pwm/for-6.16-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux: pwm: mediatek: Ensure to disable clocks in error path pwm: Fix invalid state detection commit 72782127388d96e971f0186996a5bd44e64a1665 Merge: 2dbae28a1d2639 af1ccf546e5f29 Author: Linus Torvalds Date: Tue Jul 8 13:10:32 2025 -0700 Merge tag 'modules-6.16-rc6.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux Pull modules fixes from Daniel Gomez: "This includes two fixes: one introduced in the current release cycle and another introduced back in v6.4-rc1. Additionally, as Petr and Luis mentioned in previous pull requests, add myself (Daniel Gomez) to the list of modules maintainers. The first was reported by Intel's kernel test robot, and it addresses a crash exposed by Sebastian's commit c50d295c37f2 ("rds: Use nested-BH locking for rds_page_remainder") by allowing relocations for the per-CPU section even if it lacks the SHF_ALLOC flag. Petr and Sebastian went down to the archive history (before Git) and found the commit that broke it at [1] / [2] ("Don't relocate non-allocated regions in modules."). The second fix, reported and fixed by Petr (with additional cleanup), resolves a memory leak by ensuring proper deallocation if module loading fails. We couldn't find a reproducer other than forcing it manually or leveraging eBPF. So, I tested it by enabling error injection in the codetag functions through the error path that produces the leak and made it fail until execmem is unable to allocate more memory" Link: https://git.kernel.org/pub/scm/linux/kernel/git/mpe/linux-fullhistory.git/commit/?id=b3b91325f3c7 [1] Link: https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git/commit/?id=1a6100caae [2] * tag 'modules-6.16-rc6.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux: MAINTAINERS: update Daniel Gomez's role and email address module: Make sure relocations are applied to the per-CPU section module: Avoid unnecessary return value initialization in move_module() module: Fix memory deallocation on error path in move_module() commit 31ec70afaaad11fb08970bd1b0dc9ebae3501e16 Author: David Howells Date: Mon Jul 7 11:24:33 2025 +0100 rxrpc: Fix over large frame size warning Under some circumstances, the compiler will emit the following warning for rxrpc_send_response(): net/rxrpc/output.c: In function 'rxrpc_send_response': net/rxrpc/output.c:974:1: warning: the frame size of 1160 bytes is larger than 1024 bytes This occurs because the local variables include a 16-element scatterlist array and a 16-element bio_vec array. It's probably not actually a problem as this function is only called by the rxrpc I/O thread function in a kernel thread and there won't be much on the stack before it. Fix this by overlaying the bio_vec array over the kvec array in the rxrpc_local struct. There is one of these per I/O thread and the kvec array is intended for pointing at bits of a packet to be transmitted, typically a DATA or an ACK packet. As packets for a local endpoint are only transmitted by its specific I/O thread, there can be no race, and so overlaying this bit of memory should be no problem. Fixes: 5800b1cf3fd8 ("rxrpc: Allow CHALLENGEs to the passed to the app for a RESPONSE") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506240423.E942yKJP-lkp@intel.com/ Signed-off-by: David Howells cc: Marc Dionne cc: Simon Horman cc: linux-afs@lists.infradead.org Link: https://patch.msgid.link/20250707102435.2381045-2-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit a74bb5f202dabddfea96abc1328fcedae8aa140a Author: Mikhail Paulyshka Date: Tue Jul 8 16:39:10 2025 +0200 x86/CPU/AMD: Disable INVLPGB on Zen2 AMD Cyan Skillfish (Family 17h, Model 47h, Stepping 0h) has an issue that causes system oopses and panics when performing TLB flush using INVLPGB. However, the problem is that that machine has misconfigured CPUID and should not report the INVLPGB bit in the first place. So zap the kernel's representation of the flag so that nothing gets confused. [ bp: Massage. ] Fixes: 767ae437a32d ("x86/mm: Add INVLPGB feature and Kconfig entry") Signed-off-by: Mikhail Paulyshka Signed-off-by: Borislav Petkov (AMD) Cc: Link: https://lore.kernel.org/r/1ebe845b-322b-4929-9093-b41074e9e939@mixaill.net commit 5b937a1ed64ebeba8876e398110a5790ad77407c Author: Mikhail Paulyshka Date: Sat May 24 17:53:19 2025 +0300 x86/rdrand: Disable RDSEED on AMD Cyan Skillfish AMD Cyan Skillfish (Family 17h, Model 47h, Stepping 0h) has an error that causes RDSEED to always return 0xffffffff, while RDRAND works correctly. Mask the RDSEED cap for this CPU so that both /proc/cpuinfo and direct CPUID read report RDSEED as unavailable. [ bp: Move to amd.c, massage. ] Signed-off-by: Mikhail Paulyshka Signed-off-by: Borislav Petkov (AMD) Cc: Link: https://lore.kernel.org/20250524145319.209075-1-me@mixaill.net commit fec5e6f97dae5fbd628c444148b77728eae3bb93 Author: Kent Overstreet Date: Tue Jul 8 15:21:39 2025 -0400 bcachefs: Don't set BCH_FS_error on transaction restart This started showing up more when we started logging the error being corrected in the journal - but __bch2_fsck_err() could return transaction restarts before that. Setting BCH_FS_error incorrectly causes recovery passes to not be cleared, among other issues. Fixes: b43f72492768 ("bcachefs: Log fsck errors in the journal") Signed-off-by: Kent Overstreet commit 2dbae28a1d263902d647822937f9c42090c4adcc Merge: a3b5b88ea9bc9d 1afc85deecd32f Author: Linus Torvalds Date: Tue Jul 8 12:22:16 2025 -0700 Merge tag 'bitmap-for-6.16-rc6' of https://github.com/norov/linux Pull bitops UAPI fix from Yury Norov: "Fix BITS_PER_LONG merge error Tomas' fix for __BITS_PER_LONG was effectively reverted by a wrong merge. Fix it and add the related files to MAINTAINERS" * tag 'bitmap-for-6.16-rc6' of https://github.com/norov/linux: MAINTAINERS: bitmap: add UAPI headers uapi: bitops: use UAPI-safe variant of BITS_PER_LONG again (2) commit af1ccf546e5f2915fbbde26841db43a971d81cf3 Author: Daniel Gomez Date: Fri Jul 4 21:39:59 2025 +0200 MAINTAINERS: update Daniel Gomez's role and email address Update Daniel Gomez's modules reviewer role to maintainer. This is according to the plan [1][2][3] of scaling with more reviewers for modules (for the incoming Rust support [4]) and rotate [5] every 6 months. Acked-by: Luis Chamberlain Link: https://lore.kernel.org/linux-modules/ZsPANzx4-5DrOl5m@bombadil.infradead.org [1] Link: https://lore.kernel.org/linux-modules/20240821174021.2371547-1-mcgrof@kernel.org [2] Link: https://lore.kernel.org/linux-modules/458901be-1da8-4987-9c72-5aa3da6db15e@suse.com [3] Link: https://lore.kernel.org/linux-modules/20250702-module-params-v3-v14-0-5b1cc32311af@kernel.org [4] Link: https://lore.kernel.org/linux-modules/Z3gDAnPlA3SZEbgl@bombadil.infradead.org [5] Acked-by: Petr Pavlu Signed-off-by: Daniel Gomez commit 570db4b39f535a8bb722adb8be0280d09e34ca99 Author: Sebastian Andrzej Siewior Date: Tue Jun 10 18:33:28 2025 +0200 module: Make sure relocations are applied to the per-CPU section The per-CPU data section is handled differently than the other sections. The memory allocations requires a special __percpu pointer and then the section is copied into the view of each CPU. Therefore the SHF_ALLOC flag is removed to ensure move_module() skips it. Later, relocations are applied and apply_relocations() skips sections without SHF_ALLOC because they have not been copied. This also skips the per-CPU data section. The missing relocations result in a NULL pointer on x86-64 and very small values on x86-32. This results in a crash because it is not skipped like NULL pointer would and can't be dereferenced. Such an assignment happens during static per-CPU lock initialisation with lockdep enabled. Allow relocation processing for the per-CPU section even if SHF_ALLOC is missing. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202506041623.e45e4f7d-lkp@intel.com Fixes: 1a6100caae425 ("Don't relocate non-allocated regions in modules.") #v2.6.1-rc3 Signed-off-by: Sebastian Andrzej Siewior Reviewed-by: Petr Pavlu Link: https://lore.kernel.org/r/20250610163328.URcsSUC1@linutronix.de Signed-off-by: Daniel Gomez Message-ID: <20250610163328.URcsSUC1@linutronix.de> commit eb0994a954978f0edd3efb38d0cbe6744df8b83d Author: Petr Pavlu Date: Wed Jun 18 14:26:27 2025 +0200 module: Avoid unnecessary return value initialization in move_module() All error conditions in move_module() set the return value by updating the ret variable. Therefore, it is not necessary to the initialize the variable when declaring it. Remove the unnecessary initialization. Signed-off-by: Petr Pavlu Reviewed-by: Sami Tolvanen Reviewed-by: Daniel Gomez Link: https://lore.kernel.org/r/20250618122730.51324-3-petr.pavlu@suse.com Signed-off-by: Daniel Gomez Message-ID: <20250618122730.51324-3-petr.pavlu@suse.com> commit ca3881f6fd8e9b6eb2d51e8718d07d3b8029d886 Author: Petr Pavlu Date: Wed Jun 18 14:26:26 2025 +0200 module: Fix memory deallocation on error path in move_module() The function move_module() uses the variable t to track how many memory types it has allocated and consequently how many should be freed if an error occurs. The variable is initially set to 0 and is updated when a call to module_memory_alloc() fails. However, move_module() can fail for other reasons as well, in which case t remains set to 0 and no memory is freed. Fix the problem by initializing t to MOD_MEM_NUM_TYPES. Additionally, make the deallocation loop more robust by not relying on the mod_mem_type_t enum having a signed integer as its underlying type. Fixes: c7ee8aebf6c0 ("module: add stop-grap sanity check on module memcpy()") Signed-off-by: Petr Pavlu Reviewed-by: Sami Tolvanen Reviewed-by: Daniel Gomez Link: https://lore.kernel.org/r/20250618122730.51324-2-petr.pavlu@suse.com Signed-off-by: Daniel Gomez Message-ID: <20250618122730.51324-2-petr.pavlu@suse.com> commit a3b5b88ea9bc9da00bd89d94738bf7181b2516f7 Merge: d006330be3f782 68279380266a5f Author: Linus Torvalds Date: Tue Jul 8 11:50:27 2025 -0700 Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library fix from Eric Biggers: "Fix an uninitialized variable in the s390 optimized SHA-1 and SHA-2. Note that my librarification changes also fix this by greatly simplifying how the s390 optimized SHA code is integrated. However, we need this separate fix for 6.16 and older versions" * tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 commit 9dff55ebaef7e94e5dedb6be28a1cafff65cc467 Author: Jens Axboe Date: Tue Jul 8 11:04:45 2025 -0600 Revert "io_uring: gate REQ_F_ISREG on !S_ANON_INODE as well" This reverts commit 6f11adcc6f36ffd8f33dbdf5f5ce073368975bc3. The problematic commit was fixed in mainline, so the work-around in io_uring can be removed at this point. Anonymous inodes no longer pretend to be regular files after: 1e7ab6f67824 ("anon_inode: rework assertions") Signed-off-by: Jens Axboe commit fc582cd26e888b0652bc1494f252329453fd3b23 Author: Jens Axboe Date: Tue Jul 8 11:00:32 2025 -0600 io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU syzbot reports that defer/local task_work adding via msg_ring can hit a request that has been freed: CPU: 1 UID: 0 PID: 19356 Comm: iou-wrk-19354 Not tainted 6.16.0-rc4-syzkaller-00108-g17bbde2e1716 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xd2/0x2b0 mm/kasan/report.c:521 kasan_report+0x118/0x150 mm/kasan/report.c:634 io_req_local_work_add io_uring/io_uring.c:1184 [inline] __io_req_task_work_add+0x589/0x950 io_uring/io_uring.c:1252 io_msg_remote_post io_uring/msg_ring.c:103 [inline] io_msg_data_remote io_uring/msg_ring.c:133 [inline] __io_msg_ring_data+0x820/0xaa0 io_uring/msg_ring.c:151 io_msg_ring_data io_uring/msg_ring.c:173 [inline] io_msg_ring+0x134/0xa00 io_uring/msg_ring.c:314 __io_issue_sqe+0x17e/0x4b0 io_uring/io_uring.c:1739 io_issue_sqe+0x165/0xfd0 io_uring/io_uring.c:1762 io_wq_submit_work+0x6e9/0xb90 io_uring/io_uring.c:1874 io_worker_handle_work+0x7cd/0x1180 io_uring/io-wq.c:642 io_wq_worker+0x42f/0xeb0 io_uring/io-wq.c:696 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 which is supposed to be safe with how requests are allocated. But msg ring requests alloc and free on their own, and hence must defer freeing to a sane time. Add an rcu_head and use kfree_rcu() in both spots where requests are freed. Only the one in io_msg_tw_complete() is strictly required as it has been visible on the other ring, but use it consistently in the other spot as well. This should not cause any other issues outside of KASAN rightfully complaining about it. Link: https://lore.kernel.org/io-uring/686cd2ea.a00a0220.338033.0007.GAE@google.com/ Reported-by: syzbot+54cbbfb4db9145d26fc2@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Fixes: 0617bb500bfa ("io_uring/msg_ring: improve handling of target CQE posting") Signed-off-by: Jens Axboe commit 50f930db22365738d9387c974416f38a06e8057e Author: Namjae Jeon Date: Tue Jul 8 07:47:40 2025 +0900 ksmbd: fix potential use-after-free in oplock/lease break ack If ksmbd_iov_pin_rsp return error, use-after-free can happen by accessing opinfo->state and opinfo_put and ksmbd_fd_put could called twice. Reported-by: Ziyan Xu Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 277627b431a0a6401635c416a21b2a0f77a77347 Author: Al Viro Date: Sun Jul 6 02:26:45 2025 +0100 ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() If the call of ksmbd_vfs_lock_parent() fails, we drop the parent_path references and return an error. We need to drop the write access we just got on parent_path->mnt before we drop the mount reference - callers assume that ksmbd_vfs_kern_path_locked() returns with mount write access grabbed if and only if it has returned 0. Fixes: 864fb5d37163 ("ksmbd: fix possible deadlock in smb2_open") Signed-off-by: Al Viro Acked-by: Namjae Jeon Signed-off-by: Steve French commit 0c2b53997e8f5e2ec9e0fbd17ac0436466b65488 Author: Stefan Metzmacher Date: Wed Jul 2 09:18:05 2025 +0200 smb: server: make use of rdma_destroy_qp() The qp is created by rdma_create_qp() as t->cm_id->qp and t->qp is just a shortcut. rdma_destroy_qp() also calls ib_destroy_qp(cm_id->qp) internally, but it is protected by a mutex, clears the cm_id and also calls trace_cm_qp_destroy(). This should make the tracing more useful as both rdma_create_qp() and rdma_destroy_qp() are traces and it makes the code look more sane as functions from the same layer are used for the specific qp object. trace-cmd stream -e rdma_cma:cm_qp_create -e rdma_cma:cm_qp_destroy shows this now while doing a mount and unmount from a client: <...>-80 [002] 378.514182: cm_qp_create: cm.id=1 src=172.31.9.167:5445 dst=172.31.9.166:37113 tos=0 pd.id=0 qp_type=RC send_wr=867 recv_wr=255 qp_num=1 rc=0 <...>-6283 [001] 381.686172: cm_qp_destroy: cm.id=1 src=172.31.9.167:5445 dst=172.31.9.166:37113 tos=0 qp_num=1 Before we only saw the first line. Cc: Namjae Jeon Cc: Steve French Cc: Sergey Senozhatsky Cc: Hyunchul Lee Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") Signed-off-by: Stefan Metzmacher Reviewed-by: Tom Talpey Acked-by: Namjae Jeon Signed-off-by: Steve French commit a46b4822bed08d15a856966357a4b12273751cd3 Author: Chen-Yu Tsai Date: Sat Jun 28 13:44:38 2025 +0800 arm64: dts: allwinner: a523: Rename emac0 to gmac0 The datasheets refer to the first Ethernet controller as GMAC0, not EMAC0. Fix the compatible string, node label and pinmux function name to match what the datasheets use. A change to the device tree binding is sent separately. Fixes: 56766ca6c4f6 ("arm64: dts: allwinner: a523: Add EMAC0 ethernet MAC") Fixes: acca163f3f51 ("arm64: dts: allwinner: a527: add EMAC0 to Radxa A5E board") Fixes: c6800f15998b ("arm64: dts: allwinner: t527: add EMAC0 to Avaota-A1 board") Link: https://patch.msgid.link/20250628054438.2864220-3-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit 3ef07434c7dbfba302df477bb6c70e082965f232 Author: Christophe JAILLET Date: Sat Jul 5 10:34:32 2025 +0200 net: airoha: Fix an error handling path in airoha_probe() If an error occurs after a successful airoha_hw_init() call, airoha_ppe_deinit() needs to be called as already done in the remove function. Fixes: 00a7678310fe ("net: airoha: Introduce flowtable offload support") Signed-off-by: Christophe JAILLET Reviewed-by: Simon Horman Acked-by: Lorenzo Bianconi Link: https://patch.msgid.link/1c940851b4fa3c3ed2a142910c821493a136f121.1746715755.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jakub Kicinski commit d006330be3f782ff3fb7c3ed51e617e01f29a465 Merge: eadb9fa7f775e3 d78f76457d70d3 Author: Linus Torvalds Date: Tue Jul 8 08:55:18 2025 -0700 Merge tag 'sound-6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Here are device-specific small fixes, including HD-audio, USB-audio and ASoC Intel quirks, as well as ASoC fsl, Cirrus codec and the legacy AD driver fixes. All look safe and easy" * tag 'sound-6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/realtek: Enable headset Mic on Positivo K116J ALSA: hda/tas2781: Fix calibration data parser issue ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() ASoC: cs35l56: probe() should fail if the device ID is not recognized ALSA: hda/realtek: Add quirk for ASUS ExpertBook B9403CVAR ASoC: Intel: sof_sdw: Add quirks for Lenovo P1 and P16 ALSA: usb-audio: Improve filtering of sample rates on Focusrite devices ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches MAINTAINERS: update Qualcomm audio codec drivers list ASoC: fsl_sai: Force a software reset when starting in consumer mode ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode ALSA: hda/realtek - Add mute LED support for HP Victus 15-fb2xxx ALSA: hda: Add missing NVIDIA HDA codec IDs commit 40c47232772e45385757e8c979d8871895c78823 Merge: 95a234f6affbf5 1e7d9df379a04c Author: Jakub Kicinski Date: Tue Jul 8 08:39:53 2025 -0700 Merge branch 'vsock-fix-transport_-h2g-g2h-dgram-local-toctou-issues' Michal Luczaj says: ==================== vsock: Fix transport_{h2g,g2h,dgram,local} TOCTOU issues transport_{h2g,g2h,dgram,local} may become NULL on vsock_core_unregister(). Make sure a poorly timed `rmmod transport` won't lead to a NULL/stale pointer dereference. Note that these oopses are pretty unlikely to happen in the wild. Splats were collected after sprinkling kernel with mdelay()s. v3: https://lore.kernel.org/20250702-vsock-transports-toctou-v3-0-0a7e2e692987@rbox.co v2: https://lore.kernel.org/20250620-vsock-transports-toctou-v2-0-02ebd20b1d03@rbox.co v1: https://lore.kernel.org/20250618-vsock-transports-toctou-v1-0-dd2d2ede9052@rbox.co ==================== Link: https://patch.msgid.link/20250703-vsock-transports-toctou-v4-0-98f0eb530747@rbox.co Signed-off-by: Jakub Kicinski commit 1e7d9df379a04ccd0c2f82f39fbb69d482e864cc Author: Michal Luczaj Date: Thu Jul 3 17:18:20 2025 +0200 vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` Support returning VMADDR_CID_LOCAL in case no other vsock transport is available. Fixes: 0e12190578d0 ("vsock: add local transport support in the vsock core") Suggested-by: Stefano Garzarella Reviewed-by: Stefano Garzarella Signed-off-by: Michal Luczaj Link: https://patch.msgid.link/20250703-vsock-transports-toctou-v4-3-98f0eb530747@rbox.co Signed-off-by: Jakub Kicinski commit 687aa0c5581b8d4aa87fd92973e4ee576b550cdf Author: Michal Luczaj Date: Thu Jul 3 17:18:19 2025 +0200 vsock: Fix transport_* TOCTOU Transport assignment may race with module unload. Protect new_transport from becoming a stale pointer. This also takes care of an insecure call in vsock_use_local_transport(); add a lockdep assert. BUG: unable to handle page fault for address: fffffbfff8056000 Oops: Oops: 0000 [#1] SMP KASAN RIP: 0010:vsock_assign_transport+0x366/0x600 Call Trace: vsock_connect+0x59c/0xc40 __sys_connect+0xe8/0x100 __x64_sys_connect+0x6e/0xc0 do_syscall_64+0x92/0x1c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Fixes: c0cfa2d8a788 ("vsock: add multi-transports support") Reviewed-by: Stefano Garzarella Signed-off-by: Michal Luczaj Link: https://patch.msgid.link/20250703-vsock-transports-toctou-v4-2-98f0eb530747@rbox.co Signed-off-by: Jakub Kicinski commit 209fd720838aaf1420416494c5505096478156b4 Author: Michal Luczaj Date: Thu Jul 3 17:18:18 2025 +0200 vsock: Fix transport_{g2h,h2g} TOCTOU vsock_find_cid() and vsock_dev_do_ioctl() may race with module unload. transport_{g2h,h2g} may become NULL after the NULL check. Introduce vsock_transport_local_cid() to protect from a potential null-ptr-deref. KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f] RIP: 0010:vsock_find_cid+0x47/0x90 Call Trace: __vsock_bind+0x4b2/0x720 vsock_bind+0x90/0xe0 __sys_bind+0x14d/0x1e0 __x64_sys_bind+0x6e/0xc0 do_syscall_64+0x92/0x1c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f] RIP: 0010:vsock_dev_do_ioctl.isra.0+0x58/0xf0 Call Trace: __x64_sys_ioctl+0x12d/0x190 do_syscall_64+0x92/0x1c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Fixes: c0cfa2d8a788 ("vsock: add multi-transports support") Suggested-by: Stefano Garzarella Reviewed-by: Stefano Garzarella Signed-off-by: Michal Luczaj Link: https://patch.msgid.link/20250703-vsock-transports-toctou-v4-1-98f0eb530747@rbox.co Signed-off-by: Jakub Kicinski commit 95a234f6affbf51f06338383537ab80d637bb785 Author: Haoxiang Li Date: Thu Jul 3 18:01:09 2025 +0800 net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() Add check for the return value of rcar_gen4_ptp_alloc() to prevent potential null pointer dereference. Fixes: b0d3969d2b4d ("net: ethernet: rtsn: Add support for Renesas Ethernet-TSN") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li Reviewed-by: Niklas Söderlund Link: https://patch.msgid.link/20250703100109.2541018-1-haoxiang_li2024@163.com Signed-off-by: Jakub Kicinski commit 462da827c6e2be59c7b0981ed39fff7a9488d013 Merge: d3a5f2871adc0c b3603c0466a85b Author: Jakub Kicinski Date: Tue Jul 8 08:02:52 2025 -0700 Merge branch 'allwinner-a523-rename-emac0-to-gmac0' Chen-Yu Tsai says: ==================== allwinner: a523: Rename emac0 to gmac0 This small series aims to align the name of the first ethernet controller found on the Allwinner A523 SoC family with the name found in the datasheets. It renames the compatible string and any other references from "emac0" to "gmac0". When support of the hardware was introduced, the name chosen was "EMAC", which followed previous generations. However the datasheets use the name "GMAC" instead, likely because there is another "GMAC" based on a newer DWMAC IP. ==================== Link: https://patch.msgid.link/20250628054438.2864220-1-wens@kernel.org Signed-off-by: Jakub Kicinski commit b3603c0466a85bed302e80226950092ceaf09b94 Author: Chen-Yu Tsai Date: Sat Jun 28 13:44:37 2025 +0800 dt-bindings: net: sun8i-emac: Rename A523 EMAC0 to GMAC0 The datasheets refer to the first Ethernet controller as GMAC0, not EMAC0. Rename the compatible string to align with the datasheets. A fix for the device trees will be sent separately. Fixes: 0454b9057e98 ("dt-bindings: net: sun8i-emac: Add A523 EMAC0 compatible") Signed-off-by: Chen-Yu Tsai Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250628054438.2864220-2-wens@kernel.org Signed-off-by: Jakub Kicinski commit d3a5f2871adc0c61c61869f37f3e697d97f03d8c Author: Jiayuan Chen Date: Mon Jul 7 13:41:11 2025 +0800 tcp: Correct signedness in skb remaining space calculation Syzkaller reported a bug [1] where sk->sk_forward_alloc can overflow. When we send data, if an skb exists at the tail of the write queue, the kernel will attempt to append the new data to that skb. However, the code that checks for available space in the skb is flawed: ''' copy = size_goal - skb->len ''' The types of the variables involved are: ''' copy: ssize_t (s64 on 64-bit systems) size_goal: int skb->len: unsigned int ''' Due to C's type promotion rules, the signed size_goal is converted to an unsigned int to match skb->len before the subtraction. The result is an unsigned int. When this unsigned int result is then assigned to the s64 copy variable, it is zero-extended, preserving its non-negative value. Consequently, copy is always >= 0. Assume we are sending 2GB of data and size_goal has been adjusted to a value smaller than skb->len. The subtraction will result in copy holding a very large positive integer. In the subsequent logic, this large value is used to update sk->sk_forward_alloc, which can easily cause it to overflow. The syzkaller reproducer uses TCP_REPAIR to reliably create this condition. However, this can also occur in real-world scenarios. The tcp_bound_to_half_wnd() function can also reduce size_goal to a small value. This would cause the subsequent tcp_wmem_schedule() to set sk->sk_forward_alloc to a value close to INT_MAX. Further memory allocation requests would then cause sk_forward_alloc to wrap around and become negative. [1]: https://syzkaller.appspot.com/bug?extid=de6565462ab540f50e47 Reported-by: syzbot+de6565462ab540f50e47@syzkaller.appspotmail.com Fixes: 270a1c3de47e ("tcp: Support MSG_SPLICE_PAGES") Signed-off-by: Jiayuan Chen Reviewed-by: Eric Dumazet Reviewed-by: David Howells Link: https://patch.msgid.link/20250707054112.101081-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski commit 5383fc057a0ea18e8eb9a0472ea853c24b59ee5e Merge: 7e7a7bf212cfd3 fa787ac07b3ceb Author: Paolo Bonzini Date: Tue Jul 8 10:49:19 2025 -0400 Merge tag 'kvm-x86-fixes-6.16-rcN' of https://github.com/kvm-x86/linux into HEAD KVM x86 fixes for 6.16-rcN - Reject SEV{-ES} intra-host migration if one or more vCPUs are actively being created so as not to create a non-SEV{-ES} vCPU in an SEV{-ES} VM. - Use a pre-allocated, per-vCPU buffer for handling de-sparsified vCPU masks when emulating Hyper-V hypercalls to fix a "stack frame too large" issue. - Allow out-of-range/invalid Xen event channel ports when configuring IRQ routing to avoid dictating a specific ioctl() ordering to userspace. - Conditionally reschedule when setting memory attributes to avoid soft lockups when userspace converts huge swaths of memory to/from private. - Add back MWAIT as a required feature for the MONITOR/MWAIT selftest. - Add a missing field in struct sev_data_snp_launch_start that resulted in the guest-visible workarounds field being filled at the wrong offset. - Skip non-canonical address when processing Hyper-V PV TLB flushes to avoid VM-Fail on INVVPID. - Advertise supported TDX TDVMCALLs to userspace. commit 7e7a7bf212cfd31183bd8e64295607d8e3153a66 Merge: 8aed168bf7e6b4 42ce432522a176 Author: Paolo Bonzini Date: Tue Jul 8 10:48:21 2025 -0400 Merge tag 'kvmarm-fixes-6.16-5' of https://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 6.16, take # - Remove the last leftovers from the ill-fated FPSIMD host state mapping at EL2 stage-1 - Fix unexpected advertisement to the guest of unimplemented S2 base granule sizes commit 8aed168bf7e6b4cbb4b46305f6fe9d8cbd6bd872 Merge: 25e8b1dd4883e6 0e02219f9cf4f0 Author: Paolo Bonzini Date: Tue Jul 8 10:46:40 2025 -0400 Merge tag 'kvmarm-fixes-6.16-4' of https://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 6.16, take #4 - Gracefully fail initialising pKVM if the interrupt controller isn't GICv3 - Also gracefully fail initialising pKVM if the carveout allocation fails - Fix the computing of the minimum MMIO range required for the host on stage-2 fault - Fix the generation of the GICv3 Maintenance Interrupt in nested mode commit 1afc85deecd32ff0f9972b38ecfbddb8be63143e Author: Thomas Weißschuh Date: Mon Jun 30 15:09:35 2025 +0200 MAINTAINERS: bitmap: add UAPI headers The UAPI headers have been split out from the kernel-only headers. They maintained as part of the bitmap library. Signed-off-by: Thomas Weißschuh Signed-off-by: Yury Norov (NVIDIA) commit 70b9c0c11e55167b9552ef395bc00f4920299177 Author: Thomas Weißschuh Date: Mon Jun 30 15:02:18 2025 +0200 uapi: bitops: use UAPI-safe variant of BITS_PER_LONG again (2) BITS_PER_LONG does not exist in UAPI headers, so can't be used by the UAPI __GENMASK(). Instead __BITS_PER_LONG needs to be used. When __GENMASK() was introduced in commit 3c7a8e190bc5 ("uapi: introduce uapi-friendly macros for GENMASK"), the code was fine. A broken revert in 1e7933a575ed ("uapi: Revert "bitops: avoid integer overflow in GENMASK(_ULL)"") introduced the incorrect usage of BITS_PER_LONG. That was fixed in commit 11fcf368506d ("uapi: bitops: use UAPI-safe variant of BITS_PER_LONG again"). But a broken sync of the kernel headers with the tools/ headers in commit fc92099902fb ("tools headers: Synchronize linux/bits.h with the kernel sources") undid the fix. Reapply the fix and while at it also fix the tools header. Fixes: fc92099902fb ("tools headers: Synchronize linux/bits.h with the kernel sources") Signed-off-by: Thomas Weißschuh Acked-by: Yury Norov (NVIDIA) Signed-off-by: Yury Norov (NVIDIA) commit a609bd74b8680dba62c44f7e6d00d381ddb2d3c0 Author: Amadeusz Sławiński Date: Tue Jul 8 12:50:09 2025 +0200 ASoC: Intel: avs: Fix NULL ptr deref on rmmod When uloading snd_soc_avs module there is NULL pointer dereference. It happens, because codec was moved into pdata and avs_component_hda_unregister_dais() was not updated. Fixes: 1581d5c68208 ("ASoC: Intel: avs: boards: Add Kconfig option for obsolete card names") Reviewed-by: Cezary Rojewski Signed-off-by: Amadeusz Sławiński Link: https://patch.msgid.link/20250708105009.1883627-1-amadeuszx.slawinski@linux.intel.com Signed-off-by: Mark Brown commit 9b027aa3e8c44ea826fab1928f5d02a186ff1536 Author: Christoph Hellwig Date: Fri May 23 14:31:28 2025 +0200 xfs: remove the bt_bdev_file buftarg field And use bt_file for both bdev and shmem backed buftargs. Signed-off-by: Christoph Hellwig Reviewed-by: John Garry Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 988a16827582dfb9256d22f74cb363f41f090c90 Author: Christoph Hellwig Date: Mon Jul 7 14:53:16 2025 +0200 xfs: rename the bt_bdev_* buftarg fields The extra bdev_ is weird, so drop it. Also improve the comment to make it clear these are the hardware limits. Signed-off-by: Christoph Hellwig Reviewed-by: John Garry Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit e4a7a3f9b24336059c782eaa7ed5ef88a614a1cf Author: Christoph Hellwig Date: Mon Jul 7 14:53:15 2025 +0200 xfs: refactor xfs_calc_atomic_write_unit_max This function and the helpers used by it duplicate the same logic for AGs and RTGs. Use the xfs_group_type enum to unify both variants. Signed-off-by: Christoph Hellwig Reviewed-by: John Garry Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit e74d1fa6a7d738c009a1dc7d739e64000c0d3d33 Author: Christoph Hellwig Date: Mon Jul 7 14:53:14 2025 +0200 xfs: add a xfs_group_type_buftarg helper Generalize the xfs_group_type helper in the discard code to return a buftarg and move it to xfs_mount.h, and use the result in xfs_dax_notify_dev_failure. Signed-off-by: Christoph Hellwig Reviewed-by: John Garry Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit d9b1e348cff7ed13e30886de7a72e1fa0e235863 Author: Christoph Hellwig Date: Mon Jul 7 14:53:13 2025 +0200 xfs: remove the call to sync_blockdev in xfs_configure_buftarg This extra call is not needed as xfs_alloc_buftarg already calls sync_blockdev. Signed-off-by: Christoph Hellwig Reviewed-by: John Garry Signed-off-by: Carlos Maiolino commit a578a8efa707cc99c22960e86e5b9eaeeda97c5e Author: Christoph Hellwig Date: Mon Jul 7 14:53:12 2025 +0200 xfs: clean up the initial read logic in xfs_readsb The initial sb read is always for a device logical block size buffer. The device logical block size is provided in the bt_logical_sectorsize in struct buftarg, so use that instead of the confusingly named xfs_getsize_buftarg buffer that reads it from the bdev. Update the comments surrounding the code to better describe what is going on. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 2a198bbec6913ae1c90ec963750003c6213668c7 Author: Sabrina Dubroca Date: Fri Jul 4 16:54:34 2025 +0200 Revert "xfrm: destroy xfrm_state synchronously on net exit path" This reverts commit f75a2804da391571563c4b6b29e7797787332673. With all states (whether user or kern) removed from the hashtables during deletion, there's no need for synchronous destruction of states. xfrm6_tunnel states still need to have been destroyed (which will be the case when its last user is deleted (not destroyed)) so that xfrm6_tunnel_free_spi removes it from the per-netns hashtable before the netns is destroyed. This has the benefit of skipping one synchronize_rcu per state (in __xfrm_state_destroy(sync=true)) when we exit a netns. Signed-off-by: Sabrina Dubroca Signed-off-by: Steffen Klassert commit b441cf3f8c4b8576639d20c8eb4aa32917602ecd Author: Sabrina Dubroca Date: Fri Jul 4 16:54:33 2025 +0200 xfrm: delete x->tunnel as we delete x The ipcomp fallback tunnels currently get deleted (from the various lists and hashtables) as the last user state that needed that fallback is destroyed (not deleted). If a reference to that user state still exists, the fallback state will remain on the hashtables/lists, triggering the WARN in xfrm_state_fini. Because of those remaining references, the fix in commit f75a2804da39 ("xfrm: destroy xfrm_state synchronously on net exit path") is not complete. We recently fixed one such situation in TCP due to defered freeing of skbs (commit 9b6412e6979f ("tcp: drop secpath at the same time as we currently drop dst")). This can also happen due to IP reassembly: skbs with a secpath remain on the reassembly queue until netns destruction. If we can't guarantee that the queues are flushed by the time xfrm_state_fini runs, there may still be references to a (user) xfrm_state, preventing the timely deletion of the corresponding fallback state. Instead of chasing each instance of skbs holding a secpath one by one, this patch fixes the issue directly within xfrm, by deleting the fallback state as soon as the last user state depending on it has been deleted. Destruction will still happen when the final reference is dropped. A separate lockdep class for the fallback state is required since we're going to lock x->tunnel while x is locked. Fixes: 9d4139c76905 ("netns xfrm: per-netns xfrm_state_all list") Signed-off-by: Sabrina Dubroca Signed-off-by: Steffen Klassert commit e10981075adce203eac0be866389309eeb8ef11e Author: Rong Zhang Date: Tue Jul 8 00:38:07 2025 +0800 platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots On some models supported by ideapad-laptop, the HW/FW can remember the state of keyboard backlight among boots. However, it is always turned off while shutting down, as a side effect of the LED class device unregistering sequence. This is inconvenient for users who always prefer turning on the keyboard backlight. Thus, set LED_RETAIN_AT_SHUTDOWN on the LED class device so that the state of keyboard backlight gets remembered, which also aligns with the behavior of manufacturer utilities on Windows. Fixes: 503325f84bc0 ("platform/x86: ideapad-laptop: add keyboard backlight control support") Cc: stable@vger.kernel.org Signed-off-by: Rong Zhang Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250707163808.155876-3-i@rong.moe Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 9533b789df7e8d273543a5991aec92447be043d7 Author: Rong Zhang Date: Tue Jul 8 00:38:06 2025 +0800 platform/x86: ideapad-laptop: Fix FnLock not remembered among boots On devices supported by ideapad-laptop, the HW/FW can remember the FnLock state among boots. However, since the introduction of the FnLock LED class device, it is turned off while shutting down, as a side effect of the LED class device unregistering sequence. Many users always turn on FnLock because they use function keys much more frequently than multimedia keys. The behavior change is inconvenient for them. Thus, set LED_RETAIN_AT_SHUTDOWN on the LED class device so that the FnLock state gets remembered, which also aligns with the behavior of manufacturer utilities on Windows. Fixes: 07f48f668fac ("platform/x86: ideapad-laptop: add FnLock LED class device") Cc: stable@vger.kernel.org Signed-off-by: Rong Zhang Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250707163808.155876-2-i@rong.moe Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit f2eb2796b95118b877b63d9fcd3459e70494a498 Author: Pranav Tyagi Date: Tue Jun 17 18:44:46 2025 +0530 xfs: replace strncpy with memcpy in xattr listing Use memcpy() in place of strncpy() in __xfs_xattr_put_listent(). The length is known and a null byte is added manually. No functional change intended. Signed-off-by: Pranav Tyagi Reviewed-by: Darrick J. Wong Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit 5300e5e24b8122ba3f60ce455e968379434f322e Merge: 737bb912ebbe45 eb8352ee2d1e70 Author: Johannes Berg Date: Tue Jul 8 09:22:40 2025 +0200 Merge tag 'mt76-fixes-2025-07-07' of https://github.com/nbd168/wireless Felix Fietkau says: =================== mt76 fixes for 6.16 =================== Signed-off-by: Johannes Berg commit fee58ca135a7b979c8b75e6d2eac60d695f9209b Author: Matthew Auld Date: Tue Jul 1 11:39:50 2025 +0100 drm/xe/bmg: fix compressed VRAM handling There looks to be an issue in our compression handling when the BO pages are very fragmented, where we choose to skip the identity map and instead fall back to emitting the PTEs by hand when migrating memory, such that we can hopefully do more work per blit operation. However in such a case we need to ensure the src PTEs are correctly tagged with a compression enabled PAT index on dgpu xe2+, otherwise the copy will simply treat the src memory as uncompressed, leading to corruption if the memory was compressed by the user. To fix this pass along use_comp_pat into emit_pte() on the src side, to indicate that compression should be considered. v2 (Jonathan): tweak the commit message Fixes: 523f191cc0c7 ("drm/xe/xe_migrate: Handle migration logic for xe2+ dgfx") Signed-off-by: Matthew Auld Cc: Himal Prasad Ghimiray Cc: Thomas Hellström Cc: Akshata Jahagirdar Cc: # v6.12+ Reviewed-by: Jonathan Cavitt Link: https://lore.kernel.org/r/20250701103949.83116-2-matthew.auld@intel.com (cherry picked from commit f7a2fd776e57bd6468644bdecd91ab3aba57ba58) Signed-off-by: Lucas De Marchi commit daa099fed50a39256feb37d3fac146bf0d74152f Author: Matthew Brost Date: Tue Jul 1 20:58:46 2025 -0700 Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" This reverts commit fe0154cf8222d9e38c60ccc124adb2f9b5272371. Seeing some unexplained random failures during LRC context switches with indirect ring state enabled. The failures were always there, but the repro rate increased with the addition of WA BB as a separate BO. Commit 3a1edef8f4b5 ("drm/xe: Make WA BB part of LRC BO") helped to reduce the issues in the context switches, but didn't eliminate them completely. Indirect ring state is not required for any current features, so disable for now until failures can be root caused. Cc: stable@vger.kernel.org Fixes: fe0154cf8222 ("drm/xe/xe2: Enable Indirect Ring State support for Xe2") Signed-off-by: Matthew Brost Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250702035846.3178344-1-matthew.brost@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 03d85ab36bcbcbe9dc962fccd3f8e54d7bb93b35) Signed-off-by: Lucas De Marchi commit c9a95dbe06102cf01afee4cd83ecb29f8d587a72 Author: Matthew Brost Date: Wed Jul 2 14:35:11 2025 -0700 drm/xe: Allocate PF queue size on pow2 boundary CIRC_SPACE does not work unless the size argument is a power of 2, allocate PF queue size on power of 2 boundary. Cc: stable@vger.kernel.org Fixes: 3338e4f90c14 ("drm/xe: Use topology to determine page fault queue size") Fixes: 29582e0ea75c ("drm/xe: Add page queue multiplier") Signed-off-by: Matthew Brost Reviewed-by: Francois Dugast Link: https://lore.kernel.org/r/20250702213511.3226167-1-matthew.brost@intel.com (cherry picked from commit 491b9783126303755717c0cbde0b08ee59b6abab) Signed-off-by: Lucas De Marchi commit 705a412a367f383430fa34bada387af2e52eb043 Author: Michal Wajdeczko Date: Wed Jul 2 00:00:52 2025 +0200 drm/xe/pf: Clear all LMTT pages on alloc Our LMEM buffer objects are not cleared by default on alloc and during VF provisioning we only setup LMTT PTEs for the actually provisioned LMEM range. But beyond that valid range we might leave some stale data that could either point to some other VFs allocations or even to the PF pages. Explicitly clear all new LMTT page to avoid the risk that a malicious VF would try to exploit that gap. While around add asserts to catch any undesired PTE overwrites and low-level debug traces to track LMTT PT life-cycle. Fixes: b1d204058218 ("drm/xe/pf: Introduce Local Memory Translation Table") Signed-off-by: Michal Wajdeczko Cc: Michał Winiarski Cc: Lukasz Laguna Reviewed-by: Michał Winiarski Reviewed-by: Piotr Piórkowski Link: https://lore.kernel.org/r/20250701220052.1612-1-michal.wajdeczko@intel.com (cherry picked from commit 3fae6918a3e27cce20ded2551f863fb05d4bef8d) Signed-off-by: Lucas De Marchi commit 80852774ba0adc37dfdc230acceb7b2a90c900d8 Merge: ffc2c8c4a714df c7349772c268ec Author: Jakub Kicinski Date: Mon Jul 7 19:01:28 2025 -0700 Merge tag 'for-net-2025-07-03' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - hci_sync: Fix not disabling advertising instance - hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state - hci_sync: Fix attempting to send HCI_Disconnect to BIS handle - hci_event: Fix not marking Broadcast Sink BIS as connected * tag 'for-net-2025-07-03' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state Bluetooth: hci_sync: Fix not disabling advertising instance ==================== Link: https://patch.msgid.link/20250703160409.1791514-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit ffc2c8c4a714df53a715827d6334ab9474424f6a Author: Ryo Takakura Date: Wed Jul 2 18:24:17 2025 +0900 net: bcmgenet: Initialize u64 stats seq counter Initialize u64 stats as it uses seq counter on 32bit machines as suggested by lockdep below. [ 1.830953][ T1] INFO: trying to register non-static key. [ 1.830993][ T1] The code is fine but needs lockdep annotation, or maybe [ 1.831027][ T1] you didn't initialize this object before use? [ 1.831057][ T1] turning off the locking correctness validator. [ 1.831090][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Tainted: G W 6.16.0-rc2-v7l+ #1 PREEMPT [ 1.831097][ T1] Tainted: [W]=WARN [ 1.831099][ T1] Hardware name: BCM2711 [ 1.831101][ T1] Call trace: [ 1.831104][ T1] unwind_backtrace from show_stack+0x18/0x1c [ 1.831120][ T1] show_stack from dump_stack_lvl+0x8c/0xcc [ 1.831129][ T1] dump_stack_lvl from register_lock_class+0x9e8/0x9fc [ 1.831141][ T1] register_lock_class from __lock_acquire+0x420/0x22c0 [ 1.831154][ T1] __lock_acquire from lock_acquire+0x130/0x3f8 [ 1.831166][ T1] lock_acquire from bcmgenet_get_stats64+0x4a4/0x4c8 [ 1.831176][ T1] bcmgenet_get_stats64 from dev_get_stats+0x4c/0x408 [ 1.831184][ T1] dev_get_stats from rtnl_fill_stats+0x38/0x120 [ 1.831193][ T1] rtnl_fill_stats from rtnl_fill_ifinfo+0x7f8/0x1890 [ 1.831203][ T1] rtnl_fill_ifinfo from rtmsg_ifinfo_build_skb+0xd0/0x138 [ 1.831214][ T1] rtmsg_ifinfo_build_skb from rtmsg_ifinfo+0x48/0x8c [ 1.831225][ T1] rtmsg_ifinfo from register_netdevice+0x8c0/0x95c [ 1.831237][ T1] register_netdevice from register_netdev+0x28/0x40 [ 1.831247][ T1] register_netdev from bcmgenet_probe+0x690/0x6bc [ 1.831255][ T1] bcmgenet_probe from platform_probe+0x64/0xbc [ 1.831263][ T1] platform_probe from really_probe+0xd0/0x2d4 [ 1.831269][ T1] really_probe from __driver_probe_device+0x90/0x1a4 [ 1.831273][ T1] __driver_probe_device from driver_probe_device+0x38/0x11c [ 1.831278][ T1] driver_probe_device from __driver_attach+0x9c/0x18c [ 1.831282][ T1] __driver_attach from bus_for_each_dev+0x84/0xd4 [ 1.831291][ T1] bus_for_each_dev from bus_add_driver+0xd4/0x1f4 [ 1.831303][ T1] bus_add_driver from driver_register+0x88/0x120 [ 1.831312][ T1] driver_register from do_one_initcall+0x78/0x360 [ 1.831320][ T1] do_one_initcall from kernel_init_freeable+0x2bc/0x314 [ 1.831331][ T1] kernel_init_freeable from kernel_init+0x1c/0x144 [ 1.831339][ T1] kernel_init from ret_from_fork+0x14/0x20 [ 1.831344][ T1] Exception stack(0xf082dfb0 to 0xf082dff8) [ 1.831349][ T1] dfa0: 00000000 00000000 00000000 00000000 [ 1.831353][ T1] dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 1.831356][ T1] dfe0: 00000000 00000000 00000000 00000000 00000013 00000000 Fixes: 59aa6e3072aa ("net: bcmgenet: switch to use 64bit statistics") Reviewed-by: Florian Fainelli Signed-off-by: Ryo Takakura Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250702092417.46486-1-ryotkkr98@gmail.com Signed-off-by: Jakub Kicinski commit 667eeab4999e981c96b447a4df5f20bdf5c26f13 Author: Kuniyuki Iwashima Date: Wed Jul 2 01:43:40 2025 +0000 tipc: Fix use-after-free in tipc_conn_close(). syzbot reported a null-ptr-deref in tipc_conn_close() during netns dismantle. [0] tipc_topsrv_stop() iterates tipc_net(net)->topsrv->conn_idr and calls tipc_conn_close() for each tipc_conn. The problem is that tipc_conn_close() is called after releasing the IDR lock. At the same time, there might be tipc_conn_recv_work() running and it could call tipc_conn_close() for the same tipc_conn and release its last ->kref. Once we release the IDR lock in tipc_topsrv_stop(), there is no guarantee that the tipc_conn is alive. Let's hold the ref before releasing the lock and put the ref after tipc_conn_close() in tipc_topsrv_stop(). [0]: BUG: KASAN: use-after-free in tipc_conn_close+0x122/0x140 net/tipc/topsrv.c:165 Read of size 8 at addr ffff888099305a08 by task kworker/u4:3/435 CPU: 0 PID: 435 Comm: kworker/u4:3 Not tainted 4.19.204-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: netns cleanup_net Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 print_address_description.cold+0x54/0x219 mm/kasan/report.c:256 kasan_report_error.cold+0x8a/0x1b9 mm/kasan/report.c:354 kasan_report mm/kasan/report.c:412 [inline] __asan_report_load8_noabort+0x88/0x90 mm/kasan/report.c:433 tipc_conn_close+0x122/0x140 net/tipc/topsrv.c:165 tipc_topsrv_stop net/tipc/topsrv.c:701 [inline] tipc_topsrv_exit_net+0x27b/0x5c0 net/tipc/topsrv.c:722 ops_exit_list+0xa5/0x150 net/core/net_namespace.c:153 cleanup_net+0x3b4/0x8b0 net/core/net_namespace.c:553 process_one_work+0x864/0x1570 kernel/workqueue.c:2153 worker_thread+0x64c/0x1130 kernel/workqueue.c:2296 kthread+0x33f/0x460 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 Allocated by task 23: kmem_cache_alloc_trace+0x12f/0x380 mm/slab.c:3625 kmalloc include/linux/slab.h:515 [inline] kzalloc include/linux/slab.h:709 [inline] tipc_conn_alloc+0x43/0x4f0 net/tipc/topsrv.c:192 tipc_topsrv_accept+0x1b5/0x280 net/tipc/topsrv.c:470 process_one_work+0x864/0x1570 kernel/workqueue.c:2153 worker_thread+0x64c/0x1130 kernel/workqueue.c:2296 kthread+0x33f/0x460 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 Freed by task 23: __cache_free mm/slab.c:3503 [inline] kfree+0xcc/0x210 mm/slab.c:3822 tipc_conn_kref_release net/tipc/topsrv.c:150 [inline] kref_put include/linux/kref.h:70 [inline] conn_put+0x2cd/0x3a0 net/tipc/topsrv.c:155 process_one_work+0x864/0x1570 kernel/workqueue.c:2153 worker_thread+0x64c/0x1130 kernel/workqueue.c:2296 kthread+0x33f/0x460 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 The buggy address belongs to the object at ffff888099305a00 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 8 bytes inside of 512-byte region [ffff888099305a00, ffff888099305c00) The buggy address belongs to the page: page:ffffea000264c140 count:1 mapcount:0 mapping:ffff88813bff0940 index:0x0 flags: 0xfff00000000100(slab) raw: 00fff00000000100 ffffea00028b6b88 ffffea0002cd2b08 ffff88813bff0940 raw: 0000000000000000 ffff888099305000 0000000100000006 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888099305900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888099305980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888099305a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888099305a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888099305b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Fixes: c5fa7b3cf3cb ("tipc: introduce new TIPC server infrastructure") Reported-by: syzbot+d333febcf8f4bc5f6110@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=27169a847a70550d17be Signed-off-by: Kuniyuki Iwashima Reviewed-by: Tung Nguyen Link: https://patch.msgid.link/20250702014350.692213-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit eadb9fa7f775e39c2bdd9a43a947f03e86f9e37b Merge: 6e9128ff9d8113 f8b53cc9174c59 Author: Linus Torvalds Date: Mon Jul 7 18:22:25 2025 -0700 Merge tag 'efi-fixes-for-v6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI fixes from Ard Biesheuvel: - Drop preprocessor macros in zboot.lds which is not preprocessed - Fix zboot .data section size and raw size when SBAT is enabled * tag 'efi-fixes-for-v6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efi: Fix .data section size calculations when .sbat is present efi: Drop preprocessor directives from zboot.lds commit 6e9128ff9d8113ef208e5ec82573b96ead100072 Merge: d7b8f8e20813f0 8e786a85c0a3c0 Author: Linus Torvalds Date: Mon Jul 7 17:08:36 2025 -0700 Merge tag 'tsa_x86_bugs_for_6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull CPU speculation fixes from Borislav Petkov: "Add the mitigation logic for Transient Scheduler Attacks (TSA) TSA are new aspeculative side channel attacks related to the execution timing of instructions under specific microarchitectural conditions. In some cases, an attacker may be able to use this timing information to infer data from other contexts, resulting in information leakage. Add the usual controls of the mitigation and integrate it into the existing speculation bugs infrastructure in the kernel" * tag 'tsa_x86_bugs_for_6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/process: Move the buffer clearing before MONITOR x86/microcode/AMD: Add TSA microcode SHAs KVM: SVM: Advertise TSA CPUID bits to guests x86/bugs: Add a Transient Scheduler Attacks mitigation x86/bugs: Rename MDS machinery to something more generic commit 1e3b66e326015f77bc4b36976bebeedc2ac0f588 Author: Stefano Garzarella Date: Thu Jul 3 13:23:29 2025 +0200 vsock: fix `vsock_proto` declaration From commit 634f1a7110b4 ("vsock: support sockmap"), `struct proto vsock_proto`, defined in af_vsock.c, is not static anymore, since it's used by vsock_bpf.c. If CONFIG_BPF_SYSCALL is not defined, `make C=2` will print a warning: $ make O=build C=2 W=1 net/vmw_vsock/ ... CC [M] net/vmw_vsock/af_vsock.o CHECK ../net/vmw_vsock/af_vsock.c ../net/vmw_vsock/af_vsock.c:123:14: warning: symbol 'vsock_proto' was not declared. Should it be static? Declare `vsock_proto` regardless of CONFIG_BPF_SYSCALL, since it's defined in af_vsock.c, which is built regardless of CONFIG_BPF_SYSCALL. Fixes: 634f1a7110b4 ("vsock: support sockmap") Signed-off-by: Stefano Garzarella Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20250703112329.28365-1-sgarzare@redhat.com Signed-off-by: Jakub Kicinski commit ae8f160e7eb24240a2a79fc4c815c6a0d4ee16cc Author: Kuniyuki Iwashima Date: Fri Jul 4 05:48:18 2025 +0000 netlink: Fix wraparounds of sk->sk_rmem_alloc. Netlink has this pattern in some places if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf) atomic_add(skb->truesize, &sk->sk_rmem_alloc); , which has the same problem fixed by commit 5a465a0da13e ("udp: Fix multiple wraparounds of sk->sk_rmem_alloc."). For example, if we set INT_MAX to SO_RCVBUFFORCE, the condition is always false as the two operands are of int. Then, a single socket can eat as many skb as possible until OOM happens, and we can see multiple wraparounds of sk->sk_rmem_alloc. Let's fix it by using atomic_add_return() and comparing the two variables as unsigned int. Before: [root@fedora ~]# ss -f netlink Recv-Q Send-Q Local Address:Port Peer Address:Port -1668710080 0 rtnl:nl_wraparound/293 * After: [root@fedora ~]# ss -f netlink Recv-Q Send-Q Local Address:Port Peer Address:Port 2147483072 0 rtnl:nl_wraparound/290 * ^ `--- INT_MAX - 576 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Jason Baron Closes: https://lore.kernel.org/netdev/cover.1750285100.git.jbaron@akamai.com/ Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250704054824.1580222-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 4e2bba30b16935d18e59d137f607f8e10b6fda87 Merge: b9fd9888a5654e 4ab9ada765b7ac Author: Jakub Kicinski Date: Mon Jul 7 16:43:51 2025 -0700 Merge branch 'fix-qca808x-wol-issue' Luo Jie says: ==================== Fix QCA808X WoL Issue Restore WoL (Wake-on-LAN) enablement via MMD3 register 0x8012 BIT5 for the QCA808X PHY. This change resolves the issue where WoL functionality was not working due to its unintended removal in a previous commit. Refactor at8031_set_wol() into a shared library to enable reuse of the Wake-on-LAN (WoL) functionality by the AT8031, QCA807X and QCA808X PHY drivers. ==================== Link: https://patch.msgid.link/20250704-qcom_phy_wol_support-v1-0-053342b1538d@quicinc.com Signed-off-by: Jakub Kicinski commit 4ab9ada765b7acb5cd02fe27632ec2586b7868ee Author: Luo Jie Date: Fri Jul 4 13:31:14 2025 +0800 net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() The previous commit unintentionally removed the code responsible for enabling WoL via MMD3 register 0x8012 BIT5. As a result, Wake-on-LAN (WoL) support for the QCA808X PHY is no longer functional. The WoL (Wake-on-LAN) feature for the QCA808X PHY is enabled via MMD3 register 0x8012, BIT5. This implementation is aligned with the approach used in at8031_set_wol(). Fixes: e58f30246c35 ("net: phy: at803x: fix the wol setting functions") Signed-off-by: Luo Jie Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20250704-qcom_phy_wol_support-v1-2-053342b1538d@quicinc.com Signed-off-by: Jakub Kicinski commit e31cf3cce2102af984656fed6e2254cbdd46da02 Author: Luo Jie Date: Fri Jul 4 13:31:13 2025 +0800 net: phy: qcom: move the WoL function to shared library Move the WoL (Wake-on-LAN) functionality to a shared library to enable its reuse by the QCA808X PHY driver, incorporating support for WoL functionality similar to the implementation in at8031_set_wol(). Reviewed-by: Maxime Chevallier Signed-off-by: Luo Jie Link: https://patch.msgid.link/20250704-qcom_phy_wol_support-v1-1-053342b1538d@quicinc.com Signed-off-by: Jakub Kicinski commit 6f80be548588429100eb1f5e25dc2a714d583ffe Author: Alexandru Andries Date: Tue Jul 8 01:07:30 2025 +0300 ASoC: amd: yc: add DMI quirk for ASUS M6501RM add DMI entry for ASUS Vivobook PRO 15X (M6501RM) to make the internal microphone function Signed-off-by: Alexandru Andries Link: https://patch.msgid.link/20250707220730.361290-1-alex.andries.aa@gmail.com Signed-off-by: Mark Brown commit 74f3931a1bfea5822e8953a15c8ebc587dc6b4bc Author: Kent Overstreet Date: Mon Jul 7 13:54:31 2025 -0400 bcachefs: Fix additional misalignment in journal space calculations Additional fix on top of f54b2a80d0df bcachefs: Fix misaligned bucket check in journal space calculations Make sure that when we calculate space for the next entry it's not misaligned: we need to round_down() to filesystem block size in multiple places (next entry size calculation as well as total space available). Reported-by: Ondřej Kraus Signed-off-by: Kent Overstreet commit 7de3c8b4077e052a6f7880a9ae0f42342c49631b Author: Kent Overstreet Date: Sun Jul 6 19:25:27 2025 -0400 bcachefs: Don't schedule non persistent passes persistently if (!(in_recovery && (flags & RUN_RECOVERY_PASS_nopersistent))) should have been if (!in_recovery && !(flags & RUN_RECOVERY_PASS_nopersistent))) But the !in_recovery part was also wrong: the assumption is that if we're in recovery we'll just rewind and run the recovery pass immediately, but we're not able to do so if we've already gone RW and the pass must be run before we go RW. In that case, we need to schedule it in the superblock so it can be run on the next mount attempt. Scheduling it persistently is fine, because it'll be cleared in the superblock immediately when the pass completes successfully. Signed-off-by: Kent Overstreet commit 4cdf1bdd45ac78a088773722f009883af30ad318 Author: Pankaj Raghav Date: Fri Jul 4 11:21:34 2025 +0200 block: reject bs > ps block devices when THP is disabled If THP is disabled and when a block device with logical block size > page size is present, the following null ptr deref panic happens during boot: [ [13.2 mK AOSAN: null-ptr-deref in range [0x0000000000000000-0x0000000000K0 0 0[07] [ 13.017749] RIP: 0010:create_empty_buffers+0x3b/0x380 [ 13.025448] Call Trace: [ 13.025692] [ 13.025895] block_read_full_folio+0x610/0x780 [ 13.026379] ? __pfx_blkdev_get_block+0x10/0x10 [ 13.027008] ? __folio_batch_add_and_move+0x1fa/0x2b0 [ 13.027548] ? __pfx_blkdev_read_folio+0x10/0x10 [ 13.028080] filemap_read_folio+0x9b/0x200 [ 13.028526] ? __pfx_filemap_read_folio+0x10/0x10 [ 13.029030] ? __filemap_get_folio+0x43/0x620 [ 13.029497] do_read_cache_folio+0x155/0x3b0 [ 13.029962] ? __pfx_blkdev_read_folio+0x10/0x10 [ 13.030381] read_part_sector+0xb7/0x2a0 [ 13.030805] read_lba+0x174/0x2c0 [ 13.045348] nvme_scan_ns+0x684/0x850 [nvme_core] [ 13.045858] ? __pfx_nvme_scan_ns+0x10/0x10 [nvme_core] [ 13.046414] ? _raw_spin_unlock+0x15/0x40 [ 13.046843] ? __switch_to+0x523/0x10a0 [ 13.047253] ? kvm_clock_get_cycles+0x14/0x30 [ 13.047742] ? __pfx_nvme_scan_ns_async+0x10/0x10 [nvme_core] [ 13.048353] async_run_entry_fn+0x96/0x4f0 [ 13.048787] process_one_work+0x667/0x10a0 [ 13.049219] worker_thread+0x63c/0xf60 As large folio support depends on THP, only allow bs > ps block devices if THP is enabled. Fixes: 47dd67532303 ("block/bdev: lift block size restrictions to 64k") Signed-off-by: Pankaj Raghav Reviewed-by: Luis Chamberlain Link: https://lore.kernel.org/r/20250704092134.289491-1-p.raghav@samsung.com Signed-off-by: Jens Axboe commit aa9552438ebf015fc5f9f890dbfe39f0c53cf37e Author: Zheng Qixing Date: Thu Jun 12 21:24:05 2025 +0800 nbd: fix uaf in nbd_genl_connect() error path There is a use-after-free issue in nbd: block nbd6: Receive control failed (result -104) block nbd6: shutting down sockets ================================================================== BUG: KASAN: slab-use-after-free in recv_work+0x694/0xa80 drivers/block/nbd.c:1022 Write of size 4 at addr ffff8880295de478 by task kworker/u33:0/67 CPU: 2 UID: 0 PID: 67 Comm: kworker/u33:0 Not tainted 6.15.0-rc5-syzkaller-00123-g2c89c1b655c0 #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Workqueue: nbd6-recv recv_work Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xc3/0x670 mm/kasan/report.c:521 kasan_report+0xe0/0x110 mm/kasan/report.c:634 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_dec include/linux/atomic/atomic-instrumented.h:592 [inline] recv_work+0x694/0xa80 drivers/block/nbd.c:1022 process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400 kthread+0x3c2/0x780 kernel/kthread.c:464 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 nbd_genl_connect() does not properly stop the device on certain error paths after nbd_start_device() has been called. This causes the error path to put nbd->config while recv_work continue to use the config after putting it, leading to use-after-free in recv_work. This patch moves nbd_start_device() after the backend file creation. Reported-by: syzbot+48240bab47e705c53126@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68227a04.050a0220.f2294.00b5.GAE@google.com/T/ Fixes: 6497ef8df568 ("nbd: provide a way for userspace processes to identify device backends") Signed-off-by: Zheng Qixing Reviewed-by: Yu Kuai Link: https://lore.kernel.org/r/20250612132405.364904-1-zhengqixing@huaweicloud.com Signed-off-by: Jens Axboe commit eb8352ee2d1e70f916fac02094dca2b435076fa4 Author: Leon Yen Date: Wed Jun 25 15:37:20 2025 +0800 wifi: mt76: mt792x: Limit the concurrent STA and SoftAP to operate on the same channel Due to the lack of NoA(Notice of Absence) mechanism in SoftAP mode, it is inappropriate to allow concurrent SoftAP and STA to operate on the different channels. This patch restricts the concurrent SoftAP and STA to be setup on the same channel only. Signed-off-by: Leon Yen Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20250625073720.1385210-1-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit 03ee8f73801a8f46d83dfc2bf73fb9ffa5a21602 Author: Henry Martin Date: Wed Jun 25 20:49:01 2025 +0800 wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() devm_kasprintf() returns NULL on error. Currently, mt7925_thermal_init() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to prevent this issue. Fixes: 396e41a74a88 ("wifi: mt76: mt7925: support temperature sensor") Signed-off-by: Henry Martin Reviewed-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20250625124901.1839832-1-bsdhenryma@tencent.com Signed-off-by: Felix Fietkau commit dedf2ec30fe417d181490896adf89cd6b9885b23 Author: Felix Fietkau Date: Mon Jul 7 17:47:02 2025 +0200 wifi: mt76: fix queue assignment for deauth packets When running in AP mode and deauthenticating a client that's in powersave mode, the disassoc/deauth packet can get stuck in a tx queue along with other buffered frames. This can fill up hardware queues with frames that are only released after the WTBL slot is reused for another client. Fix this by moving deauth packets to the ALTX queue. Reported-by: Chad Monroe Link: https://patch.msgid.link/20250707154702.1726-2-nbd@nbd.name Signed-off-by: Felix Fietkau commit dc66a129adf1f25e944d0b93cd2df2ee0f0bd4d6 Author: Felix Fietkau Date: Mon Jul 7 17:47:01 2025 +0200 wifi: mt76: add a wrapper for wcid access with validation Several places use rcu_dereference to get a wcid entry without validating if the index exceeds the array boundary. Fix this by using a helper function, which handles validation. Link: https://patch.msgid.link/20250707154702.1726-1-nbd@nbd.name Signed-off-by: Felix Fietkau commit 7035a082348acf1d43ffb9ff735899f8e3863f8f Author: Deren Wu Date: Sun May 25 14:11:22 2025 +0800 wifi: mt76: mt7921: prevent decap offload config before STA initialization The decap offload configuration should only be applied after the STA has been successfully initialized. Attempting to configure it earlier can lead to corruption of the MAC configuration in the chip's hardware state. Add an early check for `msta->deflink.wcid.sta` to ensure the station peer is properly initialized before proceeding with decapsulation offload configuration. Cc: stable@vger.kernel.org Fixes: 24299fc869f7 ("mt76: mt7921: enable rx header traslation offload") Signed-off-by: Deren Wu Link: https://patch.msgid.link/f23a72ba7a3c1ad38ba9e13bb54ef21d6ef44ffb.1748149855.git.deren.wu@mediatek.com Signed-off-by: Felix Fietkau commit 35ad47c0b3da04b00b19a8b9ed5632e2f2520472 Author: Deren Wu Date: Sun May 25 14:11:21 2025 +0800 wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() Add a NULL check for msta->vif before accessing its members to prevent a kernel panic in AP mode deployment. This also fix the issue reported in [1]. The crash occurs when this function is triggered before the station is fully initialized. The call trace shows a page fault at mt7925_sta_set_decap_offload() due to accessing resources when msta->vif is NULL. Fix this by adding an early return if msta->vif is NULL and also check wcid.sta is ready. This ensures we only proceed with decap offload configuration when the station's state is properly initialized. [14739.655703] Unable to handle kernel paging request at virtual address ffffffffffffffa0 [14739.811820] CPU: 0 UID: 0 PID: 895854 Comm: hostapd Tainted: G [14739.821394] Tainted: [C]=CRAP, [O]=OOT_MODULE [14739.825746] Hardware name: Raspberry Pi 4 Model B Rev 1.1 (DT) [14739.831577] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [14739.838538] pc : mt7925_sta_set_decap_offload+0xc0/0x1b8 [mt7925_common] [14739.845271] lr : mt7925_sta_set_decap_offload+0x58/0x1b8 [mt7925_common] [14739.851985] sp : ffffffc085efb500 [14739.855295] x29: ffffffc085efb500 x28: 0000000000000000 x27: ffffff807803a158 [14739.862436] x26: ffffff8041ececb8 x25: 0000000000000001 x24: 0000000000000001 [14739.869577] x23: 0000000000000001 x22: 0000000000000008 x21: ffffff8041ecea88 [14739.876715] x20: ffffff8041c19ca0 x19: ffffff8078031fe0 x18: 0000000000000000 [14739.883853] x17: 0000000000000000 x16: ffffffe2aeac1110 x15: 000000559da48080 [14739.890991] x14: 0000000000000001 x13: 0000000000000000 x12: 0000000000000000 [14739.898130] x11: 0a10020001008e88 x10: 0000000000001a50 x9 : ffffffe26457bfa0 [14739.905269] x8 : ffffff8042013bb0 x7 : ffffff807fb6cbf8 x6 : dead000000000100 [14739.912407] x5 : dead000000000122 x4 : ffffff80780326c8 x3 : 0000000000000000 [14739.919546] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffff8041ececb8 [14739.926686] Call trace: [14739.929130] mt7925_sta_set_decap_offload+0xc0/0x1b8 [mt7925_common] [14739.935505] ieee80211_check_fast_rx+0x19c/0x510 [mac80211] [14739.941344] _sta_info_move_state+0xe4/0x510 [mac80211] [14739.946860] sta_info_move_state+0x1c/0x30 [mac80211] [14739.952116] sta_apply_auth_flags.constprop.0+0x90/0x1b0 [mac80211] [14739.958708] sta_apply_parameters+0x234/0x5e0 [mac80211] [14739.964332] ieee80211_add_station+0xdc/0x190 [mac80211] [14739.969950] nl80211_new_station+0x46c/0x670 [cfg80211] [14739.975516] genl_family_rcv_msg_doit+0xdc/0x150 [14739.980158] genl_rcv_msg+0x218/0x298 [14739.983830] netlink_rcv_skb+0x64/0x138 [14739.987670] genl_rcv+0x40/0x60 [14739.990816] netlink_unicast+0x314/0x380 [14739.994742] netlink_sendmsg+0x198/0x3f0 [14739.998664] __sock_sendmsg+0x64/0xc0 [14740.002324] ____sys_sendmsg+0x260/0x298 [14740.006242] ___sys_sendmsg+0xb4/0x110 Cc: stable@vger.kernel.org Link: https://github.com/morrownr/USB-WiFi/issues/603 [1] Fixes: b859ad65309a ("wifi: mt76: mt7925: add link handling in mt7925_sta_set_decap_offload") Signed-off-by: Deren Wu Link: https://patch.msgid.link/35aedbffa050e98939264300407a52ba4e236d52.1748149855.git.deren.wu@mediatek.com Signed-off-by: Felix Fietkau commit 9f8f4a51f3c133030ac5a4bcd4759ae2b947b7bd Author: Ming Yen Hsieh Date: Mon Jun 16 14:36:49 2025 +0800 wifi: mt76: mt7925: fix incorrect scan probe IE handling for hw_scan The IEs should be processed and filled into the command tlv separately according to each band. Cc: stable@vger.kernel.org Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20250616063649.1100503-1-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit c701574c54121af2720648572efbfe77564652d1 Author: Michael Lo Date: Thu Jun 12 14:20:46 2025 +0800 wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan Update the destination index to use 'n_ssids', which is incremented only when a valid SSID is present. Previously, both mt76_connac_mcu_hw_scan() and mt7925_mcu_hw_scan() used the loop index 'i' for the destination array, potentially leaving gaps if any source SSIDs had zero length. Cc: stable@vger.kernel.org Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") Signed-off-by: Michael Lo Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20250612062046.160598-1-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit d20de55332e92f9e614c34783c00bb6ce2fec067 Author: Ming Yen Hsieh Date: Thu Jun 12 14:09:31 2025 +0800 wifi: mt76: mt7925: fix the wrong config for tx interrupt MT_INT_TX_DONE_MCU_WM may cause tx interrupt to be mishandled during a reset failure, leading to the reset process failing. By using MT_INT_TX_DONE_MCU instead of MT_INT_TX_DONE_MCU_WM, the handling of tx interrupt is improved. Cc: stable@vger.kernel.org Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20250612060931.135635-1-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit 71532576f41e5b0ec967a82ed49d5dfb1027ccdb Author: Lorenzo Bianconi Date: Thu Jun 5 13:14:20 2025 +0200 wifi: mt76: Remove RCU section in mt7996_mac_sta_rc_work() Since mt7996_mcu_add_rate_ctrl() and mt7996_mcu_set_fixed_field() can't run in atomic context, move RCU critical section in mt7996_mcu_add_rate_ctrl() and mt7996_mcu_set_fixed_field(). This patch fixes a 'sleep while atomic' issue in mt7996_mac_sta_rc_work(). Fixes: 0762bdd30279 ("wifi: mt76: mt7996: rework mt7996_mac_sta_rc_work to support MLO") Signed-off-by: Lorenzo Bianconi Tested-by: Ben Greear Link: https://patch.msgid.link/20250605-mt7996-sleep-while-atomic-v1-5-d46d15f9203c@kernel.org Signed-off-by: Felix Fietkau commit 3dd6f67c669c860b93ff533f790f23ee1cb36f25 Author: Lorenzo Bianconi Date: Thu Jun 5 13:14:19 2025 +0200 wifi: mt76: Move RCU section in mt7996_mcu_add_rate_ctrl() Since mt76_mcu_skb_send_msg() routine can't be executed in atomic context, move RCU section in mt7996_mcu_add_rate_ctrl() and execute mt76_mcu_skb_send_msg() in non-atomic context. This is a preliminary patch to fix a 'sleep while atomic' issue in mt7996_mac_sta_rc_work(). Fixes: 0762bdd30279 ("wifi: mt76: mt7996: rework mt7996_mac_sta_rc_work to support MLO") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250605-mt7996-sleep-while-atomic-v1-4-d46d15f9203c@kernel.org Signed-off-by: Felix Fietkau commit 28d519d0d493a8cf3f8ca01f10d962c56cec1825 Author: Lorenzo Bianconi Date: Thu Jun 5 13:14:18 2025 +0200 wifi: mt76: Move RCU section in mt7996_mcu_add_rate_ctrl_fixed() Since mt7996_mcu_set_fixed_field() can't be executed in a RCU critical section, move RCU section in mt7996_mcu_add_rate_ctrl_fixed() and run mt7996_mcu_set_fixed_field() in non-atomic context. This is a preliminary patch to fix a 'sleep while atomic' issue in mt7996_mac_sta_rc_work(). Fixes: 0762bdd30279 ("wifi: mt76: mt7996: rework mt7996_mac_sta_rc_work to support MLO") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250605-mt7996-sleep-while-atomic-v1-3-d46d15f9203c@kernel.org Signed-off-by: Felix Fietkau commit c772cd726eea6fe8fb81d2aeeacb18cecff73a7b Author: Lorenzo Bianconi Date: Thu Jun 5 13:14:17 2025 +0200 wifi: mt76: Move RCU section in mt7996_mcu_set_fixed_field() Since mt76_mcu_skb_send_msg() routine can't be executed in atomic context, move RCU section in mt7996_mcu_set_fixed_field() and execute mt76_mcu_skb_send_msg() in non-atomic context. This is a preliminary patch to fix a 'sleep while atomic' issue in mt7996_mac_sta_rc_work(). Fixes: 0762bdd30279 ("wifi: mt76: mt7996: rework mt7996_mac_sta_rc_work to support MLO") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250605-mt7996-sleep-while-atomic-v1-2-d46d15f9203c@kernel.org Signed-off-by: Felix Fietkau commit a0c5eac9181025b6d65ff25c203a7f10274f80c1 Author: Lorenzo Bianconi Date: Thu Jun 5 13:14:16 2025 +0200 wifi: mt76: Assume __mt76_connac_mcu_alloc_sta_req runs in atomic context Rely on GFP_ATOMIC flag in __mt76_connac_mcu_alloc_sta_req since it can run in atomic context. This is a preliminary patch to fix a 'sleep while atomic' issue in mt7996_mac_sta_rc_work(). Fixes: 0762bdd30279 ("wifi: mt76: mt7996: rework mt7996_mac_sta_rc_work to support MLO") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250605-mt7996-sleep-while-atomic-v1-1-d46d15f9203c@kernel.org Signed-off-by: Felix Fietkau commit d133036a0b23d3ef781d067ccdea6bbfb381e0cf Author: Ben Skeggs Date: Tue Jun 17 14:00:36 2025 +1000 drm/nouveau/gsp: fix potential leak of memory used during acpi init If any of the ACPI calls fail, memory allocated for the input buffer would be leaked. Fix failure paths to free allocated memory. Also add checks to ensure the allocations succeeded in the first place. Reported-by: Danilo Krummrich Fixes: 176fdcbddfd2 ("drm/nouveau/gsp/r535: add support for booting GSP-RM") Signed-off-by: Ben Skeggs Signed-off-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250617040036.2932-1-bskeggs@nvidia.com commit 203817de269539c062724d97dfa5af3cdf77a3ec Author: Pavel Begunkov Date: Mon Jul 7 09:52:33 2025 +0100 io_uring/zcrx: fix pp destruction warnings With multiple page pools and in some other cases we can have allocated niovs on page pool destruction. Remove a misplaced warning checking that all niovs are returned to zcrx on io_pp_zc_destroy(). It was reported before but apparently got lost. Reported-by: Pedro Tammela Fixes: 34a3e60821ab9 ("io_uring/zcrx: implement zerocopy receive pp memory provider") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/b9e6d919d2964bc48ddbf8eb52fc9f5d118e9bc1.1751878185.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 0e2cebd72321caeef84b6ba7084e85be0287fb4b Author: Shravan Kumar Ramani Date: Wed Jul 2 06:09:02 2025 -0400 platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input For setting the enable value, the input should be 0 or 1 only. Use kstrtobool() in place of kstrtoint() in mlxbf_pmc_enable_store() to accept only valid input. Fixes: 423c3361855c ("platform/mellanox: mlxbf-pmc: Add support for BlueField-3") Signed-off-by: Shravan Kumar Ramani Reviewed-by: David Thompson Link: https://lore.kernel.org/r/2ee618c59976bcf1379d5ddce2fc60ab5014b3a9.1751380187.git.shravankr@nvidia.com [ij: split kstrbool() change to own commit.] Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit f8c1311769d3b2c82688b294b4ae03e94f1c326d Author: Shravan Kumar Ramani Date: Wed Jul 2 06:09:02 2025 -0400 platform/mellanox: mlxbf-pmc: Validate event/enable input Before programming the event info, validate the event number received as input by checking if it exists in the event_list. Also fix a typo in the comment for mlxbf_pmc_get_event_name() to correctly mention that it returns the event name when taking the event number as input, and not the other way round. Fixes: 423c3361855c ("platform/mellanox: mlxbf-pmc: Add support for BlueField-3") Signed-off-by: Shravan Kumar Ramani Reviewed-by: David Thompson Link: https://lore.kernel.org/r/2ee618c59976bcf1379d5ddce2fc60ab5014b3a9.1751380187.git.shravankr@nvidia.com [ij: split kstrbool() change to own commit.] Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 44e6ca8faeeed12206f3e7189c5ac618b810bb9c Author: Shravan Kumar Ramani Date: Wed Jul 2 06:09:01 2025 -0400 platform/mellanox: mlxbf-pmc: Remove newline char from event name input Since the input string passed via the command line appends a newline char, it needs to be removed before comparison with the event_list. Fixes: 1a218d312e65 ("platform/mellanox: mlxbf-pmc: Add Mellanox BlueField PMC driver") Signed-off-by: Shravan Kumar Ramani Reviewed-by: David Thompson Link: https://lore.kernel.org/r/4978c18e33313b48fa2ae7f3aa6dbcfce40877e4.1751380187.git.shravankr@nvidia.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d4e83784b2a9be58b938d55efb232d2751c4cab4 Author: Armin Wolf Date: Fri Jun 27 22:51:24 2025 +0200 platform/x86: dell-ddv: Fix taking the psy->extensions_sem lock twice Calling power_supply_get_property() inside dell_wmi_ddv_battery_translate() can cause a deadlock since this function is also being called from the power supply extension code, in which case psy->extensions_sem is already being held. Fix this by using the new power_supply_get_property_direct() function to ignore any power supply extensions when retrieving the battery serial number. Tested on a Dell Inspiron 3505. Reported-by: Hans de Goede Fixes: 058de163a376 ("platform/x86: dell-ddv: Implement the battery matching algorithm") Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20250627205124.250433-3-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a5f354232118751fe43be6ac896f8d6e7d7418b5 Author: Armin Wolf Date: Fri Jun 27 22:51:23 2025 +0200 power: supply: test-power: Test access to extended power supply Test that power supply extensions can access properties of their power supply using power_supply_get_property_direct(). This both ensures that the functionality works and serves as an example for future driver developers. Signed-off-by: Armin Wolf Acked-by: Sebastian Reichel Link: https://lore.kernel.org/r/20250627205124.250433-2-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 3ebed2fddf6fac5729ffc8c471c87d111b641678 Author: Armin Wolf Date: Fri Jun 27 22:51:22 2025 +0200 power: supply: core: Add power_supply_get/set_property_direct() Power supply extensions might want to interact with the underlying power supply to retrieve data like serial numbers, charging status and more. However doing so causes psy->extensions_sem to be locked twice, possibly causing a deadlock. Provide special variants of power_supply_get/set_property() that ignore any power supply extensions and thus do not touch the associated psy->extensions_sem lock. Suggested-by: Hans de Goede Signed-off-by: Armin Wolf Acked-by: Sebastian Reichel Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250627205124.250433-1-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 8346c6af27f1c1410eb314f4be5875fdf1579a10 Author: Kurt Borja Date: Mon Jul 7 03:24:05 2025 -0300 platform/x86: alienware-wmi-wmax: Fix `dmi_system_id` array Add missing empty member to `awcc_dmi_table`. Cc: stable@vger.kernel.org Fixes: 6d7f1b1a5db6 ("platform/x86: alienware-wmi: Split DMI table") Signed-off-by: Kurt Borja Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250707-dmi-fix-v1-1-6730835d824d@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d78f76457d70d30e80b5d2e067d45de7a0505fc0 Author: Edson Juliano Drosdeck Date: Mon Jul 7 08:45:37 2025 -0300 ALSA: hda/realtek: Enable headset Mic on Positivo K116J Positivo K116J is equipped with ALC269VC, and needs a fix to make the headset mic to work. Also must to limits the internal microphone boost. Signed-off-by: Edson Juliano Drosdeck Link: https://patch.msgid.link/20250707114537.8291-1-edson.drosdeck@gmail.com Signed-off-by: Takashi Iwai commit 98f99394a104cc80296da34a62d4e1ad04127013 Author: Christian Brauner Date: Mon Jul 7 13:21:11 2025 +0200 secretmem: use SB_I_NOEXEC Anonymous inodes may never ever be exectuable and the only way to enforce this is to raise SB_I_NOEXEC on the superblock which can never be unset. I've made the exec code yell at anyone who does not abide by this rule. For good measure also kill any pretense that device nodes are supported on the secretmem filesystem. > WARNING: fs/exec.c:119 at path_noexec+0x1af/0x200 fs/exec.c:118, CPU#1: syz-executor260/5835 > Modules linked in: > CPU: 1 UID: 0 PID: 5835 Comm: syz-executor260 Not tainted 6.16.0-rc4-next-20250703-syzkaller #0 PREEMPT(full) > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 > RIP: 0010:path_noexec+0x1af/0x200 fs/exec.c:118 > Code: 02 31 ff 48 89 de e8 f0 b1 89 ff d1 eb eb 07 e8 07 ad 89 ff b3 01 89 d8 5b 41 5e 41 5f 5d c3 cc cc cc cc cc e8 f2 ac 89 ff 90 <0f> 0b 90 e9 48 ff ff ff 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c a6 > RSP: 0018:ffffc90003eefbd8 EFLAGS: 00010293 > RAX: ffffffff8235f22e RBX: ffff888072be0940 RCX: ffff88807763bc00 > RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 > RBP: 0000000000080000 R08: ffff88807763bc00 R09: 0000000000000003 > R10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000011 > R13: 1ffff920007ddf90 R14: 0000000000000000 R15: dffffc0000000000 > FS: 000055556832d380(0000) GS:ffff888125d1e000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00007f21e34810d0 CR3: 00000000718a8000 CR4: 00000000003526f0 > Call Trace: > > do_mmap+0xa43/0x10d0 mm/mmap.c:472 > vm_mmap_pgoff+0x31b/0x4c0 mm/util.c:579 > ksys_mmap_pgoff+0x51f/0x760 mm/mmap.c:607 > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] > do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 > entry_SYSCALL_64_after_hwframe+0x77/0x7f > RIP: 0033:0x7f21e340a9f9 > Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 > RSP: 002b:00007ffd23ca3468 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 > RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f21e340a9f9 > RDX: 0000000000000000 RSI: 0000000000004000 RDI: 0000200000ff9000 > RBP: 00007f21e347d5f0 R08: 0000000000000003 R09: 0000000000000000 > R10: 0000000000000011 R11: 0000000000000246 R12: 0000000000000001 > R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001 Link: https://lore.kernel.org/686ba948.a00a0220.c7b3.0080.GAE@google.com Signed-off-by: Christian Brauner commit 830a9e37cfb203aa0f73cd947eda89eda89cc48c Author: Laura Brehm Date: Thu Jul 3 14:02:44 2025 +0200 coredump: fix PIDFD_INFO_COREDUMP ioctl check In Commit 1d8db6fd698de1f73b1a7d72aea578fdd18d9a87 ("pidfs, coredump: add PIDFD_INFO_COREDUMP"), the following code was added: if (mask & PIDFD_INFO_COREDUMP) { kinfo.mask |= PIDFD_INFO_COREDUMP; kinfo.coredump_mask = READ_ONCE(pidfs_i(inode)->__pei.coredump_mask); } [...] if (!(kinfo.mask & PIDFD_INFO_COREDUMP)) { task_lock(task); if (task->mm) kinfo.coredump_mask = pidfs_coredump_mask(task->mm->flags); task_unlock(task); } The second bit in particular looks off to me - the condition in essence checks whether PIDFD_INFO_COREDUMP was **not** requested, and if so fetches the coredump_mask in kinfo, since it's checking !(kinfo.mask & PIDFD_INFO_COREDUMP), which is unconditionally set in the earlier hunk. I'm tempted to assume the idea in the second hunk was to calculate the coredump mask if one was requested but fetched in the first hunk, in which case the check should be if ((kinfo.mask & PIDFD_INFO_COREDUMP) && !(kinfo.coredump_mask)) which might be more legibly written as if ((mask & PIDFD_INFO_COREDUMP) && !(kinfo.coredump_mask)) This could also instead be achieved by changing the first hunk to be: if (mask & PIDFD_INFO_COREDUMP) { kinfo.coredump_mask = READ_ONCE(pidfs_i(inode)->__pei.coredump_mask); if (kinfo.coredump_mask) kinfo.mask |= PIDFD_INFO_COREDUMP; } and the second hunk to: if ((mask & PIDFD_INFO_COREDUMP) && !(kinfo.mask & PIDFD_INFO_COREDUMP)) { task_lock(task); if (task->mm) { kinfo.coredump_mask = pidfs_coredump_mask(task->mm->flags); kinfo.mask |= PIDFD_INFO_COREDUMP; } task_unlock(task); } However, when looking at this, the supposition that the second hunk means to cover cases where the coredump info was requested but the first hunk failed to get it starts getting doubtful, so apologies if I'm completely off-base. This patch addresses the issue by fixing the check in the second hunk. Signed-off-by: Laura Brehm Link: https://lore.kernel.org/20250703120244.96908-3-laurabrehm@hey.com Cc: brauner@kernel.org Cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit 85e323bdbe28d4638aaefd8d9192763874efe9b0 Author: Baojun Xu Date: Mon Jul 7 17:05:13 2025 +0800 ALSA: hda/tas2781: Fix calibration data parser issue We will copy calibration data from position behind to front. We have created a variable (tmp_val) point on top of calibration data buffer, and tmp_val[1] is max of node number in original calibration data structure, it will be overwritten after first data copy, so can't be used as max node number check in for loop. So we create a new variable to save max of node number (tmp_val[1]), used to check if max node number was reached in for loop. And a point need to be increased to point at calibration data in node. Data saved position also need to be increased one byte. Fixes: 4fe238513407 ("ALSA: hda/tas2781: Move and unified the calibrated-data getting function for SPI and I2C into the tas2781_hda lib") Signed-off-by: Baojun Xu Link: https://patch.msgid.link/20250707090513.1462-1-baojun.xu@ti.com Signed-off-by: Takashi Iwai commit 67a59f82196c8c4f50c83329f0577acfb1349b50 Author: Drew Hamilton Date: Tue Jul 1 11:41:26 2025 -0400 usb: musb: fix gadget state on disconnect When unplugging the USB cable or disconnecting a gadget in usb peripheral mode with echo "" > /sys/kernel/config/usb_gadget//UDC, /sys/class/udc/musb-hdrc.0/state does not change from USB_STATE_CONFIGURED. Testing on dwc2/3 shows they both update the state to USB_STATE_NOTATTACHED. Add calls to usb_gadget_set_state in musb_g_disconnect and musb_gadget_stop to fix both cases. Fixes: 49401f4169c0 ("usb: gadget: introduce gadget state tracking") Cc: stable@vger.kernel.org Co-authored-by: Yehowshua Immanuel Signed-off-by: Yehowshua Immanuel Signed-off-by: Drew Hamilton Link: https://lore.kernel.org/r/20250701154126.8543-1-drew.hamilton@zetier.com Signed-off-by: Greg Kroah-Hartman commit 737bb912ebbe4571195c56eba557c4d7315b26fb Author: Mathy Vanhoef Date: Mon Jun 16 02:46:35 2025 +0200 wifi: prevent A-MSDU attacks in mesh networks This patch is a mitigation to prevent the A-MSDU spoofing vulnerability for mesh networks. The initial update to the IEEE 802.11 standard, in response to the FragAttacks, missed this case (CVE-2025-27558). It can be considered a variant of CVE-2020-24588 but for mesh networks. This patch tries to detect if a standard MSDU was turned into an A-MSDU by an adversary. This is done by parsing a received A-MSDU as a standard MSDU, calculating the length of the Mesh Control header, and seeing if the 6 bytes after this header equal the start of an rfc1042 header. If equal, this is a strong indication of an ongoing attack attempt. This defense was tested with mac80211_hwsim against a mesh network that uses an empty Mesh Address Extension field, i.e., when four addresses are used, and when using a 12-byte Mesh Address Extension field, i.e., when six addresses are used. Functionality of normal MSDUs and A-MSDUs was also tested, and confirmed working, when using both an empty and 12-byte Mesh Address Extension field. It was also tested with mac80211_hwsim that A-MSDU attacks in non-mesh networks keep being detected and prevented. Note that the vulnerability being patched, and the defense being implemented, was also discussed in the following paper and in the following IEEE 802.11 presentation: https://papers.mathyvanhoef.com/wisec2025.pdf https://mentor.ieee.org/802.11/dcn/25/11-25-0949-00-000m-a-msdu-mesh-spoof-protection.docx Cc: stable@vger.kernel.org Signed-off-by: Mathy Vanhoef Link: https://patch.msgid.link/20250616004635.224344-1-Mathy.Vanhoef@kuleuven.be Signed-off-by: Johannes Berg commit 9fccced2d25bcfe0fb210b1a0f17bb58ad69f7ad Merge: 3c2bd251d2039c 2cdde91c14ec35 Author: Greg Kroah-Hartman Date: Mon Jul 7 10:49:54 2025 +0200 Merge tag 'thunderbolt-for-v6.16-rc4' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-linus Mika writes: thunderbolt: Fixes for v6.16-rc4 This includes following USB4/Thunderbolt fixes for v6.16-rc4: - Fix wake on connect during runtime suspend - Fix bit masking in tb_dp_port_set_hops(). Both have been in linux-next with no reported issues. * tag 'thunderbolt-for-v6.16-rc4' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: thunderbolt: Fix bit masking in tb_dp_port_set_hops() thunderbolt: Fix wake on connect at runtime commit 2ce6ad9262256dd345cb104ba0ac6cf4aeed25a3 Author: Felix Fietkau Date: Sun Jul 6 11:20:53 2025 +0200 wifi: rt2x00: fix remove callback type mismatch The function is used as remove callback for a platform driver. It was missed during the conversion from int to void Fixes: 0edb555a65d1 ("platform: Make platform_driver::remove() return void") Signed-off-by: Felix Fietkau Link: https://patch.msgid.link/20250706092053.97724-1-nbd@nbd.name Signed-off-by: Johannes Berg commit 58fcb1b4287ce38850402bb2bb16d09bf77b91d9 Author: Moon Hee Lee Date: Thu Jul 3 12:37:57 2025 -0700 wifi: mac80211: reject VHT opmode for unsupported channel widths VHT operating mode notifications are not defined for channel widths below 20 MHz. In particular, 5 MHz and 10 MHz are not valid under the VHT specification and must be rejected. Without this check, malformed notifications using these widths may reach ieee80211_chan_width_to_rx_bw(), leading to a WARN_ON due to invalid input. This issue was reported by syzbot. Reject these unsupported widths early in sta_link_apply_parameters() when opmode_notif is used. The accepted set includes 20, 40, 80, 160, and 80+80 MHz, which are valid for VHT. While 320 MHz is not defined for VHT, it is allowed to avoid rejecting HE or EHT clients that may still send a VHT opmode notification. Reported-by: syzbot+ededba317ddeca8b3f08@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=ededba317ddeca8b3f08 Fixes: 751e7489c1d7 ("wifi: mac80211: expose ieee80211_chan_width_to_rx_bw() to drivers") Tested-by: syzbot+ededba317ddeca8b3f08@syzkaller.appspotmail.com Signed-off-by: Moon Hee Lee Link: https://patch.msgid.link/20250703193756.46622-2-moonhee.lee.ca@gmail.com Signed-off-by: Johannes Berg commit 3b602ddc0df723992721b0d286c90c9bdd755b34 Author: Vitor Soares Date: Tue Jul 1 15:26:43 2025 +0100 wifi: mwifiex: discard erroneous disassoc frames on STA interface When operating in concurrent STA/AP mode with host MLME enabled, the firmware incorrectly sends disassociation frames to the STA interface when clients disconnect from the AP interface. This causes kernel warnings as the STA interface processes disconnect events that don't apply to it: [ 1303.240540] WARNING: CPU: 0 PID: 513 at net/wireless/mlme.c:141 cfg80211_process_disassoc+0x78/0xec [cfg80211] [ 1303.250861] Modules linked in: 8021q garp stp mrp llc rfcomm bnep btnxpuart nls_iso8859_1 nls_cp437 onboard_us [ 1303.327651] CPU: 0 UID: 0 PID: 513 Comm: kworker/u9:2 Not tainted 6.16.0-rc1+ #3 PREEMPT [ 1303.335937] Hardware name: Toradex Verdin AM62 WB on Verdin Development Board (DT) [ 1303.343588] Workqueue: MWIFIEX_RX_WORK_QUEUE mwifiex_rx_work_queue [mwifiex] [ 1303.350856] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 1303.357904] pc : cfg80211_process_disassoc+0x78/0xec [cfg80211] [ 1303.364065] lr : cfg80211_process_disassoc+0x70/0xec [cfg80211] [ 1303.370221] sp : ffff800083053be0 [ 1303.373590] x29: ffff800083053be0 x28: 0000000000000000 x27: 0000000000000000 [ 1303.380855] x26: 0000000000000000 x25: 00000000ffffffff x24: ffff000002c5b8ae [ 1303.388120] x23: ffff000002c5b884 x22: 0000000000000001 x21: 0000000000000008 [ 1303.395382] x20: ffff000002c5b8ae x19: ffff0000064dd408 x18: 0000000000000006 [ 1303.402646] x17: 3a36333a61623a30 x16: 32206d6f72662063 x15: ffff800080bfe048 [ 1303.409910] x14: ffff000003625300 x13: 0000000000000001 x12: 0000000000000000 [ 1303.417173] x11: 0000000000000002 x10: ffff000003958600 x9 : ffff000003625300 [ 1303.424434] x8 : ffff00003fd9ef40 x7 : ffff0000039fc280 x6 : 0000000000000002 [ 1303.431695] x5 : ffff0000038976d4 x4 : 0000000000000000 x3 : 0000000000003186 [ 1303.438956] x2 : 000000004836ba20 x1 : 0000000000006986 x0 : 00000000d00479de [ 1303.446221] Call trace: [ 1303.448722] cfg80211_process_disassoc+0x78/0xec [cfg80211] (P) [ 1303.454894] cfg80211_rx_mlme_mgmt+0x64/0xf8 [cfg80211] [ 1303.460362] mwifiex_process_mgmt_packet+0x1ec/0x460 [mwifiex] [ 1303.466380] mwifiex_process_sta_rx_packet+0x1bc/0x2a0 [mwifiex] [ 1303.472573] mwifiex_handle_rx_packet+0xb4/0x13c [mwifiex] [ 1303.478243] mwifiex_rx_work_queue+0x158/0x198 [mwifiex] [ 1303.483734] process_one_work+0x14c/0x28c [ 1303.487845] worker_thread+0x2cc/0x3d4 [ 1303.491680] kthread+0x12c/0x208 [ 1303.495014] ret_from_fork+0x10/0x20 Add validation in the STA receive path to verify that disassoc/deauth frames originate from the connected AP. Frames that fail this check are discarded early, preventing them from reaching the MLME layer and triggering WARN_ON(). This filtering logic is similar with that used in the ieee80211_rx_mgmt_disassoc() function in mac80211, which drops disassoc frames that don't match the current BSSID (!ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr)), ensuring only relevant frames are processed. Tested on: - 8997 with FW 16.68.1.p197 Fixes: 36995892c271 ("wifi: mwifiex: add host mlme for client mode") Cc: stable@vger.kernel.org Signed-off-by: Vitor Soares Reviewed-by: Jeff Chen Reviewed-by: Francesco Dolcini Link: https://patch.msgid.link/20250701142643.658990-1-ivitro@gmail.com Signed-off-by: Johannes Berg commit e1e6ebf490e55fee1ae573aa443c1d4aea5e4a40 Author: Johannes Berg Date: Mon Jun 30 15:45:01 2025 +0200 wifi: mac80211: fix non-transmitted BSSID profile search When the non-transmitted BSSID profile is found, immediately return from the search to not return the wrong profile_len when the profile is found in a multiple BSSID element that isn't the last one in the frame. Fixes: 5023b14cf4df ("mac80211: support profile split between elements") Reported-by: Michael-CY Lee Link: https://patch.msgid.link/20250630154501.f26cd45a0ecd.I28e0525d06e8a99e555707301bca29265cf20dc8@changeid Signed-off-by: Johannes Berg commit 8af596e8ae44c3bcf36d1aea09fc9a6f17c555e5 Author: Johannes Berg Date: Tue Jul 1 09:22:13 2025 +0200 wifi: mac80211: clear frame buffer to never leak stack In disconnect paths paths, local frame buffers are used to build deauthentication frames to send them over the air and as notifications to userspace. Some internal error paths (that, given no other bugs, cannot happen) don't always initialize the buffers before sending them to userspace, so in the presence of other bugs they can leak stack content. Initialize the buffers to avoid the possibility of this happening. Suggested-by: Zhongqiu Han Link: https://patch.msgid.link/20250701072213.13004-2-johannes@sipsolutions.net Signed-off-by: Johannes Berg commit c5fd399a24c8e2865524361f7dc4d4a6899be4f4 Author: Lachlan Hodges Date: Tue Jul 1 17:55:41 2025 +1000 wifi: mac80211: correctly identify S1G short beacon mac80211 identifies a short beacon by the presence of the next TBTT field, however the standard actually doesn't explicitly state that the next TBTT can't be in a long beacon or even that it is required in a short beacon - and as a result this validation does not work for all vendor implementations. The standard explicitly states that an S1G long beacon shall contain the S1G beacon compatibility element as the first element in a beacon transmitted at a TBTT that is not a TSBTT (Target Short Beacon Transmission Time) as per IEEE80211-2024 11.1.3.10.1. This is validated by 9.3.4.3 Table 9-76 which states that the S1G beacon compatibility element is only allowed in the full set and is not allowed in the minimum set of elements permitted for use within short beacons. Correctly identify short beacons by the lack of an S1G beacon compatibility element as the first element in an S1G beacon frame. Fixes: 9eaffe5078ca ("cfg80211: convert S1G beacon to scan results") Signed-off-by: Simon Wadsworth Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20250701075541.162619-1-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg commit fbe94be09fa81343d623a86ec64a742759b669b3 Author: Francesco Dolcini Date: Mon Jun 23 15:25:45 2025 +0200 arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on LDO5 regulator is used to power the i.MX8MM NVCC_SD2 I/O supply, that is used for the SD2 card interface and also for some GPIOs. When the SD card interface is not enabled the regulator subsystem could turn off this supply, since it is not used anywhere else, however this will also remove the power to some other GPIOs, for example one I/O that is used to power the ethernet phy, leading to a non working ethernet interface. [ 31.820515] On-module +V3.3_1.8_SD (LDO5): disabling [ 31.821761] PMIC_USDHC_VSELECT: disabling [ 32.764949] fec 30be0000.ethernet end0: Link is Down Fix this keeping the LDO5 supply always on. Cc: stable@vger.kernel.org Fixes: 6a57f224f734 ("arm64: dts: freescale: add initial support for verdin imx8m mini") Fixes: f5aab0438ef1 ("regulator: pca9450: Fix enable register for LDO5") Signed-off-by: Francesco Dolcini Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 505b730ede7f5c4083ff212aa955155b5b92e574 Author: Uwe Kleine-König Date: Fri Jul 4 19:27:27 2025 +0200 pwm: mediatek: Ensure to disable clocks in error path After enabling the clocks each error path must disable the clocks again. One of them failed to do so. Unify the error paths to use goto to make it harder for future changes to add a similar bug. Fixes: 7ca59947b5fc ("pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config()") Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20250704172728.626815-2-u.kleine-koenig@baylibre.com Cc: stable@vger.kernel.org Signed-off-by: Uwe Kleine-König commit 9ee124caae1b0defd0e02c65686f539845a3ac9b Author: Uwe Kleine-König Date: Fri Jul 4 19:24:17 2025 +0200 pwm: Fix invalid state detection Commit 9dd42d019e63 ("pwm: Allow pwm state transitions from an invalid state") intended to allow some state transitions that were not allowed before. The idea is sane and back then I also got the code comment right, but the check for enabled is bogus. This resulted in state transitions for enabled states to be allowed to have invalid duty/period settings and thus it can happen that low-level drivers get requests for invalid states🙄. Invert the check to allow state transitions for disabled states only. Fixes: 9dd42d019e63 ("pwm: Allow pwm state transitions from an invalid state") Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20250704172416.626433-2-u.kleine-koenig@baylibre.com Cc: stable@vger.kernel.org Signed-off-by: Uwe Kleine-König commit d7b8f8e20813f0179d8ef519541a3527e7661d3a Author: Linus Torvalds Date: Sun Jul 6 14:10:26 2025 -0700 Linux 6.16-rc5 commit bab5cac627b36a96ffc344274953558906418495 Merge: 772b78c2abd855 b969f9614885c2 Author: Linus Torvalds Date: Sun Jul 6 13:10:39 2025 -0700 Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull /proc/sys dcache lookup fix from Al Viro: "Fix for the breakage spotted by Neil in the interplay between /proc/sys ->d_compare() weirdness and parallel lookups" * tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: fix proc_sys_compare() handling of in-lookup dentries commit 772b78c2abd85586bb90b23adff89f7303c704c7 Merge: 95eb0d389b4a51 fc975cfb36393d Author: Linus Torvalds Date: Sun Jul 6 11:17:47 2025 -0700 Merge tag 'sched_urgent_for_v6.16_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Borislav Petkov: - Fix the calculation of the deadline server task's runtime as this mishap was preventing realtime tasks from running - Avoid a race condition during migrate-swapping two tasks - Fix the string reported for the "none" dynamic preemption option * tag 'sched_urgent_for_v6.16_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/deadline: Fix dl_server runtime calculation formula sched/core: Fix migrate_swap() vs. hotplug sched: Fix preemption string of preempt_dynamic_none commit 95eb0d389b4a518a2630b18fbc5916a008f519f1 Merge: a1639ce5e59030 ccdd09e0fc0d5c Author: Linus Torvalds Date: Sun Jul 6 10:55:59 2025 -0700 Merge tag 'objtool_urgent_for_v6.16_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool fix from Borislav Petkov: - Fix the compilation of an x86 kernel on a big engian machine due to a missed endianness conversion * tag 'objtool_urgent_for_v6.16_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: objtool: Add missing endian conversion to read_annotate() commit a1639ce5e590300af45bebedfbacf8fabc1777ed Merge: 5fc2e891a5badb ba677dbe77af5f Author: Linus Torvalds Date: Sun Jul 6 10:49:27 2025 -0700 Merge tag 'perf_urgent_for_v6.16_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Borislav Petkov: - Revert uprobes to using CAP_SYS_ADMIN again as currently they can destructively modify kernel code from an unprivileged process - Move a warning to where it belongs * tag 'perf_urgent_for_v6.16_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf: Revert to requiring CAP_SYS_ADMIN for uprobes perf/core: Fix the WARN_ON_ONCE is out of lock protected region commit 5fc2e891a5badbcb585850995c609be78bd73006 Merge: 463b1b2af83866 52e1a03e6cf61a Author: Linus Torvalds Date: Sun Jul 6 10:44:20 2025 -0700 Merge tag 'x86_urgent_for_v6.16_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Borislav Petkov: - Make sure AMD SEV guests using secure TSC, include a TSC_FACTOR which prevents their TSCs from going skewed from the hypervisor's * tag 'x86_urgent_for_v6.16_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/sev: Use TSC_FACTOR for Secure TSC frequency calculation commit 463b1b2af83866e6369e7764fb65f1d57449fb5b Merge: c92bda4cb96970 46b0a67e8f22d2 Author: Linus Torvalds Date: Sun Jul 6 10:38:04 2025 -0700 Merge tag 'locking_urgent_for_v6.16_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fixes from Borislav Petkov: - Disable FUTEX_PRIVATE_HASH for this cycle due to a performance regression - Add a selftests compilation product to the corresponding .gitignore file * tag 'locking_urgent_for_v6.16_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: selftests/futex: Add futex_numa to .gitignore futex: Temporary disable FUTEX_PRIVATE_HASH commit c92bda4cb96970b78037d52cfae43844044744b1 Merge: bdde3141ceb992 1e14ea901dc8d9 Author: Linus Torvalds Date: Sun Jul 6 09:29:24 2025 -0700 Merge tag 'edac_urgent_for_v6.16_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC fix from Borislav Petkov: - Initialize sysfs attributes properly to avoid lockdep complaining about an uninitialized lock class * tag 'edac_urgent_for_v6.16_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC: Initialize EDAC features sysfs attributes commit bdde3141ceb992f494e9a949c89f99983a1d6604 Merge: 45a3f125463852 30ad231a5029bf Author: Linus Torvalds Date: Sun Jul 6 09:17:48 2025 -0700 Merge tag 'ras_urgent_for_v6.16_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull RAS fixes from Borislav Petkov: - Do not remove the MCE sysfs hierarchy if thresholding sysfs nodes init fails due to new/unknown banks present, which in itself is not fatal anyway; add default names for new banks - Make sure MCE polling settings are honored after CMCI storms - Make sure MCE threshold limit is reset after the thresholding interrupt has been serviced - Clean up properly and disable CMCI banks on shutdown so that a second/kexec-ed kernel can rediscover those banks again * tag 'ras_urgent_for_v6.16_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mce: Make sure CMCI banks are cleared during shutdown on Intel x86/mce/amd: Fix threshold limit reset x86/mce/amd: Add default names for MCA banks and blocks x86/mce: Ensure user polling settings are honored when restarting timer x86/mce: Don't remove sysfs if thresholding sysfs init fails commit 45a3f1254638523869fc2ba067713f4d467e5145 Merge: 1f988d0788f50d eb2c93e7028b4c Author: Linus Torvalds Date: Sun Jul 6 09:16:31 2025 -0700 Merge tag 'irq_urgent_for_v6.16_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fix from Borislav Petkov: - Have irq-msi-lib select CONFIG_GENERIC_MSI_IRQ explicitly as it uses its facilities * tag 'irq_urgent_for_v6.16_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ commit d0a48dc4df5c986bf8c3caf4d8fc15c480273052 Author: Terry Tritton Date: Fri Jul 4 20:02:34 2025 +0100 selftests/futex: Convert 32-bit timespec to 64-bit version for 32-bit compatibility mode sys_futex_wait() expects a struct __kernel_timespec pointer for the timeout, but the provided struct timespec pointer is of type struct old_timespec32 when compiled for 32-bit architectures, unless they use 64-bit timespecs already. Make it work for all variants by converting the provided timespec value into a local struct __kernel_timespec and provide a pointer to it to the syscall. This is a pointless operation for 64-bit, but this is not a hotpath operation, so keep it simple. This fix is based off [1] Originally-by: Wei Gao Signed-off-by: Terry Tritton Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250704190234.14230-1-terry.tritton@linaro.org Link: https://lore.kernel.org/all/20231203235117.29677-1-wegao@suse.com/ [1] commit ae68ad3d7a93ea1eedbce8e5813273163b971b36 Author: Tamir Duberstein Date: Sat Jul 5 11:45:56 2025 -0400 MAINTAINERS: add miscdevice Rust abstractions Add rust abstractions to miscdevice MAINTAINERS entry. Signed-off-by: Tamir Duberstein Acked-by: Boqun Feng Link: https://lore.kernel.org/r/20250705-miscdevice-maintainers-v1-1-9a6b67f7602f@gmail.com Signed-off-by: Greg Kroah-Hartman commit 46b0a67e8f22d2dbc679b37b26c5ff0f50424847 Author: Terry Tritton Date: Fri Jul 4 11:37:49 2025 +0100 selftests/futex: Add futex_numa to .gitignore futex_numa was never added to the .gitignore file. Add it. Fixes: 9140f57c1c13 ("futex,selftests: Add another FUTEX2_NUMA selftest") Signed-off-by: Terry Tritton Signed-off-by: Thomas Gleixner Reviewed-by: André Almeida Link: https://lore.kernel.org/all/20250704103749.10341-1-terry.tritton@linaro.org commit 1f988d0788f50d8464f957e793fab356e2937369 Merge: 05df91921da664 38224c472a038f Author: Linus Torvalds Date: Sat Jul 5 16:14:03 2025 -0700 Merge tag 'hid-for-linus-2025070502' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - Memory corruption fixes in hid-appletb-kbd driver (Qasim Ijaz) - New device ID in hid-elecom driver (Leonard Dizon) - Fixed several HID debugfs contants (Vicki Pfau) * tag 'hid-for-linus-2025070502' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: appletb-kbd: fix slab use-after-free bug in appletb_kbd_probe HID: Fix debug name for BTN_GEAR_DOWN, BTN_GEAR_UP, BTN_WHEEL HID: elecom: add support for ELECOM HUGE 019B variant HID: appletb-kbd: fix memory corruption of input_handler_list commit 05df91921da664ebba2752a7e45b63e3dddb85de Merge: fd860cd7814660 3363da82e02f1b Author: Linus Torvalds Date: Sat Jul 5 13:05:28 2025 -0700 Merge tag 'v6.16-rc4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - Two reconnect fixes including one for a reboot/reconnect race - Fix for incorrect file type that can be returned by SMB3.1.1 POSIX extensions - tcon initialization fix - Fix for resolving Windows symlinks with absolute paths * tag 'v6.16-rc4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client: fix native SMB symlink traversal smb: client: fix race condition in negotiate timeout by using more precise timing cifs: all initializations for tcon should happen in tcon_info_alloc smb: client: fix warning when reconnecting channel smb: client: fix readdir returning wrong type with POSIX extensions commit fd860cd78146605eeeeee3ac264ca166cc9fa943 Merge: a79a588fc1761d 534eb6de621954 Author: Linus Torvalds Date: Sat Jul 5 12:54:24 2025 -0700 Merge tag 'i2c-for-6.16-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: - designware: initialise msg_write_idx during transfer - microchip: check return value from core xfer call - realtek: add 'reg' property constraint to the device tree * tag 'i2c-for-6.16-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: dt-bindings: i2c: realtek,rtl9301: Fix missing 'reg' constraint i2c: microchip-core: re-fix fake detections w/ i2cdetect i2c/designware: Fix an initialization issue commit 63a83463d278ea9f9eff7f58708322856e106d87 Author: Kent Overstreet Date: Fri Jul 4 12:18:02 2025 -0400 bcachefs: Fix bch2_btree_transactions_read() synchronization Since we're accessing btree_trans objects owned by another thread, we need to guard against using pointers to freed key cache entries: we need our own srcu read lock, and we should skip a btree_trans if it didn't hold the srcu lock (and thus it might have pointers to freed key cache entries). 00693 Mem abort info: 00693 ESR = 0x0000000096000005 00693 EC = 0x25: DABT (current EL), IL = 32 bits 00693 SET = 0, FnV = 0 00693 EA = 0, S1PTW = 0 00693 FSC = 0x05: level 1 translation fault 00693 Data abort info: 00693 ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 00693 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 00693 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 00693 user pgtable: 4k pages, 39-bit VAs, pgdp=000000012e650000 00693 [000000008fb96218] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 00693 Internal error: Oops: 0000000096000005 [#1] SMP 00693 Modules linked in: 00693 CPU: 0 UID: 0 PID: 4307 Comm: cat Not tainted 6.16.0-rc2-ktest-g9e15af94fd86 #27578 NONE 00693 Hardware name: linux,dummy-virt (DT) 00693 pstate: 60001005 (nZCv daif -PAN -UAO -TCO -DIT +SSBS BTYPE=--) 00693 pc : six_lock_counts+0x20/0xe8 00693 lr : bch2_btree_bkey_cached_common_to_text+0x38/0x130 00693 sp : ffffff80ca98bb60 00693 x29: ffffff80ca98bb60 x28: 000000008fb96200 x27: 0000000000000007 00693 x26: ffffff80eafd06b8 x25: 0000000000000000 x24: ffffffc080d75a60 00693 x23: ffffff80eafd0000 x22: ffffffc080bdfcc0 x21: ffffff80eafd0210 00693 x20: ffffff80c192ff08 x19: 000000008fb96200 x18: 00000000ffffffff 00693 x17: 0000000000000000 x16: 0000000000000000 x15: 00000000ffffffff 00693 x14: 0000000000000000 x13: ffffff80ceb5a29a x12: 20796220646c6568 00693 x11: 72205d3e303c5b20 x10: 0000000000000020 x9 : ffffffc0805fb6b0 00693 x8 : 0000000000000020 x7 : 0000000000000000 x6 : 0000000000000020 00693 x5 : ffffff80ceb5a29c x4 : 0000000000000001 x3 : 000000000000029c 00693 x2 : 0000000000000000 x1 : ffffff80ef66c000 x0 : 000000008fb96200 00693 Call trace: 00693 six_lock_counts+0x20/0xe8 (P) 00693 bch2_btree_bkey_cached_common_to_text+0x38/0x130 00693 bch2_btree_trans_to_text+0x260/0x2a8 00693 bch2_btree_transactions_read+0xac/0x1e8 00693 full_proxy_read+0x74/0xd8 00693 vfs_read+0x90/0x300 00693 ksys_read+0x6c/0x108 00693 __arm64_sys_read+0x20/0x30 00693 invoke_syscall.constprop.0+0x54/0xe8 00693 do_el0_svc+0x44/0xc8 00693 el0_svc+0x18/0x58 00693 el0t_64_sync_handler+0x104/0x130 00693 el0t_64_sync+0x154/0x158 00693 Code: 910003fd f9423c22 f90017e2 d2800002 (f9400c01) 00693 ---[ end trace 0000000000000000 ]--- Signed-off-by: Kent Overstreet commit 14dd95647ea533c7d7c528b9bb7e163e433b47b9 Author: Kent Overstreet Date: Thu Jul 3 19:19:21 2025 -0400 bcachefs: btree read retry fixes Fix btree node read retries after validate errors: __btree_err() is the wrong place to flag a topology error: that is done by btree_lost_data(). Additionally, some calls to bch2_bkey_pick_read_device() were not updated in the 6.16 rework for improved log messages; we were failing to signal that we still had a retry. Cc: Nikita Ofitserov Cc: Alan Huang Reported-and-tested-by: Edoardo Codeglia Signed-off-by: Kent Overstreet commit a77ffbe34d450dd685e55ba942b025ded2517aff Author: Kent Overstreet Date: Thu Jul 3 18:03:10 2025 -0400 bcachefs: btree node scan no longer uses btree cache Previously, btree node scan used the btree node cache to check if btree nodes were readable, but this is subject to interference from threads scanning different devices trying to read the same node - and more critically, nodes that we already attempted and failed to read before kicking off scan. Instead, we now allocate a 'struct btree' that does not live in the btree node cache, and call bch2_btree_node_read_done() directly. Cc: Nikita Ofitserov Reviewed-by: Nikita Ofitserov Reported-and-tested-by: Edoardo Codeglia Signed-off-by: Kent Overstreet commit 454706f1f8698eecc6cc00493c6dffbccdbbd416 Merge: 75ef7b8d44c30a c17fb542dbd1db Author: Jens Axboe Date: Sat Jul 5 06:32:59 2025 -0600 Merge tag 'md-6.16-20250705' of gitolite.kernel.org:pub/scm/linux/kernel/git/mdraid/linux into block-6.16 Pull MD fixes from Yu: " - fix uaf due to stack memory used for bio mempool, from Jinchao - fix raid10/raid1 nowait IO error path, from Nigel and Qixing - fix kernel crash from reading bitmap sysfs entry, by Håkon" * tag 'md-6.16-20250705' of gitolite.kernel.org:pub/scm/linux/kernel/git/mdraid/linux: md/md-bitmap: fix GPF in bitmap_get_stats() md/raid1,raid10: strip REQ_NOWAIT from member bios raid10: cleanup memleak at raid10_make_request md/raid1: Fix stack memory use after return in raid1_reshape commit c17fb542dbd1db745c9feac15617056506dd7195 Author: Håkon Bugge Date: Wed Jul 2 11:10:34 2025 +0200 md/md-bitmap: fix GPF in bitmap_get_stats() The commit message of commit 6ec1f0239485 ("md/md-bitmap: fix stats collection for external bitmaps") states: Remove the external bitmap check as the statistics should be available regardless of bitmap storage location. Return -EINVAL only for invalid bitmap with no storage (neither in superblock nor in external file). But, the code does not adhere to the above, as it does only check for a valid super-block for "internal" bitmaps. Hence, we observe: Oops: GPF, probably for non-canonical address 0x1cd66f1f40000028 RIP: 0010:bitmap_get_stats+0x45/0xd0 Call Trace: seq_read_iter+0x2b9/0x46a seq_read+0x12f/0x180 proc_reg_read+0x57/0xb0 vfs_read+0xf6/0x380 ksys_read+0x6d/0xf0 do_syscall_64+0x8c/0x1b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e We fix this by checking the existence of a super-block for both the internal and external case. Fixes: 6ec1f0239485 ("md/md-bitmap: fix stats collection for external bitmaps") Cc: stable@vger.kernel.org Reported-by: Gerald Gibson Signed-off-by: Håkon Bugge Link: https://lore.kernel.org/linux-raid/20250702091035.2061312-1-haakon.bugge@oracle.com Signed-off-by: Yu Kuai commit 5fa31c49928139fa948f078b094d80f12ed83f5f Author: Zheng Qixing Date: Wed Jul 2 18:23:41 2025 +0800 md/raid1,raid10: strip REQ_NOWAIT from member bios RAID layers don't implement proper non-blocking semantics for REQ_NOWAIT, making the flag potentially misleading when propagated to member disks. This patch clear REQ_NOWAIT from cloned bios in raid1/raid10. Retain original bio's REQ_NOWAIT flag for upper layer error handling. Maybe we can implement non-blocking I/O handling mechanisms within RAID in future work. Fixes: 9f346f7d4ea7 ("md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT") Signed-off-by: Zheng Qixing Link: https://lore.kernel.org/linux-raid/20250702102341.1969154-1-zhengqixing@huaweicloud.com Signed-off-by: Yu Kuai commit 43806c3d5b9bb7d74ba4e33a6a8a41ac988bde24 Author: Nigel Croxon Date: Thu Jul 3 11:23:04 2025 -0400 raid10: cleanup memleak at raid10_make_request If raid10_read_request or raid10_write_request registers a new request and the REQ_NOWAIT flag is set, the code does not free the malloc from the mempool. unreferenced object 0xffff8884802c3200 (size 192): comm "fio", pid 9197, jiffies 4298078271 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 88 41 02 00 00 00 00 00 .........A...... 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc c1a049a2): __kmalloc+0x2bb/0x450 mempool_alloc+0x11b/0x320 raid10_make_request+0x19e/0x650 [raid10] md_handle_request+0x3b3/0x9e0 __submit_bio+0x394/0x560 __submit_bio_noacct+0x145/0x530 submit_bio_noacct_nocheck+0x682/0x830 __blkdev_direct_IO_async+0x4dc/0x6b0 blkdev_read_iter+0x1e5/0x3b0 __io_read+0x230/0x1110 io_read+0x13/0x30 io_issue_sqe+0x134/0x1180 io_submit_sqes+0x48c/0xe90 __do_sys_io_uring_enter+0x574/0x8b0 do_syscall_64+0x5c/0xe0 entry_SYSCALL_64_after_hwframe+0x76/0x7e V4: changing backing tree to see if CKI tests will pass. The patch code has not changed between any versions. Fixes: c9aa889b035f ("md: raid10 add nowait support") Signed-off-by: Nigel Croxon Link: https://lore.kernel.org/linux-raid/c0787379-9caa-42f3-b5fc-369aed784400@redhat.com Signed-off-by: Yu Kuai commit d67ed2ccd2d1dcfda9292c0ea8697a9d0f2f0d98 Author: Wang Jinchao Date: Thu Jun 12 19:28:40 2025 +0800 md/raid1: Fix stack memory use after return in raid1_reshape In the raid1_reshape function, newpool is allocated on the stack and assigned to conf->r1bio_pool. This results in conf->r1bio_pool.wait.head pointing to a stack address. Accessing this address later can lead to a kernel panic. Example access path: raid1_reshape() { // newpool is on the stack mempool_t newpool, oldpool; // initialize newpool.wait.head to stack address mempool_init(&newpool, ...); conf->r1bio_pool = newpool; } raid1_read_request() or raid1_write_request() { alloc_r1bio() { mempool_alloc() { // if pool->alloc fails remove_element() { --pool->curr_nr; } } } } mempool_free() { if (pool->curr_nr < pool->min_nr) { // pool->wait.head is a stack address // wake_up() will try to access this invalid address // which leads to a kernel panic return; wake_up(&pool->wait); } } Fix: reinit conf->r1bio_pool.wait after assigning newpool. Fixes: afeee514ce7f ("md: convert to bioset_init()/mempool_init()") Signed-off-by: Wang Jinchao Reviewed-by: Yu Kuai Link: https://lore.kernel.org/linux-raid/20250612112901.3023950-1-wangjinchao600@gmail.com Signed-off-by: Yu Kuai commit 3d44147494385b245f021a3a3a5c1408be1d50d1 Author: Tamir Duberstein Date: Fri Jul 4 15:50:27 2025 -0400 rust: drm: remove unnecessary imports `kernel::str::CStr` is included in the prelude. Signed-off-by: Tamir Duberstein Signed-off-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250704-cstr-include-drm-v1-1-a279dfc4d753@gmail.com commit 162c90154422e67c3b2dc209a4304a95e293cd58 Author: Ofir Bitton Date: Mon Jul 29 15:17:18 2024 +0300 MAINTAINERS: Change habanalabs maintainer I will be leaving Intel soon, Yaron Avizrat will take the role of habanalabs driver maintainer. Signed-off-by: Ofir Bitton Signed-off-by: Lukas Wunner Acked-by: Yaron Avizrat Acked-by: Jani Nikula Acked-by: Oded Gabbay Link: https://lore.kernel.org/r/20240729121718.540489-2-obitton@habana.ai commit c2b2c7d1da8f26c6db40de2bed142d66e238bd8a Author: Kent Overstreet Date: Thu Jul 3 18:50:18 2025 -0400 bcachefs: Tweak btree cache helpers for use by btree node scan btree node scan needs to not use the btree node cache: that causes interference from prior failed reads and parallel workers. Instead we need to allocate btree nodes that don't live in the btree cache, so that we can call bch2_btree_node_read_done() directly. This patch tweaks the low level helpers so they don't touch the btree cache lists. Cc: Nikita Ofitserov Reviewed-by: Nikita Ofitserov Reported-and-tested-by: Edoardo Codeglia Signed-off-by: Kent Overstreet commit a79a588fc1761dc12a3064fc2f648ae66cea3c5a Merge: 49dcc4f601017c 250d0579da5db2 Author: Linus Torvalds Date: Fri Jul 4 17:27:30 2025 -0700 Merge tag 'pm-6.16-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These address system suspend failures under memory pressure in some configurations, fix up RAPL handling on platforms where PL1 cannot be disabled, and fix a documentation typo: - Prevent the Intel RAPL power capping driver from allowing PL1 to be exceeded by mistake on systems when PL1 cannot be disabled (Zhang Rui) - Fix a typo in the ABI documentation (Sumanth Gavini) - Allow swap to be used a bit longer during system suspend and hibernation to avoid suspend failures under memory pressure (Mario Limonciello)" * tag 'pm-6.16-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM: sleep: docs: Replace "diasble" with "disable" powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed PM: Restrict swap use to later in the suspend sequence commit 49dcc4f601017c3fb5dec6754a90403a07d043a6 Merge: b1bf2ef6259e6a de1675de39aa94 Author: Linus Torvalds Date: Fri Jul 4 17:25:41 2025 -0700 Merge tag 'acpi-6.16-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "Revert a problematic ACPI battery driver change merged recently" * tag 'acpi-6.16-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: Revert "ACPI: battery: negate current when discharging" commit 250d0579da5db2052cce2891a5eaa87450851354 Merge: 964209202ebe15 3e7e5adcd2a867 Author: Rafael J. Wysocki Date: Fri Jul 4 21:54:55 2025 +0200 Merge branch 'pm-sleep' Merge fixes related to system sleep for 6.16-rc5: - Fix typo in the ABI documentation (Sumanth Gavini). - Allow swap to be used a bit longer during system suspend and hibernation to avoid suspend failures under memory pressure (Mario Limonciello). * pm-sleep: PM: sleep: docs: Replace "diasble" with "disable" PM: Restrict swap use to later in the suspend sequence commit c72d628469b8f46251b3afc361269cb15de0c988 Author: Kent Overstreet Date: Thu Jul 3 15:53:51 2025 -0400 bcachefs: Fix btree for nonexistent tree depth The fix for when we should increase tree depth in journal replay was entirely bogus. We should only increase the tree depth in journal replay when recovery from btree node scan, and then only for keys found by btree node scan. This needs additional work - we should be shooting down existing interior node pointers when recovery from scan, they shouldn't be showing up here. Fixes: b47a82ff4772 ("bcachefs: Only run 'increase_depth' for keys from btree node csan") Cc: Alan Huang Reported-by: syzbot+8deb6ff4415db67a9f18@syzkaller.appspotmail.com Signed-off-by: Kent Overstreet commit ddb9680a7226d6081b42869d2875715a17ecb51d Author: Kent Overstreet Date: Thu Jul 3 15:08:19 2025 -0400 bcachefs: Fix bch2_io_failures_to_text() This wasn't updated when we added tracking for btree validate errors. Signed-off-by: Kent Overstreet commit 63d6e9311999a3dd125ad3e0560a769e047fd7b1 Author: Kent Overstreet Date: Wed Jul 2 13:28:55 2025 -0400 bcachefs: bch2_fpunch_snapshot() Add a new version of fpunch for operating on a snapshot ID, not a subvolume - and use it for "extent past end of inode" repair. Previously, repair would try to delete everything at once, but deleting too many extents at once can overflow the btree_trans bump allocator, as well as causing other problems - the new helper properly uses bch2_extent_trim_atomic(). Reported-and-tested-by: Edoardo Codeglia Signed-off-by: Kent Overstreet commit b1bf2ef6259e6aedc3f952ebd9bc056605563b74 Merge: c435a4f487e8c6 3f3fb973743089 Author: Linus Torvalds Date: Fri Jul 4 12:05:36 2025 -0700 Merge tag 'soc-fixes-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "A couple of fixes for firmware drivers have come up, addressing kernel side bugs in op-tee and ff-a code, as well as compatibility issues with exynos-acpm and ff-a protocols. The only devicetree fixes are for the Apple platform, addressing issues with conformance to the bindings for the wlan, spi and mipi nodes" * tag 'soc-fixes-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: arm64: dts: apple: Move touchbar mipi {address,size}-cells from dtsi to dts arm64: dts: apple: Drop {address,size}-cells from SPI NOR arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename optee: ffa: fix sleep in atomic context firmware: exynos-acpm: fix timeouts on xfers handling arm64: defconfig: update renamed PHY_SNPS_EUSB2 firmware: arm_ffa: Fix the missing entry in struct ffa_indirect_msg_hdr firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context firmware: arm_ffa: Move memory allocation outside the mutex locking firmware: arm_ffa: Fix memory leak by freeing notifier callback node commit c435a4f487e8c6a3b23dafbda87d971d4fd14e0b Merge: 4b02ed4ab721f5 5903a7452e642f Author: Linus Torvalds Date: Fri Jul 4 10:23:29 2025 -0700 Merge tag 'riscv-for-linus-6.16-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: - kCFI is restricted to clang-17 or newer, as earlier versions have known bugs - sbi_hsm_hart_start is now staticly allocated, to avoid tripping up the SBI HSM page mapping on sparse systems. * tag 'riscv-for-linus-6.16-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: cpu_ops_sbi: Use static array for boot_data riscv: Require clang-17 or newer for kCFI commit 4b02ed4ab721f559e843251564a3ea6ae1769a83 Merge: a1d8128f701682 c9764fd88bc744 Author: Linus Torvalds Date: Fri Jul 4 10:14:49 2025 -0700 Merge tag 'regulator-fix-v6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "A few driver fixes (the GPIO one being potentially nasty, though it has been there for a while without anyone reporting it), and one core fix for the rarely used combination of coupled regulators and unbinding" * tag 'regulator-fix-v6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods regulator: mp886x: Fix ID table driver_data regulator: sy8824x: Fix ID table driver_data regulator: tps65219: Fix devm_kmalloc size allocation regulator: core: fix NULL dereference on unbind due to stale coupling data commit a1d8128f701682d34d9308c9e6b7385c0ffa4b4b Merge: df46426745ac58 04a8ff1bc35148 Author: Linus Torvalds Date: Fri Jul 4 10:10:49 2025 -0700 Merge tag 'spi-fix-v6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "As well as a few driver specific fixes we've got a core change here which raises the hard coded limit on the number of devices we can support on one SPI bus since some FPGA based systems are running into the existing limit. This is not a good solution but it's one suitable for this point in the release cycle, we should dynamically size the relevant data structures which I hope will happen in the next couple of merge windows. We also pull in a MTD fix for the Qualcomm SNAND driver, the two fixes cover the same issue and merging them together minimises bisection issues" * tag 'spi-fix-v6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: cadence-quadspi: fix cleanup of rx_chan on failure paths spi: spi-fsl-dspi: Clear completion counter before initiating transfer spi: Raise limit on number of chip selects to 24 mtd: nand: qpic_common: prevent out of bounds access of BAM arrays spi: spi-qpic-snand: reallocate BAM transactions commit df46426745ac58618c822ce3f93d2bb25b9a5060 Merge: 3c2bd251d2039c 4f30f946f27b7f Author: Linus Torvalds Date: Fri Jul 4 10:05:31 2025 -0700 Merge tag 'platform-drivers-x86-v6.16-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform drivers fixes from Ilpo Järvinen: "Mostly a few lines fixed here and there except amd/isp4 which improves swnodes relationships but that is a new driver not in any stable kernels yet. The think-lmi driver changes also look relatively large but there are just many fixes to it. The i2c/piix4 change is a effectively a revert of the commit 7e173eb82ae9 ("i2c: piix4: Make CONFIG_I2C_PIIX4 dependent on CONFIG_X86") but that required moving the header out from arch/x86 under include/linux/platform_data/ Summary: - amd/isp4: Improve swnode graph (new driver exception) - asus-nb-wmi: Use duo keyboard quirk for Zenbook Duo UX8406CA - dell-lis3lv02d: Add Latitude 5500 accelerometer address - dell-wmi-sysman: Fix WMI data block retrieval and class dev unreg - hp-bioscfg: Fix class device unregistration - i2c: piix4: Re-enable on non-x86 + move FCH header under platform_data/ - intel/hid: Wildcat Lake support - mellanox: - mlxbf-pmc: Fix duplicate event ID - mlxbf-tmfifo: Fix vring_desc.len assignment - mlxreg-lc: Fix bit-not-set logic check - nvsw-sn2201: Fix bus number in error message & spelling errors - portwell-ec: Move watchdog device under correct platform hierarchy - think-lmi: Error handling fixes (sysfs, kset, kobject, class dev unreg) - thinkpad_acpi: Handle HKEY 0x1402 event (2025 Thinkpads) - wmi: Fix WMI event enablement" * tag 'platform-drivers-x86-v6.16-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (22 commits) platform/x86: think-lmi: Fix sysfs group cleanup platform/x86: think-lmi: Fix kobject cleanup platform/x86: think-lmi: Create ksets consecutively platform/mellanox: mlxreg-lc: Fix logic error in power state check i2c: Re-enable piix4 driver on non-x86 Move FCH header to a location accessible by all archs platform/x86/intel/hid: Add Wildcat Lake support platform/x86: dell-wmi-sysman: Fix class device unregistration platform/x86: think-lmi: Fix class device unregistration platform/x86: hp-bioscfg: Fix class device unregistration platform/x86: Update swnode graph for amd isp4 platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks platform/x86: wmi: Update documentation of WCxx/WExx ACPI methods platform/x86: wmi: Fix WMI event enablement platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message platform/mellanox: Fix spelling and comment clarity in Mellanox drivers platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 platform/x86: thinkpad_acpi: handle HKEY 0x1402 event platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA platform/x86: dell-lis3lv02d: Add Latitude 5500 ... commit 3c2bd251d2039ce2778c35ced5ef47b3a379f5df Merge: d46971e0b6f574 9bd9c8026341f7 Author: Linus Torvalds Date: Fri Jul 4 09:57:12 2025 -0700 Merge tag 'usb-6.16-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some USB driver fixes for 6.16-rc5. I originally wanted this to get into -rc4, but there were some regressions that had to be handled first. Now all looks good. Included in here are the following fixes: - cdns3 driver fixes - xhci driver fixes - typec driver fixes - USB hub fixes (this is what took the longest to get right) - new USB driver quirks added - chipidea driver fixes All of these have been in linux-next for a while and now we have no more reported problems with them" * tag 'usb-6.16-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (21 commits) usb: hub: Fix flushing of delayed work used for post resume purposes xhci: dbc: Flush queued requests before stopping dbc xhci: dbctty: disable ECHO flag by default xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS usb: xhci: quirk for data loss in ISOC transfers usb: dwc3: gadget: Fix TRB reclaim logic for short transfers and ZLPs usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm usb: typec: displayport: Fix potential deadlock usb: typec: altmodes/displayport: do not index invalid pin_assignments usb: cdnsp: Fix issue with CV Bad Descriptor test usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach Revert "usb: xhci: Implement xhci_handshake_check_state() helper" usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed usb: gadget: u_serial: Fix race condition in TTY wakeup Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume usb: acpi: fix device link removal usb: hub: fix detection of high tier USB3 devices behind suspended hubs Logitech C-270 even more broken usb: dwc3: Abort suspend on soft disconnect failure ... commit d46971e0b6f574059d167ddda1355ed301a0bae6 Merge: 42bb9b630c4c6c 4cf65845fdd09d Author: Linus Torvalds Date: Fri Jul 4 09:54:15 2025 -0700 Merge tag 'input-for-v6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - support for Acer NGR 200 Controller added to xpad driver - xpad driver will no longer log errors about URBs at sudden disconnect - a fix for potential NULL dereference in cs40l50-vibra driver - several drivers have been switched to using scnprintf() to suppress warnings about potential output truncation * tag 'input-for-v6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() Input: alps - use scnprintf() to suppress truncation warning Input: iqs7222 - explicitly define number of external channels Input: xpad - support Acer NGR 200 Controller Input: xpad - return errors from xpad_try_sending_next_out_packet() up Input: xpad - adjust error handling for disconnect Input: apple_z2 - drop default ARCH_APPLE in Kconfig Input: Fully open-code compatible for grepping dt-bindings: HID: i2c-hid: elan: Introduce Elan eKTH8D18 Input: psmouse - switch to use scnprintf() to suppress truncation warning Input: lifebook - switch to use scnprintf() to suppress truncation warning Input: alps - switch to use scnprintf() to suppress truncation warning Input: atkbd - switch to use scnprintf() to suppress truncation warning Input: fsia6b - suppress buffer truncation warning for phys Input: iqs626a - replace snprintf() with scnprintf() commit 42bb9b630c4c6c0964cddca98d9d30aa992826de Merge: 923d401238c590 da8d8e9001c6a3 Author: Linus Torvalds Date: Fri Jul 4 09:48:36 2025 -0700 Merge tag 'drm-fixes-2025-07-04' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Weekly drm fixes, bit of a bumper crop, the usual amdgpu/xe/i915 suspects, then there is a large scattering of fixes across core and drivers. I think the simple panel lookup fix is probably the largest, the sched race fix is also fun, but I don't see anything standing out too badly. dma-buf: - fix timeout handling gem: - fix framebuffer object references sched: - fix spsc queue job count race bridge: - fix aux hpd bridge of node - panel: move missing flag handling - samsung-dsim: fix %pK usage to %p panel: - fix problem with simple panel lookup ttm: - fix error path handling amdgpu: - SDMA 5.x reset fix - Add missing firmware declaration - Fix leak in amdgpu_ctx_mgr_entity_fini() - Freesync fix - OLED backlight fix amdkfd: - mtype fix for ext coherent system memory - MMU notifier fix - gfx7/8 fix xe: - Fix chunking the PTE updates and overflowing the maximum number of dwords with with MI_STORE_DATA_IMM - Move WA BB to the LRC BO to mitigate hangs on context switch - Fix frequency/flush WAs for BMG - Fix kconfig prompt title and description - Do not require kunit - Extend 14018094691 WA to BMG - Fix wedging the device on signal i915: - Make mei interrupt top half irq disabled to fix RT builds - Fix timeline left held on VMA alloc error - Fix NULL pointer deref in vlv_dphy_param_init() - Fix selftest mock_request() to avoid NULL deref exynos: - switch to using %p instead of %pK - fix vblank NULL ptr race - fix lockup on samsung peach-pit/pi chromebooks vesadrm: - NULL ptr fix vmwgfx: - fix encrypted memory allocation bug v3d: - fix irq enabled during reset" * tag 'drm-fixes-2025-07-04' of https://gitlab.freedesktop.org/drm/kernel: (41 commits) drm/xe: Do not wedge device on killed exec queues drm/xe: Extend WA 14018094691 to BMG drm/v3d: Disable interrupts before resetting the GPU drm/gem: Acquire references on GEM handles for framebuffers drm/sched: Increment job count before swapping tail spsc queue drm/xe: Allow dropping kunit dependency as built-in drm/xe: Fix kconfig prompt drm/xe/bmg: Update Wa_22019338487 drm/xe/bmg: Update Wa_14022085890 drm/xe: Split xe_device_td_flush() drm/xe/xe_guc_pc: Lock once to update stashed frequencies drm/xe/guc_pc: Add _locked variant for min/max freq drm/xe: Make WA BB part of LRC BO drm/xe: Fix out-of-bounds field write in MI_STORE_DATA_IMM drm/i915/gsc: mei interrupt top half should be in irq disabled context drm/i915/gt: Fix timeline left held on VMA alloc error drm/vmwgfx: Fix guests running with TDX/SEV drm/amd/display: Don't allow OLED to go down to fully off drm/amd/display: Added case for when RR equals panel's max RR using freesync drm/amdkfd: add hqd_sdma_get_doorbell callbacks for gfx7/8 ... commit 923d401238c590f39833a2015f6f9493f146d98f Merge: 1880df2cf44af6 25b1b75bbaf963 Author: Linus Torvalds Date: Fri Jul 4 09:43:08 2025 -0700 Merge tag 'iommu-fixes-v6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu fixes from Joerg Roedel: - Rockchip: fix infinite loop caused by probing race condition - Intel VT-d: assign devtlb cache tag on ATS enablement * tag 'iommu-fixes-v6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: iommu/vt-d: Assign devtlb cache tag on ATS enablement iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU commit 1880df2cf44af6266b48a905596726c267bc2b04 Merge: 482deed9dfa065 75ef7b8d44c30a Author: Linus Torvalds Date: Fri Jul 4 09:33:59 2025 -0700 Merge tag 'block-6.16-20250704' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: - NVMe fixes via Christoph: - fix incorrect cdw15 value in passthru error logging (Alok Tiwari) - fix memory leak of bio integrity in nvmet (Dmitry Bogdanov) - refresh visible attrs after being checked (Eugen Hristev) - fix suspicious RCU usage warning in the multipath code (Geliang Tang) - correctly account for namespace head reference counter (Nilay Shroff) - Fix for a regression introduced in ublk in this cycle, where it would attempt to queue a canceled request. - brd RCU sleeping fix, also introduced in this cycle. Bare bones fix, should be improved upon for the next release. * tag 'block-6.16-20250704' of git://git.kernel.dk/linux: brd: fix sleeping function called from invalid context in brd_insert_page() ublk: don't queue request if the associated uring_cmd is canceled nvme-multipath: fix suspicious RCU usage warning nvme-pci: refresh visible attrs after being checked nvmet: fix memory leak of bio integrity nvme: correctly account for namespace head reference counter nvme: Fix incorrect cdw15 value in passthru error logging commit 534eb6de621954cde61c910dbeb8fb1700a0a0d6 Merge: d0b3b7b22dfa1f 5f05fc6e2218db Author: Wolfram Sang Date: Fri Jul 4 18:31:22 2025 +0200 Merge tag 'i2c-host-fixes-6.16-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current i2c-host-fixes for v6.16-rc5 designware: initialise msg_write_idx during transfer microchip: check return value from core xfer call realtek: add 'reg' property constraint to the device tree commit 482deed9dfa065cf3f68372dadac857541c7d504 Merge: 2eb7f03acf4ac5 94426e4201fbb1 Author: Linus Torvalds Date: Fri Jul 4 09:29:22 2025 -0700 Merge tag 'bcachefs-2025-07-03' of git://evilpiepirate.org/bcachefs Pull bcachefs fixes from Kent Overstreet: "The 'opts.casefold_disabled' patch is non critical, but would be a 6.15 backport; it's to address the casefolding + overlayfs incompatibility that was discovvered late. It's late because I was hoping that this would be addressed on the overlayfs side (and will be in 6.17), but user reports keep coming in on this one (lots of people are using docker these days)" * tag 'bcachefs-2025-07-03' of git://evilpiepirate.org/bcachefs: bcachefs: opts.casefold_disabled bcachefs: Work around deadlock to btree node rewrites in journal replay bcachefs: Fix incorrect transaction restart handling bcachefs: fix btree_trans_peek_prev_journal() bcachefs: mark invalid_btree_id autofix commit 2eb7f03acf4ac5db937974e99e75dac4c2c5a83d Merge: 4c06e63b92038f 1e7ab6f6782434 Author: Linus Torvalds Date: Fri Jul 4 09:06:49 2025 -0700 Merge tag 'vfs-6.16-rc5.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - Fix a regression caused by the anonymous inode rework. Making them regular files causes various places in the kernel to tip over starting with io_uring. Revert to the former status quo and port our assertion to be based on checking the inode so we don't lose the valuable VFS_*_ON_*() assertions that have already helped discover weird behavior our outright bugs. - Fix the the upper bound calculation in fuse_fill_write_pages() - Fix priority inversion issues in the eventpoll code - Make secretmen use anon_inode_make_secure_inode() to avoid bypassing the LSM layer - Fix a netfs hang due to missing case in final DIO read result collection - Fix a double put of the netfs_io_request struct - Provide some helpers to abstract out NETFS_RREQ_IN_PROGRESS flag wrangling - Fix infinite looping in netfs_wait_for_pause/request() - Fix a netfs ref leak on an extra subrequest inserted into a request's list of subreqs - Fix various cifs RPC callbacks to set NETFS_SREQ_NEED_RETRY if a subrequest fails retriably - Fix a cifs warning in the workqueue code when reconnecting a channel - Fix the updating of i_size in netfs to avoid a race between testing if we should have extended the file with a DIO write and changing i_size - Merge the places in netfs that update i_size on write - Fix coredump socket selftests * tag 'vfs-6.16-rc5.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: anon_inode: rework assertions netfs: Update tracepoints in a number of ways netfs: Renumber the NETFS_RREQ_* flags to make traces easier to read netfs: Merge i_size update functions netfs: Fix i_size updating smb: client: set missing retry flag in cifs_writev_callback() smb: client: set missing retry flag in cifs_readv_callback() smb: client: set missing retry flag in smb2_writev_callback() netfs: Fix ref leak on inserted extra subreq in write retry netfs: Fix looping in wait functions netfs: Provide helpers to perform NETFS_RREQ_IN_PROGRESS flag wangling netfs: Fix double put of request netfs: Fix hang due to missing case in final DIO read result collection eventpoll: Fix priority inversion problem fuse: fix fuse_fill_write_pages() upper bound calculation fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass selftests/coredump: Fix "socket_detect_userspace_client" test failure commit 4f5b1aa2e40651c8ec196c15e6e8c07e3a0314ca Merge: 043faef334a1f3 3b3312f28ee2d9 Author: Takashi Iwai Date: Fri Jul 4 17:53:03 2025 +0200 Merge tag 'asoc-fix-v6.16-rc4' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.16 An update for the MAINTAINERS file, plus a number of small driver specific fixes and device quirks. commit 9dd1757493416310a5e71146a08bc228869f8dae Author: Anshuman Khandual Date: Fri Jul 4 12:08:12 2025 +0530 arm64/mm: Drop wrong writes into TCR2_EL1 Register X0 contains PIE_E1_ASM and should not be written into REG_TCR2_EL1 which could have an adverse impact otherwise. This has remained undetected till now probably because current value for PIE_E1_ASM (0xcc880e0ac0800000) clears TCR2_EL1 which again gets set subsequently with 'tcr2' after testing for FEAT_TCR2. Drop this unwarranted 'msr' which is a stray change from an earlier commit. This line got re-introduced when rebasing on top of the commit 926b66e2ebc8 ("arm64: setup: name 'tcr2' register"). Cc: Catalin Marinas Cc: Will Deacon Cc: Ryan Roberts Cc: Marc Zyngier Cc: Mark Rutland Cc: linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org Fixes: 7052e808c446 ("arm64/sysreg: Get rid of the TCR2_EL1x SysregFields") Acked-by: Marc Zyngier Signed-off-by: Anshuman Khandual Link: https://lore.kernel.org/r/20250704063812.298914-1-anshuman.khandual@arm.com Signed-off-by: Will Deacon commit 22f3a4f6085951eff28bd1e44d3f388c1d9a5f44 Author: Kevin Brodsky Date: Thu Jun 19 17:00:41 2025 +0100 arm64: poe: Handle spurious Overlay faults We do not currently issue an ISB after updating POR_EL0 when context-switching it, for instance. The rationale is that if the old value of POR_EL0 is more restrictive and causes a fault during uaccess, the access will be retried [1]. In other words, we are trading an ISB on every context-switching for the (unlikely) possibility of a spurious fault. We may also miss faults if the new value of POR_EL0 is more restrictive, but that's considered acceptable. However, as things stand, a spurious Overlay fault results in uaccess failing right away since it causes fault_from_pkey() to return true. If an Overlay fault is reported, we therefore need to double check POR_EL0 against vma_pkey(vma) - this is what arch_vma_access_permitted() already does. As it turns out, we already perform that explicit check if no Overlay fault is reported, and we need to keep that check (see comment added in fault_from_pkey()). Net result: the Overlay ISS2 bit isn't of much help to decide whether a pkey fault occurred. Remove the check for the Overlay bit from fault_from_pkey() and add a comment to try and explain the situation. While at it, also add a comment to permission_overlay_switch() in case anyone gets surprised by the lack of ISB. [1] https://lore.kernel.org/linux-arm-kernel/ZtYNGBrcE-j35fpw@arm.com/ Fixes: 160a8e13de6c ("arm64: context switch POR_EL0 register") Signed-off-by: Kevin Brodsky Link: https://lore.kernel.org/r/20250619160042.2499290-2-kevin.brodsky@arm.com Signed-off-by: Will Deacon commit a75ad2fc76a2ab70817c7eed3163b66ea84ca6ac Author: Mark Brown Date: Fri Jun 20 12:28:48 2025 +0100 arm64: Filter out SME hwcaps when FEAT_SME isn't implemented We have a number of hwcaps for various SME subfeatures enumerated via ID_AA64SMFR0_EL1. Currently we advertise these without cross checking against the main SME feature, advertised in ID_AA64PFR1_EL1.SME which means that if the two are out of sync userspace can see a confusing situation where SME subfeatures are advertised without the base SME hwcap. This can be readily triggered by using the arm64.nosme override which only masks out ID_AA64PFR1_EL1.SME, and there have also been reports of VMMs which do the same thing. Fix this as we did previously for SVE in 064737920bdb ("arm64: Filter out SVE hwcaps when FEAT_SVE isn't implemented") by filtering out the SME subfeature hwcaps when FEAT_SME is not present. Fixes: 5e64b862c482 ("arm64/sme: Basic enumeration support") Reported-by: Yury Khrustalev Signed-off-by: Mark Brown Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250620-arm64-sme-filter-hwcaps-v1-1-02b9d3c2d8ef@kernel.org Signed-off-by: Will Deacon commit 6c66bb655ca3fd5e9304163cf70796d08de512ed Author: Arnd Bergmann Date: Fri Jun 20 13:10:41 2025 +0200 arm64: move smp_send_stop() cpu mask off stack For really large values of CONFIG_NR_CPUS, a CPU mask value should not be put on the stack: arch/arm64/kernel/smp.c:1188:1: error: the frame size of 8544 bytes is larger than 1536 bytes [-Werror=frame-larger-than=] This could be achieved using alloc_cpumask_var(), which makes it depend on CONFIG_CPUMASK_OFFSTACK, but as this function is already serialized and can only run on one CPU, making the variable 'static' is easier. Signed-off-by: Arnd Bergmann Reviewed-by: Catalin Marinas Link: https://lore.kernel.org/r/20250620111045.3364827-1-arnd@kernel.org Signed-off-by: Will Deacon commit d38376b3ee48d073c64e75e150510d7e6b4b04f7 Author: Alessio Belle Date: Tue Jun 24 15:22:08 2025 +0100 drm/imagination: Fix kernel crash when hard resetting the GPU The GPU hard reset sequence calls pm_runtime_force_suspend() and pm_runtime_force_resume(), which according to their documentation should only be used during system-wide PM transitions to sleep states. The main issue though is that depending on some internal runtime PM state as seen by pm_runtime_force_suspend() (whether the usage count is <= 1), pm_runtime_force_resume() might not resume the device unless needed. If that happens, the runtime PM resume callback pvr_power_device_resume() is not called, the GPU clocks are not re-enabled, and the kernel crashes on the next attempt to access GPU registers as part of the power-on sequence. Replace calls to pm_runtime_force_suspend() and pm_runtime_force_resume() with direct calls to the driver's runtime PM callbacks, pvr_power_device_suspend() and pvr_power_device_resume(), to ensure clocks are re-enabled and avoid the kernel crash. Fixes: cc1aeedb98ad ("drm/imagination: Implement firmware infrastructure and META FW support") Signed-off-by: Alessio Belle Reviewed-by: Matt Coster Link: https://lore.kernel.org/r/20250624-fix-kernel-crash-gpu-hard-reset-v1-1-6d24810d72a6@imgtec.com Cc: stable@vger.kernel.org Signed-off-by: Matt Coster commit 0d1c86b840966a278d9b25a9d7c18881980f306e Author: Mark Brown Date: Thu Jun 19 22:15:41 2025 +0100 arm64/gcs: Don't try to access GCS registers if arm64.nogcs is enabled During EL2 setup if GCS is advertised in the ID registers we will reset the GCS control registers GCSCR_EL1 and GCSCRE0_EL1 to known values in order to ensure it is disabled. This is done without taking into account overrides supplied on the command line, meaning that if the user has configured arm64.nogcs we will still access these GCS specific registers. If this was done because EL3 does not enable GCS this results in traps to EL3 and a failed boot which is not what users would expect from having set that parameter. Move the writes to these registers to finalise_el2_state where we can pay attention to the command line overrides. For simplicity we leave the updates to the traps in HCRX_EL2 and the FGT registers in place since these should only be relevant for KVM guests and KVM will manage them itself for guests. This follows the existing practice for other similar traps for overridable features such as those for TPIDR2_EL0 and SMPRI_EL1. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20250619-arm64-fix-nogcs-v1-1-febf2973672e@kernel.org Signed-off-by: Will Deacon commit 0262393c1016783ddaa47a7c67f9180bf59f5068 Merge: 5f596380538610 c5b60592886f97 Author: Greg Kroah-Hartman Date: Fri Jul 4 16:31:28 2025 +0200 Merge tag 'icc-6.16-rc5' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/djakov/icc into char-misc-linus Georgi writes: interconnect fixes for v6.16-rc This contains a few framework core fixes (related to the new dynamic node id feature), as well as some misc Qualcomm and Samsung driver fixes. - interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node - interconnect: exynos: handle node name allocation failure - interconnect: increase ICC_DYN_ID_START - interconnect: icc-clk: destroy nodes in case of memory allocation failures - interconnect: avoid memory allocation when 'icc_bw_lock' is held Signed-off-by: Georgi Djakov * tag 'icc-6.16-rc5' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/djakov/icc: interconnect: avoid memory allocation when 'icc_bw_lock' is held interconnect: icc-clk: destroy nodes in case of memory allocation failures interconnect: increase ICC_DYN_ID_START interconnect: exynos: handle node name allocation failure interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node commit 5f596380538610f6e77437a5c632f7f80106c140 Merge: 9fe58ecd1ed816 1131e70558bc70 Author: Greg Kroah-Hartman Date: Fri Jul 4 16:28:06 2025 +0200 Merge tag 'iio-fixes-for-6.16a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-linus Jonathan writes: iio: 1st set of fixes for the 6.16 cycle The usual mixed back of the recent and ancient issues that have surfaced so far this cycle. iio-core - Fix a possible out of bounds write on writing string terminator. iio-backend: - Fix a possible out of bounds write on writing string terminator. adi,ad3530r - Fix wrong masking for channels 4-7 in powerdown mode as they are in a second register and mask assumed all in one larger register. adi,ad7380 - Fix parsing of adi,gain-milli property by reading it as u16 as specified in the binding. adi,ad7606 - Tweak dt-binding to allow both interrupts and backend to be wired up resolving some dt_schema warnings. - Mask value before returning it in register read as for parallel busses both the value and (unwanted) address are read back. adi,ad7949 - Use spi_is_bpw_supported() to correctly handle bits_per_word_mask == 0 which means default value of 8. invensense,mpu3050 - Fix wrong number of interrupts in the binding as minItems should have been maxItems. maxim,max1363 - Two related fixes for a long running mismatch between array indexes that now results in warnings after the core gained a sanity check. Resulted in unnecessary channels being sampled. nxp,fxls8962 - Fix a use after free in fxls8962af_fifo_flush() if it races with buffer mode tear down. st,sensors - Stop using indio_dev->dev before it was initialized as the parent device should be used anyway for error messages and similar. st,stm32-adc - Fix a race when installing chained IRQ handler. x-powers,axp20x_adc - Add missing sentinel in ADC channel map (avoid out of bounds read). * tag 'iio-fixes-for-6.16a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: iio: dac: ad3530r: Fix incorrect masking for channels 4-7 in powerdown mode iio: adc: ad7380: fix adi,gain-milli property parsing iio: adc: ad7949: use spi_is_bpw_supported() iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps dt-bindings: iio: gyro: invensense,mpu3050: change irq maxItems iio: common: st_sensors: Fix use of uninitialize device structs iio: adc: adi-axi-adc: fix ad7606_bus_reg_read() dt-bindings: iio: adc: adi,ad7606: fix dt_schema validation warning iio: adc: max1363: Reorder mode_list[] entries iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] iio: adc: stm32-adc: Fix race in installing chained IRQ handler iio: fix potential out-of-bound write iio: backend: fix out-of-bound write commit 9fe58ecd1ed8162a96447fe6fbcbfb2f74be0b54 Author: Krzysztof Kozlowski Date: Mon Jun 16 11:38:42 2025 +0200 mux: mmio: Fix missing CONFIG_REGMAP_MMIO MMIO mux uses now regmap_init_mmio(), so one way or another CONFIG_REGMAP_MMIO should be enabled, because there are no stubs for !REGMAP_MMIO case: ERROR: modpost: "__regmap_init_mmio_clk" [drivers/mux/mux-mmio.ko] undefined! Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202505150312.dYbBqUhG-lkp@intel.com/ Fixes: 61de83fd8256 ("mux: mmio: Do not use syscon helper to build regmap") Acked-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250521152354.92720-2-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250616093841.31985-2-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman commit 727c2a53cf959f599493c50a80fe2a356b8b1df6 Author: Marc Zyngier Date: Fri Jun 13 15:19:36 2025 +0100 arm64: Unconditionally select CONFIG_JUMP_LABEL Aneesh reports that his kernel fails to boot in nVHE mode with KVM's protected mode enabled. Further investigation by Mostafa reveals that this fails because CONFIG_JUMP_LABEL=n and that we have static keys shared between EL1 and EL2. While this can be worked around, it is obvious that we have long relied on having CONFIG_JUMP_LABEL enabled at all times, as all supported compilers now have 'asm goto' (which is the basic block for jump labels). Let's simplify our lives once and for all by mandating jump labels. It's not like anyone else is testing anything without them, and we already rely on them for other things (kfence, xfs, preempt). Link: https://lore.kernel.org/r/yq5ah60pkq03.fsf@kernel.org Reported-by: Aneesh Kumar K.V Reported-by: Mostafa Saleh Signed-off-by: Marc Zyngier Cc: Will Deacon Cc: Catalin marinas Cc: Mark Rutland Cc: Ard Biesheuvel Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20250613141936.2219895-1-maz@kernel.org Signed-off-by: Will Deacon commit ef8923e6c051a98164c2889db943df9695a39888 Author: Breno Leitao Date: Fri Jul 4 05:47:07 2025 -0700 arm64: efi: Fix KASAN false positive for EFI runtime stack KASAN reports invalid accesses during arch_stack_walk() for EFI runtime services due to vmalloc tagging[1]. The EFI runtime stack must be allocated with KASAN tags reset to avoid false positives. This patch uses arch_alloc_vmap_stack() instead of __vmalloc_node() for EFI stack allocation, which internally calls kasan_reset_tag() The changes ensure EFI runtime stacks are properly sanitized for KASAN while maintaining functional consistency. Link: https://lore.kernel.org/all/aFVVEgD0236LdrL6@gmail.com/ [1] Suggested-by: Andrey Konovalov Suggested-by: Catalin Marinas Reviewed-by: Catalin Marinas Signed-off-by: Breno Leitao Link: https://lore.kernel.org/r/20250704-arm_kasan-v2-1-32ebb4fd7607@debian.org Signed-off-by: Will Deacon commit b9fd9888a5654e59f6c6249337e36c53c1faa329 Author: Jason Xing Date: Wed Jul 2 14:48:22 2025 +0800 bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL I received a kernel-test-bot report[1] that shows the [-Wunused-but-set-variable] warning. Since the previous commit I made, as the 'Fixes' tag shows, gives users an option to turn on and off the CONFIG_RFS_ACCEL, the issue then can be discovered and reproduced with GCC specifically. Like Simon and Jakub suggested, use fewer #ifdefs which leads to fewer bugs. [1] All warnings (new ones prefixed by >>): drivers/net/ethernet/broadcom/bnxt/bnxt.c: In function 'bnxt_request_irq': >> drivers/net/ethernet/broadcom/bnxt/bnxt.c:10703:9: warning: variable 'j' set but not used [-Wunused-but-set-variable] 10703 | int i, j, rc = 0; | ^ Fixes: 9b6a30febddf ("net: allow rps/rfs related configs to be switched") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506282102.x1tXt0qz-lkp@intel.com/ Signed-off-by: Jason Xing Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 44306a684cd1699b8562a54945ddc43e2abc9eab Author: Mikko Perttunen Date: Wed Jul 2 11:08:07 2025 +0900 drm/tegra: nvdec: Fix dma_alloc_coherent error check Check for NULL return value with dma_alloc_coherent, in line with Robin's fix for vic.c in 'drm/tegra: vic: Fix DMA API misuse'. Fixes: 46f226c93d35 ("drm/tegra: Add NVDEC driver") Signed-off-by: Mikko Perttunen Signed-off-by: Thierry Reding Link: https://lore.kernel.org/r/20250702-nvdec-dma-error-check-v1-1-c388b402c53a@nvidia.com commit fc975cfb36393db1db517fbbe366e550bcdcff14 Author: kuyo chang Date: Wed Jul 2 10:12:25 2025 +0800 sched/deadline: Fix dl_server runtime calculation formula In our testing with 6.12 based kernel on a big.LITTLE system, we were seeing instances of RT tasks being blocked from running on the LITTLE cpus for multiple seconds of time, apparently by the dl_server. This far exceeds the default configured 50ms per second runtime. This is due to the fair dl_server runtime calculation being scaled for frequency & capacity of the cpu. Consider the following case under a Big.LITTLE architecture: Assume the runtime is: 50,000,000 ns, and Frequency/capacity scale-invariance defined as below: Frequency scale-invariance: 100 Capacity scale-invariance: 50 First by Frequency scale-invariance, the runtime is scaled to 50,000,000 * 100 >> 10 = 4,882,812 Then by capacity scale-invariance, it is further scaled to 4,882,812 * 50 >> 10 = 238,418. So it will scaled to 238,418 ns. This smaller "accounted runtime" value is what ends up being subtracted against the fair-server's runtime for the current period. Thus after 50ms of real time, we've only accounted ~238us against the fair servers runtime. This 209:1 ratio in this example means that on the smaller cpu the fair server is allowed to continue running, blocking RT tasks, for over 10 seconds before it exhausts its supposed 50ms of runtime. And on other hardware configurations it can be even worse. For the fair deadline_server, to prevent realtime tasks from being unexpectedly delayed, we really do want to use fixed time, and not scaled time for smaller capacity/frequency cpus. So remove the scaling from the fair server's accounting to fix this. Fixes: a110a81c52a9 ("sched/deadline: Deferrable dl server") Suggested-by: Peter Zijlstra Suggested-by: John Stultz Signed-off-by: kuyo chang Signed-off-by: Peter Zijlstra (Intel) Acked-by: Juri Lelli Acked-by: John Stultz Tested-by: John Stultz Link: https://lore.kernel.org/r/20250702021440.2594736-1-kuyo.chang@mediatek.com commit 25b1b75bbaf96331750fb01302825069657b2ff8 Author: Lu Baolu Date: Sat Jun 28 18:03:51 2025 +0800 iommu/vt-d: Assign devtlb cache tag on ATS enablement Commit <4f1492efb495> ("iommu/vt-d: Revert ATS timing change to fix boot failure") placed the enabling of ATS in the probe_finalize callback. This occurs after the default domain attachment, which is when the ATS cache tag is assigned. Consequently, the device TLB cache tag is missed when the domain is attached, leading to the device TLB not being invalidated in the iommu_unmap paths. Fix this by assigning the CACHE_TAG_DEVTLB cache tag when ATS is enabled. Fixes: 4f1492efb495 ("iommu/vt-d: Revert ATS timing change to fix boot failure") Cc: stable@vger.kernel.org Suggested-by: Kevin Tian Signed-off-by: Lu Baolu Tested-by: Shuicheng Lin Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20250625050135.3129955-1-baolu.lu@linux.intel.com Link: https://lore.kernel.org/r/20250628100351.3198955-2-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel commit 5285b5ed04ab6ad40f7b654eefbccd6ae8cbf415 Author: Milan Krstic Date: Thu Jul 3 14:30:39 2025 +0000 pinctrl: aw9523: fix can_sleep flag for GPIO chip The GPIO expander is connected via I2C, thus the can_sleep flag has to be set to true. This fixes spurious "scheduling while atomic" bugs in the kernel ringbuffer. Signed-off-by: David Bauer Signed-off-by: Milan Krstic Link: https://lore.kernel.org/20250703143039.5809-1-milan.krstic@gmail.com Signed-off-by: Linus Walleij commit 30e0fd3c0273dc106320081793793a424f1f1950 Author: Hugo Villeneuve Date: Thu Jul 3 15:18:29 2025 -0400 gpiolib: fix performance regression when using gpio_chip_get_multiple() commit 74abd086d2ee ("gpiolib: sanitize the return value of gpio_chip::get_multiple()") altered the value returned by gc->get_multiple() in case it is positive (> 0), but failed to return for other cases (<= 0). This may result in the "if (gc->get)" block being executed and thus negates the performance gain that is normally obtained by using gc->get_multiple(). Fix by returning the result of gc->get_multiple() if it is <= 0. Also move the "ret" variable to the scope where it is used, which as an added bonus fixes an indentation error introduced by the aforementioned commit. Fixes: 74abd086d2ee ("gpiolib: sanitize the return value of gpio_chip::get_multiple()") Cc: stable@vger.kernel.org Signed-off-by: Hugo Villeneuve Link: https://lore.kernel.org/r/20250703191829.2952986-1-hugo@hugovil.com Signed-off-by: Bartosz Golaszewski commit a90b2a1aaacbcf0f91d7e4868ad6c51c5dee814b Author: Eyal Birger Date: Thu Jul 3 10:02:58 2025 -0700 xfrm: interface: fix use-after-free after changing collect_md xfrm interface collect_md property on xfrm interfaces can only be set on device creation, thus xfrmi_changelink() should fail when called on such interfaces. The check to enforce this was done only in the case where the xi was returned from xfrmi_locate() which doesn't look for the collect_md interface, and thus the validation was never reached. Calling changelink would thus errornously place the special interface xi in the xfrmi_net->xfrmi hash, but since it also exists in the xfrmi_net->collect_md_xfrmi pointer it would lead to a double free when the net namespace was taken down [1]. Change the check to use the xi from netdev_priv which is available earlier in the function to prevent changes in xfrm collect_md interfaces. [1] resulting oops: [ 8.516540] kernel BUG at net/core/dev.c:12029! [ 8.516552] Oops: invalid opcode: 0000 [#1] SMP NOPTI [ 8.516559] CPU: 0 UID: 0 PID: 12 Comm: kworker/u80:0 Not tainted 6.15.0-virtme #5 PREEMPT(voluntary) [ 8.516565] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 8.516569] Workqueue: netns cleanup_net [ 8.516579] RIP: 0010:unregister_netdevice_many_notify+0x101/0xab0 [ 8.516590] Code: 90 0f 0b 90 48 8b b0 78 01 00 00 48 8b 90 80 01 00 00 48 89 56 08 48 89 32 4c 89 80 78 01 00 00 48 89 b8 80 01 00 00 eb ac 90 <0f> 0b 48 8b 45 00 4c 8d a0 88 fe ff ff 48 39 c5 74 5c 41 80 bc 24 [ 8.516593] RSP: 0018:ffffa93b8006bd30 EFLAGS: 00010206 [ 8.516598] RAX: ffff98fe4226e000 RBX: ffffa93b8006bd58 RCX: ffffa93b8006bc60 [ 8.516601] RDX: 0000000000000004 RSI: 0000000000000000 RDI: dead000000000122 [ 8.516603] RBP: ffffa93b8006bdd8 R08: dead000000000100 R09: ffff98fe4133c100 [ 8.516605] R10: 0000000000000000 R11: 00000000000003d2 R12: ffffa93b8006be00 [ 8.516608] R13: ffffffff96c1a510 R14: ffffffff96c1a510 R15: ffffa93b8006be00 [ 8.516615] FS: 0000000000000000(0000) GS:ffff98fee73b7000(0000) knlGS:0000000000000000 [ 8.516619] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8.516622] CR2: 00007fcd2abd0700 CR3: 000000003aa40000 CR4: 0000000000752ef0 [ 8.516625] PKRU: 55555554 [ 8.516627] Call Trace: [ 8.516632] [ 8.516635] ? rtnl_is_locked+0x15/0x20 [ 8.516641] ? unregister_netdevice_queue+0x29/0xf0 [ 8.516650] ops_undo_list+0x1f2/0x220 [ 8.516659] cleanup_net+0x1ad/0x2e0 [ 8.516664] process_one_work+0x160/0x380 [ 8.516673] worker_thread+0x2aa/0x3c0 [ 8.516679] ? __pfx_worker_thread+0x10/0x10 [ 8.516686] kthread+0xfb/0x200 [ 8.516690] ? __pfx_kthread+0x10/0x10 [ 8.516693] ? __pfx_kthread+0x10/0x10 [ 8.516697] ret_from_fork+0x82/0xf0 [ 8.516705] ? __pfx_kthread+0x10/0x10 [ 8.516709] ret_from_fork_asm+0x1a/0x30 [ 8.516718] Fixes: abc340b38ba2 ("xfrm: interface: support collect metadata mode") Reported-by: Lonial Con Signed-off-by: Eyal Birger Signed-off-by: Steffen Klassert commit 043faef334a1f3d96ae88e1b7618bfa2b4946388 Author: Thorsten Blum Date: Thu Jul 3 22:06:13 2025 +0200 ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() Use pr_warn() instead of dev_warn() when 'pdev' is NULL to avoid a potential NULL pointer dereference. Cc: stable@vger.kernel.org Fixes: 20869176d7a7 ("ALSA: ad1816a: Use standard print API") Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20250703200616.304309-2-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai commit 4cf65845fdd09d711fc7546d60c9abe010956922 Author: Yunshui Jiang Date: Thu Jul 3 21:56:02 2025 -0700 Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() The cs40l50_upload_owt() function allocates memory via kmalloc() without checking for allocation failure, which could lead to a NULL pointer dereference. Return -ENOMEM in case allocation fails. Signed-off-by: Yunshui Jiang Fixes: c38fe1bb5d21 ("Input: cs40l50 - Add support for the CS40L50 haptic driver") Link: https://lore.kernel.org/r/20250704024010.2353841-1-jiangyunshui@kylinos.cn Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit b969f9614885c20f903e1d1f9445611daf161d6d Author: Al Viro Date: Mon Jun 30 02:52:13 2025 -0400 fix proc_sys_compare() handling of in-lookup dentries There's one case where ->d_compare() can be called for an in-lookup dentry; usually that's nothing special from ->d_compare() point of view, but... proc_sys_compare() is weird. The thing is, /proc/sys subdirectories can look differently for different processes. Up to and including having the same name resolve to different dentries - all of them hashed. The way it's done is ->d_compare() refusing to admit a match unless this dentry is supposed to be visible to this caller. The information needed to discriminate between them is stored in inode; it is set during proc_sys_lookup() and until it's done d_splice_alias() we really can't tell who should that dentry be visible for. Normally there's no negative dentries in /proc/sys; we can run into a dying dentry in RCU dcache lookup, but those can be safely rejected. However, ->d_compare() is also called for in-lookup dentries, before they get positive - or hashed, for that matter. In case of match we will wait until dentry leaves in-lookup state and repeat ->d_compare() afterwards. In other words, the right behaviour is to treat the name match as sufficient for in-lookup dentries; if dentry is not for us, we'll see that when we recheck once proc_sys_lookup() is done with it. While we are at it, fix the misspelled READ_ONCE and WRITE_ONCE there. Fixes: d9171b934526 ("parallel lookups machinery, part 4 (and last)") Reported-by: NeilBrown Reviewed-by: Christian Brauner Reviewed-by: NeilBrown Signed-off-by: Al Viro commit da8d8e9001c6a3741e9bec26a6cdcfd75ecabc88 Merge: 8f954c435f6096 5459e16b215c18 Author: Dave Airlie Date: Fri Jul 4 10:01:49 2025 +1000 Merge tag 'drm-xe-fixes-2025-07-03' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Driver Changes: - Fix chunking the PTE updates and overflowing the maximum number of dwords with with MI_STORE_DATA_IMM (Jia Yao) - Move WA BB to the LRC BO to mitigate hangs on context switch (Matthew Brost) - Fix frequency/flush WAs for BMG (Vinay / Lucas) - Fix kconfig prompt title and description (Lucas) - Do not require kunit (Harry Austen / Lucas) - Extend 14018094691 WA to BMG (Daniele) - Fix wedging the device on signal (Matthew Brost) Signed-off-by: Dave Airlie From: Lucas De Marchi Link: https://lore.kernel.org/r/o5662wz6nrlf6xt5sjgxq5oe6qoujefzywuwblm3m626hreifv@foqayqydd6ig commit 3363da82e02f1bddc54faa92ea430c6532e2cd2e Author: Paulo Alcantara Date: Thu Jul 3 17:57:19 2025 -0300 smb: client: fix native SMB symlink traversal We've seen customers having shares mounted in paths like /??/C:/ or /??/UNC/foo.example.com/share in order to get their native SMB symlinks successfully followed from different mounts. After commit 12b466eb52d9 ("cifs: Fix creating and resolving absolute NT-style symlinks"), the client would then convert absolute paths from "/??/C:/" to "/mnt/c/" by default. The absolute paths would vary depending on the value of symlinkroot= mount option. Fix this by restoring old behavior of not trying to convert absolute paths by default. Only do this if symlinkroot= was _explicitly_ set. Before patch: $ mount.cifs //w22-fs0/test2 /mnt/1 -o vers=3.1.1,username=xxx,password=yyy $ ls -l /mnt/1/symlink2 lrwxr-xr-x 1 root root 15 Jun 20 14:22 /mnt/1/symlink2 -> /mnt/c/testfile $ mkdir -p /??/C:; echo foo > //??/C:/testfile $ cat /mnt/1/symlink2 cat: /mnt/1/symlink2: No such file or directory After patch: $ mount.cifs //w22-fs0/test2 /mnt/1 -o vers=3.1.1,username=xxx,password=yyy $ ls -l /mnt/1/symlink2 lrwxr-xr-x 1 root root 15 Jun 20 14:22 /mnt/1/symlink2 -> '/??/C:/testfile' $ mkdir -p /??/C:; echo foo > //??/C:/testfile $ cat /mnt/1/symlink2 foo Cc: linux-cifs@vger.kernel.org Reported-by: Pierguido Lambri Cc: David Howells Cc: Stefan Metzmacher Fixes: 12b466eb52d9 ("cifs: Fix creating and resolving absolute NT-style symlinks") Signed-off-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French commit 266b5d02e14f3a0e07414e11f239397de0577a1d Author: Wang Zhaolong Date: Thu Jul 3 21:29:52 2025 +0800 smb: client: fix race condition in negotiate timeout by using more precise timing When the SMB server reboots and the client immediately accesses the mount point, a race condition can occur that causes operations to fail with "Host is down" error. Reproduction steps: # Mount SMB share mount -t cifs //192.168.245.109/TEST /mnt/ -o xxxx ls /mnt # Reboot server ssh root@192.168.245.109 reboot ssh root@192.168.245.109 /path/to/cifs_server_setup.sh ssh root@192.168.245.109 systemctl stop firewalld # Immediate access fails ls /mnt ls: cannot access '/mnt': Host is down # But works if there is a delay The issue is caused by a race condition between negotiate and reconnect. The 20-second negotiate timeout mechanism can interfere with the normal recovery process when both are triggered simultaneously. ls cifsd --------------------------------------------------- cifs_getattr cifs_revalidate_dentry cifs_get_inode_info cifs_get_fattr smb2_query_path_info smb2_compound_op SMB2_open_init smb2_reconnect cifs_negotiate_protocol smb2_negotiate cifs_send_recv smb_send_rqst wait_for_response cifs_demultiplex_thread cifs_read_from_socket cifs_readv_from_socket server_unresponsive cifs_reconnect __cifs_reconnect cifs_abort_connection mid->mid_state = MID_RETRY_NEEDED cifs_wake_up_task cifs_sync_mid_result // case MID_RETRY_NEEDED rc = -EAGAIN; // In smb2_negotiate() rc = -EHOSTDOWN; The server_unresponsive() timeout triggers cifs_reconnect(), which aborts ongoing mid requests and causes the ls command to receive -EAGAIN, leading to -EHOSTDOWN. Fix this by introducing a dedicated `neg_start` field to precisely tracks when the negotiate process begins. The timeout check now uses this accurate timestamp instead of `lstrp`, ensuring that: 1. Timeout is only triggered after negotiate has actually run for 20s 2. The mechanism doesn't interfere with concurrent recovery processes 3. Uninitialized timestamps (value 0) don't trigger false timeouts Fixes: 7ccc1465465d ("smb: client: fix hang in wait_for_response() for negproto") Signed-off-by: Wang Zhaolong Signed-off-by: Steve French commit 8f954c435f609656308b6f8fe3225e7e22c0076a Merge: ac2ad73e755961 2ab3ba39153dcd Author: Dave Airlie Date: Fri Jul 4 09:40:17 2025 +1000 Merge tag 'samsung-dsim-fixes-for-v6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes - Fixed raw pointer leakage and unsafe behavior in printk() . Switch from %pK to %p for pointer formatting, as %p is now safer and prevents issues like raw pointer leakage and acquiring sleeping locks in atomic contexts. Signed-off-by: Dave Airlie From: Inki Dae Link: https://lore.kernel.org/r/20250629091742.29956-1-inki.dae@samsung.com commit ac2ad73e75596189603995cd4283949863fd7e55 Merge: afd30ace71eecc 5d91394f236167 Author: Dave Airlie Date: Fri Jul 4 09:37:57 2025 +1000 Merge tag 'exynos-drm-fixes-for-v6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes Fixups - Fixed raw pointer leakage and unsafe behavior in printk() . Switch from %pK to %p for pointer formatting, as %p is now safer and prevents issues like raw pointer leakage and acquiring sleeping locks in atomic contexts. - Fixed kernel panic during boot . A NULL pointer dereference issue occasionally occurred when the vblank interrupt handler was called before the DRM driver was fully initialized during boot. So this patch fixes the issue by adding a check in the interrupt handler to ensure the DRM driver is properly initialized. - Fixed a lockup issue on Samsung Peach-Pit/Pi Chromebooks . The issue occurred after commit c9b1150a68d9 changed the call order of CRTC enable/disable and bridge pre_enable/post_disable methods, causing fimd_dp_clock_enable() to be called before the FIMD device was activated. To fix this, runtime PM guards were added to fimd_dp_clock_enable() to ensure proper operation even when CRTC is not enabled. Signed-off-by: Dave Airlie From: Inki Dae Link: https://lore.kernel.org/r/20250629083554.28628-1-inki.dae@samsung.com commit afd30ace71eecc3ba06815c9b554e801e85ab73a Merge: b91e11ec5cd972 8cadce97bf264e Author: Dave Airlie Date: Fri Jul 4 09:26:57 2025 +1000 Merge tag 'drm-intel-fixes-2025-07-03' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Make mei interrupt top half irq disabled to fix RT builds - Fix timeline left held on VMA alloc error - Fix NULL pointer deref in vlv_dphy_param_init() - Fix selftest mock_request() to avoid NULL deref Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://lore.kernel.org/r/aGYVPAA4KvsZqDFx@jlahtine-mobl commit b91e11ec5cd972dc39121496c3a0cf2ec2e9a393 Merge: bf906c988d77d9 226862f50a7a88 Author: Dave Airlie Date: Fri Jul 4 09:06:56 2025 +1000 Merge tag 'drm-misc-fixes-2025-07-03' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes drm-misc-fixes for v6.16-rc5: - Replace simple panel lookup hack with proper fix. - nullpointer deref in vesadrm fix. - fix dma_resv_wait_timeout. - fix error handling in ttm_buffer_object_transfer. - bridge fixes. - Fix vmwgfx accidentally allocating encrypted memory. - Fix race in spsc_queue_push() - Add refcount on backing GEM objects during fb creation. - Fix v3d irq's being enabled during gpu reset. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://lore.kernel.org/r/a7461418-08dc-4b7c-b2fa-264155f66d5e@linux.intel.com commit 2e9fdbe5ec7a65b66da9c202cac621a3a366fde3 Author: Danilo Krummrich Date: Sun Jun 29 17:37:42 2025 +0200 rust: drm: device: drop_in_place() the drm::Device in release() In drm::Device::new() we allocate with __drm_dev_alloc() and return an ARef. When the reference count of the drm::Device falls to zero, the C code automatically calls drm_dev_release(), which eventually frees the memory allocated in drm::Device::new(). However, due to that, drm::Device::drop() is never called. As a result the destructor of the user's private data, i.e. drm::Device::data is never called. Hence, fix this by calling drop_in_place() from the DRM device's release callback. Fixes: 1e4b8896c0f3 ("rust: drm: add device abstraction") Reviewed-by: Alice Ryhl Signed-off-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250629153747.72536-1-dakr@kernel.org commit 8ff4fb276e2384a87ae7f65f3c28e1e139dbb3fe Author: Mario Limonciello Date: Fri Jun 27 10:01:46 2025 -0500 pinctrl: amd: Clear GPIO debounce for suspend soc-button-array hardcodes a debounce value by means of gpio_keys which uses pinctrl-amd as a backend to program debounce for a GPIO. This hardcoded value doesn't match what the firmware intended to be programmed in _AEI. The hardcoded debounce leads to problems waking from suspend. There isn't appetite to conditionalize the behavior in soc-button-array or gpio-keys so clear it when the system suspends to avoid problems with being able to resume. Cc: Dmitry Torokhov Cc: Hans de Goede Fixes: 5c4fa2a6da7fb ("Input: soc_button_array - debounce the buttons") Link: https://lore.kernel.org/linux-input/mkgtrb5gt7miyg6kvqdlbu4nj3elym6ijudobpdi26gp4xxay5@rsa6ytrjvj2q/ Link: https://lore.kernel.org/linux-input/20250625215813.3477840-1-superm1@kernel.org/ Signed-off-by: Mario Limonciello Reviewed-by: Hans de Goede Link: https://lore.kernel.org/20250627150155.3311574-1-superm1@kernel.org Signed-off-by: Linus Walleij commit e79d0ba605d54dd47f3d8a487d00f264b896966c Author: Dave Airlie Date: Thu Jul 3 09:27:07 2025 +1000 nouveau/gsp: add a 50ms delay between fbsr and driver unload rpcs This fixes a bunch of command hangs after runtime suspend/resume. This fixes a regression caused by code movement in the commit below, the commit seems to just change timings enough to cause this to happen now, and adding the sleep seems to avoid it. I've spent some time trying to root cause it to no great avail, it seems like a bug on the firmware side, but it could be a bug in our rpc handling that I can't find. Either way, we should land the workaround to fix the problem, while we continue to work out the root cause. Signed-off-by: Dave Airlie Cc: Ben Skeggs Cc: Danilo Krummrich Fixes: c21b039715ce ("drm/nouveau/gsp: add hals for fbsr.suspend/resume()") Signed-off-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250702232707.175679-1-airlied@gmail.com commit 78f88067d5c56d9aed69f27e238742841461cf67 Author: Aaron Thompson Date: Thu Jul 3 21:19:49 2025 +0000 drm/nouveau: Do not fail module init on debugfs errors If CONFIG_DEBUG_FS is enabled, nouveau_drm_init() returns an error if it fails to create the "nouveau" directory in debugfs. One case where that will happen is when debugfs access is restricted by CONFIG_DEBUG_FS_ALLOW_NONE or by the boot parameter debugfs=off, which cause the debugfs APIs to return -EPERM. So just ignore errors from debugfs. Note that nouveau_debugfs_root may be an error now, but that is a standard pattern for debugfs. From include/linux/debugfs.h: "NOTE: it's expected that most callers should _ignore_ the errors returned by this function. Other debugfs functions handle the fact that the "dentry" passed to them could be an error and they don't crash in that case. Drivers should generally work fine even if debugfs fails to init anyway." Fixes: 97118a1816d2 ("drm/nouveau: create module debugfs root") Cc: stable@vger.kernel.org Signed-off-by: Aaron Thompson Acked-by: Timur Tabi Signed-off-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250703211949.9916-1-dev@aaront.org commit 4c06e63b92038fadb566b652ec3ec04e228931e8 Merge: 025c1970da725b 157501b0469969 Author: Linus Torvalds Date: Thu Jul 3 13:29:56 2025 -0700 Merge tag 'for-6.16-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - tree-log fixes: - fixes of log tracking of directories and subvolumes - fix iteration and error handling of inode references during log replay - fix free space tree rebuild (reported by syzbot) * tag 'for-6.16-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: use btrfs_record_snapshot_destroy() during rmdir btrfs: propagate last_unlink_trans earlier when doing a rmdir btrfs: record new subvolume in parent dir earlier to avoid dir logging races btrfs: fix inode lookup error handling during log replay btrfs: fix iteration of extrefs during log replay btrfs: fix missing error handling when searching for inode refs during log replay btrfs: fix failure to rebuild free space tree using multiple transactions commit 025c1970da725b07701464990f747fe1c2bd797f Merge: 17bbde2e1716e2 021f243627ead1 Author: Linus Torvalds Date: Thu Jul 3 11:52:39 2025 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Driver fixes plus core sd.c fix are all small and obvious. The larger change to hosts.c is less obvious, but required to avoid data corruption caused by bio splitting" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: core: Fix spelling of a sysfs attribute name scsi: core: Enforce unlimited max_segment_size when virt_boundary_mask is set scsi: RDMA/srp: Don't set a max_segment_size when virt_boundary_mask is set scsi: sd: Fix VPD page 0xb7 length check scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() commit 68279380266a5fa70e664de754503338e2ec3f43 Author: Eric Biggers Date: Thu Jul 3 10:23:16 2025 -0700 crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 Commit 88c02b3f79a6 ("s390/sha3: Support sha3 performance enhancements") added the field s390_sha_ctx::first_message_part and made it be used by s390_sha_update() (now s390_sha_update_blocks()). At the time, s390_sha_update() was used by all the s390 SHA-1, SHA-2, and SHA-3 algorithms. However, only the initialization functions for SHA-3 were updated, leaving SHA-1 and SHA-2 using first_message_part uninitialized. This could cause e.g. the function code CPACF_KIMD_SHA_512 | CPACF_KIMD_NIP to be used instead of just CPACF_KIMD_SHA_512. This apparently was harmless, as the SHA-1 and SHA-2 function codes ignore CPACF_KIMD_NIP; it is recognized only by the SHA-3 function codes (https://lore.kernel.org/r/73477fe9-a1dc-4e38-98a6-eba9921e8afa@linux.ibm.com/). Therefore, this bug was found only when first_message_part was later converted to a boolean and UBSAN detected its uninitialized use. Regardless, let's fix this by just initializing to zero. Note: in 6.16, we need to patch SHA-1, SHA-384, and SHA-512. In 6.15 and earlier, we'll also need to patch SHA-224 and SHA-256, as they hadn't yet been librarified (which incidentally fixed this bug). Fixes: 88c02b3f79a6 ("s390/sha3: Support sha3 performance enhancements") Cc: stable@vger.kernel.org Reported-by: Ingo Franzki Closes: https://lore.kernel.org/r/12740696-595c-4604-873e-aefe8b405fbf@linux.ibm.com Acked-by: Heiko Carstens Link: https://lore.kernel.org/r/20250703172316.7914-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 7980ad7e4ca80f6c255f4473fba82a475342035a Author: Andrea Righi Date: Tue Jul 1 08:08:45 2025 +0200 selftests/sched_ext: Fix exit selftest hang on UP On single-CPU systems, ops.select_cpu() is never called, causing the EXIT_SELECT_CPU test case to wait indefinitely. Avoid the stall by skipping this specific sub-test when only one CPU is available. Reported-by: Phil Auld Fixes: a5db7817af780 ("sched_ext: Add selftests") Signed-off-by: Andrea Righi Reviewed-by: Phil Auld Tested-by: Phil Auld Signed-off-by: Tejun Heo commit 17bbde2e1716e2ee4b997d476b48ae85c5a47671 Merge: d32e907d15f725 223e2288f4b8c2 Author: Linus Torvalds Date: Thu Jul 3 09:18:55 2025 -0700 Merge tag 'net-6.16-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from Bluetooth. Current release - new code bugs: - eth: - txgbe: fix the issue of TX failure - ngbe: specify IRQ vector when the number of VFs is 7 Previous releases - regressions: - sched: always pass notifications when child class becomes empty - ipv4: fix stat increase when udp early demux drops the packet - bluetooth: prevent unintended pause by checking if advertising is active - virtio: fix error reporting in virtqueue_resize - eth: - virtio-net: - ensure the received length does not exceed allocated size - fix the xsk frame's length check - lan78xx: fix WARN in __netif_napi_del_locked on disconnect Previous releases - always broken: - bluetooth: mesh: check instances prior disabling advertising - eth: - idpf: convert control queue mutex to a spinlock - dpaa2: fix xdp_rxq_info leak - amd-xgbe: align CL37 AN sequence as per databook" * tag 'net-6.16-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (38 commits) vsock/vmci: Clear the vmci transport packet properly when initializing it dt-bindings: net: sophgo,sg2044-dwmac: Drop status from the example net: ngbe: specify IRQ vector when the number of VFs is 7 net: wangxun: revert the adjustment of the IRQ vector sequence net: txgbe: request MISC IRQ in ndo_open virtio_net: Enforce minimum TX ring size for reliability virtio_net: Cleanup '2+MAX_SKB_FRAGS' virtio_ring: Fix error reporting in virtqueue_resize virtio-net: xsk: rx: fix the frame's length check virtio-net: use the check_mergeable_len helper virtio-net: remove redundant truesize check with PAGE_SIZE virtio-net: ensure the received length does not exceed allocated size net: ipv4: fix stat increase when udp early demux drops the packet net: libwx: fix the incorrect display of the queue number amd-xgbe: do not double read link status net/sched: Always pass notifications when child class becomes empty nui: Fix dma_mapping_error() check rose: fix dangling neighbour pointers in rose_rt_device_down() enic: fix incorrect MTU comparison in enic_change_mtu() amd-xgbe: align CL37 AN sequence as per databook ... commit d32e907d15f7257f69d38b4c829f87a79ecf8b7f Merge: b4911fb0b06089 9e9b46672b1daa Author: Linus Torvalds Date: Thu Jul 3 09:00:04 2025 -0700 Merge tag 'xfs-fixes-6.16-rc5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Carlos Maiolino: - Fix umount hang with unflushable inodes (and add new tracepoint used for debugging this) - Fix ABBA deadlock in xfs_reclaim_inode() vs xfs_ifree_cluster() - Fix dquot buffer pin deadlock * tag 'xfs-fixes-6.16-rc5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: add FALLOC_FL_ALLOCATE_RANGE to supported flags mask xfs: fix unmount hang with unflushable inodes stuck in the AIL xfs: factor out stale buffer item completion xfs: rearrange code in xfs_buf_item.c xfs: add tracepoints for stale pinned inode state debug xfs: avoid dquot buffer pin deadlock xfs: catch stale AGF/AGF metadata xfs: xfs_ifree_cluster vs xfs_iflush_shutdown_abort deadlock xfs: actually use the xfs_growfs_check_rtgeom tracepoint xfs: Improve error handling in xfs_mru_cache_create() xfs: move xfs_submit_zoned_bio a bit xfs: use xfs_readonly_buftarg in xfs_remount_rw xfs: remove NULL pointer checks in xfs_mru_cache_insert xfs: check for shutdown before going to sleep in xfs_select_zone commit 75ef7b8d44c30a76cfbe42dde9413d43055a00a7 Merge: 0d519bb0de3bf0 d6811074203b13 Author: Jens Axboe Date: Thu Jul 3 09:42:07 2025 -0600 Merge tag 'nvme-6.16-2025-07-03' of git://git.infradead.org/nvme into block-6.16 Pull NVMe fixes from Christoph: "- fix incorrect cdw15 value in passthru error logging (Alok Tiwari) - fix memory leak of bio integrity in nvmet (Dmitry Bogdanov) - refresh visible attrs after being checked (Eugen Hristev) - fix suspicious RCU usage warning in the multipath code (Geliang Tang) - correctly account for namespace head reference counter (Nilay Shroff)" * tag 'nvme-6.16-2025-07-03' of git://git.infradead.org/nvme: nvme-multipath: fix suspicious RCU usage warning nvme-pci: refresh visible attrs after being checked nvmet: fix memory leak of bio integrity nvme: correctly account for namespace head reference counter nvme: Fix incorrect cdw15 value in passthru error logging commit c7349772c268ec3c91d83cbfbbcf63f1bd7c256c Author: Luiz Augusto von Dentz Date: Fri Jun 27 11:19:02 2025 -0400 Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected Upon receiving HCI_EVT_LE_BIG_SYNC_ESTABLISHED with status 0x00 (success) the corresponding BIS hci_conn state shall be set to BT_CONNECTED otherwise they will be left with BT_OPEN which is invalid at that point, also create the debugfs and sysfs entries following the same logic as the likes of Broadcast Source BIS and CIS connections. Fixes: f777d8827817 ("Bluetooth: ISO: Notify user space about failed bis connections") Signed-off-by: Luiz Augusto von Dentz commit 314d30b1508682e27c8a324096262c66f23455d9 Author: Luiz Augusto von Dentz Date: Thu Jul 3 09:45:08 2025 -0400 Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle BIS/PA connections do have their own cleanup proceedure which are performed by hci_conn_cleanup/bis_cleanup. Fixes: 23205562ffc8 ("Bluetooth: separate CIS_LINK and BIS_LINK link types") Signed-off-by: Luiz Augusto von Dentz commit 59710a26a289ad4e7ef227d22063e964930928b0 Author: Luiz Augusto von Dentz Date: Mon Jun 30 15:37:46 2025 -0400 Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state The check for destination to be BDADDR_ANY is no longer necessary with the introduction of BIS_LINK. Fixes: 23205562ffc8 ("Bluetooth: separate CIS_LINK and BIS_LINK link types") Signed-off-by: Luiz Augusto von Dentz commit ef9675b0ef030d135413e8638989f3a7d1f3217a Author: Luiz Augusto von Dentz Date: Fri Jun 27 12:31:33 2025 -0400 Bluetooth: hci_sync: Fix not disabling advertising instance As the code comments on hci_setup_ext_adv_instance_sync suggests the advertising instance needs to be disabled in order to update its parameters, but it was wrongly checking that !adv->pending. Fixes: cba6b758711c ("Bluetooth: hci_sync: Make use of hci_cmd_sync_queue set 2") Signed-off-by: Luiz Augusto von Dentz commit 01fdcbc7e5a56c9cba521e0f237cb5c3fd162432 Author: Paul Kocialkowski Date: Tue Jul 1 22:11:23 2025 +0200 clk: sunxi-ng: v3s: Fix TCON clock parents The TCON clock can be parented to both the video PLL and the periph0 PLL. Add the latter, which was missing from the list. Fixes: d0f11d14b0bc ("clk: sunxi-ng: add support for V3s CCU") Signed-off-by: Paul Kocialkowski Link: https://patch.msgid.link/20250701201124.812882-5-paulk@sys-base.io Signed-off-by: Chen-Yu Tsai commit 2b73328629396d32e41ca1f023653b07abf2b42f Author: Paul Kocialkowski Date: Tue Jul 1 22:11:22 2025 +0200 clk: sunxi-ng: v3s: Fix CSI1 MCLK clock name The CSI1 MCLK clock is reported as "csi-mclk" while it is specific to CSI1 as the name of the definition indicates. Fix it in the driver. Fixes: d0f11d14b0bc ("clk: sunxi-ng: add support for V3s CCU") Signed-off-by: Paul Kocialkowski Reviewed-By: Icenowy Zheng Link: https://patch.msgid.link/20250701201124.812882-4-paulk@sys-base.io Signed-off-by: Chen-Yu Tsai commit f45b2949b1a235881255132a119b8cc8c3738bd5 Author: Paul Kocialkowski Date: Tue Jul 1 22:11:21 2025 +0200 clk: sunxi-ng: v3s: Fix CSI SCLK clock name The CSI SCLK clock is incorrectly called CSI1 SCLK while it is used for both the CSI0 and CSI1 interfaces and is called CSI SCLK all around the documentation. Fix the name in the driver, header and device-tree. Fixes: d0f11d14b0bc ("clk: sunxi-ng: add support for V3s CCU") Signed-off-by: Paul Kocialkowski Reviewed-By: Icenowy Zheng Link: https://patch.msgid.link/20250701201124.812882-3-paulk@sys-base.io Signed-off-by: Chen-Yu Tsai commit 3f3fb97374308993dbe8884f44c2579a81b90bfa Merge: c6754d77bd42d0 08a0d93c353bd5 Author: Arnd Bergmann Date: Thu Jul 3 16:27:31 2025 +0200 Merge tag 'apple-soc-fixes-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux into arm/fixes Apple SoC fixes for 6.16 One devicetree fix for a dtbs_warning that's been present for a while: - Rename the PCIe BCM4377 node to conform to the devicetree binding schema Two devicetree fixes for W=1 warnings that have been introduced recently: - Drop {address,size}-cells from SPI NOR which doesn't have any child nodes such that these don't make sense - Move touchbar mipi {address,size}-cells from the dtsi file where the node is disabled and has no children to the dts file where it's enabled and its children are declared Signed-off-by: Sven Peter * tag 'apple-soc-fixes-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux: arm64: dts: apple: Move touchbar mipi {address,size}-cells from dtsi to dts arm64: dts: apple: Drop {address,size}-cells from SPI NOR arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename commit c6754d77bd42d0ca35df8bdcf481b5984141ed1f Merge: f31824a60213dd 312d02adb959ea Author: Arnd Bergmann Date: Thu Jul 3 16:26:08 2025 +0200 Merge tag 'optee-fix-for-v6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into arm/fixes A fix in the OP-TEE driver for v6.16 Fixing a sleep in atomic context in the FF-A notification callback by adding a work queue to process in a non-atomic context. * tag 'optee-fix-for-v6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: optee: ffa: fix sleep in atomic context commit f31824a60213dd12bddd5b7c2e7e8adbeda61929 Merge: 9a5d769c908467 8d2c2fa2209e83 Author: Arnd Bergmann Date: Thu Jul 3 16:23:53 2025 +0200 Merge tag 'samsung-fixes-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into arm/fixes Samsung SoC fixes for v6.16 1. Correct CONFIG option in arm64 defconfig enabling the Qualcomm SoC SNPS EUSB2 phy driver, because Kconfig entry was renamed when changing the driver to a common one, shared with Samsung SoC, thus defconfig lost that driver effectively. 2. Exynos ACPM: Fix timeouts happening with multiple requests. * tag 'samsung-fixes-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: firmware: exynos-acpm: fix timeouts on xfers handling arm64: defconfig: update renamed PHY_SNPS_EUSB2 commit 5459e16b215c18529782e7746992653f00de0779 Author: Matthew Brost Date: Tue Jun 24 10:41:03 2025 -0700 drm/xe: Do not wedge device on killed exec queues When a user closes an exec queue or interrupts an app with Ctrl-C, this does not warrant wedging the device in mode 2. Avoid this by skipping the wedge check for killed exec queues in the TDR and LR exec queue cleanup worker. Signed-off-by: Matthew Brost Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250624174103.2707941-1-matthew.brost@intel.com (cherry picked from commit 5a2f117a80c207372513ca8964eeb178874f4990) Signed-off-by: Lucas De Marchi commit d008fc65ebbc7d0f36c5a90c8b1ef117c295d8d8 Author: Daniele Ceraolo Spurio Date: Fri Jun 13 16:11:29 2025 -0700 drm/xe: Extend WA 14018094691 to BMG This WA is applicable to BMG as well. Note that this is a GSC WA and we don't load the GSC on BMG, so extending the WA to BMG won't do anything right now. However, it helps future-proof the driver so that if we ever turn the GSC on we won't have to remember to extend this WA. v2: don't use VERSION_RANGE from 2001 to 2004 (Matt) Signed-off-by: Daniele Ceraolo Spurio Cc: Matt Roper Reviewed-by: Matt Roper Link: https://lore.kernel.org/r/20250613231128.1261815-2-daniele.ceraolospurio@intel.com (cherry picked from commit 1a5ce0c5b95b0624ebd44f574b98003a466973be) Signed-off-by: Lucas De Marchi commit ff09b71bf9daeca4f21d6e5e449641c9fad75b53 Author: Thomas Fourier Date: Mon Jun 30 11:35:07 2025 +0200 mmc: bcm2835: Fix dma_unmap_sg() nents value The dma_unmap_sg() functions should be called with the same nents as the dma_map_sg(), not the value the map function returned. Fixes: 2f5da678351f ("mmc: bcm2835: Properly handle dmaengine_prep_slave_sg") Signed-off-by: Thomas Fourier Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250630093510.82871-2-fourier.thomas@gmail.com Signed-off-by: Ulf Hansson commit 9a5d769c9084678c0f21c3f9cf83ca17466a16fb Merge: 86731a2a651e58 4c46a471be1221 Author: Arnd Bergmann Date: Thu Jul 3 13:56:15 2025 +0200 Merge tag 'ffa-fixes-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes Arm FF-A fixes for v6.16 Couple of fixes to address: 1. The safety and memory issues in the FF-A notification callback handler: The fixes replaces a mutex with an rwlock to prevent sleeping in atomic context, resolving kernel warnings. Memory allocation is moved outside the lock to support this transition safely. Additionally, a memory leak in the notifier unregistration path is fixed by properly freeing the callback node. 2. The missing entry in struct ffa_indirect_msg_hdr: The fix adds the missing 32 bit reserved entry in the structure as required by the FF-A specification. * tag 'ffa-fixes-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_ffa: Fix the missing entry in struct ffa_indirect_msg_hdr firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context firmware: arm_ffa: Move memory allocation outside the mutex locking firmware: arm_ffa: Fix memory leak by freeing notifier callback node Link: https://lore.kernel.org/r/20250609105207.1185570-1-sudeep.holla@arm.com Signed-off-by: Arnd Bergmann commit 6d0b1c01847fedd7c85a5cdf59b8cfc7d14512e6 Author: Judith Mendez Date: Thu Jun 26 18:14:52 2025 -0500 mmc: sdhci_am654: Workaround for Errata i2312 Errata i2312 [0] for K3 silicon mentions the maximum obtainable timeout through MMC host controller is 700ms. And for commands taking longer than 700ms, hardware timeout should be disabled and software timeout should be used. The workaround for Errata i2312 can be achieved by adding SDHCI_QUIRK2_DISABLE_HW_TIMEOUT quirk in sdhci_am654. [0] https://www.ti.com/lit/pdf/sprz487 Signed-off-by: Judith Mendez Acked-by: Adrian Hunter Fixes: 41fd4caeb00b ("mmc: sdhci_am654: Add Initial Support for AM654 SDHCI driver") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250626231452.3460987-1-jm@ti.com Signed-off-by: Ulf Hansson commit c9764fd88bc744592b0604ccb6b6fc1a5f76b4e3 Author: Manivannan Sadhasivam Date: Thu Jul 3 16:05:49 2025 +0530 regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods drvdata::gpiods is supposed to hold an array of 'gpio_desc' pointers. But the memory is allocated for only one pointer. This will lead to out-of-bounds access later in the code if 'config::ngpios' is > 1. So fix the code to allocate enough memory to hold 'config::ngpios' of GPIO descriptors. While at it, also move the check for memory allocation failure to be below the allocation to make it more readable. Cc: stable@vger.kernel.org # 5.0 Fixes: d6cd33ad7102 ("regulator: gpio: Convert to use descriptors") Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250703103549.16558-1-mani@kernel.org Signed-off-by: Mark Brown commit 3b3312f28ee2d9c386602f8521e419cfc69f4823 Author: Richard Fitzgerald Date: Thu Jul 3 11:25:21 2025 +0100 ASoC: cs35l56: probe() should fail if the device ID is not recognized Return an error from driver probe if the DEVID read from the chip is not one supported by this driver. In cs35l56_hw_init() there is a check for valid DEVID, but the invalid case was returning the value of ret. At this point in the code ret == 0 so the caller would think that cs35l56_hw_init() was successful. Signed-off-by: Richard Fitzgerald Fixes: 84851aa055c8 ("ASoC: cs35l56: Move part of cs35l56_init() to shared library") Link: https://patch.msgid.link/20250703102521.54204-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 50c78f398e92fafa1cbba3469c95fe04b2e4206d Author: Edson Juliano Drosdeck Date: Thu Jun 26 08:24:42 2025 -0300 mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models Disable command queuing on Intel GLK-based Positivo models. Without this quirk, CQE (Command Queuing Engine) causes instability or I/O errors during operation. Disabling it ensures stable operation on affected devices. Signed-off-by: Edson Juliano Drosdeck Fixes: bedf9fc01ff1 ("mmc: sdhci: Workaround broken command queuing on Intel GLK") Cc: stable@vger.kernel.org Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20250626112442.9791-1-edson.drosdeck@gmail.com Signed-off-by: Ulf Hansson commit de1675de39aa945bad5937d1fde4df3682670639 Author: Rafael J. Wysocki Date: Thu Jul 3 12:54:55 2025 +0200 Revert "ACPI: battery: negate current when discharging" Revert commit 234f71555019 ("ACPI: battery: negate current when discharging") breaks not one but several userspace implementations of battery monitoring: Steam and MangoHud. Perhaps it breaks more, but those are the two that have been tested. Reported-by: Matthew Schwartz Closes: https://lore.kernel.org/linux-acpi/87C1B2AF-D430-4568-B620-14B941A8ABA4@linux.dev/ Signed-off-by: Rafael J. Wysocki commit 223e2288f4b8c262a864e2c03964ffac91744cd5 Author: HarshaVardhana S A Date: Tue Jul 1 14:22:54 2025 +0200 vsock/vmci: Clear the vmci transport packet properly when initializing it In vmci_transport_packet_init memset the vmci_transport_packet before populating the fields to avoid any uninitialised data being left in the structure. Cc: Bryan Tan Cc: Vishnu Dasa Cc: Broadcom internal kernel review list Cc: Stefano Garzarella Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Simon Horman Cc: virtualization@lists.linux.dev Cc: netdev@vger.kernel.org Cc: stable Signed-off-by: HarshaVardhana S A Signed-off-by: Greg Kroah-Hartman Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") Acked-by: Stefano Garzarella Link: https://patch.msgid.link/20250701122254.2397440-1-gregkh@linuxfoundation.org Signed-off-by: Paolo Abeni commit f030713e5abf67d0a88864c8855f809c763af954 Author: Krzysztof Kozlowski Date: Tue Jul 1 08:36:22 2025 +0200 dt-bindings: net: sophgo,sg2044-dwmac: Drop status from the example Examples should be complete and should not have a 'status' property, especially a disabled one because this disables the dt_binding_check of the example against the schema. Dropping 'status' property shows missing other properties - phy-mode and phy-handle. Fixes: 114508a89ddc ("dt-bindings: net: Add support for Sophgo SG2044 dwmac") Cc: Signed-off-by: Krzysztof Kozlowski Reviewed-by: Alexander Sverdlin Reviewed-by: Chen Wang Link: https://patch.msgid.link/20250701063621.23808-2-krzysztof.kozlowski@linaro.org Signed-off-by: Paolo Abeni commit b2f8ef030ef77130844c4b6f1eee28553163d5a7 Merge: b0727b0ccd907a 4174c0c331a2aa Author: Paolo Abeni Date: Thu Jul 3 11:51:41 2025 +0200 Merge branch 'fix-irq-vectors' Jiawen Wu says: ==================== Fix IRQ vectors The interrupt vector order was adjusted by [1]commit 937d46ecc5f9 ("net: wangxun: add ethtool_ops for channel number") in Linux-6.8. Because at that time, the MISC interrupt acts as the parent interrupt in the GPIO IRQ chip. When the number of Rx/Tx ring changes, the last MISC interrupt must be reallocated. Then the GPIO interrupt controller would be corrupted. So the initial plan was to adjust the sequence of the interrupt vectors, let MISC interrupt to be the first one and do not free it. Later, irq_domain was introduced in [2]commit aefd013624a1 ("net: txgbe: use irq_domain for interrupt controller") to avoid this problem. However, the vector sequence adjustment was not reverted. So there is still one problem that has been left unresolved. Due to hardware limitations of NGBE, queue IRQs can only be requested on vector 0 to 7. When the number of queues is set to the maximum 8, the PCI IRQ vectors are allocated from 0 to 8. The vector 0 is used by MISC interrupt, and althrough the vector 8 is used by queue interrupt, it is unable to receive packets. This will cause some packets to be dropped when RSS is enabled and they are assigned to queue 8. This patch set fix the above problems. [1] https://git.kernel.org/netdev/net-next/c/937d46ecc5f9 [2] https://git.kernel.org/netdev/net-next/c/aefd013624a1 ==================== Link: https://patch.msgid.link/20250701063030.59340-1-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni commit 4174c0c331a2aa3322d3b3be532808deb041b37d Author: Jiawen Wu Date: Tue Jul 1 14:30:30 2025 +0800 net: ngbe: specify IRQ vector when the number of VFs is 7 For NGBE devices, the queue number is limited to be 1 when SRIOV is enabled. In this case, IRQ vector[0] is used for MISC and vector[1] is used for queue, based on the previous patches. But for the hardware design, the IRQ vector[1] must be allocated for use by the VF[6] when the number of VFs is 7. So the IRQ vector[0] should be shared for PF MISC and QUEUE interrupts. +-----------+----------------------+ | Vector | Assigned To | +-----------+----------------------+ | Vector 0 | PF MISC and QUEUE | | Vector 1 | VF 6 | | Vector 2 | VF 5 | | Vector 3 | VF 4 | | Vector 4 | VF 3 | | Vector 5 | VF 2 | | Vector 6 | VF 1 | | Vector 7 | VF 0 | +-----------+----------------------+ Minimize code modifications, only adjust the IRQ vector number for this case. Fixes: 877253d2cbf2 ("net: ngbe: add sriov function support") Signed-off-by: Jiawen Wu Reviewed-by: Larysa Zaremba Link: https://patch.msgid.link/20250701063030.59340-4-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni commit e37546ad1f9b2c777d3a21d7e50ce265ee3dece8 Author: Jiawen Wu Date: Tue Jul 1 14:30:29 2025 +0800 net: wangxun: revert the adjustment of the IRQ vector sequence Due to hardware limitations of NGBE, queue IRQs can only be requested on vector 0 to 7. When the number of queues is set to the maximum 8, the PCI IRQ vectors are allocated from 0 to 8. The vector 0 is used by MISC interrupt, and althrough the vector 8 is used by queue interrupt, it is unable to receive packets. This will cause some packets to be dropped when RSS is enabled and they are assigned to queue 8. So revert the adjustment of the MISC IRQ location, to make it be the last one in IRQ vectors. Fixes: 937d46ecc5f9 ("net: wangxun: add ethtool_ops for channel number") Cc: stable@vger.kernel.org Signed-off-by: Jiawen Wu Reviewed-by: Larysa Zaremba Link: https://patch.msgid.link/20250701063030.59340-3-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni commit cc9f7f65cd2f31150b10e6956f1f0882e1bbae49 Author: Jiawen Wu Date: Tue Jul 1 14:30:28 2025 +0800 net: txgbe: request MISC IRQ in ndo_open Move the creating of irq_domain for MISC IRQ from .probe to .ndo_open, and free it in .ndo_stop, to maintain consistency with the queue IRQs. This it for subsequent adjustments to the IRQ vectors. Fixes: aefd013624a1 ("net: txgbe: use irq_domain for interrupt controller") Cc: stable@vger.kernel.org Signed-off-by: Jiawen Wu Reviewed-by: Michal Swiatkowski Link: https://patch.msgid.link/20250701063030.59340-2-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni commit b0727b0ccd907aa669ba48027f29019f1c48d42c Merge: 5177373c31318c 24b2f5df86aaeb Author: Paolo Abeni Date: Thu Jul 3 11:40:04 2025 +0200 Merge branch 'virtio-fixes-for-tx-ring-sizing-and-resize-error-reporting' Laurent Vivier says: ==================== virtio: Fixes for TX ring sizing and resize error reporting This patch series contains two fixes and a cleanup for the virtio subsystem. The first patch fixes an error reporting bug in virtio_ring's virtqueue_resize() function. Previously, errors from internal resize helpers could be masked if the subsequent re-enabling of the virtqueue succeeded. This patch restores the correct error propagation, ensuring that callers of virtqueue_resize() are properly informed of underlying resize failures. The second patch does a cleanup of the use of '2+MAX_SKB_FRAGS' The third patch addresses a reliability issue in virtio_net where the TX ring size could be configured too small, potentially leading to persistently stopped queues and degraded performance. It enforces a minimum TX ring size to ensure there's always enough space for at least one maximally-fragmented packet plus an additional slot. ==================== Link: https://patch.msgid.link/20250521092236.661410-1-lvivier@redhat.com Signed-off-by: Paolo Abeni commit 24b2f5df86aaebbe7bac40304eaf5a146c02367c Author: Laurent Vivier Date: Wed May 21 11:22:36 2025 +0200 virtio_net: Enforce minimum TX ring size for reliability The `tx_may_stop()` logic stops TX queues if free descriptors (`sq->vq->num_free`) fall below the threshold of (`MAX_SKB_FRAGS` + 2). If the total ring size (`ring_num`) is not strictly greater than this value, queues can become persistently stopped or stop after minimal use, severely degrading performance. A single sk_buff transmission typically requires descriptors for: - The virtio_net_hdr (1 descriptor) - The sk_buff's linear data (head) (1 descriptor) - Paged fragments (up to MAX_SKB_FRAGS descriptors) This patch enforces that the TX ring size ('ring_num') must be strictly greater than (MAX_SKB_FRAGS + 2). This ensures that the ring is always large enough to hold at least one maximally-fragmented packet plus at least one additional slot. Reported-by: Lei Yang Signed-off-by: Laurent Vivier Reviewed-by: Xuan Zhuo Acked-by: Jason Wang Link: https://patch.msgid.link/20250521092236.661410-4-lvivier@redhat.com Tested-by: Lei Yang Acked-by: Michael S. Tsirkin Signed-off-by: Paolo Abeni commit bd2948d2581ebd31745c1b7094a470513789555f Author: Laurent Vivier Date: Wed May 21 11:22:35 2025 +0200 virtio_net: Cleanup '2+MAX_SKB_FRAGS' Improve consistency by using everywhere it is needed 'MAX_SKB_FRAGS + 2' rather than '2+MAX_SKB_FRAGS' or '2 + MAX_SKB_FRAGS'. No functional change. Signed-off-by: Laurent Vivier Reviewed-by: Xuan Zhuo Acked-by: Jason Wang Link: https://patch.msgid.link/20250521092236.661410-3-lvivier@redhat.com Tested-by: Lei Yang Acked-by: Michael S. Tsirkin Signed-off-by: Paolo Abeni commit 45ebc7e6c125ce93d2ddf82cd5bea20121bb0258 Author: Laurent Vivier Date: Wed May 21 11:22:34 2025 +0200 virtio_ring: Fix error reporting in virtqueue_resize The virtqueue_resize() function was not correctly propagating error codes from its internal resize helper functions, specifically virtqueue_resize_packet() and virtqueue_resize_split(). If these helpers returned an error, but the subsequent call to virtqueue_enable_after_reset() succeeded, the original error from the resize operation would be masked. Consequently, virtqueue_resize() could incorrectly report success to its caller despite an underlying resize failure. This change restores the original code behavior: if (vdev->config->enable_vq_after_reset(_vq)) return -EBUSY; return err; Fix: commit ad48d53b5b3f ("virtio_ring: separate the logic of reset/enable from virtqueue_resize") Cc: xuanzhuo@linux.alibaba.com Signed-off-by: Laurent Vivier Acked-by: Jason Wang Link: https://patch.msgid.link/20250521092236.661410-2-lvivier@redhat.com Tested-by: Lei Yang Acked-by: Michael S. Tsirkin Signed-off-by: Paolo Abeni commit 42ce432522a17685f5a84529de49e555477c0a1f Author: Mark Rutland Date: Thu Jun 19 14:48:17 2025 +0100 KVM: arm64: Remove kvm_arch_vcpu_run_map_fp() Historically KVM hyp code saved the host's FPSIMD state into the hosts's fpsimd_state memory, and so it was necessary to map this into the hyp Stage-1 mappings before running a vCPU. This is no longer necessary as of commits: * fbc7e61195e2 ("KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state") * 8eca7f6d5100 ("KVM: arm64: Remove host FPSIMD saving for non-protected KVM") Since those commits, we eagerly save the host's FPSIMD state before calling into hyp to run a vCPU, and hyp code never reads nor writes the host's fpsimd_state memory. There's no longer any need to map the host's fpsimd_state memory into the hyp Stage-1, and kvm_arch_vcpu_run_map_fp() is unnecessary but benign. Remove kvm_arch_vcpu_run_map_fp(). Currently there is no code to perform a corresponding unmap, and we never mapped the host's SVE or SME state into the hyp Stage-1, so no other code needs to be removed. Signed-off-by: Mark Rutland Cc: Catalin Marinas Cc: Fuad Tabba Cc: Marc Zyngier Cc: Mark Brown Cc: Oliver Upton Cc: Will Deacon Cc: kvmarm@lists.linux.dev Reviewed-by: Mark Brown Tested-by: Fuad Tabba Reviewed-by: Fuad Tabba Link: https://lore.kernel.org/r/20250619134817.4075340-1-mark.rutland@arm.com Signed-off-by: Marc Zyngier commit 105485a182dc6ba32e55db46839af756c105afae Author: Marc Zyngier Date: Tue Jul 1 15:02:58 2025 +0100 KVM: arm64: Fix handling of FEAT_GTG for unimplemented granule sizes Booting an EL2 guest on a system only supporting a subset of the possible page sizes leads to interesting situations. For example, on a system that only supports 4kB and 64kB, and is booted with a 4kB kernel, we end-up advertising 16kB support at stage-2, which is pretty weird. That's because we consider that any S2 bigger than our base granule is fair game, irrespective of what the HW actually supports. While this is not impossible to support (KVM would happily handle it), it is likely to be confusing for the guest. Add new checks that will verify that this granule size is actually supported before publishing it to the guest. Fixes: e7ef6ed4583ea ("KVM: arm64: Enforce NV limits on a per-idregs basis") Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit 38224c472a038fa9ccd4085511dd9f3d6119dbf9 Author: Qasim Ijaz Date: Tue Jun 24 13:52:56 2025 +0100 HID: appletb-kbd: fix slab use-after-free bug in appletb_kbd_probe In probe appletb_kbd_probe() a "struct appletb_kbd *kbd" is allocated via devm_kzalloc() to store touch bar keyboard related data. Later on if backlight_device_get_by_name() finds a backlight device with name "appletb_backlight" a timer (kbd->inactivity_timer) is setup with appletb_inactivity_timer() and the timer is armed to run after appletb_tb_dim_timeout (60) seconds. A use-after-free is triggered when failure occurs after the timer is armed. This ultimately means probe failure occurs and as a result the "struct appletb_kbd *kbd" which is device managed memory is freed. After 60 seconds the timer will have expired and __run_timers will attempt to access the timer (kbd->inactivity_timer) however the kdb structure has been freed causing a use-after free. [ 71.636938] ================================================================== [ 71.637915] BUG: KASAN: slab-use-after-free in __run_timers+0x7ad/0x890 [ 71.637915] Write of size 8 at addr ffff8881178c5958 by task swapper/1/0 [ 71.637915] [ 71.637915] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.16.0-rc2-00318-g739a6c93cc75-dirty #12 PREEMPT(voluntary) [ 71.637915] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 71.637915] Call Trace: [ 71.637915] [ 71.637915] dump_stack_lvl+0x53/0x70 [ 71.637915] print_report+0xce/0x670 [ 71.637915] ? __run_timers+0x7ad/0x890 [ 71.637915] kasan_report+0xce/0x100 [ 71.637915] ? __run_timers+0x7ad/0x890 [ 71.637915] __run_timers+0x7ad/0x890 [ 71.637915] ? __pfx___run_timers+0x10/0x10 [ 71.637915] ? update_process_times+0xfc/0x190 [ 71.637915] ? __pfx_update_process_times+0x10/0x10 [ 71.637915] ? _raw_spin_lock_irq+0x80/0xe0 [ 71.637915] ? _raw_spin_lock_irq+0x80/0xe0 [ 71.637915] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ 71.637915] run_timer_softirq+0x141/0x240 [ 71.637915] ? __pfx_run_timer_softirq+0x10/0x10 [ 71.637915] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 71.637915] ? kvm_clock_get_cycles+0x18/0x30 [ 71.637915] ? ktime_get+0x60/0x140 [ 71.637915] handle_softirqs+0x1b8/0x5c0 [ 71.637915] ? __pfx_handle_softirqs+0x10/0x10 [ 71.637915] irq_exit_rcu+0xaf/0xe0 [ 71.637915] sysvec_apic_timer_interrupt+0x6c/0x80 [ 71.637915] [ 71.637915] [ 71.637915] Allocated by task 39: [ 71.637915] kasan_save_stack+0x33/0x60 [ 71.637915] kasan_save_track+0x14/0x30 [ 71.637915] __kasan_kmalloc+0x8f/0xa0 [ 71.637915] __kmalloc_node_track_caller_noprof+0x195/0x420 [ 71.637915] devm_kmalloc+0x74/0x1e0 [ 71.637915] appletb_kbd_probe+0x37/0x3c0 [ 71.637915] hid_device_probe+0x2d1/0x680 [ 71.637915] really_probe+0x1c3/0x690 [ 71.637915] __driver_probe_device+0x247/0x300 [ 71.637915] driver_probe_device+0x49/0x210 [...] [ 71.637915] [ 71.637915] Freed by task 39: [ 71.637915] kasan_save_stack+0x33/0x60 [ 71.637915] kasan_save_track+0x14/0x30 [ 71.637915] kasan_save_free_info+0x3b/0x60 [ 71.637915] __kasan_slab_free+0x37/0x50 [ 71.637915] kfree+0xcf/0x360 [ 71.637915] devres_release_group+0x1f8/0x3c0 [ 71.637915] hid_device_probe+0x315/0x680 [ 71.637915] really_probe+0x1c3/0x690 [ 71.637915] __driver_probe_device+0x247/0x300 [ 71.637915] driver_probe_device+0x49/0x210 [...] The root cause of the issue is that the timer is not disarmed on failure paths leading to it remaining active and accessing freed memory. To fix this call timer_delete_sync() to deactivate the timer. Another small issue is that timer_delete_sync is called unconditionally in appletb_kbd_remove(), fix this by checking for a valid kbd->backlight_dev before calling timer_delete_sync. Fixes: 93a0fc489481 ("HID: hid-appletb-kbd: add support for automatic brightness control while using the touchbar") Cc: stable@vger.kernel.org Signed-off-by: Qasim Ijaz Reviewed-by: Aditya Garg Signed-off-by: Jiri Kosina commit 5177373c31318c3c6a190383bfd232e6cf565c36 Author: Bui Quang Minh Date: Mon Jun 30 22:13:14 2025 +0700 virtio-net: xsk: rx: fix the frame's length check When calling buf_to_xdp, the len argument is the frame data's length without virtio header's length (vi->hdr_len). We check that len with xsk_pool_get_rx_frame_size() + vi->hdr_len to ensure the provided len does not larger than the allocated chunk size. The additional vi->hdr_len is because in virtnet_add_recvbuf_xsk, we use part of XDP_PACKET_HEADROOM for virtio header and ask the vhost to start placing data from hard_start + XDP_PACKET_HEADROOM - vi->hdr_len not hard_start + XDP_PACKET_HEADROOM But the first buffer has virtio_header, so the maximum frame's length in the first buffer can only be xsk_pool_get_rx_frame_size() not xsk_pool_get_rx_frame_size() + vi->hdr_len like in the current check. This commit adds an additional argument to buf_to_xdp differentiate between the first buffer and other ones to correctly calculate the maximum frame's length. Cc: stable@vger.kernel.org Reviewed-by: Xuan Zhuo Fixes: a4e7ba702701 ("virtio_net: xsk: rx: support recv small mode") Signed-off-by: Bui Quang Minh Link: https://patch.msgid.link/20250630151315.86722-2-minhquangbui99@gmail.com Signed-off-by: Paolo Abeni commit c9cbbe7ab6f31ba91c47c09eee75017d5b69462d Merge: bd475eeaaf3cad 7d4a119e45828e Author: Paolo Abeni Date: Thu Jul 3 10:56:57 2025 +0200 Merge branch 'virtio-net-fixes-for-mergeable-xdp-receive-path' Bui Quang Minh says: ==================== virtio-net: fixes for mergeable XDP receive path This series contains fixes for XDP receive path in virtio-net - Patch 1: add a missing check for the received data length with our allocated buffer size in mergeable mode. - Patch 2: remove a redundant truesize check with PAGE_SIZE in mergeable mode - Patch 3: make the current repeated code use the check_mergeable_len to check for received data length in mergeable mode ==================== Link: https://patch.msgid.link/20250630144212.48471-1-minhquangbui99@gmail.com Signed-off-by: Paolo Abeni commit 7d4a119e45828e643baedea2d2ac736804bc85ee Author: Bui Quang Minh Date: Mon Jun 30 21:42:12 2025 +0700 virtio-net: use the check_mergeable_len helper Replace the current repeated code to check received length in mergeable mode with the new check_mergeable_len helper. Signed-off-by: Bui Quang Minh Acked-by: Jason Wang Link: https://patch.msgid.link/20250630144212.48471-4-minhquangbui99@gmail.com Signed-off-by: Paolo Abeni commit 4be2193b3393dca33504793fe7586fed547abb5d Author: Bui Quang Minh Date: Mon Jun 30 21:42:11 2025 +0700 virtio-net: remove redundant truesize check with PAGE_SIZE The truesize is guaranteed not to exceed PAGE_SIZE in get_mergeable_buf_len(). It is saved in mergeable context, which is not changeable by the host side, so the check in receive path is quite redundant. Acked-by: Jason Wang Signed-off-by: Bui Quang Minh Link: https://patch.msgid.link/20250630144212.48471-3-minhquangbui99@gmail.com Signed-off-by: Paolo Abeni commit 315dbdd7cdf6aa533829774caaf4d25f1fd20e73 Author: Bui Quang Minh Date: Mon Jun 30 21:42:10 2025 +0700 virtio-net: ensure the received length does not exceed allocated size In xdp_linearize_page, when reading the following buffers from the ring, we forget to check the received length with the true allocate size. This can lead to an out-of-bound read. This commit adds that missing check. Cc: Fixes: 4941d472bf95 ("virtio-net: do not reset during XDP set") Signed-off-by: Bui Quang Minh Acked-by: Jason Wang Link: https://patch.msgid.link/20250630144212.48471-2-minhquangbui99@gmail.com Signed-off-by: Paolo Abeni commit ba677dbe77af5ffe6204e0f3f547f3ba059c6302 Author: Peter Zijlstra Date: Wed Jul 2 18:21:44 2025 +0200 perf: Revert to requiring CAP_SYS_ADMIN for uprobes Jann reports that uprobes can be used destructively when used in the middle of an instruction. The kernel only verifies there is a valid instruction at the requested offset, but due to variable instruction length cannot determine if this is an instruction as seen by the intended execution stream. Additionally, Mark Rutland notes that on architectures that mix data in the text segment (like arm64), a similar things can be done if the data word is 'mistaken' for an instruction. As such, require CAP_SYS_ADMIN for uprobes. Fixes: c9e0924e5c2b ("perf/core: open access to probes for CAP_PERFMON privileged process") Reported-by: Jann Horn Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/CAG48ez1n4520sq0XrWYDHKiKxE_+WCfAK+qt9qkY4ZiBGmL-5g@mail.gmail.com commit 194808a1ea391e35d364d6c9406e2eccb6174525 Author: Vicki Pfau Date: Tue Jul 1 20:46:42 2025 -0700 HID: Fix debug name for BTN_GEAR_DOWN, BTN_GEAR_UP, BTN_WHEEL The name of BTN_GEAR_DOWN was WheelBtn and BTN_WHEEL was missing. Further, BTN_GEAR_UP had a space in its name and no Btn, which is against convention. This makes the names BtnGearDown, BtnGearUp, and BtnWheel, fixing the errors and matching convention. Signed-off-by: Vicki Pfau Signed-off-by: Jiri Kosina commit 50f9ff52c078d66053bba791ded6fafc64055524 Author: Leonard Dizon Date: Mon Jun 30 05:48:30 2025 +0800 HID: elecom: add support for ELECOM HUGE 019B variant The ELECOM M-HT1DRBK trackball has an additional device ID (056E:019B) not yet recognized by the driver, despite using the same report descriptor as earlier variants. This patch adds the new ID and applies the same fixups, enabling all 8 buttons to function properly. Signed-off-by: Leonard Dizon Signed-off-by: Jiri Kosina commit c80f2b047d5cc42fbd2dff9d1942d4ba7545100f Author: Qasim Ijaz Date: Fri Jun 27 12:01:21 2025 +0100 HID: appletb-kbd: fix memory corruption of input_handler_list In appletb_kbd_probe an input handler is initialised and then registered with input core through input_register_handler(). When this happens input core will add the input handler (specifically its node) to the global input_handler_list. The input_handler_list is central to the functionality of input core and is traversed in various places in input core. An example of this is when a new input device is plugged in and gets registered with input core. The input_handler in probe is allocated as device managed memory. If a probe failure occurs after input_register_handler() the input_handler memory is freed, yet it will remain in the input_handler_list. This effectively means the input_handler_list contains a dangling pointer to data belonging to a freed input handler. This causes an issue when any other input device is plugged in - in my case I had an old PixArt HP USB optical mouse and I decided to plug it in after a failure occurred after input_register_handler(). This lead to the registration of this input device via input_register_device which involves traversing over every handler in the corrupted input_handler_list and calling input_attach_handler(), giving each handler a chance to bind to newly registered device. The core of this bug is a UAF which causes memory corruption of input_handler_list and to fix it we must ensure the input handler is unregistered from input core, this is done through input_unregister_handler(). [ 63.191597] ================================================================== [ 63.192094] BUG: KASAN: slab-use-after-free in input_attach_handler.isra.0+0x1a9/0x1e0 [ 63.192094] Read of size 8 at addr ffff888105ea7c80 by task kworker/0:2/54 [ 63.192094] [ 63.192094] CPU: 0 UID: 0 PID: 54 Comm: kworker/0:2 Not tainted 6.16.0-rc2-00321-g2aa6621d [ 63.192094] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.164 [ 63.192094] Workqueue: usb_hub_wq hub_event [ 63.192094] Call Trace: [ 63.192094] [ 63.192094] dump_stack_lvl+0x53/0x70 [ 63.192094] print_report+0xce/0x670 [ 63.192094] kasan_report+0xce/0x100 [ 63.192094] input_attach_handler.isra.0+0x1a9/0x1e0 [ 63.192094] input_register_device+0x76c/0xd00 [ 63.192094] hidinput_connect+0x686d/0xad60 [ 63.192094] hid_connect+0xf20/0x1b10 [ 63.192094] hid_hw_start+0x83/0x100 [ 63.192094] hid_device_probe+0x2d1/0x680 [ 63.192094] really_probe+0x1c3/0x690 [ 63.192094] __driver_probe_device+0x247/0x300 [ 63.192094] driver_probe_device+0x49/0x210 [ 63.192094] __device_attach_driver+0x160/0x320 [ 63.192094] bus_for_each_drv+0x10f/0x190 [ 63.192094] __device_attach+0x18e/0x370 [ 63.192094] bus_probe_device+0x123/0x170 [ 63.192094] device_add+0xd4d/0x1460 [ 63.192094] hid_add_device+0x30b/0x910 [ 63.192094] usbhid_probe+0x920/0xe00 [ 63.192094] usb_probe_interface+0x363/0x9a0 [ 63.192094] really_probe+0x1c3/0x690 [ 63.192094] __driver_probe_device+0x247/0x300 [ 63.192094] driver_probe_device+0x49/0x210 [ 63.192094] __device_attach_driver+0x160/0x320 [ 63.192094] bus_for_each_drv+0x10f/0x190 [ 63.192094] __device_attach+0x18e/0x370 [ 63.192094] bus_probe_device+0x123/0x170 [ 63.192094] device_add+0xd4d/0x1460 [ 63.192094] usb_set_configuration+0xd14/0x1880 [ 63.192094] usb_generic_driver_probe+0x78/0xb0 [ 63.192094] usb_probe_device+0xaa/0x2e0 [ 63.192094] really_probe+0x1c3/0x690 [ 63.192094] __driver_probe_device+0x247/0x300 [ 63.192094] driver_probe_device+0x49/0x210 [ 63.192094] __device_attach_driver+0x160/0x320 [ 63.192094] bus_for_each_drv+0x10f/0x190 [ 63.192094] __device_attach+0x18e/0x370 [ 63.192094] bus_probe_device+0x123/0x170 [ 63.192094] device_add+0xd4d/0x1460 [ 63.192094] usb_new_device+0x7b4/0x1000 [ 63.192094] hub_event+0x234d/0x3fa0 [ 63.192094] process_one_work+0x5bf/0xfe0 [ 63.192094] worker_thread+0x777/0x13a0 [ 63.192094] [ 63.192094] [ 63.192094] Allocated by task 54: [ 63.192094] kasan_save_stack+0x33/0x60 [ 63.192094] kasan_save_track+0x14/0x30 [ 63.192094] __kasan_kmalloc+0x8f/0xa0 [ 63.192094] __kmalloc_node_track_caller_noprof+0x195/0x420 [ 63.192094] devm_kmalloc+0x74/0x1e0 [ 63.192094] appletb_kbd_probe+0x39/0x440 [ 63.192094] hid_device_probe+0x2d1/0x680 [ 63.192094] really_probe+0x1c3/0x690 [ 63.192094] __driver_probe_device+0x247/0x300 [ 63.192094] driver_probe_device+0x49/0x210 [ 63.192094] __device_attach_driver+0x160/0x320 [...] [ 63.192094] [ 63.192094] Freed by task 54: [ 63.192094] kasan_save_stack+0x33/0x60 [ 63.192094] kasan_save_track+0x14/0x30 [ 63.192094] kasan_save_free_info+0x3b/0x60 [ 63.192094] __kasan_slab_free+0x37/0x50 [ 63.192094] kfree+0xcf/0x360 [ 63.192094] devres_release_group+0x1f8/0x3c0 [ 63.192094] hid_device_probe+0x315/0x680 [ 63.192094] really_probe+0x1c3/0x690 [ 63.192094] __driver_probe_device+0x247/0x300 [ 63.192094] driver_probe_device+0x49/0x210 [ 63.192094] __device_attach_driver+0x160/0x320 [...] Fixes: 7d62ba8deacf ("HID: hid-appletb-kbd: add support for fn toggle between media and function mode") Cc: stable@vger.kernel.org Reviewed-by: Aditya Garg Signed-off-by: Qasim Ijaz Signed-off-by: Jiri Kosina commit 226862f50a7a88e4e4de9abbf36c64d19acd6fd0 Author: Maíra Canal Date: Sat Jun 28 19:42:42 2025 -0300 drm/v3d: Disable interrupts before resetting the GPU Currently, an interrupt can be triggered during a GPU reset, which can lead to GPU hangs and NULL pointer dereference in an interrupt context as shown in the following trace: [ 314.035040] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000c0 [ 314.043822] Mem abort info: [ 314.046606] ESR = 0x0000000096000005 [ 314.050347] EC = 0x25: DABT (current EL), IL = 32 bits [ 314.055651] SET = 0, FnV = 0 [ 314.058695] EA = 0, S1PTW = 0 [ 314.061826] FSC = 0x05: level 1 translation fault [ 314.066694] Data abort info: [ 314.069564] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 314.075039] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 314.080080] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 314.085382] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000102728000 [ 314.091814] [00000000000000c0] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [ 314.100511] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP [ 314.106770] Modules linked in: v3d i2c_brcmstb vc4 snd_soc_hdmi_codec gpu_sched drm_shmem_helper drm_display_helper cec drm_dma_helper drm_kms_helper drm drm_panel_orientation_quirks snd_soc_core snd_compress snd_pcm_dmaengine snd_pcm snd_timer snd backlight [ 314.129654] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.25+rpt-rpi-v8 #1 Debian 1:6.12.25-1+rpt1 [ 314.139388] Hardware name: Raspberry Pi 4 Model B Rev 1.4 (DT) [ 314.145211] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 314.152165] pc : v3d_irq+0xec/0x2e0 [v3d] [ 314.156187] lr : v3d_irq+0xe0/0x2e0 [v3d] [ 314.160198] sp : ffffffc080003ea0 [ 314.163502] x29: ffffffc080003ea0 x28: ffffffec1f184980 x27: 021202b000000000 [ 314.170633] x26: ffffffec1f17f630 x25: ffffff8101372000 x24: ffffffec1f17d9f0 [ 314.177764] x23: 000000000000002a x22: 000000000000002a x21: ffffff8103252000 [ 314.184895] x20: 0000000000000001 x19: 00000000deadbeef x18: 0000000000000000 [ 314.192026] x17: ffffff94e51d2000 x16: ffffffec1dac3cb0 x15: c306000000000000 [ 314.199156] x14: 0000000000000000 x13: b2fc982e03cc5168 x12: 0000000000000001 [ 314.206286] x11: ffffff8103f8bcc0 x10: ffffffec1f196868 x9 : ffffffec1dac3874 [ 314.213416] x8 : 0000000000000000 x7 : 0000000000042a3a x6 : ffffff810017a180 [ 314.220547] x5 : ffffffec1ebad400 x4 : ffffffec1ebad320 x3 : 00000000000bebeb [ 314.227677] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 [ 314.234807] Call trace: [ 314.237243] v3d_irq+0xec/0x2e0 [v3d] [ 314.240906] __handle_irq_event_percpu+0x58/0x218 [ 314.245609] handle_irq_event+0x54/0xb8 [ 314.249439] handle_fasteoi_irq+0xac/0x240 [ 314.253527] handle_irq_desc+0x48/0x68 [ 314.257269] generic_handle_domain_irq+0x24/0x38 [ 314.261879] gic_handle_irq+0x48/0xd8 [ 314.265533] call_on_irq_stack+0x24/0x58 [ 314.269448] do_interrupt_handler+0x88/0x98 [ 314.273624] el1_interrupt+0x34/0x68 [ 314.277193] el1h_64_irq_handler+0x18/0x28 [ 314.281281] el1h_64_irq+0x64/0x68 [ 314.284673] default_idle_call+0x3c/0x168 [ 314.288675] do_idle+0x1fc/0x230 [ 314.291895] cpu_startup_entry+0x3c/0x50 [ 314.295810] rest_init+0xe4/0xf0 [ 314.299030] start_kernel+0x5e8/0x790 [ 314.302684] __primary_switched+0x80/0x90 [ 314.306691] Code: 940029eb 360ffc13 f9442ea0 52800001 (f9406017) [ 314.312775] ---[ end trace 0000000000000000 ]--- [ 314.317384] Kernel panic - not syncing: Oops: Fatal exception in interrupt [ 314.324249] SMP: stopping secondary CPUs [ 314.328167] Kernel Offset: 0x2b9da00000 from 0xffffffc080000000 [ 314.334076] PHYS_OFFSET: 0x0 [ 314.336946] CPU features: 0x08,00002013,c0200000,0200421b [ 314.342337] Memory Limit: none [ 314.345382] ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]--- Before resetting the GPU, it's necessary to disable all interrupts and deal with any interrupt handler still in-flight. Otherwise, the GPU might reset with jobs still running, or yet, an interrupt could be handled during the reset. Cc: stable@vger.kernel.org Fixes: 57692c94dcbe ("drm/v3d: Introduce a new DRM driver for Broadcom V3D V3.x+") Reviewed-by: Juan A. Suarez Reviewed-by: Iago Toral Quiroga Link: https://lore.kernel.org/r/20250628224243.47599-1-mcanal@igalia.com Signed-off-by: Maíra Canal commit bd475eeaaf3cad1b183418fff7b19c9b1e3d1c4f Merge: c2a2ff6b4db556 0325143b59c6c6 Author: Jakub Kicinski Date: Wed Jul 2 14:52:25 2025 -0700 Merge branch '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2025-07-01 (idpf, igc) For idpf: Michal returns 0 for key size when RSS is not supported. Ahmed changes control queue to a spinlock due to sleeping calls. For igc: Vitaly disables L1.2 PCI-E link substate on I226 devices to resolve performance issues. * '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: igc: disable L1.2 PCI-E link substate to avoid performance issue idpf: convert control queue mutex to a spinlock idpf: return 0 size for RSS key if not supported ==================== Link: https://patch.msgid.link/20250701164317.2983952-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit c2a2ff6b4db55647575260bf2227b0e09d46addb Author: Antoine Tenart Date: Tue Jul 1 09:49:34 2025 +0200 net: ipv4: fix stat increase when udp early demux drops the packet udp_v4_early_demux now returns drop reasons as it either returns 0 or ip_mc_validate_source, which returns itself a drop reason. However its use was not converted in ip_rcv_finish_core and the drop reason is ignored, leading to potentially skipping increasing LINUX_MIB_IPRPFILTER if the drop reason is SKB_DROP_REASON_IP_RPFILTER. This is a fix and we're not converting udp_v4_early_demux to explicitly return a drop reason to ease backports; this can be done as a follow-up. Fixes: d46f827016d8 ("net: ip: make ip_mc_validate_source() return drop reason") Cc: Menglong Dong Reported-by: Sabrina Dubroca Signed-off-by: Antoine Tenart Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20250701074935.144134-1-atenart@kernel.org Signed-off-by: Jakub Kicinski commit 5186ff7e1d0e26aaef998ba18b31c79c28d1441f Author: Jiawen Wu Date: Tue Jul 1 15:06:25 2025 +0800 net: libwx: fix the incorrect display of the queue number When setting "ethtool -L eth0 combined 1", the number of RX/TX queue is changed to be 1. RSS is disabled at this moment, and the indices of FDIR have not be changed in wx_set_rss_queues(). So the combined count still shows the previous value. This issue was introduced when supporting FDIR. Fix it for those devices that support FDIR. Fixes: 34744a7749b3 ("net: txgbe: add FDIR info to ethtool ops") Cc: stable@vger.kernel.org Signed-off-by: Jiawen Wu Reviewed-by: Simon Horman Link: https://patch.msgid.link/A5C8FE56D6C04608+20250701070625.73680-1-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 16ceda2ef683a50cd0783006c0504e1931cd8879 Author: Raju Rangoju Date: Tue Jul 1 12:20:16 2025 +0530 amd-xgbe: do not double read link status The link status is latched low so that momentary link drops can be detected. Always double-reading the status defeats this design feature. Only double read if link was already down This prevents unnecessary duplicate readings of the link status. Fixes: 4f3b20bfbb75 ("amd-xgbe: add support for rx-adaptation") Signed-off-by: Raju Rangoju Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250701065016.4140707-1-Raju.Rangoju@amd.com Signed-off-by: Jakub Kicinski commit 103406b38c600fec1fe375a77b27d87e314aea09 Author: Lion Ackermann Date: Mon Jun 30 15:27:30 2025 +0200 net/sched: Always pass notifications when child class becomes empty Certain classful qdiscs may invoke their classes' dequeue handler on an enqueue operation. This may unexpectedly empty the child qdisc and thus make an in-flight class passive via qlen_notify(). Most qdiscs do not expect such behaviour at this point in time and may re-activate the class eventually anyways which will lead to a use-after-free. The referenced fix commit attempted to fix this behavior for the HFSC case by moving the backlog accounting around, though this turned out to be incomplete since the parent's parent may run into the issue too. The following reproducer demonstrates this use-after-free: tc qdisc add dev lo root handle 1: drr tc filter add dev lo parent 1: basic classid 1:1 tc class add dev lo parent 1: classid 1:1 drr tc qdisc add dev lo parent 1:1 handle 2: hfsc def 1 tc class add dev lo parent 2: classid 2:1 hfsc rt m1 8 d 1 m2 0 tc qdisc add dev lo parent 2:1 handle 3: netem tc qdisc add dev lo parent 3:1 handle 4: blackhole echo 1 | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888 tc class delete dev lo classid 1:1 echo 1 | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888 Since backlog accounting issues leading to a use-after-frees on stale class pointers is a recurring pattern at this point, this patch takes a different approach. Instead of trying to fix the accounting, the patch ensures that qdisc_tree_reduce_backlog always calls qlen_notify when the child qdisc is empty. This solves the problem because deletion of qdiscs always involves a call to qdisc_reset() and / or qdisc_purge_queue() which ultimately resets its qlen to 0 thus causing the following qdisc_tree_reduce_backlog() to report to the parent. Note that this may call qlen_notify on passive classes multiple times. This is not a problem after the recent patch series that made all the classful qdiscs qlen_notify() handlers idempotent. Fixes: 3f981138109f ("sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()") Signed-off-by: Lion Ackermann Reviewed-by: Jamal Hadi Salim Acked-by: Cong Wang Acked-by: Jamal Hadi Salim Link: https://patch.msgid.link/d912cbd7-193b-4269-9857-525bee8bbb6a@gmail.com Signed-off-by: Jakub Kicinski commit 3e7e5adcd2a86783c441edf6f518fc903e3c4e7c Author: Sumanth Gavini Date: Fri May 23 15:02:37 2025 -0700 PM: sleep: docs: Replace "diasble" with "disable" Fix misspelling reported by codespell. Signed-off-by: Sumanth Gavini Link: https://patch.msgid.link/20250523220238.455718-1-sumanth.gavini@yahoo.com [ rjw: Subject rewrite ] Signed-off-by: Rafael J. Wysocki commit 5903a7452e642f1475f274373633522db168b60b Merge: d0b3b7b22dfa1f 2b29be967ae456 Author: Palmer Dabbelt Date: Wed Jul 2 10:51:00 2025 -0700 Merge tag 'riscv-fixes-6.16-rc4' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/alexghiti/linux into fixes riscv fixes for 6.16-rc4 - A fix for a percpu variable that may lie in the vmalloc region and on which we used __pa() - A fix to require at least clang-17 to prevent build issues with previous versions on kCFI * tag 'riscv-fixes-6.16-rc4' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/alexghiti/linux: riscv: cpu_ops_sbi: Use static array for boot_data riscv: Require clang-17 or newer for kCFI commit b4911fb0b060899e4eebca0151eb56deb86921ec Merge: ba6a2f25d3d0c8 ec54c0a20709ed Author: Linus Torvalds Date: Wed Jul 2 09:34:57 2025 -0700 Merge tag 'mmc-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: "MMC core: - Apply BROKEN_SD_DISCARD quirk earlier during init - Silence some confusing error messages for SD UHS-II cards MMC host: - mtk-sd: - Prevent memory corruption from DMA map failure - Fix a pagefault in dma_unmap_sg() for not prepared data - sdhci: Revert "Disable SD card clock before changing parameters" - sdhci-of-k1: Fix error code in probe() - sdhci-uhs2: Silence some confusing error messages for SD UHS-II cards" * tag 'mmc-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mtk-sd: reset host->mrq on prepare_data() error Revert "mmc: sdhci: Disable SD card clock before changing parameters" mmc: sdhci-uhs2: Adjust some error messages and register dump for SD UHS-II card mmc: sdhci: Add a helper function for dump register in dynamic debug mode mmc: core: Adjust some error messages for SD UHS-II cards mtk-sd: Prevent memory corruption from DMA map failure mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data mmc: sdhci-of-k1: Fix error code in probe() mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier commit ba6a2f25d3d0c813bc5f70c4437002ecc90b85d5 Merge: 3c894cb29bbf4e 62355f1f87b8c7 Author: Linus Torvalds Date: Wed Jul 2 09:27:57 2025 -0700 Merge tag 's390-6.16-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Alexander Gordeev: - Fix PCI error recovery and bring it in line with AER/EEH * tag 's390-6.16-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/pci: Allow automatic recovery with minimal driver support s390/pci: Do not try re-enabling load/store if device is disabled s390/pci: Fix stale function handles in error handling commit 3c894cb29bbf4e36c5f2497cf8ea6fb09e157920 Merge: 7e4a6b57dd7f55 9a96876e3c6578 Author: Linus Torvalds Date: Wed Jul 2 09:23:56 2025 -0700 Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd Pull iommufd fixes from Jason Gunthorpe: "Some changes to the userspace selftest framework cause the iommufd tests to start failing. This turned out to be bugs in the iommufd side that were just getting uncovered. - Deal with MAP_HUGETLB mmaping more than requested even when in MAP_FIXED mode - Fixup missing error flow cleanup in the test - Check that the memory allocations suceeded - Suppress some bogus gcc 'may be used uninitialized' warnings" * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: iommufd/selftest: Fix build warnings due to uninitialized mfd iommufd/selftest: Add asserts testing global mfd iommufd/selftest: Add missing close(mfd) in memfd_mmap() iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes commit 7e4a6b57dd7f55cce9ece0778c111905e73db7b1 Merge: 65c1736c8e9d06 a9a9e68954f29b Author: Linus Torvalds Date: Wed Jul 2 09:17:40 2025 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: "Several mlx5 bugs, crashers, and reports: - Limit stack usage - Fix mis-use of __xa_store/erase() without holding the lock to a locked version - Rate limit prints in the gid cache error cases - Fully initialize the event object before making it globally visible in an xarray - Fix deadlock inside the ODP code if the MMU notifier was called from a reclaim context - Include missed counters for some switchdev configurations and mulit-port MPV mode - Fix loopback packet support when in mulit-port MPV mode" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/mlx5: Fix vport loopback for MPV device RDMA/mlx5: Fix CC counters query for MPV RDMA/mlx5: Fix HW counters query for non-representor devices IB/core: Annotate umem_mutex acquisition under fs_reclaim for lockdep IB/mlx5: Fix potential deadlock in MR deregistration RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert RDMA/core: Rate limit GID cache warning messages RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling RDMA/mlx5: reduce stack usage in mlx5_ib_ufile_hw_cleanup commit 5f05fc6e2218db7ecc52c60eb34b707fe69262c2 Author: Krzysztof Kozlowski Date: Wed Jul 2 08:15:31 2025 +0200 dt-bindings: i2c: realtek,rtl9301: Fix missing 'reg' constraint Lists should have fixed amount if items, so add missing constraint to the 'reg' property (only one address space entry). Fixes: c5eda0333076 ("dt-bindings: i2c: Add Realtek RTL I2C Controller") Cc: # v6.13+ Signed-off-by: Krzysztof Kozlowski Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250702061530.6940-2-krzysztof.kozlowski@linaro.org commit db98ee56851061082fecd7e6b4b6a93600562ec2 Author: Peter Ujfalusi Date: Tue Jul 1 16:34:11 2025 +0300 ALSA: hda/realtek: Add quirk for ASUS ExpertBook B9403CVAR ASUS ExpertBook B9403CVAR needs the ALC294_FIXUP_ASUS_HPE for the headphones to work. Closes: https://github.com/thesofproject/linux/issues/5472 Signed-off-by: Peter Ujfalusi Tested-by: Anton Khirnov Link: https://patch.msgid.link/20250701133411.25275-1-peter.ujfalusi@linux.intel.com Signed-off-by: Takashi Iwai commit 1e7ab6f67824343ee3e96f100f0937c393749a8a Author: Christian Brauner Date: Wed Jul 2 11:23:55 2025 +0200 anon_inode: rework assertions Making anonymous inodes regular files comes with a lot of risk and regression potential as evidenced by a recent hickup in io_uring. We're better of continuing to not have them be regular files. Since we have S_ANON_INODE we can port all of our assertions easily. Link: https://lore.kernel.org/20250702-work-fixes-v1-1-ff76ea589e33@kernel.org Fixes: cfd86ef7e8e7 ("anon_inode: use a proper mode internally") Acked-by: Jens Axboe Cc: stable@kernel.org Reported-by: Jens Axboe Signed-off-by: Christian Brauner commit f7690d058170dbc1520b0bfbc3d9daf046b59326 Author: Simon Trimmer Date: Wed Jul 2 11:22:35 2025 +0000 ASoC: Intel: sof_sdw: Add quirks for Lenovo P1 and P16 These Lenovo Laptops have the DMICs connected to the host instead of the CS42L43 and so need the SOC_SDW_CODEC_MIC quirk. Signed-off-by: Simon Trimmer Link: https://patch.msgid.link/20250702112235.377479-1-simont@opensource.cirrus.com Signed-off-by: Mark Brown commit 561aa0e22b70a5e7246b73d62a824b3aef3fc375 Author: Thomas Fourier Date: Mon Jun 30 10:36:43 2025 +0200 nui: Fix dma_mapping_error() check dma_map_XXX() functions return values DMA_MAPPING_ERROR as error values which is often ~0. The error value should be tested with dma_mapping_error(). This patch creates a new function in niu_ops to test if the mapping failed. The test is fixed in niu_rbr_add_page(), added in niu_start_xmit() and the successfully mapped pages are unmaped upon error. Fixes: ec2deec1f352 ("niu: Fix to check for dma mapping errors.") Signed-off-by: Thomas Fourier Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 4f30f946f27b7f044cf8f3f1f353dee1dcd3517a Author: Kurt Borja Date: Mon Jun 30 14:31:21 2025 -0300 platform/x86: think-lmi: Fix sysfs group cleanup Many error paths in tlmi_sysfs_init() lead to sysfs groups being removed when they were not even created. Fix this by letting the kobject core manage these groups through their kobj_type's defult_groups. Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms") Cc: stable@vger.kernel.org Reviewed-by: Mark Pearson Reviewed-by: Ilpo Järvinen Signed-off-by: Kurt Borja Link: https://lore.kernel.org/r/20250630-lmi-fix-v3-3-ce4f81c9c481@gmail.com Signed-off-by: Ilpo Järvinen commit 9110056fe10b0519529bdbbac37311a5037ea0c2 Author: Kurt Borja Date: Mon Jun 30 14:31:20 2025 -0300 platform/x86: think-lmi: Fix kobject cleanup In tlmi_analyze(), allocated structs with an embedded kobject are freed in error paths after the they were already initialized. Fix this by first by avoiding the initialization of kobjects in tlmi_analyze() and then by correctly cleaning them up in tlmi_release_attr() using their kset's kobject list. Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms") Fixes: 30e78435d3bf ("platform/x86: think-lmi: Split kobject_init() and kobject_add() calls") Cc: stable@vger.kernel.org Reviewed-by: Mark Pearson Reviewed-by: Ilpo Järvinen Signed-off-by: Kurt Borja Link: https://lore.kernel.org/r/20250630-lmi-fix-v3-2-ce4f81c9c481@gmail.com Signed-off-by: Ilpo Järvinen commit 8dab34ca77293b409c3223636dde915a22656748 Author: Kurt Borja Date: Mon Jun 30 14:31:19 2025 -0300 platform/x86: think-lmi: Create ksets consecutively Avoid entering tlmi_release_attr() in error paths if both ksets are not yet created. This is accomplished by initializing them side by side. Reviewed-by: Mark Pearson Reviewed-by: Ilpo Järvinen Cc: stable@vger.kernel.org Signed-off-by: Kurt Borja Link: https://lore.kernel.org/r/20250630-lmi-fix-v3-1-ce4f81c9c481@gmail.com Signed-off-by: Ilpo Järvinen commit 5307dce878d4126e1b375587318955bd019c3741 Author: Thomas Zimmermann Date: Mon Jun 30 10:36:47 2025 +0200 drm/gem: Acquire references on GEM handles for framebuffers A GEM handle can be released while the GEM buffer object is attached to a DRM framebuffer. This leads to the release of the dma-buf backing the buffer object, if any. [1] Trying to use the framebuffer in further mode-setting operations leads to a segmentation fault. Most easily happens with driver that use shadow planes for vmap-ing the dma-buf during a page flip. An example is shown below. [ 156.791968] ------------[ cut here ]------------ [ 156.796830] WARNING: CPU: 2 PID: 2255 at drivers/dma-buf/dma-buf.c:1527 dma_buf_vmap+0x224/0x430 [...] [ 156.942028] RIP: 0010:dma_buf_vmap+0x224/0x430 [ 157.043420] Call Trace: [ 157.045898] [ 157.048030] ? show_trace_log_lvl+0x1af/0x2c0 [ 157.052436] ? show_trace_log_lvl+0x1af/0x2c0 [ 157.056836] ? show_trace_log_lvl+0x1af/0x2c0 [ 157.061253] ? drm_gem_shmem_vmap+0x74/0x710 [ 157.065567] ? dma_buf_vmap+0x224/0x430 [ 157.069446] ? __warn.cold+0x58/0xe4 [ 157.073061] ? dma_buf_vmap+0x224/0x430 [ 157.077111] ? report_bug+0x1dd/0x390 [ 157.080842] ? handle_bug+0x5e/0xa0 [ 157.084389] ? exc_invalid_op+0x14/0x50 [ 157.088291] ? asm_exc_invalid_op+0x16/0x20 [ 157.092548] ? dma_buf_vmap+0x224/0x430 [ 157.096663] ? dma_resv_get_singleton+0x6d/0x230 [ 157.101341] ? __pfx_dma_buf_vmap+0x10/0x10 [ 157.105588] ? __pfx_dma_resv_get_singleton+0x10/0x10 [ 157.110697] drm_gem_shmem_vmap+0x74/0x710 [ 157.114866] drm_gem_vmap+0xa9/0x1b0 [ 157.118763] drm_gem_vmap_unlocked+0x46/0xa0 [ 157.123086] drm_gem_fb_vmap+0xab/0x300 [ 157.126979] drm_atomic_helper_prepare_planes.part.0+0x487/0xb10 [ 157.133032] ? lockdep_init_map_type+0x19d/0x880 [ 157.137701] drm_atomic_helper_commit+0x13d/0x2e0 [ 157.142671] ? drm_atomic_nonblocking_commit+0xa0/0x180 [ 157.147988] drm_mode_atomic_ioctl+0x766/0xe40 [...] [ 157.346424] ---[ end trace 0000000000000000 ]--- Acquiring GEM handles for the framebuffer's GEM buffer objects prevents this from happening. The framebuffer's cleanup later puts the handle references. Commit 1a148af06000 ("drm/gem-shmem: Use dma_buf from GEM object instance") triggers the segmentation fault easily by using the dma-buf field more widely. The underlying issue with reference counting has been present before. v2: - acquire the handle instead of the BO (Christian) - fix comment style (Christian) - drop the Fixes tag (Christian) - rename err_ gotos - add missing Link tag Suggested-by: Christian König Signed-off-by: Thomas Zimmermann Link: https://elixir.bootlin.com/linux/v6.15/source/drivers/gpu/drm/drm_gem.c#L241 # [1] Cc: Thomas Zimmermann Cc: Anusha Srivatsa Cc: Christian König Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: Sumit Semwal Cc: "Christian König" Cc: linux-media@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Cc: linaro-mm-sig@lists.linaro.org Cc: Reviewed-by: Christian König Link: https://lore.kernel.org/r/20250630084001.293053-1-tzimmermann@suse.de commit 2ca58d87ebae20906cf808ef813d747db0177a18 Author: Fernando Fernandez Mancera Date: Tue Jun 24 15:11:15 2025 +0200 xfrm: ipcomp: adjust transport header after decompressing The skb transport header pointer needs to be adjusted by network header pointer plus the size of the ipcomp header. This shows up when running traffic over ipcomp using transport mode. After being reinjected, packets are dropped because the header isn't adjusted properly and some checks can be triggered. E.g the skb is mistakenly considered as IP fragmented packet and later dropped. kworker/30:1-mm 443 [030] 102.055250: skb:kfree_skb:skbaddr=0xffff8f104aa3ce00 rx_sk=( ffffffff8419f1f4 sk_skb_reason_drop+0x94 ([kernel.kallsyms]) ffffffff8419f1f4 sk_skb_reason_drop+0x94 ([kernel.kallsyms]) ffffffff84281420 ip_defrag+0x4b0 ([kernel.kallsyms]) ffffffff8428006e ip_local_deliver+0x4e ([kernel.kallsyms]) ffffffff8432afb1 xfrm_trans_reinject+0xe1 ([kernel.kallsyms]) ffffffff83758230 process_one_work+0x190 ([kernel.kallsyms]) ffffffff83758f37 worker_thread+0x2d7 ([kernel.kallsyms]) ffffffff83761cc9 kthread+0xf9 ([kernel.kallsyms]) ffffffff836c3437 ret_from_fork+0x197 ([kernel.kallsyms]) ffffffff836718da ret_from_fork_asm+0x1a ([kernel.kallsyms]) Fixes: eb2953d26971 ("xfrm: ipcomp: Use crypto_acomp interface") Link: https://bugzilla.suse.com/1244532 Signed-off-by: Fernando Fernandez Mancera Acked-by: Herbert Xu Signed-off-by: Steffen Klassert commit 3ac9e29211fa2df5539ba0d742c8fe9fe95fdc79 Author: Tobias Brunner Date: Tue Jun 24 14:47:20 2025 +0200 xfrm: Set transport header to fix UDP GRO handling The referenced commit replaced a call to __xfrm4|6_udp_encap_rcv() with a custom check for non-ESP markers. But what the called function also did was setting the transport header to the ESP header. The function that follows, esp4|6_gro_receive(), relies on that being set when it calls xfrm_parse_spi(). We have to set the full offset as the skb's head was not moved yet so adding just the UDP header length won't work. Fixes: e3fd05777685 ("xfrm: Fix UDP GRO handling for some corner cases") Signed-off-by: Tobias Brunner Signed-off-by: Steffen Klassert commit 34a500caf48c47d5171f4aa1f237da39b07c6157 Author: Kohei Enju Date: Sun Jun 29 12:06:31 2025 +0900 rose: fix dangling neighbour pointers in rose_rt_device_down() There are two bugs in rose_rt_device_down() that can cause use-after-free: 1. The loop bound `t->count` is modified within the loop, which can cause the loop to terminate early and miss some entries. 2. When removing an entry from the neighbour array, the subsequent entries are moved up to fill the gap, but the loop index `i` is still incremented, causing the next entry to be skipped. For example, if a node has three neighbours (A, A, B) with count=3 and A is being removed, the second A is not checked. i=0: (A, A, B) -> (A, B) with count=2 ^ checked i=1: (A, B) -> (A, B) with count=2 ^ checked (B, not A!) i=2: (doesn't occur because i < count is false) This leaves the second A in the array with count=2, but the rose_neigh structure has been freed. Code that accesses these entries assumes that the first `count` entries are valid pointers, causing a use-after-free when it accesses the dangling pointer. Fix both issues by iterating over the array in reverse order with a fixed loop bound. This ensures that all entries are examined and that the removal of an entry doesn't affect subsequent iterations. Reported-by: syzbot+e04e2c007ba2c80476cb@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=e04e2c007ba2c80476cb Tested-by: syzbot+e04e2c007ba2c80476cb@syzkaller.appspotmail.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kohei Enju Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250629030833.6680-1-enjuk@amazon.com Signed-off-by: Jakub Kicinski commit aaf2b2480375099c022a82023e1cd772bf1c6a5d Author: Alok Tiwari Date: Sat Jun 28 07:56:05 2025 -0700 enic: fix incorrect MTU comparison in enic_change_mtu() The comparison in enic_change_mtu() incorrectly used the current netdev->mtu instead of the new new_mtu value when warning about an MTU exceeding the port MTU. This could suppress valid warnings or issue incorrect ones. Fix the condition and log to properly reflect the new_mtu. Fixes: ab123fe071c9 ("enic: handle mtu change for vf properly") Signed-off-by: Alok Tiwari Acked-by: John Daley Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250628145612.476096-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit 56448e78a6bb4e1a8528a0e2efe94eff0400c247 Author: Andrew Jeffery Date: Mon Jun 16 22:43:39 2025 +0930 soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled Mitigate e.g. the following: # echo 1e789080.lpc-snoop > /sys/bus/platform/drivers/aspeed-lpc-snoop/unbind ... [ 120.363594] Unable to handle kernel NULL pointer dereference at virtual address 00000004 when write [ 120.373866] [00000004] *pgd=00000000 [ 120.377910] Internal error: Oops: 805 [#1] SMP ARM [ 120.383306] CPU: 1 UID: 0 PID: 315 Comm: sh Not tainted 6.15.0-rc1-00009-g926217bc7d7d-dirty #20 NONE ... [ 120.679543] Call trace: [ 120.679559] misc_deregister from aspeed_lpc_snoop_remove+0x84/0xac [ 120.692462] aspeed_lpc_snoop_remove from platform_remove+0x28/0x38 [ 120.700996] platform_remove from device_release_driver_internal+0x188/0x200 ... Fixes: 9f4f9ae81d0a ("drivers/misc: add Aspeed LPC snoop driver") Cc: stable@vger.kernel.org Cc: Jean Delvare Acked-by: Jean Delvare Link: https://patch.msgid.link/20250616-aspeed-lpc-snoop-fixes-v2-2-3cdd59c934d3@codeconstruct.com.au Signed-off-by: Andrew Jeffery commit 8481d59be606d2338dbfe14b04cdbd1a3402c150 Author: Andrew Jeffery Date: Mon Jun 16 22:43:38 2025 +0930 soc: aspeed: lpc-snoop: Cleanup resources in stack-order Free the kfifo after unregistering the miscdev in aspeed_lpc_disable_snoop() as the kfifo is initialised before the miscdev in aspeed_lpc_enable_snoop(). Fixes: 3772e5da4454 ("drivers/misc: Aspeed LPC snoop output using misc chardev") Cc: stable@vger.kernel.org Cc: Jean Delvare Acked-by: Jean Delvare Link: https://patch.msgid.link/20250616-aspeed-lpc-snoop-fixes-v2-1-3cdd59c934d3@codeconstruct.com.au Signed-off-by: Andrew Jeffery commit bf906c988d77d9cdfb52a7d19ad9b183991271a3 Merge: d0b3b7b22dfa1f 39d81457ad3417 Author: Dave Airlie Date: Wed Jul 2 11:17:25 2025 +1000 Merge tag 'amd-drm-fixes-6.16-2025-07-01' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.16-2025-07-01: amdgpu: - SDMA 5.x reset fix - Add missing firmware declaration - Fix leak in amdgpu_ctx_mgr_entity_fini() - Freesync fix - OLED backlight fix amdkfd: - mtype fix for ext coherent system memory - MMU notifier fix - gfx7/8 fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://lore.kernel.org/r/20250701192642.32490-1-alexander.deucher@amd.com commit 42fd432fe6d320323215ebdf4de4d0d7e56e6792 Author: Raju Rangoju Date: Tue Jul 1 00:56:36 2025 +0530 amd-xgbe: align CL37 AN sequence as per databook Update the Clause 37 Auto-Negotiation implementation to properly align with the PCS hardware specifications: - Fix incorrect bit settings in Link Status and Link Duplex fields - Implement missing sequence steps 2 and 7 These changes ensure CL37 auto-negotiation protocol follows the exact sequence patterns as specified in the hardware databook. Fixes: 1bf40ada6290 ("amd-xgbe: Add support for clause 37 auto-negotiation") Signed-off-by: Raju Rangoju Link: https://patch.msgid.link/20250630192636.3838291-1-Raju.Rangoju@amd.com Signed-off-by: Jakub Kicinski commit e6ed134a4ef592fe1fd0cafac9683813b3c8f3e8 Author: Dan Carpenter Date: Mon Jun 30 14:36:40 2025 -0500 lib: test_objagg: Set error message in check_expect_hints_stats() Smatch complains that the error message isn't set in the caller: lib/test_objagg.c:923 test_hints_case2() error: uninitialized symbol 'errmsg'. This static checker warning only showed up after a recent refactoring but the bug dates back to when the code was originally added. This likely doesn't affect anything in real life. Reported-by: kernel test robot Closes: https://lore.kernel.org/r/202506281403.DsuyHFTZ-lkp@intel.com/ Fixes: 0a020d416d0a ("lib: introduce initial implementation of object aggregation manager") Signed-off-by: Dan Carpenter Reviewed-by: Ido Schimmel Reviewed-by: Simon Horman Link: https://patch.msgid.link/8548f423-2e3b-4bb7-b816-5041de2762aa@sabinyo.mountain Signed-off-by: Jakub Kicinski commit 94426e4201fbb1c5ea4a697eb62a8b7cd7dfccbf Author: Kent Overstreet Date: Thu Jun 26 09:46:35 2025 -0400 bcachefs: opts.casefold_disabled Add an option for completely disabling casefolding on a filesystem, as a workaround for overlayfs. This should only be needed as a temporary workaround, until the overlayfs fix arrives. Signed-off-by: Kent Overstreet commit c6e8d51b37d2ca37dee63753fd240bcbc6402ad3 Author: Kent Overstreet Date: Tue Jul 1 13:36:51 2025 -0400 bcachefs: Work around deadlock to btree node rewrites in journal replay Don't mark btree nodes for rewrites, if they are or would be degraded, if journal replay hasn't finished, to avoid a deadlock. This is because btree node rewrites generate more updates for the interior updates (alloc, backpointers), and if those updates touch new nodes and generate more rewrites - we can only have so many interior btree updates in flight before we deadlock on open_buckets. The biggest cause is that we don't use the btree write buffer (for the backpointer updates - this needs some real thought on locking in order to fix. The problem with this workaround (not doing the rewrite for degraded nodes in journal replay) is that those degraded nodes persist, and we don't want that (this is a real bug when a btree node write completes with fewer replicas than we wanted and leaves a degraded node due to device _removal_, i.e. the device went away mid write). It's less of a bug here, but still a problem because we don't yet have a way of tracking degraded data - we another index (all extents/btree nodes, by replicas entry) in order to fix properly (re-replicate degraded data at the earliest possible time). Signed-off-by: Kent Overstreet commit 8af39ec5cf2be522c8eb43a3d8005ed59e4daaee Author: Matthew Brost Date: Fri Jun 13 14:20:13 2025 -0700 drm/sched: Increment job count before swapping tail spsc queue A small race exists between spsc_queue_push and the run-job worker, in which spsc_queue_push may return not-first while the run-job worker has already idled due to the job count being zero. If this race occurs, job scheduling stops, leading to hangs while waiting on the job’s DMA fences. Seal this race by incrementing the job count before appending to the SPSC queue. This race was observed on a drm-tip 6.16-rc1 build with the Xe driver in an SVM test case. Fixes: 1b1f42d8fde4 ("drm: move amd_gpu_scheduler into common location") Fixes: 27105db6c63a ("drm/amdgpu: Add SPSC queue to scheduler.") Cc: stable@vger.kernel.org Signed-off-by: Matthew Brost Reviewed-by: Jonathan Cavitt Link: https://lore.kernel.org/r/20250613212013.719312-1-matthew.brost@intel.com commit bf4807c89d8f92c47404b1e4eeeefb42259d1b50 Author: Paul Chaignon Date: Tue Jul 1 21:48:03 2025 +0200 selftests/bpf: Add negative test cases for snprintf This patch adds a couple negative test cases with a trailing % at the end of the format string. The %p% case was fixed by the previous commit, whereas the %s% case was already successfully rejected before. Acked-by: Yonghong Song Signed-off-by: Paul Chaignon Link: https://lore.kernel.org/r/0669bf6eb4f9e5bb10e949d60311c06e2d942447.1751395489.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit f8242745871f81a3ac37f9f51853d12854fd0b58 Author: Paul Chaignon Date: Tue Jul 1 21:47:30 2025 +0200 bpf: Reject %p% format string in bprintf-like helpers static const char fmt[] = "%p%"; bpf_trace_printk(fmt, sizeof(fmt)); The above BPF program isn't rejected and causes a kernel warning at runtime: Please remove unsupported %\x00 in format string WARNING: CPU: 1 PID: 7244 at lib/vsprintf.c:2680 format_decode+0x49c/0x5d0 This happens because bpf_bprintf_prepare skips over the second %, detected as punctuation, while processing %p. This patch fixes it by not skipping over punctuation. %\x00 is then processed in the next iteration and rejected. Reported-by: syzbot+e2c932aec5c8a6e1d31c@syzkaller.appspotmail.com Fixes: 48cac3f4a96d ("bpf: Implement formatted output helpers with bstr_printf") Acked-by: Yonghong Song Signed-off-by: Paul Chaignon Link: https://lore.kernel.org/r/a0e06cc479faec9e802ae51ba5d66420523251ee.1751395489.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit aa18d5769fcafe645a3ba01a9a69dde4f8dc8cc3 Author: Harry Austen Date: Fri Jun 27 13:30:35 2025 -0700 drm/xe: Allow dropping kunit dependency as built-in Fix Kconfig symbol dependency on KUNIT, which isn't actually required for XE to be built-in. However, if KUNIT is enabled, it must be built-in too. Fixes: 08987a8b6820 ("drm/xe: Fix build with KUNIT=m") Cc: Lucas De Marchi Cc: Thomas Hellström Cc: Jani Nikula Cc: Maarten Lankhorst Signed-off-by: Harry Austen Reviewed-by: Lucas De Marchi Acked-by: Randy Dunlap Tested-by: Randy Dunlap Link: https://lore.kernel.org/r/20250627-xe-kunit-v2-2-756fe5cd56cf@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit a559434880b320b83733d739733250815aecf1b0) Signed-off-by: Lucas De Marchi commit de6acfdc390ec2eb64d43186721038ddc93228b3 Author: Lucas De Marchi Date: Wed Jun 11 12:38:37 2025 -0700 drm/xe: Fix kconfig prompt The xe driver is the official driver for Intel Xe2 and later, while maintaining experimental support for earlier GPUs. Reword the help message accordingly. Reviewed-by: Maarten Lankhorst Link: https://lore.kernel.org/r/20250611-xe-kconfig-help-v1-1-8bcc6b47d11a@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 1488a3089de3d0bcdc9532da7ce04cf0af9d7dd0) Signed-off-by: Lucas De Marchi commit 84c0b4a00610afbde650fdb8ad6db0424f7b2cc3 Author: Vinay Belgaumkar Date: Wed Jun 18 11:50:01 2025 -0700 drm/xe/bmg: Update Wa_22019338487 Limit GT max frequency to 2600MHz and wait for frequency to reduce before proceeding with a transient flush. This is really only needed for the transient flush: if L2 flush is needed due to 16023588340 then there's no need to do this additional wait since we are already using the bigger hammer. v2: Use generic names, ensure user set max frequency requests wait for flush to complete (Rodrigo) v3: - User requests wait via wait_var_event_timeout (Lucas) - Close races on flush + user requests (Lucas) - Fix xe_guc_pc_remove_flush_freq_limit() being called on last gt rather than root gt (Lucas) v4: - Only apply the freq reducing part if a TDF is needed: L2 flush trumps the need for waiting a lower frequency Fixes: aaa08078e725 ("drm/xe/bmg: Apply Wa_22019338487") Reviewed-by: Rodrigo Vivi Signed-off-by: Vinay Belgaumkar Link: https://lore.kernel.org/r/20250618-wa-22019338487-v5-4-b888388477f2@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit deea6a7d6d803d6bb874a3e6f1b312e560e6c6df) Signed-off-by: Lucas De Marchi commit a5c7dcdd969f2248cc91d65e5ac852859fc8dac2 Author: Vinay Belgaumkar Date: Thu Jun 12 00:09:02 2025 -0700 drm/xe/bmg: Update Wa_14022085890 Set GT min frequency to 1200Mhz once driver load is complete. v2: Review comments (Rodrigo) v3: Apply Wa earlier so user_req_min is not clobbered. v4: Apply to all GTs (Lucas) Cc: Matt Roper Cc: Rodrigo Vivi Signed-off-by: Vinay Belgaumkar Reviewed-by: Stuart Summers Link: https://lore.kernel.org/r/20250612-wa-14022085890-v4-3-94ba5dcc1e30@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit bdde16c9ac5cb56ad2ee19792222fa1853577af7) Signed-off-by: Lucas De Marchi commit a1eec6cae95a1a0888cb8370338822ca81cd9436 Author: Lucas De Marchi Date: Wed Jun 18 11:50:00 2025 -0700 drm/xe: Split xe_device_td_flush() xe_device_td_flush() has 2 possible implementations: an entire L2 flush or a transient flush, depending on WA 16023588340. Make this clear by splitting the function so it calls each of them. Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/20250618-wa-22019338487-v5-3-b888388477f2@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 5e300ed8a545bdffc26b579c526b5fef7b2d5365) Signed-off-by: Lucas De Marchi commit 4cec9099b93a63eb0b1e8cbbe6419fdaeb72e09b Author: Lucas De Marchi Date: Wed Jun 18 11:49:59 2025 -0700 drm/xe/xe_guc_pc: Lock once to update stashed frequencies pc_set_mert_freq_cap() currently lock()/unlock() the mutex multiple times to stash the current frequencies. It's not a problem since xe_guc_pc_restore_stashed_freq() is guaranteed to be called only later in the init sequence. However, now that we have _locked() variants for this functions, use them and avoid potential issues when called from other places or using the same pattern. While at it, prefer and early return for the WA check to reduce indentation. Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250618-wa-22019338487-v5-2-b888388477f2@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit d878c97daa603573e5af01fd8beec2fffdb42ad1) Signed-off-by: Lucas De Marchi commit d8390768dcf6f5a78af56aa03797a076871b01f3 Author: Lucas De Marchi Date: Wed Jun 18 11:49:58 2025 -0700 drm/xe/guc_pc: Add _locked variant for min/max freq There are places in which the getters/setters are called one after the other causing a multiple lock()/unlock(). These are not currently a problem since they are all happening from the same thread, but there's a race possibility as calls are added outside of the early init when the max/min and stashed values need to be correlated. Add the _locked() variants to prepare for that. Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250618-wa-22019338487-v5-1-b888388477f2@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 1beae9aa2b88d3a02eb666e7b777eb2d7bc645f4) Signed-off-by: Lucas De Marchi commit 65c1736c8e9d06bfa5cc734b156518ff65926918 Merge: ce95858aeedfd7 d9d79e4f7dc935 Author: Linus Torvalds Date: Tue Jul 1 13:50:21 2025 -0700 Merge tag 'mfd-fixes-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD fix from Lee Jones: - Fix some -Werror=unused-variable build errors * tag 'mfd-fixes-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: mfd: Fix building without CONFIG_OF commit afcad92411772a1f361339f22c49f855c6cc7d0f Author: Matthew Brost Date: Wed Jun 11 20:19:25 2025 -0700 drm/xe: Make WA BB part of LRC BO No idea why, but without this GuC context switches randomly fail when running IGTs in a loop. Need to follow up why this fixes the aforementioned issue but can live with a stable driver for now. Fixes: 617d824c5323 ("drm/xe: Add WA BB to capture active context utilization") Cc: stable@vger.kernel.org Signed-off-by: Matthew Brost Reviewed-by: Lucas De Marchi Tested-by: Shuicheng Lin Link: https://lore.kernel.org/r/20250612031925.4009701-1-matthew.brost@intel.com (cherry picked from commit 3a1edef8f4b58b0ba826bc68bf4bce4bdf59ecf3) Signed-off-by: Lucas De Marchi commit ce95858aeedfd7f942e91234b81841eec0260a82 Merge: 66701750d5565c 38074de35b015d Author: Linus Torvalds Date: Tue Jul 1 13:42:30 2025 -0700 Merge tag 'nfs-for-6.16-2' of git://git.linux-nfs.org/projects/anna/linux-nfs Pull NFS client fixes from Anna Schumaker: - Fix loop in GSS sequence number cache - Clean up /proc/net/rpc/nfs if nfs_fs_proc_net_init() fails - Fix a race to wake on NFS_LAYOUT_DRAIN - Fix handling of NFS level errors in I/O * tag 'nfs-for-6.16-2' of git://git.linux-nfs.org/projects/anna/linux-nfs: NFSv4/flexfiles: Fix handling of NFS level errors in I/O NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. sunrpc: fix loop in gss seqno cache commit d5cb81ba929c1b0d02dadd4be27fc1440dd2e014 Merge: 8c44dac8add750 90b3ccf514578c Author: Christian Brauner Date: Tue Jul 1 22:37:20 2025 +0200 Merge patch series "netfs, cifs: Fixes to retry-related code" David Howells says: Here are some miscellaneous fixes and changes for netfslib and cifs, if you could consider pulling them. Many of these were found because a bug in Samba was causing smbd to crash and restart after about 1-2s and this was vigorously and abruptly exercising the netfslib retry paths. Subsequent testing of the cifs RDMA support showed up some more bugs, but the fixes for those went via the cifs tree and have been removed from this set as they're now upstream. First, there are some netfs fixes: (1) Fix a hang due to missing case in final DIO read result collection not breaking out of a loop if the request finished, but there were no subrequests being processed and NETFS_RREQ_ALL_QUEUED wasn't yet set. (2) Fix a double put of the netfs_io_request struct if completion happened in the pause loop. (3) Provide some helpers to abstract out NETFS_RREQ_IN_PROGRESS flag wrangling. (4) Fix infinite looping in netfs_wait_for_pause/request() which wa caused by a loop waiting for NETFS_RREQ_ALL_QUEUED to get set - but which wouldn't get set until the looping function returned. This uses patch (3) above. (5) Fix a ref leak on an extra subrequest inserted into a request's list of subreqs because more subreq records were needed for retrying than were needed for the original request (say, for instance, that the amount of cifs credit available was reduced and, subsequently, the ops had to be smaller). Then a bunch of cifs fixes, some of which are from other people: (6-8) cifs: Fix various RPC callbacks to set NETFS_SREQ_NEED_RETRY if a subrequest fails retriably. (10) Fix a warning in the workqueue code when reconnecting a channel. Followed by some patches to deal with i_size handling: (11) Fix the updating of i_size to use a lock to avoid a race between testing if we should have extended the file with a DIO write and changing i_size. (12) A follow-up patch to (11) to merge the places in netfslib that update i_size on write. And finally a couple of patches to improve tracing output, but that should otherwise not affect functionality: (13) Renumber the NETFS_RREQ_* flags to make the hex values easier to interpret by eye, including moving the main status flags down to the lowest bits, with IN_PROGRESS in bit 0. (14) Update the tracepoints in a number of ways, including adding more tracepoints into the cifs read/write RPC callback so that differend MID_RESPONSE_* values can be differentiated. * patches from https://lore.kernel.org/20250701163852.2171681-1-dhowells@redhat.com: netfs: Update tracepoints in a number of ways netfs: Renumber the NETFS_RREQ_* flags to make traces easier to read netfs: Merge i_size update functions netfs: Fix i_size updating smb: client: set missing retry flag in cifs_writev_callback() smb: client: set missing retry flag in cifs_readv_callback() smb: client: set missing retry flag in smb2_writev_callback() netfs: Fix ref leak on inserted extra subreq in write retry netfs: Fix looping in wait functions netfs: Provide helpers to perform NETFS_RREQ_IN_PROGRESS flag wangling netfs: Fix double put of request netfs: Fix hang due to missing case in final DIO read result collection Link: https://lore.kernel.org/20250701163852.2171681-1-dhowells@redhat.com Signed-off-by: Christian Brauner commit 90b3ccf514578ca3a6ac25db51a29a48e34e0f1b Author: David Howells Date: Tue Jul 1 17:38:48 2025 +0100 netfs: Update tracepoints in a number of ways Make a number of updates to the netfs tracepoints: (1) Remove a duplicate trace from netfs_unbuffered_write_iter_locked(). (2) Move the trace in netfs_wake_rreq_flag() to after the flag is cleared so that the change appears in the trace. (3) Differentiate the use of netfs_rreq_trace_wait/woke_queue symbols. (4) Don't do so many trace emissions in the wait functions as some of them are redundant. (5) In netfs_collect_read_results(), differentiate a subreq that's being abandoned vs one that has been consumed in a regular way. (6) Add a tracepoint to indicate the call to ->ki_complete(). (7) Don't double-increment the subreq_counter when retrying a write. (8) Move the netfs_sreq_trace_io_progress tracepoint within cifs code to just MID_RESPONSE_RECEIVED and add different tracepoints for other MID states and note check failure. Signed-off-by: David Howells Co-developed-by: Paulo Alcantara Signed-off-by: Paulo Alcantara Link: https://lore.kernel.org/20250701163852.2171681-14-dhowells@redhat.com cc: Steve French cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org cc: linux-cifs@vger.kernel.org Signed-off-by: Christian Brauner commit 4e32541076833f5ce2e23523c9faa25f7b2cc96f Author: David Howells Date: Tue Jul 1 17:38:47 2025 +0100 netfs: Renumber the NETFS_RREQ_* flags to make traces easier to read Renumber the NETFS_RREQ_* flags to put the most useful status bits in the bottom nibble - and therefore the last hex digit in the trace output - making it easier to grasp the state at a glance. In particular, put the IN_PROGRESS flag in bit 0 and ALL_QUEUED at bit 1. Also make the flags field in /proc/fs/netfs/requests larger to accommodate all the flags. Also make the flags field in the netfs_sreq tracepoint larger to accommodate all the NETFS_SREQ_* flags. Signed-off-by: David Howells Link: https://lore.kernel.org/20250701163852.2171681-13-dhowells@redhat.com Reviewed-by: Paulo Alcantara cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit 5e1e6ec2e346c0850f304c31abdef4158007474e Author: David Howells Date: Tue Jul 1 17:38:46 2025 +0100 netfs: Merge i_size update functions Netfslib has two functions for updating the i_size after a write: one for buffered writes into the pagecache and one for direct/unbuffered writes. However, what needs to be done is much the same in both cases, so merge them together. This does raise one question, though: should updating the i_size after a direct write do the same estimated update of i_blocks as is done for buffered writes. Also get rid of the cleanup function pointer from netfs_io_request as it's only used for direct write to update i_size; instead do the i_size setting directly from write collection. Signed-off-by: David Howells Link: https://lore.kernel.org/20250701163852.2171681-12-dhowells@redhat.com cc: Steve French cc: Paulo Alcantara cc: linux-cifs@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit 2e0658940d90a3dc130bb3b7f75bae9f4100e01f Author: David Howells Date: Tue Jul 1 17:38:45 2025 +0100 netfs: Fix i_size updating Fix the updating of i_size, particularly in regard to the completion of DIO writes and especially async DIO writes by using a lock. The bug is triggered occasionally by the generic/207 xfstest as it chucks a bunch of AIO DIO writes at the filesystem and then checks that fstat() returns a reasonable st_size as each completes. The problem is that netfs is trying to do "if new_size > inode->i_size, update inode->i_size" sort of thing but without a lock around it. This can be seen with cifs, but shouldn't be seen with kafs because kafs serialises modification ops on the client whereas cifs sends the requests to the server as they're generated and lets the server order them. Fixes: 153a9961b551 ("netfs: Implement unbuffered/DIO write support") Signed-off-by: David Howells Link: https://lore.kernel.org/20250701163852.2171681-11-dhowells@redhat.com Reviewed-by: Paulo Alcantara (Red Hat) cc: Steve French cc: Paulo Alcantara cc: linux-cifs@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit 74ee76bea4b445c023d04806e0bcd78a912fd30b Author: Paulo Alcantara Date: Tue Jul 1 17:38:43 2025 +0100 smb: client: set missing retry flag in cifs_writev_callback() Set NETFS_SREQ_NEED_RETRY flag to tell netfslib that the subreq needs to be retried. Fixes: ee4cdf7ba857 ("netfs: Speed up buffered reading") Signed-off-by: Paulo Alcantara (Red Hat) Signed-off-by: David Howells Link: https://lore.kernel.org/20250701163852.2171681-9-dhowells@redhat.com Tested-by: Steve French Cc: linux-cifs@vger.kernel.org Cc: netfs@lists.linux.dev Signed-off-by: Christian Brauner commit 0e60bae24ad28ab06a485698077d3c626f1e54ab Author: Paulo Alcantara Date: Tue Jul 1 17:38:42 2025 +0100 smb: client: set missing retry flag in cifs_readv_callback() Set NETFS_SREQ_NEED_RETRY flag to tell netfslib that the subreq needs to be retried. Fixes: ee4cdf7ba857 ("netfs: Speed up buffered reading") Signed-off-by: Paulo Alcantara (Red Hat) Signed-off-by: David Howells Link: https://lore.kernel.org/20250701163852.2171681-8-dhowells@redhat.com Tested-by: Steve French Cc: linux-cifs@vger.kernel.org Cc: netfs@lists.linux.dev Signed-off-by: Christian Brauner commit e67e75edeb88022c04f8e0a173e1ff6dc688f155 Author: Paulo Alcantara Date: Tue Jul 1 17:38:41 2025 +0100 smb: client: set missing retry flag in smb2_writev_callback() Set NETFS_SREQ_NEED_RETRY flag to tell netfslib that the subreq needs to be retried. Fixes: ee4cdf7ba857 ("netfs: Speed up buffered reading") Signed-off-by: Paulo Alcantara (Red Hat) Signed-off-by: David Howells Link: https://lore.kernel.org/20250701163852.2171681-7-dhowells@redhat.com Tested-by: Steve French Cc: linux-cifs@vger.kernel.org Cc: netfs@lists.linux.dev Signed-off-by: Christian Brauner commit 97d8e8e52cb8ab3d7675880a92626d9a4332f7a6 Author: David Howells Date: Tue Jul 1 17:38:40 2025 +0100 netfs: Fix ref leak on inserted extra subreq in write retry The write-retry algorithm will insert extra subrequests into the list if it can't get sufficient capacity to split the range that needs to be retried into the sequence of subrequests it currently has (for instance, if the cifs credit pool has fewer credits available than it did when the range was originally divided). However, the allocator furnishes each new subreq with 2 refs and then another is added for resubmission, causing one to be leaked. Fix this by replacing the ref-getting line with a neutral trace line. Fixes: 288ace2f57c9 ("netfs: New writeback implementation") Signed-off-by: David Howells Link: https://lore.kernel.org/20250701163852.2171681-6-dhowells@redhat.com Tested-by: Steve French Reviewed-by: Paulo Alcantara cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit 09623e3a14c1c5465124350cd227457c2b0fb017 Author: David Howells Date: Tue Jul 1 17:38:39 2025 +0100 netfs: Fix looping in wait functions netfs_wait_for_request() and netfs_wait_for_pause() can loop forever if netfs_collect_in_app() returns 2, indicating that it wants to repeat because the ALL_QUEUED flag isn't yet set and there are no subreqs left that haven't been collected. The problem is that, unless collection is offloaded (OFFLOAD_COLLECTION), we have to return to the application thread to continue and eventually set ALL_QUEUED after pausing to deal with a retry - but we never get there. Fix this by inserting checks for the IN_PROGRESS and PAUSE flags as appropriate before cycling round - and add cond_resched() for good measure. Fixes: 2b1424cd131c ("netfs: Fix wait/wake to be consistent about the waitqueue used") Signed-off-by: David Howells Link: https://lore.kernel.org/20250701163852.2171681-5-dhowells@redhat.com Tested-by: Steve French Reviewed-by: Paulo Alcantara cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit 1a6d45fec33a03ca681eee125ea96987742a893f Author: David Howells Date: Tue Jul 1 17:38:38 2025 +0100 netfs: Provide helpers to perform NETFS_RREQ_IN_PROGRESS flag wangling Provide helpers to clear and test the NETFS_RREQ_IN_PROGRESS and to insert the appropriate barrierage. Signed-off-by: David Howells Link: https://lore.kernel.org/20250701163852.2171681-4-dhowells@redhat.com Tested-by: Steve French Reviewed-by: Paulo Alcantara cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit 9df7b5ebead649b00bf9a53a798e4bf83a1318fd Author: David Howells Date: Tue Jul 1 17:38:37 2025 +0100 netfs: Fix double put of request If a netfs request finishes during the pause loop, it will have the ref that belongs to the IN_PROGRESS flag removed at that point - however, if it then goes to the final wait loop, that will *also* put the ref because it sees that the IN_PROGRESS flag is clear and incorrectly assumes that this happened when it called the collector. In fact, since IN_PROGRESS is clear, we shouldn't call the collector again since it's done all the cleanup, such as calling ->ki_complete(). Fix this by making netfs_collect_in_app() just return, indicating that we're done if IN_PROGRESS is removed. Fixes: 2b1424cd131c ("netfs: Fix wait/wake to be consistent about the waitqueue used") Signed-off-by: David Howells Link: https://lore.kernel.org/20250701163852.2171681-3-dhowells@redhat.com Tested-by: Steve French Reviewed-by: Paulo Alcantara cc: Steve French cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org cc: linux-cifs@vger.kernel.org Signed-off-by: Christian Brauner commit da8cf4bd458722d090a788c6e581eeb72695c62f Author: David Howells Date: Tue Jul 1 17:38:36 2025 +0100 netfs: Fix hang due to missing case in final DIO read result collection When doing a DIO read, if the subrequests we issue fail and cause the request PAUSE flag to be set to put a pause on subrequest generation, we may complete collection of the subrequests (possibly discarding them) prior to the ALL_QUEUED flags being set. In such a case, netfs_read_collection() doesn't see ALL_QUEUED being set after netfs_collect_read_results() returns and will just return to the app (the collector can be seen unpausing the generator in the trace log). The subrequest generator can then set ALL_QUEUED and the app thread reaches netfs_wait_for_request(). This causes netfs_collect_in_app() to be called to see if we're done yet, but there's missing case here. netfs_collect_in_app() will see that a thread is active and set inactive to false, but won't see any subrequests in the read stream, and so won't set need_collect to true. The function will then just return 0, indicating that the caller should just sleep until further activity (which won't be forthcoming) occurs. Fix this by making netfs_collect_in_app() check to see if an active thread is complete - i.e. that ALL_QUEUED is set and the subrequests list is empty - and to skip the sleep return path. The collector will then be called which will clear the request IN_PROGRESS flag, allowing the app to progress. Fixes: 2b1424cd131c ("netfs: Fix wait/wake to be consistent about the waitqueue used") Reported-by: Steve French Signed-off-by: David Howells Link: https://lore.kernel.org/20250701163852.2171681-2-dhowells@redhat.com Tested-by: Steve French Reviewed-by: Paulo Alcantara cc: linux-cifs@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit 8c44dac8add7503c345c0f6c7962e4863b88ba42 Author: Nam Cao Date: Tue May 27 11:08:36 2025 +0200 eventpoll: Fix priority inversion problem The ready event list of an epoll object is protected by read-write semaphore: - The consumer (waiter) acquires the write lock and takes items. - the producer (waker) takes the read lock and adds items. The point of this design is enabling epoll to scale well with large number of producers, as multiple producers can hold the read lock at the same time. Unfortunately, this implementation may cause scheduling priority inversion problem. Suppose the consumer has higher scheduling priority than the producer. The consumer needs to acquire the write lock, but may be blocked by the producer holding the read lock. Since read-write semaphore does not support priority-boosting for the readers (even with CONFIG_PREEMPT_RT=y), we have a case of priority inversion: a higher priority consumer is blocked by a lower priority producer. This problem was reported in [1]. Furthermore, this could also cause stall problem, as described in [2]. To fix this problem, make the event list half-lockless: - The consumer acquires a mutex (ep->mtx) and takes items. - The producer locklessly adds items to the list. Performance is not the main goal of this patch, but as the producer now can add items without waiting for consumer to release the lock, performance improvement is observed using the stress test from https://github.com/rouming/test-tools/blob/master/stress-epoll.c. This is the same test that justified using read-write semaphore in the past. Testing using 12 x86_64 CPUs: Before After Diff threads events/ms events/ms 8 6932 19753 +185% 16 7820 27923 +257% 32 7648 35164 +360% 64 9677 37780 +290% 128 11166 38174 +242% Testing using 1 riscv64 CPU (averaged over 10 runs, as the numbers are noisy): Before After Diff threads events/ms events/ms 1 73 129 +77% 2 151 216 +43% 4 216 364 +69% 8 234 382 +63% 16 251 392 +56% Reported-by: Frederic Weisbecker Closes: https://lore.kernel.org/linux-rt-users/20210825132754.GA895675@lothringen/ [1] Reported-by: Valentin Schneider Closes: https://lore.kernel.org/linux-rt-users/xhsmhttqvnall.mognet@vschneid.remote.csb/ [2] Signed-off-by: Nam Cao Link: https://lore.kernel.org/20250527090836.1290532-1-namcao@linutronix.de Tested-by: K Prateek Nayak Acked-by: Frederic Weisbecker Signed-off-by: Christian Brauner commit 2d5cff2b4bc567dcaad7ab5b46c973ba534cc062 Author: Jia Yao Date: Thu Jun 12 22:46:20 2025 +0000 drm/xe: Fix out-of-bounds field write in MI_STORE_DATA_IMM According to Bspec, bits 0~9 of MI_STORE_DATA_IMM must not exceed 0x3FE. The macro MI_SDI_NUM_QW(x) evaluates to 2 * x + 1, which means the condition 2 * x + 1 <= 0x3FE must be satisfied. Therefore, the maximum valid value for x is 0x1FE, not 0x1FF. v2 - Replace 0x1fe with macro MAX_PTE_PER_SDI (Auld, Matthew & Patelczyk, Maciej) v3 - Change macro MAX_PTE_PER_SDI from 0x1fe to 0x1feU (De Marchi, Lucas) Bspec: 60246 Fixes: 9c44fd5f6e8a ("drm/xe: Add migrate layer functions for SVM support") Cc: Matthew Brost Cc: Brian3 Nguyen Cc: Alex Zuo Cc: Matthew Auld Cc: Maciej Patelczyk Cc: Lucas De Marchi Suggested-by: Shuicheng Lin Signed-off-by: Jia Yao Reviewed-by: Matthew Brost Reviewed-by: Lucas De Marchi Reviewed-by: Maciej Patelczyk Link: https://lore.kernel.org/r/20250612224620.161105-1-jia.yao@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit c038bdba98c9f6a36378044a9d4385531a194d3e) Signed-off-by: Lucas De Marchi commit c584c4f264c3bd7c27247688056a5c77907dbb07 Author: Conor Dooley Date: Mon Jun 30 16:18:17 2025 +0100 i2c: microchip-core: re-fix fake detections w/ i2cdetect Introducing support for smbus re-broke i2cdetect, causing it to detect devices at every i2c address, just as it did prior to being fixed in commit 49e1f0fd0d4cb ("i2c: microchip-core: fix "ghost" detections"). This was caused by an oversight, where the new smbus code failed to check the return value of mchp_corei2c_xfer(). Check it, and propagate any errors. Fixes: d6ceb40538263 ("i2c: microchip-corei2c: add smbus support") Signed-off-by: Conor Dooley Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250630-shopper-proven-500f4075e7d6@spud commit 0325143b59c6c6d79987afc57d2456e7a20d13b7 Author: Vitaly Lifshits Date: Wed Jun 11 15:52:54 2025 +0300 igc: disable L1.2 PCI-E link substate to avoid performance issue I226 devices advertise support for the PCI-E link L1.2 substate. However, due to a hardware limitation, the exit latency from this low-power state is longer than the packet buffer can tolerate under high traffic conditions. This can lead to packet loss and degraded performance. To mitigate this, disable the L1.2 substate. The increased power draw between L1.1 and L1.2 is insignificant. Fixes: 43546211738e ("igc: Add new device ID's") Link: https://lore.kernel.org/intel-wired-lan/15248b4f-3271-42dd-8e35-02bfc92b25e1@intel.com Signed-off-by: Vitaly Lifshits Reviewed-by: Aleksandr Loktionov Tested-by: Mor Bar-Gabay Signed-off-by: Tony Nguyen commit b2beb5bb2cd90d7939e470ed4da468683f41baa3 Author: Ahmed Zaki Date: Fri May 23 14:55:37 2025 -0600 idpf: convert control queue mutex to a spinlock With VIRTCHNL2_CAP_MACFILTER enabled, the following warning is generated on module load: [ 324.701677] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:578 [ 324.701684] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1582, name: NetworkManager [ 324.701689] preempt_count: 201, expected: 0 [ 324.701693] RCU nest depth: 0, expected: 0 [ 324.701697] 2 locks held by NetworkManager/1582: [ 324.701702] #0: ffffffff9f7be770 (rtnl_mutex){....}-{3:3}, at: rtnl_newlink+0x791/0x21e0 [ 324.701730] #1: ff1100216c380368 (_xmit_ETHER){....}-{2:2}, at: __dev_open+0x3f0/0x870 [ 324.701749] Preemption disabled at: [ 324.701752] [] __dev_open+0x3dd/0x870 [ 324.701765] CPU: 30 UID: 0 PID: 1582 Comm: NetworkManager Not tainted 6.15.0-rc5+ #2 PREEMPT(voluntary) [ 324.701771] Hardware name: Intel Corporation M50FCP2SBSTD/M50FCP2SBSTD, BIOS SE5C741.86B.01.01.0001.2211140926 11/14/2022 [ 324.701774] Call Trace: [ 324.701777] [ 324.701779] dump_stack_lvl+0x5d/0x80 [ 324.701788] ? __dev_open+0x3dd/0x870 [ 324.701793] __might_resched.cold+0x1ef/0x23d <..> [ 324.701818] __mutex_lock+0x113/0x1b80 <..> [ 324.701917] idpf_ctlq_clean_sq+0xad/0x4b0 [idpf] [ 324.701935] ? kasan_save_track+0x14/0x30 [ 324.701941] idpf_mb_clean+0x143/0x380 [idpf] <..> [ 324.701991] idpf_send_mb_msg+0x111/0x720 [idpf] [ 324.702009] idpf_vc_xn_exec+0x4cc/0x990 [idpf] [ 324.702021] ? rcu_is_watching+0x12/0xc0 [ 324.702035] idpf_add_del_mac_filters+0x3ed/0xb50 [idpf] <..> [ 324.702122] __hw_addr_sync_dev+0x1cf/0x300 [ 324.702126] ? find_held_lock+0x32/0x90 [ 324.702134] idpf_set_rx_mode+0x317/0x390 [idpf] [ 324.702152] __dev_open+0x3f8/0x870 [ 324.702159] ? __pfx___dev_open+0x10/0x10 [ 324.702174] __dev_change_flags+0x443/0x650 <..> [ 324.702208] netif_change_flags+0x80/0x160 [ 324.702218] do_setlink.isra.0+0x16a0/0x3960 <..> [ 324.702349] rtnl_newlink+0x12fd/0x21e0 The sequence is as follows: rtnl_newlink()-> __dev_change_flags()-> __dev_open()-> dev_set_rx_mode() - > # disables BH and grabs "dev->addr_list_lock" idpf_set_rx_mode() -> # proceed only if VIRTCHNL2_CAP_MACFILTER is ON __dev_uc_sync() -> idpf_add_mac_filter -> idpf_add_del_mac_filters -> idpf_send_mb_msg() -> idpf_mb_clean() -> idpf_ctlq_clean_sq() # mutex_lock(cq_lock) Fix by converting cq_lock to a spinlock. All operations under the new lock are safe except freeing the DMA memory, which may use vunmap(). Fix by requesting a contiguous physical memory for the DMA mapping. Fixes: a251eee62133 ("idpf: add SRIOV support and other ndo_ops") Reviewed-by: Aleksandr Loktionov Signed-off-by: Ahmed Zaki Reviewed-by: Simon Horman Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit f77bf1ebf8ff6301ccdbc346f7b52db928f9cbf8 Author: Michal Swiatkowski Date: Thu May 22 10:52:06 2025 +0200 idpf: return 0 size for RSS key if not supported Returning -EOPNOTSUPP from function returning u32 is leading to cast and invalid size value as a result. -EOPNOTSUPP as a size probably will lead to allocation fail. Command: ethtool -x eth0 It is visible on all devices that don't have RSS caps set. [ 136.615917] Call Trace: [ 136.615921] [ 136.615927] ? __warn+0x89/0x130 [ 136.615942] ? __alloc_frozen_pages_noprof+0x322/0x330 [ 136.615953] ? report_bug+0x164/0x190 [ 136.615968] ? handle_bug+0x58/0x90 [ 136.615979] ? exc_invalid_op+0x17/0x70 [ 136.615987] ? asm_exc_invalid_op+0x1a/0x20 [ 136.616001] ? rss_prepare_get.constprop.0+0xb9/0x170 [ 136.616016] ? __alloc_frozen_pages_noprof+0x322/0x330 [ 136.616028] __alloc_pages_noprof+0xe/0x20 [ 136.616038] ___kmalloc_large_node+0x80/0x110 [ 136.616072] __kmalloc_large_node_noprof+0x1d/0xa0 [ 136.616081] __kmalloc_noprof+0x32c/0x4c0 [ 136.616098] ? rss_prepare_get.constprop.0+0xb9/0x170 [ 136.616105] rss_prepare_get.constprop.0+0xb9/0x170 [ 136.616114] ethnl_default_doit+0x107/0x3d0 [ 136.616131] genl_family_rcv_msg_doit+0x100/0x160 [ 136.616147] genl_rcv_msg+0x1b8/0x2c0 [ 136.616156] ? __pfx_ethnl_default_doit+0x10/0x10 [ 136.616168] ? __pfx_genl_rcv_msg+0x10/0x10 [ 136.616176] netlink_rcv_skb+0x58/0x110 [ 136.616186] genl_rcv+0x28/0x40 [ 136.616195] netlink_unicast+0x19b/0x290 [ 136.616206] netlink_sendmsg+0x222/0x490 [ 136.616215] __sys_sendto+0x1fd/0x210 [ 136.616233] __x64_sys_sendto+0x24/0x30 [ 136.616242] do_syscall_64+0x82/0x160 [ 136.616252] ? __sys_recvmsg+0x83/0xe0 [ 136.616265] ? syscall_exit_to_user_mode+0x10/0x210 [ 136.616275] ? do_syscall_64+0x8e/0x160 [ 136.616282] ? __count_memcg_events+0xa1/0x130 [ 136.616295] ? count_memcg_events.constprop.0+0x1a/0x30 [ 136.616306] ? handle_mm_fault+0xae/0x2d0 [ 136.616319] ? do_user_addr_fault+0x379/0x670 [ 136.616328] ? clear_bhb_loop+0x45/0xa0 [ 136.616340] ? clear_bhb_loop+0x45/0xa0 [ 136.616349] ? clear_bhb_loop+0x45/0xa0 [ 136.616359] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 136.616369] RIP: 0033:0x7fd30ba7b047 [ 136.616376] Code: 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 80 3d bd d5 0c 00 00 41 89 ca 74 10 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 71 c3 55 48 83 ec 30 44 89 4c 24 2c 4c 89 44 [ 136.616381] RSP: 002b:00007ffde1796d68 EFLAGS: 00000202 ORIG_RAX: 000000000000002c [ 136.616388] RAX: ffffffffffffffda RBX: 000055d7bd89f2a0 RCX: 00007fd30ba7b047 [ 136.616392] RDX: 0000000000000028 RSI: 000055d7bd89f3b0 RDI: 0000000000000003 [ 136.616396] RBP: 00007ffde1796e10 R08: 00007fd30bb4e200 R09: 000000000000000c [ 136.616399] R10: 0000000000000000 R11: 0000000000000202 R12: 000055d7bd89f340 [ 136.616403] R13: 000055d7bd89f3b0 R14: 000055d78943f200 R15: 0000000000000000 Fixes: 02cbfba1add5 ("idpf: add ethtool callbacks") Reviewed-by: Ahmed Zaki Signed-off-by: Michal Swiatkowski Reviewed-by: Simon Horman Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit 0d519bb0de3bf0ac9e6f401d4910fc119062d7be Author: Yu Kuai Date: Mon Jun 30 19:28:28 2025 +0800 brd: fix sleeping function called from invalid context in brd_insert_page() __xa_cmpxchg() is called with rcu_read_lock(), and it will allocate memory if necessary. Fix the problem by moving rcu_read_lock() after __xa_cmpxchg(), meanwhile, it still should be held before xa_unlock(), prevent returned page to be freed by concurrent discard. Fixes: bbcacab2e8ee ("brd: avoid extra xarray lookups on first write") Reported-by: syzbot+ea4c8fd177a47338881a@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/685ec4c9.a00a0220.129264.000c.GAE@google.com/ Signed-off-by: Yu Kuai Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20250630112828.421219-1-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe commit 61f1065272ea3721c20c4c0a6877d346b0e237c3 Author: Richard Zhu Date: Mon Jun 9 17:11:27 2025 +0800 arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep Correct the DMA interrupter number of pcie0_ep from 317 to 311. Fixes: 3b1d5deb29ff ("arm64: dts: imx95: add pcie[0,1] and pcie-ep[0,1] support") Signed-off-by: Richard Zhu Reviewed-by: Peng Fan Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 01ed88aea527e19def9070349399684522c66c72 Author: Ming Lei Date: Tue Jul 1 15:23:25 2025 +0800 ublk: don't queue request if the associated uring_cmd is canceled Commit 524346e9d79f ("ublk: build batch from IOs in same io_ring_ctx and io task") need to dereference `io->cmd` for checking if the IO can be added to current batch, see ublk_belong_to_same_batch() and io_uring_cmd_ctx_handle(). However, `io->cmd` may become invalid after the uring_cmd is canceled. Fixes it by only allowing to queue this IO in case that ublk_prep_req() returns `BLK_STS_OK`, when 'io->cmd' is guaranteed to be valid. Reported-by: Changhui Zhong Fixes: 524346e9d79f ("ublk: build batch from IOs in same io_ring_ctx and io task") Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250701072325.1458109-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 04a8ff1bc3514808481ddebd454342ad902a3f60 Author: Khairul Anuar Romli Date: Mon Jun 30 17:11:56 2025 +0800 spi: cadence-quadspi: fix cleanup of rx_chan on failure paths Remove incorrect checks on cqspi->rx_chan that cause driver breakage during failure cleanup. Ensure proper resource freeing on the success path when operating in cqspi->use_direct_mode, preventing leaks and improving stability. Signed-off-by: Khairul Anuar Romli Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/89765a2b94f047ded4f14babaefb7ef92ba07cb2.1751274389.git.khairul.anuar.romli@altera.com Signed-off-by: Mark Brown commit 9a57c3773152a3ff2c35cc8325e088d011c9f83b Author: Sebastian Andrzej Siewior Date: Mon Jun 30 16:50:34 2025 +0200 futex: Temporary disable FUTEX_PRIVATE_HASH Chris Mason reported a performance regression on big iron. Reports of this kind were usually reported as part of a micro benchmark but Chris' test did mimic his real workload. This makes it a real regression. The root cause is rcuref_get() which is invoked during each futex operation. If all threads of an application do this simultaneously then it leads to cache line bouncing and the performance drops. Disable FUTEX_PRIVATE_HASH entirely for this cycle. The performance regression will be addressed in the following cycle enabling the option again. Closes: https://lore.kernel.org/all/3ad05298-351e-4d61-9972-ca45a0a50e33@meta.com/ Reported-by: Chris Mason Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20250630145034.8JnINEaS@linutronix.de commit ccdd09e0fc0d5ce6dfc8360f0c88da9a5045b6ea Author: Heiko Carstens Date: Mon Jun 30 15:12:30 2025 +0200 objtool: Add missing endian conversion to read_annotate() Trying to compile an x86 kernel on big endian results in this error: net/ipv4/netfilter/iptable_nat.o: warning: objtool: iptable_nat_table_init+0x150: Unknown annotation type: 50331648 make[5]: *** [scripts/Makefile.build:287: net/ipv4/netfilter/iptable_nat.o] Error 255 Reason is a missing endian conversion in read_annotate(). Add the missing conversion to fix this. Fixes: 2116b349e29a ("objtool: Generic annotation infrastructure") Signed-off-by: Heiko Carstens Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20250630131230.4130185-1-hca@linux.ibm.com commit 009836b4fa52f92cba33618e773b1094affa8cd2 Author: Peter Zijlstra Date: Thu Jun 5 12:00:09 2025 +0200 sched/core: Fix migrate_swap() vs. hotplug On Mon, Jun 02, 2025 at 03:22:13PM +0800, Kuyo Chang wrote: > So, the potential race scenario is: > > CPU0 CPU1 > // doing migrate_swap(cpu0/cpu1) > stop_two_cpus() > ... > // doing _cpu_down() > sched_cpu_deactivate() > set_cpu_active(cpu, false); > balance_push_set(cpu, true); > cpu_stop_queue_two_works > __cpu_stop_queue_work(stopper1,...); > __cpu_stop_queue_work(stopper2,..); > stop_cpus_in_progress -> true > preempt_enable(); > ... > 1st balance_push > stop_one_cpu_nowait > cpu_stop_queue_work > __cpu_stop_queue_work > list_add_tail -> 1st add push_work > wake_up_q(&wakeq); -> "wakeq is empty. > This implies that the stopper is at wakeq@migrate_swap." > preempt_disable > wake_up_q(&wakeq); > wake_up_process // wakeup migrate/0 > try_to_wake_up > ttwu_queue > ttwu_queue_cond ->meet below case > if (cpu == smp_processor_id()) > return false; > ttwu_do_activate > //migrate/0 wakeup done > wake_up_process // wakeup migrate/1 > try_to_wake_up > ttwu_queue > ttwu_queue_cond > ttwu_queue_wakelist > __ttwu_queue_wakelist > __smp_call_single_queue > preempt_enable(); > > 2nd balance_push > stop_one_cpu_nowait > cpu_stop_queue_work > __cpu_stop_queue_work > list_add_tail -> 2nd add push_work, so the double list add is detected > ... > ... > cpu1 get ipi, do sched_ttwu_pending, wakeup migrate/1 > So this balance_push() is part of schedule(), and schedule() is supposed to switch to stopper task, but because of this race condition, stopper task is stuck in WAKING state and not actually visible to be picked. Therefore CPU1 can do another schedule() and end up doing another balance_push() even though the last one hasn't been done yet. This is a confluence of fail, where both wake_q and ttwu_wakelist can cause crucial wakeups to be delayed, resulting in the malfunction of balance_push. Since there is only a single stopper thread to be woken, the wake_q doesn't really add anything here, and can be removed in favour of direct wakeups of the stopper thread. Then add a clause to ttwu_queue_cond() to ensure the stopper threads are never queued / delayed. Of all 3 moving parts, the last addition was the balance_push() machinery, so pick that as the point the bug was introduced. Fixes: 2558aacff858 ("sched/hotplug: Ensure only per-cpu kthreads run during hotplug") Reported-by: Kuyo Chang Signed-off-by: Peter Zijlstra (Intel) Tested-by: Kuyo Chang Link: https://lkml.kernel.org/r/20250605100009.GO39944@noisy.programming.kicks-ass.net commit 3ebb1b6522392f64902b4e96954e35927354aa27 Author: Thomas Weißschuh Date: Thu Jun 26 11:23:44 2025 +0200 sched: Fix preemption string of preempt_dynamic_none Zero is a valid value for "preempt_dynamic_mode", namely "preempt_dynamic_none". Fix the off-by-one in preempt_model_str(), so that "preempty_dynamic_none" is correctly formatted as PREEMPT(none) instead of PREEMPT(undef). Fixes: 8bdc5daaa01e ("sched: Add a generic function to return the preemption string") Signed-off-by: Thomas Weißschuh Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Sebastian Andrzej Siewior Tested-by: Shrikanth Hegde Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20250626-preempt-str-none-v2-1-526213b70a89@linutronix.de commit d6811074203b13f715ce2480ac64c5b1c773f2a5 Author: Geliang Tang Date: Mon Jun 30 15:48:32 2025 +0800 nvme-multipath: fix suspicious RCU usage warning When I run the NVME over TCP test in virtme-ng, I get the following "suspicious RCU usage" warning in nvme_mpath_add_sysfs_link(): ''' [ 5.024557][ T44] nvmet: Created nvm controller 1 for subsystem nqn.2025-06.org.nvmexpress.mptcp for NQN nqn.2014-08.org.nvmexpress:uuid:f7f6b5e0-ff97-4894-98ac-c85309e0bc77. [ 5.027401][ T183] nvme nvme0: creating 2 I/O queues. [ 5.029017][ T183] nvme nvme0: mapped 2/0/0 default/read/poll queues. [ 5.032587][ T183] nvme nvme0: new ctrl: NQN "nqn.2025-06.org.nvmexpress.mptcp", addr 127.0.0.1:4420, hostnqn: nqn.2014-08.org.nvmexpress:uuid:f7f6b5e0-ff97-4894-98ac-c85309e0bc77 [ 5.042214][ T25] [ 5.042440][ T25] ============================= [ 5.042579][ T25] WARNING: suspicious RCU usage [ 5.042705][ T25] 6.16.0-rc3+ #23 Not tainted [ 5.042812][ T25] ----------------------------- [ 5.042934][ T25] drivers/nvme/host/multipath.c:1203 RCU-list traversed in non-reader section!! [ 5.043111][ T25] [ 5.043111][ T25] other info that might help us debug this: [ 5.043111][ T25] [ 5.043341][ T25] [ 5.043341][ T25] rcu_scheduler_active = 2, debug_locks = 1 [ 5.043502][ T25] 3 locks held by kworker/u9:0/25: [ 5.043615][ T25] #0: ffff888008730948 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work+0x7ed/0x1350 [ 5.043830][ T25] #1: ffffc900001afd40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work+0xcf3/0x1350 [ 5.044084][ T25] #2: ffff888013ee0020 (&head->srcu){.+.+}-{0:0}, at: nvme_mpath_add_sysfs_link.part.0+0xb4/0x3a0 [ 5.044300][ T25] [ 5.044300][ T25] stack backtrace: [ 5.044439][ T25] CPU: 0 UID: 0 PID: 25 Comm: kworker/u9:0 Not tainted 6.16.0-rc3+ #23 PREEMPT(full) [ 5.044441][ T25] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 5.044442][ T25] Workqueue: async async_run_entry_fn [ 5.044445][ T25] Call Trace: [ 5.044446][ T25] [ 5.044449][ T25] dump_stack_lvl+0x6f/0xb0 [ 5.044453][ T25] lockdep_rcu_suspicious.cold+0x4f/0xb1 [ 5.044457][ T25] nvme_mpath_add_sysfs_link.part.0+0x2fb/0x3a0 [ 5.044459][ T25] ? queue_work_on+0x90/0xf0 [ 5.044461][ T25] ? lockdep_hardirqs_on+0x78/0x110 [ 5.044466][ T25] nvme_mpath_set_live+0x1e9/0x4f0 [ 5.044470][ T25] nvme_mpath_add_disk+0x240/0x2f0 [ 5.044472][ T25] ? __pfx_nvme_mpath_add_disk+0x10/0x10 [ 5.044475][ T25] ? add_disk_fwnode+0x361/0x580 [ 5.044480][ T25] nvme_alloc_ns+0x81c/0x17c0 [ 5.044483][ T25] ? kasan_quarantine_put+0x104/0x240 [ 5.044487][ T25] ? __pfx_nvme_alloc_ns+0x10/0x10 [ 5.044495][ T25] ? __pfx_nvme_find_get_ns+0x10/0x10 [ 5.044496][ T25] ? rcu_read_lock_any_held+0x45/0xa0 [ 5.044498][ T25] ? validate_chain+0x232/0x4f0 [ 5.044503][ T25] nvme_scan_ns+0x4c8/0x810 [ 5.044506][ T25] ? __pfx_nvme_scan_ns+0x10/0x10 [ 5.044508][ T25] ? find_held_lock+0x2b/0x80 [ 5.044512][ T25] ? ktime_get+0x16d/0x220 [ 5.044517][ T25] ? kvm_clock_get_cycles+0x18/0x30 [ 5.044520][ T25] ? __pfx_nvme_scan_ns_async+0x10/0x10 [ 5.044522][ T25] async_run_entry_fn+0x97/0x560 [ 5.044523][ T25] ? rcu_is_watching+0x12/0xc0 [ 5.044526][ T25] process_one_work+0xd3c/0x1350 [ 5.044532][ T25] ? __pfx_process_one_work+0x10/0x10 [ 5.044536][ T25] ? assign_work+0x16c/0x240 [ 5.044539][ T25] worker_thread+0x4da/0xd50 [ 5.044545][ T25] ? __pfx_worker_thread+0x10/0x10 [ 5.044546][ T25] kthread+0x356/0x5c0 [ 5.044548][ T25] ? __pfx_kthread+0x10/0x10 [ 5.044549][ T25] ? ret_from_fork+0x1b/0x2e0 [ 5.044552][ T25] ? __lock_release.isra.0+0x5d/0x180 [ 5.044553][ T25] ? ret_from_fork+0x1b/0x2e0 [ 5.044555][ T25] ? rcu_is_watching+0x12/0xc0 [ 5.044557][ T25] ? __pfx_kthread+0x10/0x10 [ 5.044559][ T25] ret_from_fork+0x218/0x2e0 [ 5.044561][ T25] ? __pfx_kthread+0x10/0x10 [ 5.044562][ T25] ret_from_fork_asm+0x1a/0x30 [ 5.044570][ T25] ''' This patch uses sleepable RCU version of helper list_for_each_entry_srcu() instead of list_for_each_entry_rcu() to fix it. Fixes: 4dbd2b2ebe4c ("nvme-multipath: Add visibility for round-robin io-policy") Signed-off-by: Geliang Tang Reviewed-by: Keith Busch Reviewed-by: Hannes Reinecke Reviewed-by: Nilay Shroff Signed-off-by: Christoph Hellwig commit 8cadce97bf264ed478669c6f32d5603b34608335 Author: Junxiao Chang Date: Fri Apr 25 23:11:07 2025 +0800 drm/i915/gsc: mei interrupt top half should be in irq disabled context MEI GSC interrupt comes from i915. It has top half and bottom half. Top half is called from i915 interrupt handler. It should be in irq disabled context. With RT kernel, by default i915 IRQ handler is in threaded IRQ. MEI GSC top half might be in threaded IRQ context. generic_handle_irq_safe API could be called from either IRQ or process context, it disables local IRQ then calls MEI GSC interrupt top half. This change fixes A380/A770 GPU boot hang issue with RT kernel. Fixes: 1e3dc1d8622b ("drm/i915/gsc: add gsc as a mei auxiliary device") Tested-by: Furong Zhou Suggested-by: Sebastian Andrzej Siewior Acked-by: Sebastian Andrzej Siewior Signed-off-by: Junxiao Chang Link: https://lore.kernel.org/r/20250425151108.643649-1-junxiao.chang@intel.com Reviewed-by: Rodrigo Vivi Signed-off-by: Rodrigo Vivi (cherry picked from commit dccf655f69002d496a527ba441b4f008aa5bebbf) Signed-off-by: Joonas Lahtinen commit a5aa7bc1fca78c7fa127d9e33aa94a0c9066c1d6 Author: Janusz Krzysztofik Date: Wed Jun 11 12:42:13 2025 +0200 drm/i915/gt: Fix timeline left held on VMA alloc error The following error has been reported sporadically by CI when a test unbinds the i915 driver on a ring submission platform: <4> [239.330153] ------------[ cut here ]------------ <4> [239.330166] i915 0000:00:02.0: [drm] drm_WARN_ON(dev_priv->mm.shrink_count) <4> [239.330196] WARNING: CPU: 1 PID: 18570 at drivers/gpu/drm/i915/i915_gem.c:1309 i915_gem_cleanup_early+0x13e/0x150 [i915] ... <4> [239.330640] RIP: 0010:i915_gem_cleanup_early+0x13e/0x150 [i915] ... <4> [239.330942] Call Trace: <4> [239.330944] <4> [239.330949] i915_driver_late_release+0x2b/0xa0 [i915] <4> [239.331202] i915_driver_release+0x86/0xa0 [i915] <4> [239.331482] devm_drm_dev_init_release+0x61/0x90 <4> [239.331494] devm_action_release+0x15/0x30 <4> [239.331504] release_nodes+0x3d/0x120 <4> [239.331517] devres_release_all+0x96/0xd0 <4> [239.331533] device_unbind_cleanup+0x12/0x80 <4> [239.331543] device_release_driver_internal+0x23a/0x280 <4> [239.331550] ? bus_find_device+0xa5/0xe0 <4> [239.331563] device_driver_detach+0x14/0x20 ... <4> [357.719679] ---[ end trace 0000000000000000 ]--- If the test also unloads the i915 module then that's followed with: <3> [357.787478] ============================================================================= <3> [357.788006] BUG i915_vma (Tainted: G U W N ): Objects remaining on __kmem_cache_shutdown() <3> [357.788031] ----------------------------------------------------------------------------- <3> [357.788204] Object 0xffff888109e7f480 @offset=29824 <3> [357.788670] Allocated in i915_vma_instance+0xee/0xc10 [i915] age=292729 cpu=4 pid=2244 <4> [357.788994] i915_vma_instance+0xee/0xc10 [i915] <4> [357.789290] init_status_page+0x7b/0x420 [i915] <4> [357.789532] intel_engines_init+0x1d8/0x980 [i915] <4> [357.789772] intel_gt_init+0x175/0x450 [i915] <4> [357.790014] i915_gem_init+0x113/0x340 [i915] <4> [357.790281] i915_driver_probe+0x847/0xed0 [i915] <4> [357.790504] i915_pci_probe+0xe6/0x220 [i915] ... Closer analysis of CI results history has revealed a dependency of the error on a few IGT tests, namely: - igt@api_intel_allocator@fork-simple-stress-signal, - igt@api_intel_allocator@two-level-inception-interruptible, - igt@gem_linear_blits@interruptible, - igt@prime_mmap_coherency@ioctl-errors, which invisibly trigger the issue, then exhibited with first driver unbind attempt. All of the above tests perform actions which are actively interrupted with signals. Further debugging has allowed to narrow that scope down to DRM_IOCTL_I915_GEM_EXECBUFFER2, and ring_context_alloc(), specific to ring submission, in particular. If successful then that function, or its execlists or GuC submission equivalent, is supposed to be called only once per GEM context engine, followed by raise of a flag that prevents the function from being called again. The function is expected to unwind its internal errors itself, so it may be safely called once more after it returns an error. In case of ring submission, the function first gets a reference to the engine's legacy timeline and then allocates a VMA. If the VMA allocation fails, e.g. when i915_vma_instance() called from inside is interrupted with a signal, then ring_context_alloc() fails, leaving the timeline held referenced. On next I915_GEM_EXECBUFFER2 IOCTL, another reference to the timeline is got, and only that last one is put on successful completion. As a consequence, the legacy timeline, with its underlying engine status page's VMA object, is still held and not released on driver unbind. Get the legacy timeline only after successful allocation of the context engine's VMA. v2: Add a note on other submission methods (Krzysztof Karas): Both execlists and GuC submission use lrc_alloc() which seems free from a similar issue. Fixes: 75d0a7f31eec ("drm/i915: Lift timeline into intel_context") Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/12061 Cc: Chris Wilson Cc: Matthew Auld Cc: Krzysztof Karas Reviewed-by: Sebastian Brzezinka Reviewed-by: Krzysztof Niemiec Signed-off-by: Janusz Krzysztofik Reviewed-by: Nitin Gote Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250611104352.1014011-2-janusz.krzysztofik@linux.intel.com (cherry picked from commit cc43422b3cc79eacff4c5a8ba0d224688ca9dd4f) Signed-off-by: Joonas Lahtinen commit 7dfede7d7edd18c0c91ca854cde8eaaf4ccf97ea Author: Marko Kiiskila Date: Wed Jun 18 15:29:26 2025 -0400 drm/vmwgfx: Fix guests running with TDX/SEV Commit 81256a50aa0f ("x86/mm: Make memremap(MEMREMAP_WB) map memory as encrypted by default") changed the default behavior of memremap(MEMREMAP_WB) and started mapping memory as encrypted. The driver requires the fifo memory to be decrypted to communicate with the host but was relaying on the old default behavior of memremap(MEMREMAP_WB) and thus broke. Fix it by explicitly specifying the desired behavior and passing MEMREMAP_DEC to memremap. Fixes: 81256a50aa0f ("x86/mm: Make memremap(MEMREMAP_WB) map memory as encrypted by default") Signed-off-by: Marko Kiiskila Signed-off-by: Zack Rusin Cc: Kirill A. Shutemov Cc: Ingo Molnar Cc: Andrew Morton Cc: Dave Hansen Cc: Linus Torvalds Cc: Peter Zijlstra Cc: linux-mm@kvack.org Cc: linux-kernel@vger.kernel.org Acked-by: Kirill A. Shutemov Link: https://lore.kernel.org/r/20250618192926.1092450-1-zack.rusin@broadcom.com commit 72fb83735c71e3f6f025ab7f5dbfec7c9e26b6cc Merge: 3b2c45cb1b5080 89fb8acc388521 Author: Jakub Kicinski Date: Mon Jun 30 18:58:47 2025 -0700 Merge tag 'for-net-2025-06-27' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - MGMT: set_mesh: update LE scan interval and window - MGMT: mesh_send: check instances prior disabling advertising - hci_sync: revert some mesh modifications - hci_sync: Set extended advertising data synchronously - hci_sync: Prevent unintended pause by checking if advertising is active * tag 'for-net-2025-06-27' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: HCI: Set extended advertising data synchronously Bluetooth: MGMT: mesh_send: check instances prior disabling advertising Bluetooth: MGMT: set_mesh: update LE scan interval and window Bluetooth: hci_sync: revert some mesh modifications Bluetooth: Prevent unintended pause by checking if advertising is active ==================== Link: https://patch.msgid.link/20250627181601.520435-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit 3b2c45cb1b508014cee59cbabb1fc936f2f2dd3f Author: Lukas Bulwahn Date: Fri Jun 27 15:44:53 2025 +0200 MAINTAINERS: adjust file entry after renaming rzv2h-gbeth dtb Commit d53320aeef18 ("dt-bindings: net: Rename renesas,r9a09g057-gbeth.yaml") renames the net devicetree binding renesas,r9a09g057-gbeth.yaml to renesas,rzv2h-gbeth.yaml, but misses to adjust the file entry in the RENESAS RZ/V2H(P) DWMAC GBETH GLUE LAYER DRIVER section in MAINTAINERS. Adjust the file entry after this file renaming. Signed-off-by: Lukas Bulwahn Reviewed-by: Geert Uytterhoeven Reviewed-by: Simon Horman Reviewed-by: Lad Prabhakar Link: https://patch.msgid.link/20250627134453.51780-1-lukas.bulwahn@redhat.com Signed-off-by: Jakub Kicinski commit 6c7ffc9af7186ed79403a3ffee9a1e5199fc7450 Author: Oleksij Rempel Date: Fri Jun 27 07:13:46 2025 +0200 net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect Remove redundant netif_napi_del() call from disconnect path. A WARN may be triggered in __netif_napi_del_locked() during USB device disconnect: WARNING: CPU: 0 PID: 11 at net/core/dev.c:7417 __netif_napi_del_locked+0x2b4/0x350 This happens because netif_napi_del() is called in the disconnect path while NAPI is still enabled. However, it is not necessary to call netif_napi_del() explicitly, since unregister_netdev() will handle NAPI teardown automatically and safely. Removing the redundant call avoids triggering the warning. Full trace: lan78xx 1-1:1.0 enu1: Failed to read register index 0x000000c4. ret = -ENODEV lan78xx 1-1:1.0 enu1: Failed to set MAC down with error -ENODEV lan78xx 1-1:1.0 enu1: Link is Down lan78xx 1-1:1.0 enu1: Failed to read register index 0x00000120. ret = -ENODEV ------------[ cut here ]------------ WARNING: CPU: 0 PID: 11 at net/core/dev.c:7417 __netif_napi_del_locked+0x2b4/0x350 Modules linked in: flexcan can_dev fuse CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 6.16.0-rc2-00624-ge926949dab03 #9 PREEMPT Hardware name: SKOV IMX8MP CPU revC - bd500 (DT) Workqueue: usb_hub_wq hub_event pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __netif_napi_del_locked+0x2b4/0x350 lr : __netif_napi_del_locked+0x7c/0x350 sp : ffffffc085b673c0 x29: ffffffc085b673c0 x28: ffffff800b7f2000 x27: ffffff800b7f20d8 x26: ffffff80110bcf58 x25: ffffff80110bd978 x24: 1ffffff0022179eb x23: ffffff80110bc000 x22: ffffff800b7f5000 x21: ffffff80110bc000 x20: ffffff80110bcf38 x19: ffffff80110bcf28 x18: dfffffc000000000 x17: ffffffc081578940 x16: ffffffc08284cee0 x15: 0000000000000028 x14: 0000000000000006 x13: 0000000000040000 x12: ffffffb0022179e8 x11: 1ffffff0022179e7 x10: ffffffb0022179e7 x9 : dfffffc000000000 x8 : 0000004ffdde8619 x7 : ffffff80110bcf3f x6 : 0000000000000001 x5 : ffffff80110bcf38 x4 : ffffff80110bcf38 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 1ffffff0022179e7 x0 : 0000000000000000 Call trace: __netif_napi_del_locked+0x2b4/0x350 (P) lan78xx_disconnect+0xf4/0x360 usb_unbind_interface+0x158/0x718 device_remove+0x100/0x150 device_release_driver_internal+0x308/0x478 device_release_driver+0x1c/0x30 bus_remove_device+0x1a8/0x368 device_del+0x2e0/0x7b0 usb_disable_device+0x244/0x540 usb_disconnect+0x220/0x758 hub_event+0x105c/0x35e0 process_one_work+0x760/0x17b0 worker_thread+0x768/0xce8 kthread+0x3bc/0x690 ret_from_fork+0x10/0x20 irq event stamp: 211604 hardirqs last enabled at (211603): [] _raw_spin_unlock_irqrestore+0x84/0x98 hardirqs last disabled at (211604): [] el1_dbg+0x24/0x80 softirqs last enabled at (211296): [] handle_softirqs+0x820/0xbc8 softirqs last disabled at (210993): [] __do_softirq+0x18/0x20 ---[ end trace 0000000000000000 ]--- lan78xx 1-1:1.0 enu1: failed to kill vid 0081/0 Fixes: ec4c7e12396b ("lan78xx: Introduce NAPI polling support") Suggested-by: Jakub Kicinski Signed-off-by: Oleksij Rempel Link: https://patch.msgid.link/20250627051346.276029-1-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit e39ed71c7a26e8e94c637e222bc373b511ca127f Author: Jiawen Wu Date: Thu Jun 26 16:51:53 2025 +0800 net: txgbe: fix the issue of TX failure There is a occasional problem that ping is failed between AML devices. That is because the manual enablement of the security Tx path on the hardware is missing, no matter what its previous state was. Fixes: 6f8b4c01a8cd ("net: txgbe: Implement PHYLINK for AML 25G/10G devices") Signed-off-by: Jiawen Wu Reviewed-by: Simon Horman Link: https://patch.msgid.link/5BDFB14C57D1C42A+20250626085153.86122-1-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 66701750d5565c574af42bef0b789ce0203e3071 Merge: 4b424a3f7d91c4 6f11adcc6f36ff Author: Linus Torvalds Date: Mon Jun 30 16:32:43 2025 -0700 Merge tag 'io_uring-6.16-20250630' of git://git.kernel.dk/linux Pull io_uring fix from Jens Axboe: "Now that anonymous inodes set S_IFREG, this breaks the io_uring read/write retries for short reads/writes. As things like timerfd and eventfd are anon inodes, applications that previously did: unsigned long event_data[2]; io_uring_prep_read(sqe, evfd, event_data, sizeof(event_data), 0); and just got a short read when 1 event was posted, will now wait for the full amount before posting a completion. This caused issues for the ghostty application, making it basically unusable due to excessive buffering" * tag 'io_uring-6.16-20250630' of git://git.kernel.dk/linux: io_uring: gate REQ_F_ISREG on !S_ANON_INODE as well commit 52e1a03e6cf61ae165f59f41c44394a653a0a788 Author: Nikunj A Dadhania Date: Mon Jun 30 13:48:58 2025 +0530 x86/sev: Use TSC_FACTOR for Secure TSC frequency calculation When using Secure TSC, the GUEST_TSC_FREQ MSR reports a frequency based on the nominal P0 frequency, which deviates slightly (typically ~0.2%) from the actual mean TSC frequency due to clocking parameters. Over extended VM uptime, this discrepancy accumulates, causing clock skew between the hypervisor and a SEV-SNP VM, leading to early timer interrupts as perceived by the guest. The guest kernel relies on the reported nominal frequency for TSC-based timekeeping, while the actual frequency set during SNP_LAUNCH_START may differ. This mismatch results in inaccurate time calculations, causing the guest to perceive hrtimers as firing earlier than expected. Utilize the TSC_FACTOR from the SEV firmware's secrets page (see "Secrets Page Format" in the SNP Firmware ABI Specification) to calculate the mean TSC frequency, ensuring accurate timekeeping and mitigating clock skew in SEV-SNP VMs. Use early_ioremap_encrypted() to map the secrets page as ioremap_encrypted() uses kmalloc() which is not available during early TSC initialization and causes a panic. [ bp: Drop the silly dummy var: https://lore.kernel.org/r/20250630192726.GBaGLlHl84xIopx4Pt@fat_crate.local ] Fixes: 73bbf3b0fbba ("x86/tsc: Init the TSC for Secure TSC guests") Signed-off-by: Nikunj A Dadhania Signed-off-by: Borislav Petkov (AMD) Cc: stable@vger.kernel.org Link: https://lore.kernel.org/20250630081858.485187-1-nikunj@amd.com commit fbf913cb72a52559ae98951fb4311b81d7b0650e Author: Alan Huang Date: Mon Jun 30 20:36:33 2025 +0800 bcachefs: Fix incorrect transaction restart handling Reported-by: syzbot+cc7567f096079cb4146f@syzkaller.appspotmail.com Signed-off-by: Alan Huang Signed-off-by: Kent Overstreet commit 74ebd02163fde05baa23129e06dde4b8f0f2377a Author: Shyam Prasad N Date: Mon Jun 30 23:09:34 2025 +0530 cifs: all initializations for tcon should happen in tcon_info_alloc Today, a few work structs inside tcon are initialized inside cifs_get_tcon and not in tcon_info_alloc. As a result, if a tcon is obtained from tcon_info_alloc, but not called as a part of cifs_get_tcon, we may trip over. Cc: Signed-off-by: Shyam Prasad N Reviewed-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French commit 964209202ebe1569c858337441e87ef0f9d71416 Author: Zhang Rui Date: Thu Jun 19 15:13:40 2025 +0800 powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed PL1 cannot be disabled on some platforms. The ENABLE bit is still set after software clears it. This behavior leads to a scenario where, upon user request to disable the Power Limit through the powercap sysfs, the ENABLE bit remains set while the CLAMPING bit is inadvertently cleared. According to the Intel Software Developer's Manual, the CLAMPING bit, "When set, allows the processor to go below the OS requested P states in order to maintain the power below specified Platform Power Limit value." Thus this means the system may operate at higher power levels than intended on such platforms. Enhance the code to check ENABLE bit after writing to it, and stop further processing if ENABLE bit cannot be changed. Reported-by: Srinivas Pandruvada Fixes: 2d281d8196e3 ("PowerCap: Introduce Intel RAPL power capping driver") Cc: All applicable Signed-off-by: Zhang Rui Link: https://patch.msgid.link/20250619071340.384782-1-rui.zhang@intel.com [ rjw: Use str_enabled_disabled() instead of open-coded equivalent ] Signed-off-by: Rafael J. Wysocki commit 3bbe46716092d8ef6b0df4b956f585c5cd0fc78e Author: Paulo Alcantara Date: Wed Jun 25 00:00:17 2025 -0300 smb: client: fix warning when reconnecting channel When reconnecting a channel in smb2_reconnect_server(), a dummy tcon is passed down to smb2_reconnect() with ->query_interface uninitialized, so we can't call queue_delayed_work() on it. Fix the following warning by ensuring that we're queueing the delayed worker from correct tcon. WARNING: CPU: 4 PID: 1126 at kernel/workqueue.c:2498 __queue_delayed_work+0x1d2/0x200 Modules linked in: cifs cifs_arc4 nls_ucs2_utils cifs_md4 [last unloaded: cifs] CPU: 4 UID: 0 PID: 1126 Comm: kworker/4:0 Not tainted 6.16.0-rc3 #5 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-4.fc42 04/01/2014 Workqueue: cifsiod smb2_reconnect_server [cifs] RIP: 0010:__queue_delayed_work+0x1d2/0x200 Code: 41 5e 41 5f e9 7f ee ff ff 90 0f 0b 90 e9 5d ff ff ff bf 02 00 00 00 e8 6c f3 07 00 89 c3 eb bd 90 0f 0b 90 e9 57 f> 0b 90 e9 65 fe ff ff 90 0f 0b 90 e9 72 fe ff ff 90 0f 0b 90 e9 RSP: 0018:ffffc900014afad8 EFLAGS: 00010003 RAX: 0000000000000000 RBX: ffff888124d99988 RCX: ffffffff81399cc1 RDX: dffffc0000000000 RSI: ffff888114326e00 RDI: ffff888124d999f0 RBP: 000000000000ea60 R08: 0000000000000001 R09: ffffed10249b3331 R10: ffff888124d9998f R11: 0000000000000004 R12: 0000000000000040 R13: ffff888114326e00 R14: ffff888124d999d8 R15: ffff888114939020 FS: 0000000000000000(0000) GS:ffff88829f7fe000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe7a2b4038 CR3: 0000000120a6f000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: queue_delayed_work_on+0xb4/0xc0 smb2_reconnect+0xb22/0xf50 [cifs] smb2_reconnect_server+0x413/0xd40 [cifs] ? __pfx_smb2_reconnect_server+0x10/0x10 [cifs] ? local_clock_noinstr+0xd/0xd0 ? local_clock+0x15/0x30 ? lock_release+0x29b/0x390 process_one_work+0x4c5/0xa10 ? __pfx_process_one_work+0x10/0x10 ? __list_add_valid_or_report+0x37/0x120 worker_thread+0x2f1/0x5a0 ? __kthread_parkme+0xde/0x100 ? __pfx_worker_thread+0x10/0x10 kthread+0x1fe/0x380 ? kthread+0x10f/0x380 ? __pfx_kthread+0x10/0x10 ? local_clock_noinstr+0xd/0xd0 ? ret_from_fork+0x1b/0x1f0 ? local_clock+0x15/0x30 ? lock_release+0x29b/0x390 ? rcu_is_watching+0x20/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x15b/0x1f0 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 irq event stamp: 1116206 hardirqs last enabled at (1116205): [] __up_console_sem+0x52/0x60 hardirqs last disabled at (1116206): [] queue_delayed_work_on+0x6e/0xc0 softirqs last enabled at (1116138): [] __smb_send_rqst+0x42d/0x950 [cifs] softirqs last disabled at (1116136): [] release_sock+0x21/0xf0 Cc: linux-cifs@vger.kernel.org Reported-by: David Howells Fixes: 42ca547b13a2 ("cifs: do not disable interface polling on failure") Reviewed-by: David Howells Tested-by: David Howells Reviewed-by: Shyam Prasad N Signed-off-by: Paulo Alcantara (Red Hat) Signed-off-by: David Howells Tested-by: Steve French Signed-off-by: Steve French commit 39d81457ad3417a98ac826161f9ca0e642677661 Author: Mario Limonciello Date: Thu Jun 19 09:29:13 2025 -0500 drm/amd/display: Don't allow OLED to go down to fully off [Why] OLED panels can be fully off, but this behavior is unexpected. [How] Ensure that minimum luminance is at least 1. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4338 Reviewed-by: Alex Hung Signed-off-by: Mario Limonciello Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 51496c7737d06a74b599d0aa7974c3d5a4b1162e) commit 84f2902bfcfe79e94adf5dfe9bf85ad334a4c63a Author: Harold Sun Date: Thu Jun 19 14:52:54 2025 -0400 drm/amd/display: Added case for when RR equals panel's max RR using freesync [WHY] Rounding error sometimes occurs when the refresh rate is equal to a panel's max refresh rate, causing HDMI compliance failures. [HOW] Added a case so that we round up to avoid v_total_min to be below a panel's minimum bound. Reviewed-by: Jun Lei Signed-off-by: Harold Sun Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit fe7645d22bc0f7c1558296538ec49987bf268ef6) commit 34659c1a1f4fd4c148ab13e13b11fd64df01ffcd Author: Alex Deucher Date: Wed Jun 25 18:15:37 2025 -0400 drm/amdkfd: add hqd_sdma_get_doorbell callbacks for gfx7/8 These were missed when support was added for other generations. The callbacks are called unconditionally so we need to make sure all generations have them. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4304 Link: https://github.com/ROCm/ROCm/issues/4965 Fixes: bac38ca8c475 ("drm/amdkfd: implement per queue sdma reset for gfx 9.4+") Cc: Jonathan Kim Reported-by: Johl Brown Reviewed-by: Jonathan Kim Signed-off-by: Alex Deucher (cherry picked from commit 1e9d17a5dcf1242e9518e461d8e63ad35240e49e) Cc: stable@vger.kernel.org commit f3e58d8e154dae5015c7400812c80789589fc36e Author: Lin.Cao Date: Tue Jun 24 17:05:34 2025 +0800 drm/amdgpu: Fix memory leak in amdgpu_ctx_mgr_entity_fini patch dd64956685fa ("drm/amdgpu: Remove duplicated "context still alive" check") removed ctx put, which will cause amdgpu_ctx_fini() cannot be called and then cause some finished fence that added by amdgpu_ctx_add_fence() cannot be released and cause memleak. Fixes: dd64956685fa ("drm/amdgpu: Remove duplicated "context still alive" check") Signed-off-by: Lin.Cao Reviewed-by: Tvrtko Ursulin Acked-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 8cf66089e28108dedd47e6156a48489303cf525c) Cc: stable@vger.kernel.org commit cf234231fcbc7d391e2135b9518613218cc5347f Author: Philip Yang Date: Fri Jun 20 18:32:32 2025 -0400 drm/amdkfd: Don't call mmput from MMU notifier callback If the process is exiting, the mmput inside mmu notifier callback from compactd or fork or numa balancing could release the last reference of mm struct to call exit_mmap and free_pgtable, this triggers deadlock with below backtrace. The deadlock will leak kfd process as mmu notifier release is not called and cause VRAM leaking. The fix is to take mm reference mmget_non_zero when adding prange to the deferred list to pair with mmput in deferred list work. If prange split and add into pchild list, the pchild work_item.mm is not used, so remove the mm parameter from svm_range_unmap_split and svm_range_add_child. The backtrace of hung task: INFO: task python:348105 blocked for more than 64512 seconds. Call Trace: __schedule+0x1c3/0x550 schedule+0x46/0xb0 rwsem_down_write_slowpath+0x24b/0x4c0 unlink_anon_vmas+0xb1/0x1c0 free_pgtables+0xa9/0x130 exit_mmap+0xbc/0x1a0 mmput+0x5a/0x140 svm_range_cpu_invalidate_pagetables+0x2b/0x40 [amdgpu] mn_itree_invalidate+0x72/0xc0 __mmu_notifier_invalidate_range_start+0x48/0x60 try_to_unmap_one+0x10fa/0x1400 rmap_walk_anon+0x196/0x460 try_to_unmap+0xbb/0x210 migrate_page_unmap+0x54d/0x7e0 migrate_pages_batch+0x1c3/0xae0 migrate_pages_sync+0x98/0x240 migrate_pages+0x25c/0x520 compact_zone+0x29d/0x590 compact_zone_order+0xb6/0xf0 try_to_compact_pages+0xbe/0x220 __alloc_pages_direct_compact+0x96/0x1a0 __alloc_pages_slowpath+0x410/0x930 __alloc_pages_nodemask+0x3a9/0x3e0 do_huge_pmd_anonymous_page+0xd7/0x3e0 __handle_mm_fault+0x5e3/0x5f0 handle_mm_fault+0xf7/0x2e0 hmm_vma_fault.isra.0+0x4d/0xa0 walk_pmd_range.isra.0+0xa8/0x310 walk_pud_range+0x167/0x240 walk_pgd_range+0x55/0x100 __walk_page_range+0x87/0x90 walk_page_range+0xf6/0x160 hmm_range_fault+0x4f/0x90 amdgpu_hmm_range_get_pages+0x123/0x230 [amdgpu] amdgpu_ttm_tt_get_user_pages+0xb1/0x150 [amdgpu] init_user_pages+0xb1/0x2a0 [amdgpu] amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x543/0x7d0 [amdgpu] kfd_ioctl_alloc_memory_of_gpu+0x24c/0x4e0 [amdgpu] kfd_ioctl+0x29d/0x500 [amdgpu] Fixes: fa582c6f3684 ("drm/amdkfd: Use mmget_not_zero in MMU notifier") Signed-off-by: Philip Yang Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher (cherry picked from commit a29e067bd38946f752b0ef855f3dfff87e77bec7) Cc: stable@vger.kernel.org commit 3d30048958e0d43425f6d4e76565e6249fa71050 Author: Michael J. Ruhl Date: Fri Jun 27 10:35:11 2025 -0400 i2c/designware: Fix an initialization issue The i2c_dw_xfer_init() function requires msgs and msg_write_idx from the dev context to be initialized. amd_i2c_dw_xfer_quirk() inits msgs and msgs_num, but not msg_write_idx. This could allow an out of bounds access (of msgs). Initialize msg_write_idx before calling i2c_dw_xfer_init(). Reviewed-by: Andy Shevchenko Fixes: 17631e8ca2d3 ("i2c: designware: Add driver support for AMD NAVI GPU") Cc: # v5.13+ Signed-off-by: Michael J. Ruhl Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250627143511.489570-1-michael.j.ruhl@intel.com commit e54c5de901ea56fc68f8d56b3cce9940169346f4 Author: Kent Russell Date: Tue Jun 24 11:42:06 2025 -0400 drm/amdgpu: Include sdma_4_4_4.bin This got missed during SDMA 4.4.4 support. Fixes: 968e3811c3e8 ("drm/amdgpu: add initial support for sdma444") Signed-off-by: Kent Russell Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 51526efe02714339ed6139f7bc348377d363200a) Cc: stable@vger.kernel.org commit 62461367f4c0dcf4fab9cafb4ab3a7d346788df6 Author: David Yat Sin Date: Thu Jun 19 17:51:13 2025 +0000 amdkfd: MTYPE_UC for ext-coherent system memory Set memory mtype to UC host memory when ext-coherent flag is set and memory is registered as a SVM allocation. Reviewed-by: Amber Lin Signed-off-by: David Yat Sin Signed-off-by: Alex Deucher (cherry picked from commit 5d14fdab4778c29cfd39e62c3ce84d232b4a7d8c) commit 905967e359f0a3345dce096504e8c0390d0a8f49 Author: Alex Deucher Date: Mon Jun 16 14:04:54 2025 -0400 drm/amdgpu/sdma5.x: suspend KFD queues in ring reset SDMA 5.x only supports engine soft reset which resets all queues on the engine. As such, we need to suspend KFD queues around resets like we do for SDMA 4.x. Reviewed-by: Jesse Zhang Signed-off-by: Alex Deucher (cherry picked from commit 61feed0baa1a0d094af0e07e968b1e6e875f07d0) commit ba74278c638df7c333a970a265dfcc258e70807b Author: Marc Zyngier Date: Wed Jun 25 12:18:06 2025 +0100 Revert "PCI: ecam: Allow cfg->priv to be pre-populated from the root port device" This reverts commit 4900454b4f819e88e9c57ed93542bf9325d7e161. Now that nobody relies of cfg->priv containing anything useful before the .init() callback is used, restore the previous behaviour. Signed-off-by: Marc Zyngier Signed-off-by: Bjorn Helgaas Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250625111806.4153773-4-maz@kernel.org commit bdb32a0f6780660512d2335db2ebe32e6582cdc8 Author: Geert Uytterhoeven Date: Wed Jun 25 12:18:04 2025 +0100 PCI: host-generic: Set driver_data before calling gen_pci_init() On MicroChip MPFS Icicle: microchip-pcie 2000000000.pcie: host bridge /soc/pcie@2000000000 ranges: microchip-pcie 2000000000.pcie: Parsing ranges property... microchip-pcie 2000000000.pcie: MEM 0x2008000000..0x2087ffffff -> 0x0008000000 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000368 Current swapper/0 pgtable: 4K pagesize, 39-bit VAs, pgdp=0x00000000814f1000 [0000000000000368] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 Oops [#1] Modules linked in: CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.15.0-rc1-icicle-00003-gafc0a570bb61 #232 NONE Hardware name: Microchip PolarFire-SoC Icicle Kit (DT) [...] [] plda_pcie_setup_iomems+0xe/0x78 [] mc_platform_init+0x80/0x1d2 [] pci_ecam_create+0x104/0x1e2 [] pci_host_common_init+0x120/0x228 [] pci_host_common_probe+0x7c/0x8a The initialization of driver_data was moved after the call to gen_pci_init(), while the pci_ecam_ops.init() callback mc_platform_init() expects it has already been initialized. Fix this by moving the initialization of driver_data up. Fixes: afc0a570bb613871 ("PCI: host-generic: Extract an ECAM bridge creation helper from pci_host_common_probe()") Signed-off-by: Geert Uytterhoeven Signed-off-by: Marc Zyngier Signed-off-by: Bjorn Helgaas Link: https://lore.kernel.org/r/774290708a6f0f683711914fda110742c18a7fb2.1750787223.git.geert+renesas@glider.be Link: https://patch.msgid.link/20250625111806.4153773-2-maz@kernel.org commit 643c0c9d0496c5727ca28cd841d069b5afee06cf Author: Marc Zyngier Date: Wed Jun 25 12:18:05 2025 +0100 PCI: apple: Add tracking of probed root ports The apple driver relies on being able to directly find the matching root port structure from the platform device that represents this port. A previous hack stashed a pointer to the root port structure in the config window private pointer, but that ended up relying on assumptions that break other drivers. Instead, bite the bullet and track the association as part of the driver itself as a list of probed root ports. Signed-off-by: Marc Zyngier Signed-off-by: Bjorn Helgaas Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250625111806.4153773-3-maz@kernel.org commit a106b6a888caf478d5fd31d123ffa09558500772 Author: Andy Shevchenko Date: Mon Jun 30 11:21:52 2025 +0300 Input: alps - use scnprintf() to suppress truncation warning The commit 76c968e75715 ("Input: alps - switch to use scnprintf() to suppress truncation warning") converted one place in the driver while the other left untouched. Convert the other place as well. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250630082245.1416796-1-andriy.shevchenko@linux.intel.com Signed-off-by: Dmitry Torokhov commit 60f7f4afaf6d09c27971f30f5ab69a3aab78b28f Author: Mark Bloch Date: Thu Jun 26 18:42:52 2025 -0700 MAINTAINERS: Add myself as mlx5 core and mlx5e co-maintainer I have been working on mlx5 related code for several years, contributing features, code reviews, and occasional maintainer tasks when needed. This patch makes my maintainer role official. Signed-off-by: Mark Bloch Signed-off-by: Saeed Mahameed Link: https://patch.msgid.link/20250627014252.1262592-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit e8537cad824065b0425fb0429e762e14a08067c2 Author: Dmitry Baryshkov Date: Sun Jun 8 18:52:04 2025 +0300 drm/bridge: aux-hpd-bridge: fix assignment of the of_node Perform fix similar to the one in the commit 85e444a68126 ("drm/bridge: Fix assignment of the of_node of the parent to aux bridge"). The assignment of the of_node to the aux HPD bridge needs to mark the of_node as reused, otherwise driver core will attempt to bind resources like pinctrl, which is going to fail as corresponding pins are already marked as used by the parent device. Fix that by using the device_set_of_node_from_dev() helper instead of assigning it directly. Fixes: e560518a6c2e ("drm/bridge: implement generic DP HPD bridge") Signed-off-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250608-fix-aud-hpd-bridge-v1-1-4641a6f8e381@oss.qualcomm.com commit eb028cd884e1b0976ff8c5944ee6650fe3ed0a6c Author: Dmitry Baryshkov Date: Thu Feb 20 17:07:26 2025 +0200 drm/bridge: panel: move prepare_prev_first handling to drm_panel_bridge_add_typed The commit 5ea6b1702781 ("drm/panel: Add prepare_prev_first flag to drm_panel") and commit 0974687a19c3 ("drm/bridge: panel: Set pre_enable_prev_first from drmm_panel_bridge_add") added handling of panel's prepare_prev_first to devm_panel_bridge_add() and drmm_panel_bridge_add(). However if the driver calls drm_panel_bridge_add_typed() directly, then the flag won't be handled and thus the drm_bridge.pre_enable_prev_first will not be set. Move prepare_prev_first handling to the drm_panel_bridge_add_typed() so that there is no way to miss the flag. Fixes: 5ea6b1702781 ("drm/panel: Add prepare_prev_first flag to drm_panel") Fixes: 0974687a19c3 ("drm/bridge: panel: Set pre_enable_prev_first from drmm_panel_bridge_add") Reported-by: Svyatoslav Ryhel Closes: https://lore.kernel.org/dri-devel/CAPVz0n3YZass3Bns1m0XrFxtAC0DKbEPiW6vXimQx97G243sXw@mail.gmail.com/ Signed-off-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250220-panel_prev_first-v1-1-b9e787825a1a@linaro.org commit 4b424a3f7d91c4c694a36ecb30b978e30689cdae Merge: d0b3b7b22dfa1f 08d82d0cad51c2 Author: Linus Torvalds Date: Mon Jun 30 08:27:38 2025 -0700 Merge tag 'rtc-6.16-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC fixes from Alexandre Belloni: "Some fixes for 6.16. The cmos one is important for PREEMPT_RT. I've also added the s5m changes as they had a dependency on the MFD pull request that was included in 6.16-rc1 and we didn't synchronize before the merge window and they won't hurt. - cmos: use spin_lock_irqsave in cmos_interrupt - pcf2127: fix SPI command byte for PCF2131 - s5m: add S2MPG10 support" * tag 'rtc-6.16-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: rtc: pcf2127: add missing semicolon after statement rtc: pcf2127: fix SPI command byte for PCF2131 rtc: cmos: use spin_lock_irqsave in cmos_interrupt rtc: s5m: replace open-coded read/modify/write registers with regmap helpers rtc: s5m: replace regmap_update_bits with regmap_clear/set_bits rtc: s5m: switch to devm_device_init_wakeup rtc: s5m: fix a typo: peding -> pending rtc: s5m: add support for S2MPG10 RTC rtc: s5m: prepare for external regmap rtc: s5m: cache device type during probe commit 6729c134ccc0d37d865c342e466b90df29081f1a Author: Jisheng Zhang Date: Sun Jun 29 17:59:18 2025 +0800 regulator: mp886x: Fix ID table driver_data Currently, the driver_data of the i2c ID table is wrong, so it won't work if any mp886x user makes use of the ID table. Fortunately, there's no such user in upstream source code, we can fix the issue by using different ID table entry for mp8867 and mp8869. Signed-off-by: Jisheng Zhang Link: https://patch.msgid.link/20250629095918.912-1-jszhang@kernel.org Signed-off-by: Mark Brown commit f172ffde18997aa401a74153cea4ae3bfdcb5124 Author: Jisheng Zhang Date: Sun Jun 29 17:59:05 2025 +0800 regulator: sy8824x: Fix ID table driver_data Currently, the driver_data of the i2c ID table is wrong, so it won't work if any sy8824x user makes use of the ID table. Fortunately, there's no such user in upstream source code, we can fix the issue by using different ID table entry for sy8824c, sy8824e, sy20276 and sy20278. Signed-off-by: Jisheng Zhang Link: https://patch.msgid.link/20250629095905.898-1-jszhang@kernel.org Signed-off-by: Mark Brown commit eb2c93e7028b4c9fe4761734d65ee40712d1c242 Author: Nam Cao Date: Mon Jun 30 12:26:14 2025 +0200 irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ irq-msi-lib directly uses struct msi_domain_info and more things which are only available when CONFIG_GENERIC_MSI_IRQ=y. However, there is no dependency specified and CONFIG_IRQ_MSI_LIB can be enabled without CONFIG_GENERIC_MSI_IRQ, which causes the kernel build fail. Make IRQ_MSI_LIB select GENEREIC_MSI_IRQ to prevent that. Fixes: 72e257c6f058 ("irqchip: Provide irq-msi-lib") Reported-by: kernel test robot Signed-off-by: Nam Cao Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/b0c44007f3b7e062228349a2395f8d850050db33.1751277765.git.namcao@linutronix.de Closes: https://lore.kernel.org/oe-kbuild-all/202506282256.cHlEHrdc-lkp@intel.com/ commit 9bd9c8026341f75f25c53104eb7e656e357ca1a2 Author: Mathias Nyman Date: Fri Jun 27 19:43:48 2025 +0300 usb: hub: Fix flushing of delayed work used for post resume purposes Delayed work that prevents USB3 hubs from runtime-suspending too early needed to be flushed in hub_quiesce() to resolve issues detected on QC SC8280XP CRD board during suspend resume testing. This flushing did however trigger new issues on Raspberry Pi 3B+, which doesn't have USB3 ports, and doesn't queue any post resume delayed work. The flushed 'hub->init_work' item is used for several purposes, and is originally initialized with a 'NULL' work function. The work function is also changed on the fly, which may contribute to the issue. Solve this by creating a dedicated delayed work item for post resume work, and flush that delayed work in hub_quiesce() Cc: stable Fixes: a49e1e2e785f ("usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm") Reported-by: Mark Brown Closes: https://lore.kernel.org/linux-usb/aF5rNp1l0LWITnEB@finisterre.sirena.org.uk Signed-off-by: Mathias Nyman Tested-by: Konrad Dybcio # SC8280XP CRD Tested-by: Mark Brown Link: https://lore.kernel.org/r/20250627164348.3982628-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 74b1ec9f5d627d2bdd5e5b6f3f81c23317657023 Author: Daniil Dulov Date: Thu Jun 26 14:46:19 2025 +0300 wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() There is a potential NULL pointer dereference in zd_mac_tx_to_dev(). For example, the following is possible: T0 T1 zd_mac_tx_to_dev() /* len == skb_queue_len(q) */ while (len > ZD_MAC_MAX_ACK_WAITERS) { filter_ack() spin_lock_irqsave(&q->lock, flags); /* position == skb_queue_len(q) */ for (i=1; itype == NL80211_IFTYPE_AP) skb = __skb_dequeue(q); spin_unlock_irqrestore(&q->lock, flags); skb_dequeue() -> NULL Since there is a small gap between checking skb queue length and skb being unconditionally dequeued in zd_mac_tx_to_dev(), skb_dequeue() can return NULL. Then the pointer is passed to zd_mac_tx_status() where it is dereferenced. In order to avoid potential NULL pointer dereference due to situations like above, check if skb is not NULL before passing it to zd_mac_tx_status(). Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 459c51ad6e1f ("zd1211rw: port to mac80211") Signed-off-by: Daniil Dulov Link: https://patch.msgid.link/20250626114619.172631-1-d.dulov@aladdin.ru Signed-off-by: Johannes Berg commit 1fe44a86ff0ff483aa1f1332f2b08f431fa51ce8 Author: Lachlan Hodges Date: Thu Jun 26 21:51:18 2025 +1000 wifi: cfg80211: fix S1G beacon head validation in nl80211 S1G beacons contain fixed length optional fields that precede the variable length elements, ensure we take this into account when validating the beacon. This particular case was missed in 1e1f706fc2ce ("wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements"). Fixes: 1d47f1198d58 ("nl80211: correctly validate S1G beacon head") Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20250626115118.68660-1-lachlan.hodges@morsemicro.com [shorten/reword subject] Signed-off-by: Johannes Berg commit 9e9b46672b1daac814b384286c21fb8332a87392 Author: Youling Tang Date: Mon Jun 30 09:11:48 2025 +0800 xfs: add FALLOC_FL_ALLOCATE_RANGE to supported flags mask Add FALLOC_FL_ALLOCATE_RANGE to the set of supported fallocate flags in XFS_FALLOC_FL_SUPPORTED. This change improves code clarity and maintains by explicitly showing this flag in the supported flags mask. Note that since FALLOC_FL_ALLOCATE_RANGE is defined as 0x00, this addition has no functional modifications. Reviewed-by: Carlos Maiolino Signed-off-by: Youling Tang Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 4ec24e9601d5cfc9ac9798c0acb8e88c6ab61fc5 Merge: fa60c094c19b97 ddaad4ad774d4a Author: Mark Brown Date: Mon Jun 30 12:42:36 2025 +0100 spi: spi-qpic-snand: avoid memory corruption Merge series from Gabor Juhos : The 'spi-qpic-nand' driver may cause memory corruption under some circumstances. The first patch in the series changes the driver to avoid that, whereas the second adds some sanity checks to the common QPIC code in order to make detecting such errors easier in the future. commit 97e000acf2e20a86a50a0ec8c2739f0846f37509 Author: Christian König Date: Fri Jun 13 13:16:38 2025 +0200 drm/ttm: fix error handling in ttm_buffer_object_transfer Unlocking the resv object was missing in the error path, additionally to that we should move over the resource only after the fence slot was reserved. Signed-off-by: Christian König Reviewed-by: Matthew Brost Fixes: c8d4c18bfbc4a ("dma-buf/drivers: make reserving a shared slot mandatory v4") Cc: Link: https://lore.kernel.org/r/20250616130726.22863-3-christian.koenig@amd.com commit 2b95a7db6e0f75587bffddbb490399cbb87e4985 Author: Christian König Date: Tue Jan 28 10:47:48 2025 +0100 dma-buf: fix timeout handling in dma_resv_wait_timeout v2 Even the kerneldoc says that with a zero timeout the function should not wait for anything, but still return 1 to indicate that the fences are signaled now. Unfortunately that isn't what was implemented, instead of only returning 1 we also waited for at least one jiffies. Fix that by adjusting the handling to what the function is actually documented to do. v2: improve code readability Reported-by: Marek Olšák Reported-by: Lucas Stach Signed-off-by: Christian König Reviewed-by: Lucas Stach Cc: Link: https://lore.kernel.org/r/20250129105841.1806-1-christian.koenig@amd.com commit 644bec18e705ca41d444053407419a21832fcb2f Author: Alok Tiwari Date: Mon Jun 30 03:58:08 2025 -0700 platform/mellanox: mlxreg-lc: Fix logic error in power state check Fixes a logic issue in mlxreg_lc_completion_notify() where the intention was to check if MLXREG_LC_POWERED flag is not set before powering on the device. The original code used "state & ~MLXREG_LC_POWERED" to check for the absence of the POWERED bit. However this condition evaluates to true even when other bits are set, leading to potentially incorrect behavior. Corrected the logic to explicitly check for the absence of MLXREG_LC_POWERED using !(state & MLXREG_LC_POWERED). Fixes: 62f9529b8d5c ("platform/mellanox: mlxreg-lc: Add initial support for Nvidia line card devices") Suggested-by: Vadim Pasternak Signed-off-by: Alok Tiwari Link: https://lore.kernel.org/r/20250630105812.601014-1-alok.a.tiwari@oracle.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit af14ed3fcb2703d1185bf10531fee87e6e1cc60b Author: Mario Limonciello Date: Tue Jun 10 15:58:17 2025 -0500 i2c: Re-enable piix4 driver on non-x86 loongarch and mips both support hardware that uses the i2c-piix4 driver. It should not be restricted to x86, so drop the x86 dependency. Reported-by: Geert Uytterhoeven Closes: https://lore.kernel.org/all/CAMuHMdVPQLjOox5sMp34Z5MTwKv2WOpHa=MpZr8hWG22fQKcjw@mail.gmail.com/ Fixes: 7e173eb82ae97175 ("i2c: piix4: Make CONFIG_I2C_PIIX4 dependent on CONFIG_X86"). Signed-off-by: Mario Limonciello Reviewed-by: Hans de Goede Acked-by: Andi Shyti Link: https://lore.kernel.org/r/20250610205817.3912944-2-superm1@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit b1c26e059536d8acbf9d508374f4b76537e20fb7 Author: Mario Limonciello Date: Tue Jun 10 15:58:16 2025 -0500 Move FCH header to a location accessible by all archs A new header fch.h was created to store registers used by different AMD drivers. This header was included by i2c-piix4 in commit 624b0d5696a8 ("i2c: piix4, x86/platform: Move the SB800 PIIX4 FCH definitions to "). To prevent compile failures on non-x86 archs i2c-piix4 was set to only compile on x86 by commit 7e173eb82ae9717 ("i2c: piix4: Make CONFIG_I2C_PIIX4 dependent on CONFIG_X86"). This was not a good decision because loongarch and mips both actually support i2c-piix4 and set it enabled in the defconfig. Move the header to a location accessible by all architectures. Fixes: 624b0d5696a89 ("i2c: piix4, x86/platform: Move the SB800 PIIX4 FCH definitions to ") Suggested-by: Hans de Goede Signed-off-by: Mario Limonciello Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250610205817.3912944-1-superm1@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 690be4bc589a145dc211b8d66b8f851713abd344 Author: Srinivas Pandruvada Date: Tue Jun 17 16:29:13 2025 -0700 platform/x86/intel/hid: Add Wildcat Lake support Add ACPI ID for Wildcat Lake. Signed-off-by: Srinivas Pandruvada Link: https://lore.kernel.org/r/20250617232913.3314765-1-srinivas.pandruvada@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 314e5ad4782d08858b3abc325c0487bd2abc23a1 Author: Kurt Borja Date: Wed Jun 25 22:17:37 2025 -0300 platform/x86: dell-wmi-sysman: Fix class device unregistration Devices under the firmware_attributes_class do not have unique a dev_t. Therefore, device_unregister() should be used instead of device_destroy(), since the latter may match any device with a given dev_t. Fixes: e8a60aa7404b ("platform/x86: Introduce support for Systems Management Driver over WMI for Dell Systems") Signed-off-by: Kurt Borja Link: https://lore.kernel.org/r/20250625-dest-fix-v1-3-3a0f342312bb@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 5ff1fbb3059730700b4823f43999fc1315984632 Author: Kurt Borja Date: Wed Jun 25 22:17:36 2025 -0300 platform/x86: think-lmi: Fix class device unregistration Devices under the firmware_attributes_class do not have unique a dev_t. Therefore, device_unregister() should be used instead of device_destroy(), since the latter may match any device with a given dev_t. Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms") Signed-off-by: Kurt Borja Link: https://lore.kernel.org/r/20250625-dest-fix-v1-2-3a0f342312bb@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 11cba4793b95df3bc192149a6eb044f69aa0b99e Author: Kurt Borja Date: Wed Jun 25 22:17:35 2025 -0300 platform/x86: hp-bioscfg: Fix class device unregistration Devices under the firmware_attributes_class do not have unique a dev_t. Therefore, device_unregister() should be used instead of device_destroy(), since the latter may match any device with a given dev_t. Fixes: a34fc329b189 ("platform/x86: hp-bioscfg: bioscfg") Signed-off-by: Kurt Borja Link: https://lore.kernel.org/r/20250625-dest-fix-v1-1-3a0f342312bb@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 9037532ab893635a46afe88542cd747a4a846497 Author: Diederik de Haas Date: Sat Jun 28 16:28:18 2025 +0200 arm64: dts: rockchip: Add missing fan-supply to rk3566-quartz64-a The Quartz 64 Model-A Schematic from 20210427 on page 7 shows that the fan's power supply is provided by VCC12V_DCIN. This fixes the following warning: gpio-fan gpio_fan: supply fan not found, using dummy regulator Signed-off-by: Diederik de Haas Link: https://lore.kernel.org/r/20250628142843.839150-1-didi.debian@cknow.org Signed-off-by: Heiko Stuebner commit 53b6445ad08f07b6f4a84f1434f543196009ed89 Author: Jakob Unterwurzacher Date: Fri Jun 27 15:17:12 2025 +0200 arm64: dts: rockchip: use cs-gpios for spi1 on ringneck Hardware CS has a very slow rise time of about 6us, causing transmission errors when CS does not reach high between transaction. It looks like it's not driven actively when transitioning from low to high but switched to input, so only the CPU pull-up pulls it high, slowly. Transitions from high to low are fast. On the oscilloscope, CS looks like an irregular sawtooth pattern like this: _____ ^ / | ^ /| / | /| / | / | / | / | / | ___/ |___/ |_____/ |___ With cs-gpios we have a CS rise time of about 20ns, as it should be, and CS looks rectangular. This fixes the data errors when running a flashcp loop against a m25p40 spi flash. With the Rockchip 6.1 kernel we see the same slow rise time, but for some reason CS is always high for long enough to reach a solid high. The RK3399 and RK3588 SoCs use the same SPI driver, so we also checked our "Puma" (RK3399) and "Tiger" (RK3588) boards. They do not have this problem. Hardware CS rise time is good. Fixes: c484cf93f61b ("arm64: dts: rockchip: add PX30-µQ7 (Ringneck) SoM with Haikou baseboard") Cc: stable@vger.kernel.org Reviewed-by: Quentin Schulz Signed-off-by: Jakob Unterwurzacher Link: https://lore.kernel.org/r/20250627131715.1074308-1-jakob.unterwurzacher@cherry.de Signed-off-by: Heiko Stuebner commit e1af6f0146d64fc4fb142504ba128a97cd171558 Author: Pratap Nirujogi Date: Wed Jun 18 16:29:48 2025 -0400 platform/x86: Update swnode graph for amd isp4 Existing swnode graph format is specific to sensor device and is causing conflicts when accessing standard property variables outside the sensor driver. To address this issue, enhanced swnode graph format with dedicated nodes for i2c and isp devices, with sensor node added as child to i2c node. This approach allows to have standard property variables (ex: 'clock-frequency') with values applicable for each of the devices (sensor, i2c and isp). ACPI device driver_data handle is also initialized with root camera swnode to access the property variables in the graph in isp and i2c drivers. Signed-off-by: Pratap Nirujogi Reviewed-by: Mario Limonciello Link: https://lore.kernel.org/r/20250618202958.3934822-1-pratap.nirujogi@amd.com Signed-off-by: Ilpo Järvinen commit 1e14ea901dc8d976d355ddc3e0de84ee86ef0596 Author: Shiju Jose Date: Thu Jun 26 11:13:44 2025 +0100 EDAC: Initialize EDAC features sysfs attributes Fix the lockdep splat caused by missing sysfs_attr_init() calls for the recently added EDAC feature's sysfs attributes. In lockdep_init_map_type(), the check for the lock-class key if (!static_obj(key) && !is_dynamic_key(key)) causes the splat. Backtrace: RIP: 0010:lockdep_init_map_type Call Trace: __kernfs_create_file sysfs_add_file_mode_ns internal_create_group internal_create_groups device_add ? __init_waitqueue_head edac_dev_register devm_cxl_memdev_edac_register ? lock_acquire ? find_held_lock ? cxl_mem_probe ? cxl_mem_probe ? lockdep_hardirqs_on ? cxl_mem_probe cxl_mem_probe [ bp: Massage. ] Fixes: f90b738166fe ("EDAC: Add scrub control feature") Fixes: bcbd069b11b0 ("EDAC: Add a Error Check Scrub control feature") Fixes: 699ea5219c4b ("EDAC: Add a memory repair control feature") Reported-by: Dave Jiang Suggested-by: Jonathan Cameron Signed-off-by: Shiju Jose Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/20250626101344.1726-1-shiju.jose@huawei.com commit eb617dd25ca176f3fee24f873f0fd60010773d67 Author: Kurt Borja Date: Mon Jun 30 00:43:12 2025 -0300 platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks After retrieving WMI data blocks in sysfs callbacks, check for the validity of them before dereferencing their content. Reported-by: Jan Graczyk Closes: https://lore.kernel.org/r/CAHk-=wgMiSKXf7SvQrfEnxVtmT=QVQPjJdNjfm3aXS7wc=rzTw@mail.gmail.com/ Fixes: e8a60aa7404b ("platform/x86: Introduce support for Systems Management Driver over WMI for Dell Systems") Suggested-by: Linus Torvalds Reviewed-by: Armin Wolf Signed-off-by: Kurt Borja Link: https://lore.kernel.org/r/20250630-sysman-fix-v2-1-d185674d0a30@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 7b4c5a37544ba22c6ebe72c0d4ea56c953459fa5 Author: Luo Gengkun Date: Thu Jun 26 13:54:03 2025 +0000 perf/core: Fix the WARN_ON_ONCE is out of lock protected region commit 3172fb986666 ("perf/core: Fix WARN in perf_cgroup_switch()") try to fix a concurrency problem between perf_cgroup_switch and perf_cgroup_event_disable. But it does not to move the WARN_ON_ONCE into lock-protected region, so the warning is still be triggered. Fixes: 3172fb986666 ("perf/core: Fix WARN in perf_cgroup_switch()") Signed-off-by: Luo Gengkun Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20250626135403.2454105-1-luogengkun@huaweicloud.com commit 05f254a6369ac020fc0382a7cbd3ef64ad997c92 Author: Alexander Tsoy Date: Mon Jun 30 04:33:57 2025 +0300 ALSA: usb-audio: Improve filtering of sample rates on Focusrite devices Previously we were filtering out only upper unsupported sampling rates. This patch adds filtering of the lower unsupported sampling rates. As a result there is 1:1 mapping between altsetting and supported rates. The issue was found on a Scarlett 3rd Gen card (see linked bug), but the same filtering is likely needed for the Scarlett 1st and 2nd Gen as well as the older Clarett cards which lacks Valid Alternate Setting Control. Patch was not tested on a real hardware. Link: https://bugzilla.kernel.org/show_bug.cgi?id=214493 Signed-off-by: Alexander Tsoy Link: https://patch.msgid.link/20250630013357.1327420-1-alexander@tsoy.me Signed-off-by: Takashi Iwai commit 2b29be967ae456fc09c320d91d52278cf721be1e Author: Vivian Wang Date: Tue Jun 24 16:04:46 2025 +0800 riscv: cpu_ops_sbi: Use static array for boot_data Since commit 6b9f29b81b15 ("riscv: Enable pcpu page first chunk allocator"), if NUMA is enabled, the page percpu allocator may be used on very sparse configurations, or when requested on boot with percpu_alloc=page. In that case, percpu data gets put in the vmalloc area. However, sbi_hsm_hart_start() needs the physical address of a sbi_hart_boot_data, and simply assumes that __pa() would work. This causes the just started hart to immediately access an invalid address and hang. Fortunately, struct sbi_hart_boot_data is not too large, so we can simply allocate an array for boot_data statically, putting it in the kernel image. This fixes NUMA=y SMP boot on Sophgo SG2042. To reproduce on QEMU: Set CONFIG_NUMA=y and CONFIG_DEBUG_VIRTUAL=y, then run with: qemu-system-riscv64 -M virt -smp 2 -nographic \ -kernel arch/riscv/boot/Image \ -append "percpu_alloc=page" Kernel output: [ 0.000000] Booting Linux on hartid 0 [ 0.000000] Linux version 6.16.0-rc1 (dram@sakuya) (riscv64-unknown-linux-gnu-gcc (GCC) 14.2.1 20250322, GNU ld (GNU Binutils) 2.44) #11 SMP Tue Jun 24 14:56:22 CST 2025 ... [ 0.000000] percpu: 28 4K pages/cpu s85784 r8192 d20712 ... [ 0.083192] smp: Bringing up secondary CPUs ... [ 0.086722] ------------[ cut here ]------------ [ 0.086849] virt_to_phys used for non-linear address: (____ptrval____) (0xff2000000001d080) [ 0.088001] WARNING: CPU: 0 PID: 1 at arch/riscv/mm/physaddr.c:14 __virt_to_phys+0xae/0xe8 [ 0.088376] Modules linked in: [ 0.088656] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.16.0-rc1 #11 NONE [ 0.088833] Hardware name: riscv-virtio,qemu (DT) [ 0.088948] epc : __virt_to_phys+0xae/0xe8 [ 0.089001] ra : __virt_to_phys+0xae/0xe8 [ 0.089037] epc : ffffffff80021eaa ra : ffffffff80021eaa sp : ff2000000004bbc0 [ 0.089057] gp : ffffffff817f49c0 tp : ff60000001d60000 t0 : 5f6f745f74726976 [ 0.089076] t1 : 0000000000000076 t2 : 705f6f745f747269 s0 : ff2000000004bbe0 [ 0.089095] s1 : ff2000000001d080 a0 : 0000000000000000 a1 : 0000000000000000 [ 0.089113] a2 : 0000000000000000 a3 : 0000000000000000 a4 : 0000000000000000 [ 0.089131] a5 : 0000000000000000 a6 : 0000000000000000 a7 : 0000000000000000 [ 0.089155] s2 : ffffffff8130dc00 s3 : 0000000000000001 s4 : 0000000000000001 [ 0.089174] s5 : ffffffff8185eff8 s6 : ff2000007f1eb000 s7 : ffffffff8002a2ec [ 0.089193] s8 : 0000000000000001 s9 : 0000000000000001 s10: 0000000000000000 [ 0.089211] s11: 0000000000000000 t3 : ffffffff8180a9f7 t4 : ffffffff8180a9f7 [ 0.089960] t5 : ffffffff8180a9f8 t6 : ff2000000004b9d8 [ 0.089984] status: 0000000200000120 badaddr: ffffffff80021eaa cause: 0000000000000003 [ 0.090101] [] __virt_to_phys+0xae/0xe8 [ 0.090228] [] sbi_cpu_start+0x6e/0xe8 [ 0.090247] [] __cpu_up+0x1e/0x8c [ 0.090260] [] bringup_cpu+0x42/0x258 [ 0.090277] [] cpuhp_invoke_callback+0xe0/0x40c [ 0.090292] [] __cpuhp_invoke_callback_range+0x68/0xfc [ 0.090320] [] _cpu_up+0x11a/0x244 [ 0.090334] [] cpu_up+0x52/0x90 [ 0.090384] [] bringup_nonboot_cpus+0x78/0x118 [ 0.090411] [] smp_init+0x34/0xb8 [ 0.090425] [] kernel_init_freeable+0x148/0x2e4 [ 0.090442] [] kernel_init+0x1e/0x14c [ 0.090455] [] ret_from_fork_kernel+0xe/0xf0 [ 0.090471] [] ret_from_fork_kernel_asm+0x16/0x18 [ 0.090560] ---[ end trace 0000000000000000 ]--- [ 1.179875] CPU1: failed to come online [ 1.190324] smp: Brought up 1 node, 1 CPU Cc: stable@vger.kernel.org Reported-by: Han Gao Fixes: 6b9f29b81b15 ("riscv: Enable pcpu page first chunk allocator") Reviewed-by: Alexandre Ghiti Tested-by: Alexandre Ghiti Signed-off-by: Vivian Wang Link: https://lore.kernel.org/r/20250624-riscv-hsm-boot-data-array-v1-1-50b5eeafbe61@iscas.ac.cn Signed-off-by: Alexandre Ghiti commit 6f49743af42ca43ef6d5487fc6d32f6184909430 Author: Nathan Chancellor Date: Thu Jun 12 12:57:01 2025 -0700 riscv: Require clang-17 or newer for kCFI After the combination of commit c217157bcd1d ("riscv: Implement HAVE_DYNAMIC_FTRACE_WITH_CALL_OPS"), which starts using '-fpatchable-function-entry=M,N', and commit d0262e907e29 ("riscv: ftrace: support PREEMPT"), which allows CONFIG_DYNAMIC_FTRACE to be enabled by allmodconfig, allmodconfig builds with clang-16 begin crashing in the generic LLVM kCFI pass (see [1] for the stack trace). clang-17 avoids this crash by moving to target-specific lowering of the kCFI operand bundles [2]. Require clang-17 to select CONFIG_CFI_CLANG to avoid this crash. Fixes: c217157bcd1d ("riscv: Implement HAVE_DYNAMIC_FTRACE_WITH_CALL_OPS") Link: https://godbolt.org/z/xG39Pn16o [1] Link: https://github.com/llvm/llvm-project/commit/62fa708ceb027713b386c7e0efda994f8bdc27e2 [2] Signed-off-by: Nathan Chancellor Reviewed-by: Sami Tolvanen Link: https://lore.kernel.org/r/20250612-riscv-require-clang-17-for-kcfi-v1-1-216f7cd7d87f@kernel.org Signed-off-by: Alexandre Ghiti commit 14005c96d6649b27fa52d0cd0f492eb3b5586c07 Author: Eugen Hristev Date: Fri Jun 13 16:21:01 2025 -0300 nvme-pci: refresh visible attrs after being checked The sysfs attributes are registered early, but the driver does not know whether they are needed or not at that moment. For the CMB attributes, commit e917a849c3fc ("nvme-pci: refresh visible attrs for cmb attributes") solved this problem by calling nvme_update_attrs after mapping the CMB. However the issue persists for the HMB attributes. To solve the problem, moved the call to nvme_update_attrs after nvme_setup_host_mem, which sets up the HMB. Fixes: e917a849c3fc ("nvme-pci: refresh visible attrs for cmb attributes") Fixes: 86adbf0cdb9e ("nvme: simplify transport specific device attribute handling") Signed-off-by: Eugen Hristev Signed-off-by: André Almeida Signed-off-by: Christoph Hellwig commit 190f4c2c863af7cc5bb354b70e0805f06419c038 Author: Dmitry Bogdanov Date: Wed Jun 25 14:45:33 2025 +0300 nvmet: fix memory leak of bio integrity If nvmet receives commands with metadata there is a continuous memory leak of kmalloc-128 slab or more precisely bio->bi_integrity. Since commit bf4c89fc8797 ("block: don't call bio_uninit from bio_endio") each user of bio_init has to use bio_uninit as well. Otherwise the bio integrity is not getting free. Nvmet uses bio_init for inline bios. Uninit the inline bio to complete deallocation of integrity in bio. Fixes: bf4c89fc8797 ("block: don't call bio_uninit from bio_endio") Signed-off-by: Dmitry Bogdanov Signed-off-by: Christoph Hellwig commit ba806c900379899e5cdd6ca165b900e2081e1c99 Author: Nilay Shroff Date: Thu Jun 26 10:49:19 2025 +0530 nvme: correctly account for namespace head reference counter The blktests nvme/058 manifests an issue where the NVMe subsystem kobject entry remains stale in sysfs, causing a failure during subsequent NVMe module reloads[1]. Specifically, when attempting to register a new NVMe subsystem, the driver encounters a kobejct name collision because a stale kobject still exists. Though, please note that nvme/058 doesn't report any failure and test case passes and it's only during subsequent NVMe module reloads, the stale nvme sub- system kobject entry in sysfs causes the observed symptom[1]. This issue stems from an imbalance in the get/put usage of the namespace head (nshead) reference counter. The nshead holds a reference to the associated NVMe subsystem. If the nshead reference is not properly released, it prevents the cleanup of the subsystem's kobject, leaving nvme subsystem stale entry behind in sysfs. During the failure case, the last namespace path referencing a nshead is removed, but the nshead reference was not released. This occurs because the release logic currently only puts the nshead reference when its state is LIVE. However, in configurations where ANA (Asymmetric Namespace Access) is enabled, a namespace may be associated with an ANA state that is neither optimized nor non-optimized. In this case, the nshead may never transition to LIVE, and the corresponding nshead reference is then never dropped. In fact nvme/058 associates some of nvme namespaces to an inaccessible ANA state and with that nshead is created but it's state is not transitioned to LIVE. So the current logic would then causes nshead reference to be leaked for non-LIVE states. Another scenario, during namespace allocation, the driver first allocates a nshead and then issues an Identify Namespace command. If this command fails — which can happen in tests like nvme/058 that rapidly enables and disables namespaces — we must release the reference to the newly allocated nshead. However this reference release is currently missing in the failure, causing a nshead reference leak. To fix this, we now unconditionally release the nshead reference when the last nvme path referencing to the nshead is removed, regardless of the head’s state. Also during identify namespace failure case we now properly release the nshead reference. So this ensures proper cleanup of the nshead, and consequently, the NVMe subsystem and its associated kobject. This change prevents stale kobject entries from lingering in sysfs and eliminates the module reload failures observed just after running nvme/058. [1] https://lore.kernel.org/all/CAHj4cs8fOBS-eSjsd5LUBzy7faKXJtgLkCN+mDy_-ezCLLLq+Q@mail.gmail.com/ Reported-by: yi.zhang@redhat.com Closes: https://lore.kernel.org/all/CAHj4cs8fOBS-eSjsd5LUBzy7faKXJtgLkCN+mDy_-ezCLLLq+Q@mail.gmail.com/ Fixes: 62188639ec16 ("nvme-multipath: introduce delayed removal of the multipath head node") Tested-by: yi.zhang@redhat.com Signed-off-by: Nilay Shroff Reviewed-by: Hannes Reinecke Signed-off-by: Christoph Hellwig commit 2e96d2d8c2a7a6c2cef45593c028d9c5ef180316 Author: Alok Tiwari Date: Sat Jun 28 11:12:32 2025 -0700 nvme: Fix incorrect cdw15 value in passthru error logging Fix an error in nvme_log_err_passthru() where cdw14 was incorrectly printed twice instead of cdw15. This fix ensures accurate logging of the full passthrough command payload. Fixes: 9f079dda1433 ("nvme: allow passthru cmd error logging") Signed-off-by: Alok Tiwari Reviewed-by: Martin K. Petersen Signed-off-by: Christoph Hellwig commit 7da6c155a67d42a0c1e4e22bd3f492fabcb14f2c Author: Hans de Goede Date: Thu Jun 26 16:33:17 2025 +0200 drm/i915/dsi: Fix NULL pointer deref in vlv_dphy_param_init() Commit 77ba0b856225 ("drm/i915/dsi: convert vlv_dsi.[ch] to struct intel_display") added a to_intel_display(connector) call to vlv_dphy_param_init() but when vlv_dphy_param_init() gets called the connector object has not been initialized yet, so this leads to a NULL pointer deref: BUG: kernel NULL pointer dereference, address: 000000000000000c ... Hardware name: ASUSTeK COMPUTER INC. T100TA/T100TA, BIOS T100TA.314 08/13/2015 RIP: 0010:vlv_dsi_init+0x4e6/0x1600 [i915] ... Call Trace: ? intel_step_name+0x4be8/0x5c30 [i915] intel_setup_outputs+0x2d6/0xbd0 [i915] intel_display_driver_probe_nogem+0x13f/0x220 [i915] i915_driver_probe+0x3d9/0xaf0 [i915] Use to_intel_display(&intel_dsi->base) instead to fix this. Fixes: 77ba0b856225 ("drm/i915/dsi: convert vlv_dsi.[ch] to struct intel_display") Signed-off-by: Hans de Goede Reviewed-by: Jani Nikula Link: https://lore.kernel.org/r/20250626143317.101706-1-hansg@kernel.org Signed-off-by: Jani Nikula (cherry picked from commit 0dc6bfb50a5d0759e726cd36a3d3b7529fd2a627) Signed-off-by: Joonas Lahtinen commit caa7c7a76b78ce41d347003f84975125383e6b59 Author: Dan Carpenter Date: Wed Jun 25 10:21:58 2025 -0500 drm/i915/selftests: Change mock_request() to return error pointers There was an error pointer vs NULL bug in __igt_breadcrumbs_smoketest(). The __mock_request_alloc() function implements the smoketest->request_alloc() function pointer. It was supposed to return error pointers, but it propogates the NULL return from mock_request() so in the event of a failure, it would lead to a NULL pointer dereference. To fix this, change the mock_request() function to return error pointers and update all the callers to expect that. Fixes: 52c0fdb25c7c ("drm/i915: Replace global breadcrumbs with per-context interrupt tracking") Signed-off-by: Dan Carpenter Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/685c1417.050a0220.696f5.5c05@mx.google.com Signed-off-by: Rodrigo Vivi (cherry picked from commit 778fa8ad5f0f23397d045c7ebca048ce8def1c43) Signed-off-by: Joonas Lahtinen commit 720fd1cbc0a0f3acdb26aedb3092ab10fe05e7ae Author: Meng Li Date: Sun Jun 8 11:06:16 2025 +0800 arm64: dts: add big-endian property back into watchdog node Watchdog doesn't work on NXP ls1046ardb board because in commit 7c8ffc5555cb("arm64: dts: layerscape: remove big-endian for mmc nodes"), it intended to remove the big-endian from mmc node, but the big-endian of watchdog node is also removed by accident. So, add watchdog big-endian property back. In addition, add compatible string fsl,ls1046a-wdt, which allow big-endian property. Fixes: 7c8ffc5555cb ("arm64: dts: layerscape: remove big-endian for mmc nodes") Cc: stable@vger.kernel.org Signed-off-by: Meng Li Reviewed-by: Ahmad Fatoum Signed-off-by: Shawn Guo commit e0322ac2a3cf7013b7af73b1293670f1e163c92e Author: Wei Fang Date: Wed May 28 16:34:32 2025 +0800 arm64: dts: imx95-15x15-evk: fix the overshoot issue of NETC The overshoot of MDIO, MDC, ENET1_TDx and ENET2_TDx is too high, so reduce the drive strength of these pins. Fixes: e3e8b199aff8 ("arm64: dts: imx95: Add imx95-15x15-evk support") Signed-off-by: Wei Fang Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 36c2bf42b6f02ded87a381edc6b500cd6aac5018 Author: Wei Fang Date: Wed May 28 16:34:31 2025 +0800 arm64: dts: imx95-19x19-evk: fix the overshoot issue of NETC The overshoot of MDIO, MDC and ENET1_TDx is too high, so reduce the drive strength these pins. Fixes: 025cf78938c2 ("arm64: dts: imx95-19x19-evk: add ENETC 0 support") Signed-off-by: Wei Fang Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 63f4970a1219b5256e8ea952096c86dab666d312 Author: Jeff LaBundy Date: Sun Jun 29 18:33:30 2025 -0700 Input: iqs7222 - explicitly define number of external channels The number of external channels is assumed to be a multiple of 10, but this is not the case for IQS7222D. As a result, some CRx pins are wrongly prevented from being assigned to some channels. Address this problem by explicitly defining the number of external channels for cases in which the number of external channels is not equal to the total number of available channels. Fixes: dd24e202ac72 ("Input: iqs7222 - add support for Azoteq IQS7222D") Signed-off-by: Jeff LaBundy Link: https://lore.kernel.org/r/aGHVf6HkyFZrzTPy@nixie71 Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 6f11adcc6f36ffd8f33dbdf5f5ce073368975bc3 Author: Jens Axboe Date: Sun Jun 29 16:48:28 2025 -0600 io_uring: gate REQ_F_ISREG on !S_ANON_INODE as well io_uring marks a request as dealing with a regular file on S_ISREG. This drives things like retries on short reads or writes, which is generally not expected on a regular file (or bdev). Applications tend to not expect that, so io_uring tries hard to ensure it doesn't deliver short IO on regular files. However, a recent commit added S_IFREG to anonymous inodes. When io_uring is used to read from various things that are backed by anon inodes, like eventfd, timerfd, etc, then it'll now all of a sudden wait for more data when rather than deliver what was read or written in a single operation. This breaks applications that issue reads on anon inodes, if they ask for more data than a single read delivers. Add a check for !S_ANON_INODE as well before setting REQ_F_ISREG to prevent that. Cc: Christian Brauner Cc: stable@vger.kernel.org Link: https://github.com/ghostty-org/ghostty/discussions/7720 Fixes: cfd86ef7e8e7 ("anon_inode: use a proper mode internally") Signed-off-by: Jens Axboe commit b8f89cb723b9e66f5dbd7199e4036fee34fb0de0 Author: Philipp Kerling Date: Sun Jun 29 19:05:05 2025 +0200 smb: client: fix readdir returning wrong type with POSIX extensions When SMB 3.1.1 POSIX Extensions are negotiated, userspace applications using readdir() or getdents() calls without stat() on each individual file (such as a simple "ls" or "find") would misidentify file types and exhibit strange behavior such as not descending into directories. The reason for this behavior is an oversight in the cifs_posix_to_fattr conversion function. Instead of extracting the entry type for cf_dtype from the properly converted cf_mode field, it tries to extract the type from the PDU. While the wire representation of the entry mode is similar in structure to POSIX stat(), the assignments of the entry types are different. Applying the S_DT macro to cf_mode instead yields the correct result. This is also what the equivalent function smb311_posix_info_to_fattr in inode.c already does for stat() etc.; which is why "ls -l" would give the correct file type but "ls" would not (as identified by the colors). Cc: stable@vger.kernel.org Signed-off-by: Philipp Kerling Signed-off-by: Steve French commit fa60c094c19b97e103d653f528f8d9c178b6a5f5 Author: James Clark Date: Fri Jun 27 11:21:37 2025 +0100 spi: spi-fsl-dspi: Clear completion counter before initiating transfer In target mode, extra interrupts can be received between the end of a transfer and halting the module if the host continues sending more data. If the interrupt from this occurs after the reinit_completion() then the completion counter is left at a non-zero value. The next unrelated transfer initiated by userspace will then complete immediately without waiting for the interrupt or writing to the RX buffer. Fix it by resetting the counter before the transfer so that lingering values are cleared. This is done after clearing the FIFOs and the status register but before the transfer is initiated, so no interrupts should be received at this point resulting in other race conditions. Fixes: 4f5ee75ea171 ("spi: spi-fsl-dspi: Replace interruptible wait queue with a simple completion") Signed-off-by: James Clark Reviewed-by: Frank Li Link: https://patch.msgid.link/20250627-james-nxp-spi-dma-v4-1-178dba20c120@linaro.org Signed-off-by: Mark Brown commit 96893cdd4760ad94a438c1523cc5ca2470e04670 Author: Marc Kleine-Budde Date: Sun Jun 29 18:15:32 2025 +0200 spi: Raise limit on number of chip selects to 24 We have a system which uses 24 SPI chip selects, raise the hard coded limit accordingly. Signed-off-by: Marc Kleine-Budde Link: https://patch.msgid.link/20250629-spi-increase-number-of-cs-v2-1-85a0a09bab32@pengutronix.de Signed-off-by: Mark Brown commit ddaad4ad774d4ae02047ef873a8e38f62a4b7b01 Author: Gabor Juhos Date: Wed Jun 18 22:22:50 2025 +0200 mtd: nand: qpic_common: prevent out of bounds access of BAM arrays The common QPIC code does not do any boundary checking when it handles the command elements and scatter gater list arrays of a BAM transaction, thus it allows to access out of bounds elements in those. Although it is the responsibility of the given driver to allocate enough space for all possible BAM transaction variations, however there can be mistakes in the driver code which can lead to hidden memory corruption issues which are hard to debug. This kind of problem has been observed during testing the 'spi-qpic-snand' driver. Although the driver has been fixed with a preceding patch, but it still makes sense to reduce the chance of having such errors again later. In order to prevent such errors, change the qcom_alloc_bam_transaction() function to store the number of elements of the arrays in the 'bam_transaction' strucutre during allocation. Also, add sanity checks to the qcom_prep_bam_dma_desc_{cmd,data}() functions to avoid using out of bounds indices for the arrays. Tested-by: Lakshmi Sowjanya D # on SDX75 Acked-by: Miquel Raynal Signed-off-by: Gabor Juhos Link: https://patch.msgid.link/20250618-qpic-snand-avoid-mem-corruption-v3-2-319c71296cda@gmail.com Signed-off-by: Mark Brown commit d85d0380292a7e618915069c3579ae23c7c80339 Author: Gabor Juhos Date: Wed Jun 18 22:22:49 2025 +0200 spi: spi-qpic-snand: reallocate BAM transactions Using the mtd_nandbiterrs module for testing the driver occasionally results in weird things like below. 1. swiotlb mapping fails with the following message: [ 85.926216] qcom_snand 79b0000.spi: swiotlb buffer is full (sz: 4294967294 bytes), total 512 (slots), used 0 (slots) [ 85.932937] qcom_snand 79b0000.spi: failure in mapping desc [ 87.999314] qcom_snand 79b0000.spi: failure to write raw page [ 87.999352] mtd_nandbiterrs: error: write_oob failed (-110) Rebooting the board after this causes a panic due to a NULL pointer dereference. 2. If the swiotlb mapping does not fail, rebooting the board may result in a different panic due to a bad spinlock magic: [ 256.104459] BUG: spinlock bad magic on CPU#3, procd/2241 [ 256.104488] Unable to handle kernel paging request at virtual address ffffffff0000049b ... Investigating the issue revealed that these symptoms are results of memory corruption which is caused by out of bounds access within the driver. The driver uses a dynamically allocated structure for BAM transactions, which structure must have enough space for all possible variations of different flash operations initiated by the driver. The required space heavily depends on the actual number of 'codewords' which is calculated from the pagesize of the actual NAND chip. Although the qcom_nandc_alloc() function allocates memory for the BAM transactions during probe, but since the actual number of 'codewords' is not yet know the allocation is done for one 'codeword' only. Because of this, whenever the driver does a flash operation, and the number of the required transactions exceeds the size of the allocated arrays the driver accesses memory out of the allocated range. To avoid this, change the code to free the initially allocated BAM transactions memory, and allocate a new one once the actual number of 'codewords' required for a given NAND chip is known. Fixes: 7304d1909080 ("spi: spi-qpic: add driver for QCOM SPI NAND flash Interface") Reviewed-by: Md Sadre Alam Signed-off-by: Gabor Juhos Link: https://patch.msgid.link/20250618-qpic-snand-avoid-mem-corruption-v3-1-319c71296cda@gmail.com Signed-off-by: Mark Brown commit eeca209124bb694650026216d3e59cae02d91686 Author: Shree Ramamoorthy Date: Fri Jun 20 10:45:41 2025 -0500 regulator: tps65219: Fix devm_kmalloc size allocation In probe(), two arrays of structs are allocated with the devm_kmalloc() function, but the memory size of the allocations were given as the arrays' length (pmic->common_irq_size for the first call and pmic->dev_irq_size for the second devm_kmalloc call). The memory size should have been the total memory needed. This led to a heap overflow when the struct array was used. The issue was first discovered with the PocketBeagle2 and BeaglePlay. The common and device-specific structs are now allocated one at a time within the loop. Fixes: 38c9f98db20a ("regulator: tps65219: Add support for TPS65215 Regulator IRQs") Reported-by: Dhruva Gole Closes: https://lore.kernel.org/all/20250619153526.297398-1-d-gole@ti.com/ Tested-by: Robert Nelson Acked-by: Andrew Davis Signed-off-by: Shree Ramamoorthy Reviewed-by: Nishanth Menon Link: https://patch.msgid.link/20250620154541.2713036-1-s-ramamoorthy@ti.com Signed-off-by: Mark Brown commit ca46946a482238b0cdea459fb82fc837fb36260e Author: Alessandro Carminati Date: Thu Jun 26 08:38:09 2025 +0000 regulator: core: fix NULL dereference on unbind due to stale coupling data Failing to reset coupling_desc.n_coupled after freeing coupled_rdevs can lead to NULL pointer dereference when regulators are accessed post-unbind. This can happen during runtime PM or other regulator operations that rely on coupling metadata. For example, on ridesx4, unbinding the 'reg-dummy' platform device triggers a panic in regulator_lock_recursive() due to stale coupling state. Ensure n_coupled is set to 0 to prevent access to invalid pointers. Signed-off-by: Alessandro Carminati Link: https://patch.msgid.link/20250626083809.314842-1-acarmina@redhat.com Signed-off-by: Mark Brown commit c871c199accb39d0f4cb941ad0dccabfc21e9214 Author: Abdun Nihaal Date: Thu Jun 26 22:58:21 2025 +0530 regmap: fix potential memory leak of regmap_bus When __regmap_init() is called from __regmap_init_i2c() and __regmap_init_spi() (and their devm versions), the bus argument obtained from regmap_get_i2c_bus() and regmap_get_spi_bus(), may be allocated using kmemdup() to support quirks. In those cases, the bus->free_on_exit field is set to true. However, inside __regmap_init(), buf is not freed on any error path. This could lead to a memory leak of regmap_bus when __regmap_init() fails. Fix that by freeing bus on error path when free_on_exit is set. Fixes: ea030ca68819 ("regmap-i2c: Set regmap max raw r/w from quirks") Signed-off-by: Abdun Nihaal Link: https://patch.msgid.link/20250626172823.18725-1-abdun.nihaal@gmail.com Signed-off-by: Mark Brown commit a7528e9beadbddcec21b394ce5fa8dc4e5cdaa24 Author: Charles Keepax Date: Thu Jun 26 15:18:41 2025 +0100 ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches Matches should go from more specific to less specific, correct the ordering of two cs42l43 entries. Fixes: c0524067653d ("ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops") Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20250626141841.77780-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit be2e1a63448b35bd6736b5934f7720534649b51e Author: Srinivas Kandagatla Date: Fri Jun 27 17:03:29 2025 +0100 MAINTAINERS: update Qualcomm audio codec drivers list Some of the codec drivers like wcd939x are missing in the MAINTAINERS which is resulting in incorrect list from get_maintainers script. Fix this by using wildcard matching on both wcd93* and wsa88* codec and bindings. Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20250627160329.442795-1-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit dc78f7e59169d3f0e6c3c95d23dc8e55e95741e2 Author: Arun Raghavan Date: Thu Jun 26 09:08:25 2025 -0400 ASoC: fsl_sai: Force a software reset when starting in consumer mode On an imx8mm platform with an external clock provider, when running the receiver (arecord) and triggering an xrun with xrun_injection, we see a channel swap/offset. This happens sometimes when running only the receiver, but occurs reliably if a transmitter (aplay) is also concurrently running. It seems that the SAI loses track of frame sync during the trigger stop -> trigger start cycle that occurs during an xrun. Doing just a FIFO reset in this case does not suffice, and only a software reset seems to get it back on track. This looks like the same h/w bug that is already handled for the producer case, so we now do the reset unconditionally on config disable. Signed-off-by: Arun Raghavan Reported-by: Pieterjan Camerlynck Fixes: 3e3f8bd56955 ("ASoC: fsl_sai: fix no frame clk in master mode") Cc: stable@vger.kernel.org Reviewed-by: Fabio Estevam Link: https://patch.msgid.link/20250626130858.163825-1-arun@arunraghavan.net Signed-off-by: Mark Brown commit 960aed31eedbaeb2e47b1bc485b462fd38a53311 Author: Bard Liao Date: Thu Jun 26 14:44:20 2025 +0800 ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH The helpers that are provided by SND_SOC_ACPI_INTEL_MATCH (soc-acpi-intel-ssp-common) are used in SND_SOC_INTEL_SOF_BOARD_HELPERS (sof_board_helpers). SND_SOC_ACPI_INTEL_MATCH is selected by machine drivers. When skl_hda_dsp_generic uses the board helpers, it select SND_SOC_INTEL_SOF_BOARD_HELPERS only but not SND_SOC_ACPI_INTEL_MATCH which initroduce the undefined symbol errors. However, it makes more sense that SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH itself. Fixes: b28b23dea314 ("ASoC: Intel: skl_hda_dsp_generic: use common module for DAI links") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506141543.dN0JJyZC-lkp@intel.com/ Signed-off-by: Bard Liao Reviewed-by: Péter Ujfalusi Reviewed-by: Liam Girdwood Link: https://patch.msgid.link/20250626064420.450334-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit cbe876121633dadb2b0ce52711985328638e9aab Author: Shengjiu Wang Date: Wed Jun 25 10:05:04 2025 +0800 ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode When USRC=0, there is underrun issue for the non-ideal ratio mode; according to the reference mannual, the internal measured ratio can be used with USRC=1 and IDRC=0. Fixes: d0250cf4f2ab ("ASoC: fsl_asrc: Add an option to select internal ratio mode") Signed-off-by: Shengjiu Wang Reviewed-by: Daniel Baluta Link: https://patch.msgid.link/20250625020504.2728161-1-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit d0b3b7b22dfa1f4b515fd3a295b3fd958f9e81af Author: Linus Torvalds Date: Sun Jun 29 13:09:04 2025 -0700 Linux 6.16-rc4 commit fe49aae0fcb348b656bbde2eb1d1c75d8a1a5c3c Author: Janne Grunau Date: Sat Jun 28 13:36:00 2025 +0200 rust: init: Fix generics in *_init! macros The match pattern for a optional trailing comma in the list of generics is erroneously repeated in the code block resulting in following error: | error: attempted to repeat an expression containing no syntax variables matched as repeating at this depth | --> rust/kernel/init.rs:301:73 | | | 301 | ::pin_init::try_pin_init!($(&$this in)? $t $(::<$($generics),* $(,)?>)? { | | ^^^ Remove "$(,)?" from all code blocks in the try_init! and try_pin_init! definitions. Cc: stable@vger.kernel.org Fixes: 578eb8b6db13 ("rust: pin-init: move the default error behavior of `try_[pin_]init`") Signed-off-by: Janne Grunau Reviewed-by: Benno Lossin Link: https://lore.kernel.org/r/20250628-rust_init_trailing_comma-v1-1-2d162ae1a757@jannau.net Signed-off-by: Miguel Ojeda commit afa9a6f4f5744d907954f5b708d76c9bffa43234 Merge: 798804b69fb6c5 a55bc4ffc06d8c Author: Linus Torvalds Date: Sun Jun 29 09:25:55 2025 -0700 Merge tag 'staging-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fix from Greg KH: "Here is a single staging driver fix for 6.16-rc4. It resolves a build error in the rtl8723bs driver for some versions of clang on arm64 when checking the frame size with -Wframe-larger-than. It has been in linux-next for a while now with no reported issues" * tag 'staging-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() commit 798804b69fb6c5b5a4a5d38cd6054e42fc4a174e Merge: 3b1890e4b250c9 09812134071b39 Author: Linus Torvalds Date: Sun Jun 29 09:21:27 2025 -0700 Merge tag 'tty-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial driver fixes from Greg KH: "Here are five small serial and tty and vt fixes for 6.16-rc4. Included in here are: - kerneldoc fixes for recent vt changes - imx serial driver fix - of_node sysfs fix for a regression - vt missing notification fix - 8250 dt bindings fix All of these have been in linux-next for a while with no reported issues" * tag 'tty-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive serial: imx: Restore original RXTL for console to fix data loss serial: core: restore of_node information in sysfs vt: fix kernel-doc warnings in ucs_get_fallback() vt: add missing notification when switching back to text mode commit 1131e70558bc70f1fc52515281de2663e961e1cc Author: Kim Seer Paller Date: Thu Jun 26 16:38:12 2025 +0800 iio: dac: ad3530r: Fix incorrect masking for channels 4-7 in powerdown mode In the current implementation of ad3530r_set_dac_powerdown() function, the macro AD3530R_OP_MODE_CHAN_MSK(chan->channel) is used to generate the bitmask for the operating mode of a specific channel. However, this macro does not account for channels 4-7, which map to the second register AD3530R_OUTPUT_OPERATING_MODE_1 for the 8 channeled device. As a result, the bitmask is incorrectly calculated for these channels, leading to improper configuration of the powerdown mode. Resolve this issue by adjusting the channel index for channels 4-7 by subtracting 4 before applying the macro. This ensures that the correct bitmask is generated for the second register. Fixes: 93583174a3df ("iio: dac: ad3530r: Add driver for AD3530R and AD3531R") Signed-off-by: Kim Seer Paller Reviewed-by: David Lechner Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250626-bug_fix-v1-1-eb3c2b370f10@analog.com Cc: Signed-off-by: Jonathan Cameron commit 24fa69894ea3f76ecb13d7160692ee574a912803 Author: David Lechner Date: Thu Jun 19 10:24:22 2025 -0500 iio: adc: ad7380: fix adi,gain-milli property parsing Change the data type of the "adi,gain-milli" property from u32 to u16. The devicetree binding specifies it as uint16, so we need to read it as such to avoid an -EOVERFLOW error when parsing the property. Fixes: c904e6dcf402 ("iio: adc: ad7380: add support for adaq4370-4 and adaq4380-4") Signed-off-by: David Lechner Link: https://patch.msgid.link/20250619-iio-adc-ad7380-fix-adi-gain-milli-parsing-v1-1-4c27fb426860@baylibre.com Cc: Signed-off-by: Jonathan Cameron commit 7b86482632788acd48d7b9ee1867f5ad3a32ccbb Author: David Lechner Date: Wed Jun 11 10:04:58 2025 -0500 iio: adc: ad7949: use spi_is_bpw_supported() Use spi_is_bpw_supported() instead of directly accessing spi->controller ->bits_per_word_mask. bits_per_word_mask may be 0, which implies that 8-bits-per-word is supported. spi_is_bpw_supported() takes this into account while spi_ctrl_mask == SPI_BPW_MASK(8) does not. Fixes: 0b2a740b424e ("iio: adc: ad7949: enable use with non 14/16-bit controllers") Closes: https://lore.kernel.org/linux-spi/c8b8a963-6cef-4c9b-bfef-dab2b7bd0b0f@sirena.org.uk/ Signed-off-by: David Lechner Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-adc-ad7949-use-spi_is_bpw_supported-v1-1-c4e15bfd326e@baylibre.com Signed-off-by: Jonathan Cameron commit 1fe16dc1a2f5057772e5391ec042ed7442966c9a Author: Sean Nyekjaer Date: Tue Jun 3 14:25:44 2025 +0200 iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush fxls8962af_fifo_flush() uses indio_dev->active_scan_mask (with iio_for_each_active_channel()) without making sure the indio_dev stays in buffer mode. There is a race if indio_dev exits buffer mode in the middle of the interrupt that flushes the fifo. Fix this by calling synchronize_irq() to ensure that no interrupt is currently running when disabling buffer mode. Unable to handle kernel NULL pointer dereference at virtual address 00000000 when read [...] _find_first_bit_le from fxls8962af_fifo_flush+0x17c/0x290 fxls8962af_fifo_flush from fxls8962af_interrupt+0x80/0x178 fxls8962af_interrupt from irq_thread_fn+0x1c/0x7c irq_thread_fn from irq_thread+0x110/0x1f4 irq_thread from kthread+0xe0/0xfc kthread from ret_from_fork+0x14/0x2c Fixes: 79e3a5bdd9ef ("iio: accel: fxls8962af: add hw buffered sampling") Cc: stable@vger.kernel.org Suggested-by: David Lechner Signed-off-by: Sean Nyekjaer Link: https://patch.msgid.link/20250603-fxlsrace-v2-1-5381b36ba1db@geanix.com Signed-off-by: Jonathan Cameron commit 3281ddcea6429f7bc1fdb39d407752dd1371aba9 Author: Chen-Yu Tsai Date: Sat Jun 7 21:56:27 2025 +0800 iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps The AXP717 ADC channel maps is missing a sentinel entry at the end. This causes a KASAN warning. Add the missing sentinel entry. Fixes: 5ba0cb92584b ("iio: adc: axp20x_adc: add support for AXP717 ADC") Signed-off-by: Chen-Yu Tsai Link: https://patch.msgid.link/20250607135627.2086850-1-wens@kernel.org Cc: Signed-off-by: Jonathan Cameron commit fd8e6f8729629407d2d932116d83b9cd71c17d80 Author: Rodrigo Gobbi Date: Tue May 27 18:51:06 2025 -0300 dt-bindings: iio: gyro: invensense,mpu3050: change irq maxItems The mpu3050 datasheet describes that this IC only supports one INT pin, which means one item with two cells inside binding. Change max to match this description. Signed-off-by: Rodrigo Gobbi Fixes: 749787477ae4 ("dt-bindings:iio:gyro:invensense,mpu3050: txt to yaml format conversion.") Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250527215818.13000-1-rodrigo.gobbi.7@gmail.com Signed-off-by: Jonathan Cameron commit 9f92e93e257b33e73622640a9205f8642ec16ddd Author: Maud Spierings Date: Tue May 27 08:36:08 2025 +0200 iio: common: st_sensors: Fix use of uninitialize device structs Throughout the various probe functions &indio_dev->dev is used before it is initialized. This caused a kernel panic in st_sensors_power_enable() when the call to devm_regulator_bulk_get_enable() fails and then calls dev_err_probe() with the uninitialized device. This seems to only cause a panic with dev_err_probe(), dev_err(), dev_warn() and dev_info() don't seem to cause a panic, but are fixed as well. The issue is reported and traced here: [1] Link: https://lore.kernel.org/all/AM7P189MB100986A83D2F28AF3FFAF976E39EA@AM7P189MB1009.EURP189.PROD.OUTLOOK.COM/ [1] Cc: stable@vger.kernel.org Signed-off-by: Maud Spierings Reviewed-by: Andy Shevchenko Link: https://... [1] Link: https://patch.msgid.link/20250527-st_iio_fix-v4-1-12d89801c761@gocontroll.com Signed-off-by: Jonathan Cameron commit 6ac609d1fba19d5d40fb3c81201ffadcb6d00fb3 Author: David Lechner Date: Fri May 30 16:50:14 2025 -0500 iio: adc: adi-axi-adc: fix ad7606_bus_reg_read() Mask the value read before returning it. The value read over the parallel bus via the AXI ADC IP block contains both the address and the data, but callers expect val to only contain the data. axi_adc_raw_write() takes a u32 parameter, so addr was the wrong type. This wasn't causing any issues but is corrected anyway since we are touching the same line to add a new variable. Cc: stable@vger.kernel.org Fixes: 79c47485e438 ("iio: adc: adi-axi-adc: add support for AD7606 register writing") Signed-off-by: David Lechner Link: https://patch.msgid.link/20250530-iio-adc-adi-axi-adc-fix-ad7606_bus_reg_read-v2-1-ad2dfc0694ce@baylibre.com Signed-off-by: Jonathan Cameron commit 43d8c4a3a3c7caa7fcc01d1bb349920db7004266 Author: Angelo Dureghello Date: Mon May 26 15:19:08 2025 +0200 dt-bindings: iio: adc: adi,ad7606: fix dt_schema validation warning Fix following dt_schema warning when offload is used: DTC [C] arch/arm/boot/dts/xilinx/zynq-zed-adv7511-ad7606.dtb /home/angelo/dev-baylibre/linux-iio/arch/arm/boot/dts/xilinx/zynq-zed-adv7511-ad7606.dtb: adc@0: 'oneOf' conditional failed, one must be fixed: 'interrupts' is a required property 'io-backends' is a required property from schema $id: http://devicetree.org/schemas/iio/adc/adi,ad7606.yaml# There isn't any reason that we couldn't have interrupts wired up at the same time we are using io-backends or SPI offload, so dropping off the related "oneOf" block entirely. Fixes: 81fe5529e812 ("dt-bindings: iio: adc: adi,ad7606: add SPI offload properties") Signed-off-by: Angelo Dureghello Acked-by: Conor Dooley Link: https://patch.msgid.link/20250526-wip-bl-ad7606-dtschema-fixes-v2-1-9bd56d039489@baylibre.com Signed-off-by: Jonathan Cameron commit 3b1890e4b250c95cf93a0a772433c3a2300e7c8f Merge: cc69ac7a65820d a3f3040657417a Author: Linus Torvalds Date: Sun Jun 29 08:43:54 2025 -0700 Merge tag 'edac_urgent_for_v6.16_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC fix from Borislav Petkov: - Consider secondary address mask registers in amd64_edac in order to get the correct total memory size of the system * tag 'edac_urgent_for_v6.16_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs commit cc69ac7a65820dd96c48fd2988255f8acc2527f2 Merge: 2fc18d0b8958dc fa7d0f83c5c422 Author: Linus Torvalds Date: Sun Jun 29 08:28:24 2025 -0700 Merge tag 'x86_urgent_for_v6.16_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: - Make sure DR6 and DR7 are initialized to their architectural values and not accidentally cleared, leading to misconfigurations * tag 'x86_urgent_for_v6.16_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/traps: Initialize DR7 by writing its architectural reset value x86/traps: Initialize DR6 by writing its architectural reset value commit 2fc18d0b8958dcea74c7357ebbc6912d0d6e2936 Merge: 753a0f61b90915 1476b218327b89 Author: Linus Torvalds Date: Sun Jun 29 08:16:02 2025 -0700 Merge tag 'perf_urgent_for_v6.16_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fix from Borislav Petkov: - Make sure an AUX perf event is really disabled when it overruns * tag 'perf_urgent_for_v6.16_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/aux: Fix pending disable flow when the AUX ring buffer overruns commit 753a0f61b9091536425d656c145881b70eb402f7 Merge: dfba48a70cb688 a24cc6ce1933ea Author: Linus Torvalds Date: Sun Jun 29 08:09:13 2025 -0700 Merge tag 'locking_urgent_for_v6.16_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fix from Borislav Petkov: - Make sure the new futex phash is not copied during fork in order to avoid a double-free * tag 'locking_urgent_for_v6.16_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: futex: Initialize futex_phash_new during fork(). commit e5d110fec068c7708002f4f372bf9ecdc1bc3da2 Author: Johannes Berg Date: Wed Jun 25 20:42:21 2025 +0300 wifi: iwlwifi: pcie: fix locking on invalid TOP reset If a TOP reset were to ever be erroneously requested on HW prior to SC, the code warns and returns, but doesn't take care to unlock the mutex in this case. Fix that. Fixes: 909e1be65462 ("wifi: iwlwifi: implement TOP reset") Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202506100707.WAnP5ePA-lkp@intel.com/ Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250625204210.19a0378838b1.I6bdc58d4996e995e1358ad94d4cc5017f3abf47b@changeid Signed-off-by: Miri Korenblit commit ce174b48aebb3fa18fe48c59a3d10a89c414fdf2 Author: Edip Hazuri Date: Fri Jun 27 23:34:16 2025 +0300 ALSA: hda/realtek - Add mute LED support for HP Victus 15-fb2xxx The mute led on this laptop is using ALC245 but requires a quirk to work This patch enables the existing quirk for the device. Tested on my friend's Victus 15-fb2xxx Laptop. The LED behaviour works as intended. Cc: Signed-off-by: Edip Hazuri Link: https://patch.msgid.link/20250627203415.56785-2-edip@medip.dev Signed-off-by: Takashi Iwai commit e0a911ac86857a73182edde9e50d9b4b949b7f01 Author: Daniel Dadap Date: Thu Jun 26 16:16:30 2025 -0500 ALSA: hda: Add missing NVIDIA HDA codec IDs Add codec IDs for several NVIDIA products with HDA controllers to the snd_hda_id_hdmi[] patch table. Signed-off-by: Daniel Dadap Cc: Link: https://patch.msgid.link/aF24rqwMKFWoHu12@ddadap-lakeline.nvidia.com Signed-off-by: Takashi Iwai commit 2ab3ba39153dcdc9de7d2eec42bf19f84d4844cf Author: Thomas Weißschuh Date: Wed Jun 18 09:52:20 2025 +0200 drm/bridge: samsung-dsim: Don't use %pK through printk In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log. Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts. Switch to the regular pointer formatting which is safer and easier to reason about. Signed-off-by: Thomas Weißschuh Signed-off-by: Inki Dae commit 5d91394f236167ac624b823820faf4aa928b889e Author: Marek Szyprowski Date: Wed Jun 18 14:06:26 2025 +0200 drm/exynos: fimd: Guard display clock control with runtime PM calls Commit c9b1150a68d9 ("drm/atomic-helper: Re-order bridge chain pre-enable and post-disable") changed the call sequence to the CRTC enable/disable and bridge pre_enable/post_disable methods, so those bridge methods are now called when CRTC is not yet enabled. This causes a lockup observed on Samsung Peach-Pit/Pi Chromebooks. The source of this lockup is a call to fimd_dp_clock_enable() function, when FIMD device is not yet runtime resumed. It worked before the mentioned commit only because the CRTC implemented by the FIMD driver was always enabled what guaranteed the FIMD device to be runtime resumed. This patch adds runtime PM guards to the fimd_dp_clock_enable() function to enable its proper operation also when the CRTC implemented by FIMD is not yet enabled. Fixes: 196e059a8a6a ("drm/exynos: convert clock_enable crtc callback to pipeline clock") Signed-off-by: Marek Szyprowski Reviewed-by: Tomi Valkeinen Signed-off-by: Inki Dae commit b846350aa272de99bf6fecfa6b08e64ebfb13173 Author: Kaustabh Chakraborty Date: Fri Jun 27 00:50:30 2025 +0530 drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling If there's support for another console device (such as a TTY serial), the kernel occasionally panics during boot. The panic message and a relevant snippet of the call stack is as follows: Unable to handle kernel NULL pointer dereference at virtual address 000000000000000 Call trace: drm_crtc_handle_vblank+0x10/0x30 (P) decon_irq_handler+0x88/0xb4 [...] Otherwise, the panics don't happen. This indicates that it's some sort of race condition. Add a check to validate if the drm device can handle vblanks before calling drm_crtc_handle_vblank() to avoid this. Cc: stable@vger.kernel.org Fixes: 96976c3d9aff ("drm/exynos: Add DECON driver") Signed-off-by: Kaustabh Chakraborty Signed-off-by: Inki Dae commit 18665eaa2acbe17da11c2748ac43c2f4ec2fad85 Author: Thomas Weißschuh Date: Wed Jun 18 09:52:21 2025 +0200 drm/exynos: Don't use %pK through printk In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log. Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts. Switch to the regular pointer formatting which is safer and easier to reason about. Signed-off-by: Thomas Weißschuh Signed-off-by: Inki Dae commit 14da58521ee5b31976f5b5b437438b8f28f9ba51 Author: Kent Overstreet Date: Sat Jun 28 21:54:58 2025 -0400 bcachefs: fix btree_trans_peek_prev_journal() Signed-off-by: Kent Overstreet commit dfba48a70cb68888efb494c9642502efe73614ed Merge: ded779017ad78f f40213cd93e608 Author: Linus Torvalds Date: Sat Jun 28 15:23:17 2025 -0700 Merge tag 'i2c-for-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: - imx: fix SMBus protocol compliance during block read - omap: fix error handling path in probe - robotfuzz, tiny-usb: prevent zero-length reads - x86, designware, amdisp: fix build error when modules are disabled (agreed to go in via i2c) - scx200_acb: fix build error because of missing HAS_IOPORT * tag 'i2c-for-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: scx200_acb: depends on HAS_IOPORT i2c: omap: Fix an error handling path in omap_i2c_probe() platform/x86: Use i2c adapter name to fix build errors i2c: amd-isp: Initialize unique adapter name i2c: designware: Initialize adapter name only when not set i2c: tiny-usb: disable zero-length read messages i2c: robotfuzz-osif: disable zero-length read messages i2c: imx: fix emulated smbus block read commit ded779017ad78fc9df3e9d9ae0e39d2e73865851 Merge: 3a3de75a68ff8d 6921d1e07cb5ed Author: Linus Torvalds Date: Sat Jun 28 11:39:24 2025 -0700 Merge tag 'trace-v6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fix from Steven Rostedt: - Fix possible UAF on error path in filter_free_subsystem_filters() When freeing a subsystem filter, the filter for the subsystem is passed in to be freed and all the events within the subsystem will have their filter freed too. In order to free without waiting for RCU synchronization, list items are allocated to hold what is going to be freed to free it via a call_rcu(). If the allocation of these items fails, it will call the synchronization directly and free after that (causing a bit of delay for the user). The subsystem filter is first added to this list and then the filters for all the events under the subsystem. The bug is if one of the allocations of the list items for the event filters fail to allocate, it jumps to the "free_now" label which will free the subsystem filter, then all the items on the allocated list, and then the event filters that were not added to the list yet. But because the subsystem filter was added first, it gets freed twice. The solution is to add the subsystem filter after the events, and then if any of the allocations fail it will not try to free any of them twice * tag 'trace-v6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Fix filter logic error commit 3a3de75a68ff8d52466980c4cfb2c16192d5e4e7 Merge: aaf724ed692647 955853cf83657f Author: Linus Torvalds Date: Sat Jun 28 11:35:11 2025 -0700 Merge tag 'loongarch-fixes-6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: - replace __ASSEMBLY__ with __ASSEMBLER__ in headers like others - fix build warnings about export.h - reserve the EFI memory map region for kdump - handle __init vs inline mismatches - fix some KVM bugs * tag 'loongarch-fixes-6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: KVM: Disable updating of "num_cpu" and "feature" LoongArch: KVM: Check validity of "num_cpu" from user space LoongArch: KVM: Check interrupt route from physical CPU LoongArch: KVM: Fix interrupt route update with EIOINTC LoongArch: KVM: Add address alignment check for IOCSR emulation LoongArch: KVM: Avoid overflow with array index LoongArch: Handle KCOV __init vs inline mismatches LoongArch: Reserve the EFI memory map region LoongArch: Fix build warnings about export.h LoongArch: Replace __ASSEMBLY__ with __ASSEMBLER__ in headers commit 62355f1f87b8c7f8785a8dd3cd5ca6e5b513566a Author: Niklas Schnelle Date: Wed Jun 25 11:28:30 2025 +0200 s390/pci: Allow automatic recovery with minimal driver support According to Documentation/PCI/pci-error-recovery.rst only the error_detected() callback in the err_handler struct is mandatory for a driver to support error recovery. So far s390's error recovery chose a stricter approach also requiring slot_reset() and resume(). Relax this requirement and only require error_detected(). If a callback is not implemented EEH and AER treat this as PCI_ERS_RESULT_NONE. This return value is otherwise used by drivers abstaining from their vote on how to proceed with recovery and currently also not supported by s390's recovery code. So to support missing callbacks in-line with other implementors of the recovery flow, also handle PCI_ERS_RESULT_NONE. Since s390 only does per PCI function recovery and does not do voting, treat PCI_ERS_RESULT_NONE optimistically and proceed through recovery unless other failures prevent this. Reviewed-by: Farhan Ali Reviewed-by: Julian Ruess Signed-off-by: Niklas Schnelle Signed-off-by: Alexander Gordeev commit b97a7972b1f4f81417840b9a2ab0c19722b577d5 Author: Niklas Schnelle Date: Wed Jun 25 11:28:29 2025 +0200 s390/pci: Do not try re-enabling load/store if device is disabled If a device is disabled unblocking load/store on its own is not useful as a full re-enable of the function is necessary anyway. Note that SCLP Write Event Data Action Qualifier 0 (Reset) leaves the device disabled and triggers this case unless the driver already requests a reset. Cc: stable@vger.kernel.org Fixes: 4cdf2f4e24ff ("s390/pci: implement minimal PCI error recovery") Reviewed-by: Farhan Ali Signed-off-by: Niklas Schnelle Signed-off-by: Alexander Gordeev commit 45537926dd2aaa9190ac0fac5a0fbeefcadfea95 Author: Niklas Schnelle Date: Wed Jun 25 11:28:28 2025 +0200 s390/pci: Fix stale function handles in error handling The error event information for PCI error events contains a function handle for the respective function. This handle is generally captured at the time the error event was recorded. Due to delays in processing or cascading issues, it may happen that during firmware recovery multiple events are generated. When processing these events in order Linux may already have recovered an affected function making the event information stale. Fix this by doing an unconditional CLP List PCI function retrieving the current function handle with the zdev->state_lock held and ignoring the event if its function handle is stale. Cc: stable@vger.kernel.org Fixes: 4cdf2f4e24ff ("s390/pci: implement minimal PCI error recovery") Reviewed-by: Julian Ruess Reviewed-by: Gerd Bayer Reviewed-by: Farhan Ali Signed-off-by: Niklas Schnelle Signed-off-by: Alexander Gordeev commit efe3e3ae5a66cb38ef29c909e951b4039044bae9 Author: Mathias Nyman Date: Fri Jun 27 17:41:22 2025 +0300 xhci: dbc: Flush queued requests before stopping dbc Flush dbc requests when dbc is stopped and transfer rings are freed. Failure to flush them lead to leaking memory and dbc completing odd requests after resuming from suspend, leading to error messages such as: [ 95.344392] xhci_hcd 0000:00:0d.0: no matched request Cc: stable Fixes: dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver") Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20250627144127.3889714-5-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 2b857d69a5e116150639a0c6c39c86cc329939ee Author: Łukasz Bartosik Date: Fri Jun 27 17:41:21 2025 +0300 xhci: dbctty: disable ECHO flag by default When /dev/ttyDBC0 device is created then by default ECHO flag is set for the terminal device. However if data arrives from a peer before application using /dev/ttyDBC0 applies its set of terminal flags then the arriving data will be echoed which might not be desired behavior. Fixes: 4521f1613940 ("xhci: dbctty: split dbc tty driver registration and unregistration functions.") Cc: stable Signed-off-by: Łukasz Bartosik Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/stable/20250610111802.18742-1-ukaszb%40chromium.org Link: https://lore.kernel.org/r/20250627144127.3889714-4-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit cd65ee81240e8bc3c3119b46db7f60c80864b90b Author: Hongyu Xie Date: Fri Jun 27 17:41:20 2025 +0300 xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS Disable stream for platform xHC controller with broken stream. Fixes: 14aec589327a6 ("storage: accept some UAS devices if streams are unavailable") Cc: stable Signed-off-by: Hongyu Xie Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20250627144127.3889714-3-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit cbc889ab0122366f6cdbe3c28d477c683ebcebc2 Author: Raju Rangoju Date: Fri Jun 27 17:41:19 2025 +0300 usb: xhci: quirk for data loss in ISOC transfers During the High-Speed Isochronous Audio transfers, xHCI controller on certain AMD platforms experiences momentary data loss. This results in Missed Service Errors (MSE) being generated by the xHCI. The root cause of the MSE is attributed to the ISOC OUT endpoint being omitted from scheduling. This can happen when an IN endpoint with a 64ms service interval either is pre-scheduled prior to the ISOC OUT endpoint or the interval of the ISOC OUT endpoint is shorter than that of the IN endpoint. Consequently, the OUT service is neglected when an IN endpoint with a service interval exceeding 32ms is scheduled concurrently (every 64ms in this scenario). This issue is particularly seen on certain older AMD platforms. To mitigate this problem, it is recommended to adjust the service interval of the IN endpoint to not exceed 32ms (interval 8). This adjustment ensures that the OUT endpoint will not be bypassed, even if a smaller interval value is utilized. Cc: stable Signed-off-by: Raju Rangoju Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20250627144127.3889714-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 80e08394377559ed5a2ccadd861e62d24b826911 Author: SCHNEIDER Johannes Date: Wed Jun 25 07:49:16 2025 +0000 usb: dwc3: gadget: Fix TRB reclaim logic for short transfers and ZLPs Commit 96c7bf8f6b3e ("usb: dwc3: gadget: Cleanup SG handling") updated the TRB reclaim path to use the TRB CHN (Chain) bit to determine whether a TRB was part of a chain. However, this inadvertently changed the behavior of reclaiming the final TRB in some scatter-gather or short transfer cases. In particular, if the final TRB did not have the CHN bit set, the cleanup path could incorrectly skip clearing the HWO (Hardware Own) bit, leaving stale TRBs in the ring. This resulted in broken data transfer completions in userspace, notably for MTP over FunctionFS. Fix this by unconditionally clearing the HWO bit during TRB reclaim, regardless of the CHN bit state. This restores correct behavior especially for transfers that require ZLPs or end on non-CHN TRBs. Fixes: 61440628a4ff ("usb: dwc3: gadget: Cleanup SG handling") Signed-off-by: Johannes Schneider Acked-by: Thinh Nguyen Cc: stable Link: https://lore.kernel.org/r/AM8PR06MB7521A29A8863C838B54987B6BC7BA@AM8PR06MB7521.eurprd06.prod.outlook.com Signed-off-by: Greg Kroah-Hartman commit 30ad231a5029bfa16e46ce868497b1a5cdd3c24d Author: JP Kobryn Date: Fri Jun 27 10:49:35 2025 -0700 x86/mce: Make sure CMCI banks are cleared during shutdown on Intel CMCI banks are not cleared during shutdown on Intel CPUs. As a side effect, when a kexec is performed, CPUs coming back online are unable to rediscover/claim these occupied banks which breaks MCE reporting. Clear the CPU ownership during shutdown via cmci_clear() so the banks can be reclaimed and MCE reporting will become functional once more. [ bp: Massage commit message. ] Reported-by: Aijay Adams Signed-off-by: JP Kobryn Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tony Luck Reviewed-by: Qiuxu Zhuo Cc: Link: https://lore.kernel.org/20250627174935.95194-1-inwardvessel@gmail.com commit aaf724ed69264719550ec4f194d3ab17b886af9a Merge: 0fd39af24e37a6 263debecb4aa7c Author: Linus Torvalds Date: Fri Jun 27 20:38:05 2025 -0700 Merge tag 'v6.16-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - Multichannel reconnect lock ordering deadlock fix - Fix for regression in handling native Windows symlinks - Three smbdirect fixes: - oops in RDMA response processing - smbdirect memcpy issue - fix smbdirect regression with large writes (smbdirect test cases now all passing) - Fix for "FAILED_TO_PARSE" warning in trace-cmd report output * tag 'v6.16-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code cifs: Fix the smbd_response slab to allow usercopy smb: client: fix potential deadlock when reconnecting channels smb: client: remove \t from TP_printk statements smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data smb: client: fix regression with native SMB symlinks commit 0fd39af24e37a6866c479ca385301845f6029787 Merge: 867b9987a30b7f c0cb210a87fcdd Author: Linus Torvalds Date: Fri Jun 27 20:34:10 2025 -0700 Merge tag 'mm-hotfixes-stable-2025-06-27-16-56' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "16 hotfixes. 6 are cc:stable and the remainder address post-6.15 issues or aren't considered necessary for -stable kernels. 5 are for MM" * tag 'mm-hotfixes-stable-2025-06-27-16-56' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: MAINTAINERS: add Lorenzo as THP co-maintainer mailmap: update Duje Mihanović's email address selftests/mm: fix validate_addr() helper crashdump: add CONFIG_KEYS dependency mailmap: correct name for a historical account of Zijun Hu mailmap: add entries for Zijun Hu fuse: fix runtime warning on truncate_folio_batch_exceptionals() scripts/gdb: fix dentry_name() lookup mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write mm/alloc_tag: fix the kmemleak false positive issue in the allocation of the percpu variable tag->counters lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() mm/hugetlb: remove unnecessary holding of hugetlb_lock MAINTAINERS: add missing files to mm page alloc section MAINTAINERS: add tree entry to mm init block mm: add OOM killer maintainer structure fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio commit 867b9987a30b7f68a6e9e89d3670730692222a4a Merge: fa33adcaf8af14 c5136add3f9b4c Author: Linus Torvalds Date: Fri Jun 27 20:22:18 2025 -0700 Merge tag 'riscv-for-linus-5.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V Fixes for 5.16-rc4 - .rodata is no longer linkd into PT_DYNAMIC. It was not supposed to be there in the first place and resulted in invalid (but unused) entries. This manifests as at least warnings in llvm-readelf - A fix for runtime constants with all-0 upper 32-bits. This should only manifest on MMU=n kernels - A fix for context save/restore on systems using the T-Head vector extensions - A fix for a conflicting "+r"/"r" register constraint in the VDSO getrandom syscall wrapper, which is undefined behavior in clang - A fix for a missing register clobber in the RVV raid6 implementation. This manifests as a NULL pointer reference on some compilers, but could trigger in other ways - Misaligned accesses from userspace at faulting addresses are now handled correctly - A fix for an incorrect optimization that allowed access_ok() to mark invalid addresses as accessible, which can result in userspace triggering BUG()s - A few fixes for build warnings, and an update to Drew's email address * tag 'riscv-for-linus-5.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: export boot_cpu_hartid Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" riscv: Fix sparse warning in vendor_extensions/sifive.c Revert "riscv: misaligned: fix sleeping function called during misaligned access handling" MAINTAINERS: Update Drew Fustini's email address RISC-V: uaccess: Wrap the get_user_8 uaccess macro raid6: riscv: Fix NULL pointer dereference caused by a missing clobber RISC-V: vDSO: Correct inline assembly constraints in the getrandom syscall wrapper riscv: vector: Fix context save/restore with xtheadvector riscv: fix runtime constant support for nommu kernels riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment commit fa33adcaf8af147f4238c84d76a316a47e43e091 Merge: 7abdafd2343ab1 5aa326a6a2ff0a Author: Linus Torvalds Date: Fri Jun 27 20:17:48 2025 -0700 Merge tag 'pci-v6.16-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull PCI fix from Bjorn Helgaas: - Fix a PTM debugfs build error with CONFIG_DEBUG_FS=n && CONFIG_PCIE_PTM=y (Manivannan Sadhasivam) * tag 'pci-v6.16-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI/PTM: Build debugfs code only if CONFIG_DEBUG_FS is enabled commit 7abdafd2343ab199367c8243d6a5f06a9aa6976b Merge: 26fd9f7b7ff379 9fbceb37c95939 Author: Linus Torvalds Date: Fri Jun 27 19:38:36 2025 -0700 Merge tag 'drm-fixes-2025-06-28' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Regular weekly drm updates, nothing out of the ordinary, amdgpu, xe, i915 and a few misc bits. Seems about right for this time in the release cycle. core: - fix drm_writeback_connector_cleanup function signature - use correct HDMI audio bridge in drm_connector_hdmi_audio_init bridge: - SN65DSI86: fix HPD amdgpu: - Cleaner shader support for additional GFX9 GPUs - MES firmware compatibility fixes - Discovery error reporting fixes - SDMA6/7 userq fixes - Backlight fix - EDID sanity check i915: - Fix for SNPS PHY HDMI for 1080p@120Hz - Correct DP AUX DPCD probe address - Followup build fix for GCOV and AutoFDO enabled config xe: - Missing error check - Fix xe_hwmon_power_max_write - Move flushes - Explicitly exit CT safe mode on unwind - Process deferred GGTT node removals on device unwind" * tag 'drm-fixes-2025-06-28' of https://gitlab.freedesktop.org/drm/kernel: drm/xe: Process deferred GGTT node removals on device unwind drm/xe/guc: Explicitly exit CT safe mode on unwind drm/xe: move DPT l2 flush to a more sensible place drm/xe: Move DSB l2 flush to a more sensible place drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type drm/i915: fix build error some more drm/xe/hwmon: Fix xe_hwmon_power_max_write drm/xe/display: Add check for alloc_ordered_workqueue() drm/amd/display: Add sanity checks for drm_edid_raw() drm/amd/display: Fix AMDGPU_MAX_BL_LEVEL value drm/amdgpu/sdma7: add ucode version checks for userq support drm/amdgpu/sdma6: add ucode version checks for userq support drm/amd: Adjust output for discovery error handling drm/amdgpu/mes: add compatibility checks for set_hw_resource_1 drm/amdgpu/gfx9: Add Cleaner Shader Support for GFX9.x GPUs drm/bridge-connector: Fix bridge in drm_connector_hdmi_audio_init() drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS drm/i915/snps_hdmi_pll: Fix 64-bit divisor truncation by using div64_u64 drm: writeback: Fix drm_writeback_connector_cleanup signature commit 26fd9f7b7ff3794c5de0e6ae538cead53118b4c3 Merge: 5683cd63a33a5f 0a46f60a9fe16f Author: Linus Torvalds Date: Fri Jun 27 17:58:32 2025 -0700 Merge tag 'cxl-fixes-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull Compute Express Link (CXL) fixes from Dave Jiang: "These fixes address a few issues in the CXL subsystem, including dealing with some bugs in the CXL EDAC and RAS drivers: - Fix return value of cxlctl_validate_set_features() - Fix min_scrub_cycle of a region miscaculation and add additional documentation - Fix potential memory leak issues for CXL EDAC - Fix CPER handler device confusion for CXL RAS - Fix using wrong repair type to check DRAM event record" * tag 'cxl-fixes-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: cxl/edac: Fix using wrong repair type to check dram event record cxl/ras: Fix CPER handler device confusion cxl/edac: Fix potential memory leak issues cxl/Documentation: Add more description about min/max scrub cycle cxl/edac: Fix the min_scrub_cycle of a region miscalculation cxl: fix return value in cxlctl_validate_set_features() commit 5683cd63a33a5f0bf629a77f704ddd45cdb36cba Merge: 35e261cd95ddc7 64f7548aad63d2 Author: Linus Torvalds Date: Fri Jun 27 17:32:30 2025 -0700 Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library fix from Eric Biggers: "Fix a regression where the purgatory code sometimes fails to build" * tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: lib/crypto: sha256: Mark sha256_choose_blocks as __always_inline commit 2def09ead4ad5907988b655d1e1454003aaf8297 Author: Fushuai Wang Date: Thu Jun 26 21:30:03 2025 +0800 dpaa2-eth: fix xdp_rxq_info leak The driver registered xdp_rxq_info structures via xdp_rxq_info_reg() but failed to properly unregister them in error paths and during removal. Fixes: d678be1dc1ec ("dpaa2-eth: add XDP_REDIRECT support") Signed-off-by: Fushuai Wang Reviewed-by: Simon Horman Reviewed-by: Ioana Ciornei Link: https://patch.msgid.link/20250626133003.80136-1-wangfushuai@baidu.com Signed-off-by: Jakub Kicinski commit d72411d20905180cdc452c553be17481b24463d2 Author: Thomas Fourier Date: Wed Jun 25 16:16:24 2025 +0200 ethernet: atl1: Add missing DMA mapping error checks and count errors The `dma_map_XXX()` functions can fail and must be checked using `dma_mapping_error()`. This patch adds proper error handling for all DMA mapping calls. In `atl1_alloc_rx_buffers()`, if DMA mapping fails, the buffer is deallocated and marked accordingly. In `atl1_tx_map()`, previously mapped buffers are unmapped and the packet is dropped on failure. If `atl1_xmit_frame()` drops the packet, increment the tx_error counter. Fixes: f3cc28c79760 ("Add Attansic L1 ethernet driver.") Signed-off-by: Thomas Fourier Link: https://patch.msgid.link/20250625141629.114984-2-fourier.thomas@gmail.com Signed-off-by: Jakub Kicinski commit 22c69d786ef8fb789c61ca75492a272774221324 Author: Nilton Perim Neto Date: Fri Jun 27 16:29:40 2025 -0700 Input: xpad - support Acer NGR 200 Controller Add the NGR 200 Xbox 360 to the list of recognized controllers. Signed-off-by: Nilton Perim Neto Link: https://lore.kernel.org/r/20250608060517.14967-1-niltonperimneto@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit ba2f83eecd2b36b12f92e5edd8bdc0509c7cd44e Author: Ulrich Weber Date: Thu Jun 26 16:56:18 2025 +0200 doc: tls: socket needs to be established to enable ulp To enable TLS ulp socket needs to be in established state. This was added in commit d91c3e17f75f ("net/tls: Only attach to sockets in ESTABLISHED state"), in 2018. Signed-off-by: Ulrich Weber Link: https://patch.msgid.link/20250626145618.15464-1-ulrich.weber@gmail.com Signed-off-by: Jakub Kicinski commit 6e457732c8a4431952a5cc075215268ce021dc0f Author: Jakub Kicinski Date: Thu Jun 26 11:20:55 2025 -0700 docs: netdev: correct the heading level for co-posting selftests "Co-posting selftests" belongs in the "netdev patch review" section, same as "co-posting changes to user space components". It was erroneously added as its own section. Reviewed-by: Bagas Sanjaya Link: https://patch.msgid.link/20250626182055.4161905-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 8550821a153558d49dffacbc1dc98ac9d3eed2fa Author: Jan Karcher Date: Thu Jun 26 07:16:53 2025 +0200 MAINTAINERS: update smc section Due to changes of my responsibilities within IBM i can no longer act as maintainer for smc. As a result of the co-operation with Alibaba over the last years we decided to, once more, give them more responsibility for smc by appointing D. Wythe and Dust Li as maintainers as well. Within IBM Sidraya Jayagond and Mahanta Jambigi are going to take over the maintainership for smc. Signed-off-by: Jan Karcher Reviewed-by: Wenjia Zhang Link: https://patch.msgid.link/20250626051653.4259-1-jaka@linux.ibm.com Signed-off-by: Jakub Kicinski commit 9fbceb37c95939182e1409211447a1d3f3db9274 Merge: 6daaa479ac557b 55e8ff842051b1 Author: Dave Airlie Date: Sat Jun 28 06:53:00 2025 +1000 Merge tag 'drm-misc-fixes-2025-06-26' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes drm-misc-fixes for v6.16-rc4: - Fix function signature of drm_writeback_connector_cleanup. - Use correct HDMI audio bridge in drm_connector_hdmi_audio_init. - Make HPD work on SN65DSI86. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://lore.kernel.org/r/3dd1d5e1-73b6-4b0c-a208-f7d6235cf530@linux.intel.com commit 6921d1e07cb5eddec830801087b419194fde0803 Author: Edward Adam Davis Date: Tue Jun 24 14:38:46 2025 +0800 tracing: Fix filter logic error If the processing of the tr->events loop fails, the filter that has been added to filter_head will be released twice in free_filter_list(&head->rcu) and __free_filter(filter). After adding the filter of tr->events, add the filter to the filter_head process to avoid triggering uaf. Link: https://lore.kernel.org/tencent_4EF87A626D702F816CD0951CE956EC32CD0A@qq.com Fixes: a9d0aab5eb33 ("tracing: Fix regression of filter waiting a long time on RCU synchronization") Reported-by: syzbot+daba72c4af9915e9c894@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=daba72c4af9915e9c894 Tested-by: syzbot+daba72c4af9915e9c894@syzkaller.appspotmail.com Acked-by: Masami Hiramatsu (Google) Signed-off-by: Edward Adam Davis Signed-off-by: Steven Rostedt (Google) commit 77451cb102506a980cd299581e1c03a367af3c9a Author: Mario Limonciello Date: Fri Jun 27 12:23:44 2025 -0700 Input: xpad - return errors from xpad_try_sending_next_out_packet() up Not all errors that occur in xpad_try_sending_next_out_packet() are IO errors. Pass up the error code to the caller so that it can decide what to do. Signed-off-by: Mario Limonciello Link: https://lore.kernel.org/r/20250609014718.236827-3-superm1@kernel.org Signed-off-by: Dmitry Torokhov commit 35ecea24b5ef7534b8c928bb9ddfa936bd2805ab Author: Mario Limonciello Date: Fri Jun 27 12:23:20 2025 -0700 Input: xpad - adjust error handling for disconnect When a device supporting xpad is disconnected it's expected that a URB will fail to transmit. Only show an error message when the error isn't -ENODEV. Fixes: 7fc595f4c0263 ("Input: xpad - correctly handle concurrent LED and FF requests") Signed-off-by: Mario Limonciello Link: https://lore.kernel.org/r/20250609014718.236827-2-superm1@kernel.org Signed-off-by: Dmitry Torokhov commit 35e261cd95ddc741d8664f5ac897bbd0d384bbd0 Merge: e540341508ce2f 2b8be57fa0c88a Author: Linus Torvalds Date: Fri Jun 27 12:08:36 2025 -0700 Merge tag 'acpi-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "Revert a commit that attempted to fix a memory leak in an error code path and introduced a different issue (Zhe Qiao)" * tag 'acpi-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" commit c5b60592886f97b01503c1bb553f88d6a7df42ea Author: Gabor Juhos Date: Fri Jun 27 09:58:54 2025 +0200 interconnect: avoid memory allocation when 'icc_bw_lock' is held The 'icc_bw_lock' mutex is introduced in commit af42269c3523 ("interconnect: Fix locking for runpm vs reclaim") in order to decouple serialization of bw aggregation from codepaths that require memory allocation. However commit d30f83d278a9 ("interconnect: core: Add dynamic id allocation support") added a devm_kasprintf() call into a path protected by the 'icc_bw_lock' which causes the following lockdep warning on machines like the Lenovo ThinkPad X13s: ====================================================== WARNING: possible circular locking dependency detected 6.16.0-rc3 #15 Not tainted ------------------------------------------------------ (udev-worker)/342 is trying to acquire lock: ffffb973f7ec4638 (fs_reclaim){+.+.}-{0:0}, at: __kmalloc_node_track_caller_noprof+0xa0/0x3e0 but task is already holding lock: ffffb973f7f7f0e8 (icc_bw_lock){+.+.}-{4:4}, at: icc_node_add+0x44/0x154 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (icc_bw_lock){+.+.}-{4:4}: icc_init+0x48/0x108 do_one_initcall+0x64/0x30c kernel_init_freeable+0x27c/0x500 kernel_init+0x20/0x1d8 ret_from_fork+0x10/0x20 -> #0 (fs_reclaim){+.+.}-{0:0}: __lock_acquire+0x136c/0x2114 lock_acquire+0x1c8/0x354 fs_reclaim_acquire+0x74/0xa8 __kmalloc_node_track_caller_noprof+0xa0/0x3e0 devm_kmalloc+0x54/0x124 devm_kvasprintf+0x74/0xd4 devm_kasprintf+0x58/0x80 icc_node_add+0xb4/0x154 qcom_osm_l3_probe+0x20c/0x314 [icc_osm_l3] platform_probe+0x68/0xd8 really_probe+0xc0/0x38c __driver_probe_device+0x7c/0x160 driver_probe_device+0x40/0x110 __driver_attach+0xfc/0x208 bus_for_each_dev+0x74/0xd0 driver_attach+0x24/0x30 bus_add_driver+0x110/0x234 driver_register+0x60/0x128 __platform_driver_register+0x24/0x30 osm_l3_driver_init+0x20/0x1000 [icc_osm_l3] do_one_initcall+0x64/0x30c do_init_module+0x58/0x23c load_module+0x1df8/0x1f70 init_module_from_file+0x88/0xc4 idempotent_init_module+0x188/0x280 __arm64_sys_finit_module+0x6c/0xd8 invoke_syscall+0x48/0x110 el0_svc_common.constprop.0+0xc0/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x4c/0x158 el0t_64_sync_handler+0xc8/0xcc el0t_64_sync+0x198/0x19c other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(icc_bw_lock); lock(fs_reclaim); lock(icc_bw_lock); lock(fs_reclaim); *** DEADLOCK *** The icc_node_add() functions is not designed to fail, and as such it should not do any memory allocation. In order to avoid this, add a new helper function for the name generation to be called by drivers which are using the new dynamic id feature. Fixes: d30f83d278a9 ("interconnect: core: Add dynamic id allocation support") Signed-off-by: Gabor Juhos Link: https://lore.kernel.org/r/20250625-icc-bw-lockdep-v3-1-2b8f8b8987c4@gmail.com Co-developed-by: Johan Hovold Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20250627075854.26943-1-johan+linaro@kernel.org Signed-off-by: Georgi Djakov commit 89fb8acc38852116d38d721ad394aad7f2871670 Author: Christian Eggers Date: Fri Jun 27 09:05:08 2025 +0200 Bluetooth: HCI: Set extended advertising data synchronously Currently, for controllers with extended advertising, the advertising data is set in the asynchronous response handler for extended adverstising params. As most advertising settings are performed in a synchronous context, the (asynchronous) setting of the advertising data is done too late (after enabling the advertising). Move setting of adverstising data from asynchronous response handler into synchronous context to fix ordering of HCI commands. Signed-off-by: Christian Eggers Fixes: a0fb3726ba55 ("Bluetooth: Use Set ext adv/scan rsp data if controller supports") Cc: stable@vger.kernel.org v2: https://lore.kernel.org/linux-bluetooth/20250626115209.17839-1-ceggers@arri.de/ Signed-off-by: Luiz Augusto von Dentz commit f3cb5676e5c11c896ba647ee309a993e73531588 Author: Christian Eggers Date: Wed Jun 25 15:09:31 2025 +0200 Bluetooth: MGMT: mesh_send: check instances prior disabling advertising The unconditional call of hci_disable_advertising_sync() in mesh_send_done_sync() also disables other LE advertisings (non mesh related). I am not sure whether this call is required at all, but checking the adv_instances list (like done at other places) seems to solve the problem. Fixes: b338d91703fa ("Bluetooth: Implement support for Mesh") Cc: stable@vger.kernel.org Signed-off-by: Christian Eggers Signed-off-by: Luiz Augusto von Dentz commit e5af67a870f738bb8a4594b6c60c2caf4c87a3c9 Author: Christian Eggers Date: Wed Jun 25 15:09:30 2025 +0200 Bluetooth: MGMT: set_mesh: update LE scan interval and window According to the message of commit b338d91703fa ("Bluetooth: Implement support for Mesh"), MGMT_OP_SET_MESH_RECEIVER should set the passive scan parameters. Currently the scan interval and window parameters are silently ignored, although user space (bluetooth-meshd) expects that they can be used [1] [1] https://git.kernel.org/pub/scm/bluetooth/bluez.git/tree/mesh/mesh-io-mgmt.c#n344 Fixes: b338d91703fa ("Bluetooth: Implement support for Mesh") Cc: stable@vger.kernel.org Signed-off-by: Christian Eggers Signed-off-by: Luiz Augusto von Dentz commit 46c0d947b64ac8efcf89dd754213dab5d1bd00aa Author: Christian Eggers Date: Wed Jun 25 15:09:29 2025 +0200 Bluetooth: hci_sync: revert some mesh modifications This reverts minor parts of the changes made in commit b338d91703fa ("Bluetooth: Implement support for Mesh"). It looks like these changes were only made for development purposes but shouldn't have been part of the commit. Fixes: b338d91703fa ("Bluetooth: Implement support for Mesh") Cc: stable@vger.kernel.org Signed-off-by: Christian Eggers Signed-off-by: Luiz Augusto von Dentz commit 157501b0469969fc1ba53add5049575aadd79d80 Author: Filipe Manana Date: Fri Jun 20 16:37:01 2025 +0100 btrfs: use btrfs_record_snapshot_destroy() during rmdir We are setting the parent directory's last_unlink_trans directly which may result in a concurrent task starting to log the directory not see the update and therefore can log the directory after we removed a child directory which had a snapshot within instead of falling back to a transaction commit. Replaying such a log tree would result in a mount failure since we can't currently delete snapshots (and subvolumes) during log replay. This is the type of failure described in commit 1ec9a1ae1e30 ("Btrfs: fix unreplayable log after snapshot delete + parent dir fsync"). Fix this by using btrfs_record_snapshot_destroy() which updates the last_unlink_trans field while holding the inode's log_mutex lock. Fixes: 44f714dae50a ("Btrfs: improve performance on fsync against new inode after rename/unlink") Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit c466e33e729a0ee017d10d919cba18f503853c60 Author: Filipe Manana Date: Fri Jun 20 15:54:05 2025 +0100 btrfs: propagate last_unlink_trans earlier when doing a rmdir In case the removed directory had a snapshot that was deleted, we are propagating its inode's last_unlink_trans to the parent directory after we removed the entry from the parent directory. This leaves a small race window where someone can log the parent directory after we removed the entry and before we updated last_unlink_trans, and as a result if we ever try to replay such a log tree, we will fail since we will attempt to remove a snapshot during log replay, which is currently not possible and results in the log replay (and mount) to fail. This is the type of failure described in commit 1ec9a1ae1e30 ("Btrfs: fix unreplayable log after snapshot delete + parent dir fsync"). So fix this by propagating the last_unlink_trans to the parent directory before we remove the entry from it. Fixes: 44f714dae50a ("Btrfs: improve performance on fsync against new inode after rename/unlink") Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit bf5bcf9a6fa070ec8a725b08db63fb1318f77366 Author: Filipe Manana Date: Thu Jun 19 13:13:38 2025 +0100 btrfs: record new subvolume in parent dir earlier to avoid dir logging races Instead of recording that a new subvolume was created in a directory after we add the entry do the directory, record it before adding the entry. This is to avoid races where after creating the entry and before recording the new subvolume in the directory (the call to btrfs_record_new_subvolume()), another task logs the directory, so we end up with a log tree where we logged a directory that has an entry pointing to a root that was not yet committed, resulting in an invalid entry if the log is persisted and replayed later due to a power failure or crash. Also state this requirement in the function comment for btrfs_record_new_subvolume(), similar to what we do for the btrfs_record_unlink_dir() and btrfs_record_snapshot_destroy(). Fixes: 45c4102f0d82 ("btrfs: avoid transaction commit on any fsync after subvolume creation") Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 5f61b961599acbd2bed028d3089105a1f7d224b8 Author: Filipe Manana Date: Wed Jun 18 15:58:31 2025 +0100 btrfs: fix inode lookup error handling during log replay When replaying log trees we use read_one_inode() to get an inode, which is just a wrapper around btrfs_iget_logging(), which in turn is a wrapper for btrfs_iget(). But read_one_inode() always returns NULL for any error that btrfs_iget_logging() / btrfs_iget() may return and this is a problem because: 1) In many callers of read_one_inode() we convert the NULL into -EIO, which is not accurate since btrfs_iget() may return -ENOMEM and -ENOENT for example, besides -EIO and other errors. So during log replay we may end up reporting a false -EIO, which is confusing since we may not have had any IO error at all; 2) When replaying directory deletes, at replay_dir_deletes(), we assume the NULL returned from read_one_inode() means that the inode doesn't exist and then proceed as if no error had happened. This is wrong because unless btrfs_iget() returned ERR_PTR(-ENOENT), we had an actual error and the target inode may exist in the target subvolume root - this may later result in the log replay code failing at a later stage (if we are "lucky") or succeed but leaving some inconsistency in the filesystem. So fix this by not ignoring errors from btrfs_iget_logging() and as a consequence remove the read_one_inode() wrapper and just use btrfs_iget_logging() directly. Also since btrfs_iget_logging() is supposed to be called only against subvolume roots, just like read_one_inode() which had a comment about it, add an assertion to btrfs_iget_logging() to check that the target root corresponds to a subvolume root. Fixes: 5d4f98a28c7d ("Btrfs: Mixed back reference (FORWARD ROLLING FORMAT CHANGE)") Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 54a7081ed168b72a8a2d6ef4ba3a1259705a2926 Author: Filipe Manana Date: Mon Jun 23 12:11:58 2025 +0100 btrfs: fix iteration of extrefs during log replay At __inode_add_ref() when processing extrefs, if we jump into the next label we have an undefined value of victim_name.len, since we haven't initialized it before we did the goto. This results in an invalid memory access in the next iteration of the loop since victim_name.len was not initialized to the length of the name of the current extref. Fix this by initializing victim_name.len with the current extref's name length. Fixes: e43eec81c516 ("btrfs: use struct qstr instead of name and namelen pairs") Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 6561a40ceced9082f50c374a22d5966cf9fc5f5c Author: Filipe Manana Date: Wed Jun 18 16:57:07 2025 +0100 btrfs: fix missing error handling when searching for inode refs during log replay During log replay, at __add_inode_ref(), when we are searching for inode ref keys we totally ignore if btrfs_search_slot() returns an error. This may make a log replay succeed when there was an actual error and leave some metadata inconsistency in a subvolume tree. Fix this by checking if an error was returned from btrfs_search_slot() and if so, return it to the caller. Fixes: e02119d5a7b4 ("Btrfs: Add a write ahead tree log to optimize synchronous operations") Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 1e6ed33cabba8f06f532f2e5851a102602823734 Author: Filipe Manana Date: Sat Jun 7 13:43:32 2025 +0100 btrfs: fix failure to rebuild free space tree using multiple transactions If we are rebuilding a free space tree, while modifying the free space tree we may need to allocate a new metadata block group. If we end up using multiple transactions for the rebuild, when we call btrfs_end_transaction() we enter btrfs_create_pending_block_groups() which calls add_block_group_free_space() to add items to the free space tree for the block group. Then later during the free space tree rebuild, at btrfs_rebuild_free_space_tree(), we may find such new block groups and call populate_free_space_tree() for them, which fails with -EEXIST because there are already items in the free space tree. Then we abort the transaction with -EEXIST at btrfs_rebuild_free_space_tree(). Notice that we say "may find" the new block groups because a new block group may be inserted in the block groups rbtree, which is being iterated by the rebuild process, before or after the current node where the rebuild process is currently at. Syzbot recently reported such case which produces a trace like the following: ------------[ cut here ]------------ BTRFS: Transaction aborted (error -17) WARNING: CPU: 1 PID: 7626 at fs/btrfs/free-space-tree.c:1341 btrfs_rebuild_free_space_tree+0x470/0x54c fs/btrfs/free-space-tree.c:1341 Modules linked in: CPU: 1 UID: 0 PID: 7626 Comm: syz.2.25 Not tainted 6.15.0-rc7-syzkaller-00085-gd7fa1af5b33e-dirty #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : btrfs_rebuild_free_space_tree+0x470/0x54c fs/btrfs/free-space-tree.c:1341 lr : btrfs_rebuild_free_space_tree+0x470/0x54c fs/btrfs/free-space-tree.c:1341 sp : ffff80009c4f7740 x29: ffff80009c4f77b0 x28: ffff0000d4c3f400 x27: 0000000000000000 x26: dfff800000000000 x25: ffff70001389eee8 x24: 0000000000000003 x23: 1fffe000182b6e7b x22: 0000000000000000 x21: ffff0000c15b73d8 x20: 00000000ffffffef x19: ffff0000c15b7378 x18: 1fffe0003386f276 x17: ffff80008f31e000 x16: ffff80008adbe98c x15: 0000000000000001 x14: 1fffe0001b281550 x13: 0000000000000000 x12: 0000000000000000 x11: ffff60001b281551 x10: 0000000000000003 x9 : 1c8922000a902c00 x8 : 1c8922000a902c00 x7 : ffff800080485878 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff80008047843c x2 : 0000000000000001 x1 : ffff80008b3ebc40 x0 : 0000000000000001 Call trace: btrfs_rebuild_free_space_tree+0x470/0x54c fs/btrfs/free-space-tree.c:1341 (P) btrfs_start_pre_rw_mount+0xa78/0xe10 fs/btrfs/disk-io.c:3074 btrfs_remount_rw fs/btrfs/super.c:1319 [inline] btrfs_reconfigure+0x828/0x2418 fs/btrfs/super.c:1543 reconfigure_super+0x1d4/0x6f0 fs/super.c:1083 do_remount fs/namespace.c:3365 [inline] path_mount+0xb34/0xde0 fs/namespace.c:4200 do_mount fs/namespace.c:4221 [inline] __do_sys_mount fs/namespace.c:4432 [inline] __se_sys_mount fs/namespace.c:4409 [inline] __arm64_sys_mount+0x3e8/0x468 fs/namespace.c:4409 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 irq event stamp: 330 hardirqs last enabled at (329): [] raw_spin_rq_unlock_irq kernel/sched/sched.h:1525 [inline] hardirqs last enabled at (329): [] finish_lock_switch+0xb0/0x1c0 kernel/sched/core.c:5130 hardirqs last disabled at (330): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:511 softirqs last enabled at (10): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32 softirqs last disabled at (8): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19 ---[ end trace 0000000000000000 ]--- Fix this by flagging new block groups which had their free space tree entries already added and then skip them in the rebuild process. Also, since the rebuild may be triggered when doing a remount, make sure that when we clear an existing free space tree that we clear such flag from every existing block group, otherwise we would skip those block groups during the rebuild. Reported-by: syzbot+d0014fb0fc39c5487ae5@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/68460a54.050a0220.daf97.0af5.GAE@google.com/ Fixes: 882af9f13e83 ("btrfs: handle free space tree rebuild in multiple transactions") Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 1f029b4e30a602db33dedee5ac676e9236ad193c Author: Yang Li Date: Thu Jun 19 11:01:07 2025 +0800 Bluetooth: Prevent unintended pause by checking if advertising is active When PA Create Sync is enabled, advertising resumes unexpectedly. Therefore, it's necessary to check whether advertising is currently active before attempting to pause it. < HCI Command: LE Add Device To... (0x08|0x0011) plen 7 #1345 [hci0] 48.306205 Address type: Random (0x01) Address: 4F:84:84:5F:88:17 (Resolvable) Identity type: Random (0x01) Identity: FC:5B:8C:F7:5D:FB (Static) < HCI Command: LE Set Address Re.. (0x08|0x002d) plen 1 #1347 [hci0] 48.308023 Address resolution: Enabled (0x01) ... < HCI Command: LE Set Extended A.. (0x08|0x0039) plen 6 #1349 [hci0] 48.309650 Extended advertising: Enabled (0x01) Number of sets: 1 (0x01) Entry 0 Handle: 0x01 Duration: 0 ms (0x00) Max ext adv events: 0 ... < HCI Command: LE Periodic Adve.. (0x08|0x0044) plen 14 #1355 [hci0] 48.314575 Options: 0x0000 Use advertising SID, Advertiser Address Type and address Reporting initially enabled SID: 0x02 Adv address type: Random (0x01) Adv address: 4F:84:84:5F:88:17 (Resolvable) Identity type: Random (0x01) Identity: FC:5B:8C:F7:5D:FB (Static) Skip: 0x0000 Sync timeout: 20000 msec (0x07d0) Sync CTE type: 0x0000 Fixes: ad383c2c65a5 ("Bluetooth: hci_sync: Enable advertising when LL privacy is enabled") Signed-off-by: Yang Li Signed-off-by: Luiz Augusto von Dentz commit 96de8f85203147e3d1e646da891307fa3e462c32 Author: Bharadwaj Raju Date: Fri Jun 27 22:11:29 2025 +0530 bcachefs: mark invalid_btree_id autofix Checking for invalid IDs was introduced in 9e7cfb35e266 ("bcachefs: Check for invalid btree IDs") to prevent an invalid shift later, but since 141526548052 ("bcachefs: Bad btree roots are now autofix") which made btree_root_bkey_invalid autofix, the fsck_err_on call didn't do anything. We can mark this err type (invalid_btree_id) autofix as well, so it gets handled. Reported-by: syzbot+029d1989099aa5ae3e89@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=029d1989099aa5ae3e89 Fixes: 141526548052 ("bcachefs: Bad btree roots are now autofix") Signed-off-by: Bharadwaj Raju Signed-off-by: Kent Overstreet commit e540341508ce2f6e27810106253d5de194b66750 Merge: 0a47e02d8a283a c007062188d8e4 Author: Linus Torvalds Date: Fri Jun 27 09:02:33 2025 -0700 Merge tag 'block-6.16-20250626' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: - Fixes for ublk: - fix C++ narrowing warnings in the uapi header - update/improve UBLK_F_SUPPORT_ZERO_COPY comment in uapi header - fix for the ublk ->queue_rqs() implementation, limiting a batch to just the specific task AND ring - ublk_get_data() error handling fix - sanity check more arguments in ublk_ctrl_add_dev() - selftest addition - NVMe pull request via Christoph: - reset delayed remove_work after reconnect - fix atomic write size validation - Fix for a warning introduced in bdev_count_inflight_rw() in this merge window * tag 'block-6.16-20250626' of git://git.kernel.dk/linux: block: fix false warning in bdev_count_inflight_rw() ublk: sanity check add_dev input for underflow nvme: fix atomic write size validation nvme: refactor the atomic write unit detection nvme: reset delayed remove_work after reconnect ublk: setup ublk_io correctly in case of ublk_get_data() failure ublk: update UBLK_F_SUPPORT_ZERO_COPY comment in UAPI header ublk: fix narrowing warnings in UAPI header selftests: ublk: don't take same backing file for more than one ublk devices ublk: build batch from IOs in same io_ring_ctx and io task commit 0a47e02d8a283a99592876556b9d42e087525828 Merge: 9c7331f150549d 178b8ff66ff827 Author: Linus Torvalds Date: Fri Jun 27 08:55:57 2025 -0700 Merge tag 'io_uring-6.16-20250626' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: - Two tweaks for a recent fix: fixing a memory leak if multiple iovecs were initially mapped but only the first was used and hence turned into a UBUF rathan than an IOVEC iterator, and catching a case where a retry would be done even if the previous segment wasn't full - Small series fixing an issue making the vm unhappy if debugging is turned on, hitting a VM_BUG_ON_PAGE() - Fix a resource leak in io_import_dmabuf() in the error handling case, which is a regression in this merge window - Mark fallocate as needing to be write serialized, as is already done for truncate and buffered writes * tag 'io_uring-6.16-20250626' of git://git.kernel.dk/linux: io_uring/kbuf: flag partial buffer mappings io_uring/net: mark iov as dynamically allocated even for single segments io_uring: fix resource leak in io_import_dmabuf() io_uring: don't assume uaddr alignment in io_vec_fill_bvec io_uring/rsrc: don't rely on user vaddr alignment io_uring/rsrc: fix folio unpinning io_uring: make fallocate be hashed work commit 9c7331f150549d3c724051aa11c5dcb51bf3aa99 Merge: 51df97f90002cb 3e0809b1664b9d Author: Linus Torvalds Date: Fri Jun 27 08:30:37 2025 -0700 Merge tag 'ata-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata fix from Niklas Cassel: - Use the correct DMI identifier for ASUSPRO-D840SA LPM quirk such that the quirk actually gets applied (me) * tag 'ata-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk commit 51df97f90002cb055e966189bd46d831af69e155 Merge: 9c2f970518c900 7f8073cfb04a97 Author: Linus Torvalds Date: Fri Jun 27 08:26:25 2025 -0700 Merge tag 's390-6.16-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Alexander Gordeev: - Fix incorrectly dropped dereferencing of the stack nth entry introduced with a previous KASAN false positive fix - Use a proper memdup_array_user() helper to prevent overflow in a protected key size calculation * tag 's390-6.16-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/ptrace: Fix pointer dereferencing in regs_get_kernel_stack_nth() s390/pkey: Prevent overflow in size calculation for memdup_user() commit 9c2f970518c900821acdac47bbd681b99a325e3d Merge: 67a993863163cb 7ab6847a03229e Author: Linus Torvalds Date: Fri Jun 27 08:21:05 2025 -0700 Merge tag 'sound-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes again: - A regression fix for hibernation bug in ASoC SoundWire - Fixes for the new Qualcomm USB offload stuff - A potential OOB access fix in USB-audio - A potential memleadk fix in ASoC Intel - Quirks for HD-audio and ASoC AMD ACP" * tag 'sound-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR ALSA: usb: qcom: fix NULL pointer dereference in qmi_stop_session ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. ASoC: rt721-sdca: fix boost gain calculation error ALSA: qc_audio_offload: Fix missing error code in prepare_qmi_response() ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 6 G1a ASoC: amd: ps: fix for soundwire failures during hibernation exit sequence ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic ASoC: qcom: sm8250: Fix possibly undefined reference ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 ALSA: hda/realtek: Add quirks for some Clevo laptops commit 615cc4223fcbe1e0e6f68b8494b26bb6c08d917a Author: Thomas Zimmermann Date: Tue Jun 17 16:09:34 2025 +0200 drm/vesadrm: Avoid NULL-ptr deref in vesadrm_pmi_cmap_write() Only set PMI fields if the screen_info's Vesa PM segment has been set. Vesa PMI is the power-management interface. It also provides means to set the color palette. The interface is optional, so not all VESA graphics cards support it. Print vesafb's warning [1] if the hardware palette cannot be set at all. If unsupported the field PrimaryPalette in struct vesadrm.pmi is NULL, which results in a segmentation fault. Happens with qemu's Cirrus emulation. Signed-off-by: Thomas Zimmermann Fixes: 814d270b31d2 ("drm/sysfb: vesadrm: Add gamma correction") Link: https://elixir.bootlin.com/linux/v6.15/source/drivers/video/fbdev/vesafb.c#L375 # 1 Cc: Thomas Zimmermann Cc: Javier Martinez Canillas Cc: dri-devel@lists.freedesktop.org Acked-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20250617140944.142392-1-tzimmermann@suse.de commit 7b5f775be14ac1532c049022feadcfe44769566d Author: Dave Chinner Date: Thu Jun 26 08:49:00 2025 +1000 xfs: fix unmount hang with unflushable inodes stuck in the AIL Unmount of a shutdown filesystem can hang with stale inode cluster buffers in the AIL like so: [95964.140623] Call Trace: [95964.144641] __schedule+0x699/0xb70 [95964.154003] schedule+0x64/0xd0 [95964.156851] xfs_ail_push_all_sync+0x9b/0xf0 [95964.164816] xfs_unmount_flush_inodes+0x41/0x70 [95964.168698] xfs_unmountfs+0x7f/0x170 [95964.171846] xfs_fs_put_super+0x3b/0x90 [95964.175216] generic_shutdown_super+0x77/0x160 [95964.178060] kill_block_super+0x1b/0x40 [95964.180553] xfs_kill_sb+0x12/0x30 [95964.182796] deactivate_locked_super+0x38/0x100 [95964.185735] deactivate_super+0x41/0x50 [95964.188245] cleanup_mnt+0x9f/0x160 [95964.190519] __cleanup_mnt+0x12/0x20 [95964.192899] task_work_run+0x89/0xb0 [95964.195221] resume_user_mode_work+0x4f/0x60 [95964.197931] syscall_exit_to_user_mode+0x76/0xb0 [95964.201003] do_syscall_64+0x74/0x130 $ pstree -N mnt |grep umount |-check-parallel---nsexec---run_test.sh---753---umount It always seems to be generic/753 that triggers this, and repeating a quick group test run triggers it every 10-15 iterations. Hence it generally triggers once up every 30-40 minutes of test time. just running generic/753 by itself or concurrently with a limited group of tests doesn't reproduce this issue at all. Tracing on a hung system shows the AIL repeating every 50ms a log force followed by an attempt to push pinned, aborted inodes from the AIL (trimmed for brevity): xfs_log_force: lsn 0x1c caller xfsaild+0x18e xfs_log_force: lsn 0x0 caller xlog_cil_flush+0xbd xfs_log_force: lsn 0x1c caller xfs_log_force+0x77 xfs_ail_pinned: lip 0xffff88826014afa0 lsn 1/37472 type XFS_LI_INODE flags IN_AIL|ABORTED xfs_ail_pinned: lip 0xffff88814000a708 lsn 1/37472 type XFS_LI_INODE flags IN_AIL|ABORTED xfs_ail_pinned: lip 0xffff88810b850c80 lsn 1/37472 type XFS_LI_INODE flags IN_AIL|ABORTED xfs_ail_pinned: lip 0xffff88810b850af0 lsn 1/37472 type XFS_LI_INODE flags IN_AIL|ABORTED xfs_ail_pinned: lip 0xffff888165cf0a28 lsn 1/37472 type XFS_LI_INODE flags IN_AIL|ABORTED xfs_ail_pinned: lip 0xffff88810b850bb8 lsn 1/37472 type XFS_LI_INODE flags IN_AIL|ABORTED .... The inode log items are marked as aborted, which means that either: a) a transaction commit has occurred, seen an error or shutdown, and called xfs_trans_free_items() to abort the items. This should happen before any pinning of log items occurs. or b) a dirty transaction has been cancelled. This should also happen before any pinning of log items occurs. or c) AIL insertion at journal IO completion is marked as aborted. In this case, the log item is pinned by the CIL until journal IO completes and hence needs to be unpinned. This is then done after the ->iop_committed() callback is run, so the pin count should be balanced correctly. Yet none of these seemed to be occurring. Further tracing indicated this: d) Shutdown during CIL pushing resulting in log item completion being called from checkpoint abort processing. Items are unpinned and released without serialisation against each other, journal IO completion or transaction commit completion. In this case, we may still have a transaction commit in flight that holds a reference to a xfs_buf_log_item (BLI) after CIL insertion. e.g. a synchronous transaction will flush the CIL before the transaction is torn down. The concurrent CIL push then aborts insertion it and drops the commit/AIL reference to the BLI. This can leave the transaction commit context with the last reference to the BLI which is dropped here: xfs_trans_free_items() ->iop_release xfs_buf_item_release xfs_buf_item_put if (XFS_LI_ABORTED) xfs_trans_ail_delete xfs_buf_item_relse() Unlike the journal completion ->iop_unpin path, this path does not run stale buffer completion process when it drops the last reference, hence leaving the stale inodes attached to the buffer sitting the AIL. There are no other references to those inodes, so there is no other mechanism to remove them from the AIL. Hence unmount hangs. The buffer lock context for stale buffers is passed to the last BLI reference. This is normally the last BLI unpin on journal IO completion. The unpin then processes the stale buffer completion and releases the buffer lock. However, if the final unpin from journal IO completion (or CIL push abort) does not hold the last reference to the BLI, there -must- still be a transaction context that references the BLI, and so that context must perform the stale buffer completion processing before the buffer is unlocked and the BLI torn down. The fix for this is to rework the xfs_buf_item_relse() path to run stale buffer completion processing if it drops the last reference to the BLI. We still hold the buffer locked, so the buffer owner and lock context is the same as if we passed the BLI and buffer to the ->iop_unpin() context to finish stale process on journal commit. However, we have to be careful here. In a shutdown state, we can be freeing dirty BLIs from xfs_buf_item_put() via xfs_trans_brelse() and xfs_trans_bdetach(). The existing code handles this case by considering shutdown state as "aborted", but in doing so largely masks the failure to clean up stale BLI state from the xfs_buf_item_relse() path. i.e regardless of the shutdown state and whether the item is in the AIL, we must finish the stale buffer cleanup if we are are dropping the last BLI reference from the ->iop_relse path in transaction commit context. Signed-off-by: Dave Chinner Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit 816c330b605c3f4813c0dc0ab5af5cce17ff06b3 Author: Dave Chinner Date: Thu Jun 26 08:48:59 2025 +1000 xfs: factor out stale buffer item completion The stale buffer item completion handling is currently only done from BLI unpinning. We need to perform this function from where-ever the last reference to the BLI is dropped, so first we need to factor this code out into a helper. Signed-off-by: Dave Chinner Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit d2fe5c4c8d25999862d615f616aea7befdd62799 Author: Dave Chinner Date: Thu Jun 26 08:48:58 2025 +1000 xfs: rearrange code in xfs_buf_item.c The code to initialise, release and free items is all the way down the bottom of the file. Upcoming fixes need to these functions earlier in the file, so move them to the top. There is one code change in this move - the parameter to xfs_buf_item_relse() is changed from the xfs_buf to the xfs_buf_log_item - the thing that the function is releasing. Signed-off-by: Dave Chinner Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit fc48627b9c22f4d18651ca72ba171952d7a26004 Author: Dave Chinner Date: Thu Jun 26 08:48:57 2025 +1000 xfs: add tracepoints for stale pinned inode state debug I needed more insight into how stale inodes were getting stuck on the AIL after a forced shutdown when running fsstress. These are the tracepoints I added for that purpose. Signed-off-by: Dave Chinner Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit d62016b1a2df24c8608fe83cd3ae8090412881b3 Author: Dave Chinner Date: Thu Jun 26 08:48:56 2025 +1000 xfs: avoid dquot buffer pin deadlock On shutdown when quotas are enabled, the shutdown can deadlock trying to unpin the dquot buffer buf_log_item like so: [ 3319.483590] task:kworker/20:0H state:D stack:14360 pid:1962230 tgid:1962230 ppid:2 task_flags:0x4208060 flags:0x00004000 [ 3319.493966] Workqueue: xfs-log/dm-6 xlog_ioend_work [ 3319.498458] Call Trace: [ 3319.500800] [ 3319.502809] __schedule+0x699/0xb70 [ 3319.512672] schedule+0x64/0xd0 [ 3319.515573] schedule_timeout+0x30/0xf0 [ 3319.528125] __down_common+0xc3/0x200 [ 3319.531488] __down+0x1d/0x30 [ 3319.534186] down+0x48/0x50 [ 3319.540501] xfs_buf_lock+0x3d/0xe0 [ 3319.543609] xfs_buf_item_unpin+0x85/0x1b0 [ 3319.547248] xlog_cil_committed+0x289/0x570 [ 3319.571411] xlog_cil_process_committed+0x6d/0x90 [ 3319.575590] xlog_state_shutdown_callbacks+0x52/0x110 [ 3319.580017] xlog_force_shutdown+0x169/0x1a0 [ 3319.583780] xlog_ioend_work+0x7c/0xb0 [ 3319.587049] process_scheduled_works+0x1d6/0x400 [ 3319.591127] worker_thread+0x202/0x2e0 [ 3319.594452] kthread+0x20c/0x240 The CIL push has seen the deadlock, so it has aborted the push and is running CIL checkpoint completion to abort all the items in the checkpoint. This calls ->iop_unpin(remove = true) to clean up the log items in the checkpoint. When a buffer log item is unpined like this, it needs to lock the buffer to run io completion to correctly fail the buffer and run all the required completions to fail attached log items as well. In this case, the attempt to lock the buffer on unpin is hanging because the buffer is already locked. I suspected a leaked XFS_BLI_HOLD state because of XFS_BLI_STALE handling changes I was testing, so I went looking for pin events on HOLD buffers and unpin events on locked buffer. That isolated this one buffer with these two events: xfs_buf_item_pin: dev 251:6 daddr 0xa910 bbcount 0x2 hold 2 pincount 0 lock 0 flags DONE|KMEM recur 0 refcount 1 bliflags HOLD|DIRTY|LOGGED liflags DIRTY .... xfs_buf_item_unpin: dev 251:6 daddr 0xa910 bbcount 0x2 hold 4 pincount 1 lock 0 flags DONE|KMEM recur 0 refcount 1 bliflags DIRTY liflags ABORTED Firstly, bbcount = 0x2, which means it is not a single sector structure. That rules out every xfs_trans_bhold() case except one: dquot buffers. Then hung task dumping gave this trace: [ 3197.312078] task:fsync-tester state:D stack:12080 pid:2051125 tgid:2051125 ppid:1643233 task_flags:0x400000 flags:0x00004002 [ 3197.323007] Call Trace: [ 3197.325581] [ 3197.327727] __schedule+0x699/0xb70 [ 3197.334582] schedule+0x64/0xd0 [ 3197.337672] schedule_timeout+0x30/0xf0 [ 3197.350139] wait_for_completion+0xbd/0x180 [ 3197.354235] __flush_workqueue+0xef/0x4e0 [ 3197.362229] xlog_cil_force_seq+0xa0/0x300 [ 3197.374447] xfs_log_force+0x77/0x230 [ 3197.378015] xfs_qm_dqunpin_wait+0x49/0xf0 [ 3197.382010] xfs_qm_dqflush+0x55/0x460 [ 3197.385663] xfs_qm_dquot_isolate+0x29e/0x4d0 [ 3197.389977] __list_lru_walk_one+0x141/0x220 [ 3197.398867] list_lru_walk_one+0x10/0x20 [ 3197.402713] xfs_qm_shrink_scan+0x6a/0x100 [ 3197.406699] do_shrink_slab+0x18a/0x350 [ 3197.410512] shrink_slab+0xf7/0x430 [ 3197.413967] drop_slab+0x97/0xf0 [ 3197.417121] drop_caches_sysctl_handler+0x59/0xc0 [ 3197.421654] proc_sys_call_handler+0x18b/0x280 [ 3197.426050] proc_sys_write+0x13/0x20 [ 3197.429750] vfs_write+0x2b8/0x3e0 [ 3197.438532] ksys_write+0x7e/0xf0 [ 3197.441742] __x64_sys_write+0x1b/0x30 [ 3197.445363] x64_sys_call+0x2c72/0x2f60 [ 3197.449044] do_syscall_64+0x6c/0x140 [ 3197.456341] entry_SYSCALL_64_after_hwframe+0x76/0x7e Yup, another test run by check-parallel is running drop_caches concurrently and the dquot shrinker for the hung filesystem is running. That's trying to flush a dirty dquot from reclaim context, and it waiting on a log force to complete. xfs_qm_dqflush is called with the dquot buffer held locked, and so we've called xfs_log_force() with that buffer locked. Now the log force is waiting for a workqueue flush to complete, and that workqueue flush is waiting of CIL checkpoint processing to finish. The CIL checkpoint processing is aborting all the log items it has, and that requires locking aborted buffers to cancel them. Now, normally this isn't a problem if we are issuing a log force to unpin an object, because the ->iop_unpin() method wakes pin waiters first. That results in the pin waiter finishing off whatever it was doing, dropping the lock and then xfs_buf_item_unpin() can lock the buffer and fail it. However, xfs_qm_dqflush() is waiting on the -dquot- unpin event, not the dquot buffer unpin event, and so it never gets woken and so does not drop the buffer lock. Inodes do not have this problem, as they can only be written from one spot (->iop_push) whilst dquots can be written from multiple places (memory reclaim, ->iop_push, xfs_dq_dqpurge, and quotacheck). The reason that the dquot buffer has an attached buffer log item is that it has been recently allocated. Initialisation of the dquot buffer logs the buffer directly, thereby pinning it in memory. We then modify the dquot in a separate operation, and have memory reclaim racing with a shutdown and we trigger this deadlock. check-parallel reproduces this reliably on 1kB FSB filesystems with quota enabled because it does all of these things concurrently without having to explicitly write tests to exercise these corner case conditions. xfs_qm_dquot_logitem_push() doesn't have this deadlock because it checks if the dquot is pinned before locking the dquot buffer and skipping it if it is pinned. This means the xfs_qm_dqunpin_wait() log force in xfs_qm_dqflush() never triggers and we unlock the buffer safely allowing a concurrent shutdown to fail the buffer appropriately. xfs_qm_dqpurge() could have this problem as it is called from quotacheck and we might have allocated dquot buffers when recording the quota updates. This can be fixed by calling xfs_qm_dqunpin_wait() before we lock the dquot buffer. Because we hold the dquot locked, nothing will be able to add to the pin count between the unpin_wait and the dqflush callout, so this now makes xfs_qm_dqpurge() safe against this race. xfs_qm_dquot_isolate() can also be fixed this same way but, quite frankly, we shouldn't be doing IO in memory reclaim context. If the dquot is pinned or dirty, simply rotate it and let memory reclaim come back to it later, same as we do for inodes. This then gets rid of the nasty issue in xfs_qm_flush_one() where quotacheck writeback races with memory reclaim flushing the dquots. We can lift xfs_qm_dqunpin_wait() up into this code, then get rid of the "can't get the dqflush lock" buffer write to cycle the dqlfush lock and enable it to be flushed again. checking if the dquot is pinned and returning -EAGAIN so that the dquot walk will revisit the dquot again later. Finally, with xfs_qm_dqunpin_wait() lifted into all the callers, we can remove it from the xfs_qm_dqflush() code. Signed-off-by: Dave Chinner Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit db6a2274162de615ff74b927d38942fe3134d298 Author: Dave Chinner Date: Thu Jun 26 08:48:55 2025 +1000 xfs: catch stale AGF/AGF metadata There is a race condition that can trigger in dmflakey fstests that can result in asserts in xfs_ialloc_read_agi() and xfs_alloc_read_agf() firing. The asserts look like this: XFS: Assertion failed: pag->pagf_freeblks == be32_to_cpu(agf->agf_freeblks), file: fs/xfs/libxfs/xfs_alloc.c, line: 3440 ..... Call Trace: xfs_alloc_read_agf+0x2ad/0x3a0 xfs_alloc_fix_freelist+0x280/0x720 xfs_alloc_vextent_prepare_ag+0x42/0x120 xfs_alloc_vextent_iterate_ags+0x67/0x260 xfs_alloc_vextent_start_ag+0xe4/0x1c0 xfs_bmapi_allocate+0x6fe/0xc90 xfs_bmapi_convert_delalloc+0x338/0x560 xfs_map_blocks+0x354/0x580 iomap_writepages+0x52b/0xa70 xfs_vm_writepages+0xd7/0x100 do_writepages+0xe1/0x2c0 __writeback_single_inode+0x44/0x340 writeback_sb_inodes+0x2d0/0x570 __writeback_inodes_wb+0x9c/0xf0 wb_writeback+0x139/0x2d0 wb_workfn+0x23e/0x4c0 process_scheduled_works+0x1d4/0x400 worker_thread+0x234/0x2e0 kthread+0x147/0x170 ret_from_fork+0x3e/0x50 ret_from_fork_asm+0x1a/0x30 I've seen the AGI variant from scrub running on the filesysetm after unmount failed due to systemd interference: XFS: Assertion failed: pag->pagi_freecount == be32_to_cpu(agi->agi_freecount) || xfs_is_shutdown(pag->pag_mount), file: fs/xfs/libxfs/xfs_ialloc.c, line: 2804 ..... Call Trace: xfs_ialloc_read_agi+0xee/0x150 xchk_perag_drain_and_lock+0x7d/0x240 xchk_ag_init+0x34/0x90 xchk_inode_xref+0x7b/0x220 xchk_inode+0x14d/0x180 xfs_scrub_metadata+0x2e2/0x510 xfs_ioc_scrub_metadata+0x62/0xb0 xfs_file_ioctl+0x446/0xbf0 __se_sys_ioctl+0x6f/0xc0 __x64_sys_ioctl+0x1d/0x30 x64_sys_call+0x1879/0x2ee0 do_syscall_64+0x68/0x130 ? exc_page_fault+0x62/0xc0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Essentially, it is the same problem. When _flakey_drop_and_remount() loads the drop-writes table, it makes all writes silently fail. Writes are reported to the fs as completed successfully, but they are not issued to the backing store. The filesystem sees the successful write completion and marks the metadata buffer clean and removes it from the AIL. If this happens at the same time as memory pressure is occuring, the now-clean AGF and/or AGI buffers can be reclaimed from memory. Shortly afterwards, but before _flakey_drop_and_remount() runs unmount, background writeback is kicked and it tries to allocate blocks for the dirty pages in memory. This then tries to access the AGF buffer we just turfed out of memory. It's not found, so it gets read in from disk. This is all fine, except for the fact that the last writeback of the AGF did not actually reach disk. The AGF on disk is stale compared to the in-memory state held by the perag, and so they don't match and the assert fires. Then other operations on that inode hang because the task was killed whilst holding inode locks. e.g: Workqueue: xfs-conv/dm-12 xfs_end_io Call Trace: __schedule+0x650/0xb10 schedule+0x6d/0xf0 schedule_preempt_disabled+0x15/0x30 rwsem_down_write_slowpath+0x31a/0x5f0 down_write+0x43/0x60 xfs_ilock+0x1a8/0x210 xfs_trans_alloc_inode+0x9c/0x240 xfs_iomap_write_unwritten+0xe3/0x300 xfs_end_ioend+0x90/0x130 xfs_end_io+0xce/0x100 process_scheduled_works+0x1d4/0x400 worker_thread+0x234/0x2e0 kthread+0x147/0x170 ret_from_fork+0x3e/0x50 ret_from_fork_asm+0x1a/0x30 and it's all down hill from there. Memory pressure is one way to trigger this, another is to run "echo 3 > /proc/sys/vm/drop_caches" randomly while tests are running. Regardless of how it is triggered, this effectively takes down the system once umount hangs because it's holding a sb->s_umount lock exclusive and now every sync(1) call gets stuck on it. Fix this by replacing the asserts with a corruption detection check and a shutdown. Signed-off-by: Dave Chinner Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit 09234a632be42573d9743ac5ff6773622d233ad0 Author: Dave Chinner Date: Thu Jun 26 08:48:54 2025 +1000 xfs: xfs_ifree_cluster vs xfs_iflush_shutdown_abort deadlock Lock order of xfs_ifree_cluster() is cluster buffer -> try ILOCK -> IFLUSHING, except for the last inode in the cluster that is triggering the free. In that case, the lock order is ILOCK -> cluster buffer -> IFLUSHING. xfs_iflush_cluster() uses cluster buffer -> try ILOCK -> IFLUSHING, so this can safely run concurrently with xfs_ifree_cluster(). xfs_inode_item_precommit() uses ILOCK -> cluster buffer, but this cannot race with xfs_ifree_cluster() so being in a different order will not trigger a deadlock. xfs_reclaim_inode() during a filesystem shutdown uses ILOCK -> IFLUSHING -> cluster buffer via xfs_iflush_shutdown_abort(), and this deadlocks against xfs_ifree_cluster() like so: sysrq: Show Blocked State task:kworker/10:37 state:D stack:12560 pid:276182 tgid:276182 ppid:2 flags:0x00004000 Workqueue: xfs-inodegc/dm-3 xfs_inodegc_worker Call Trace: __schedule+0x650/0xb10 schedule+0x6d/0xf0 schedule_timeout+0x8b/0x180 schedule_timeout_uninterruptible+0x1e/0x30 xfs_ifree+0x326/0x730 xfs_inactive_ifree+0xcb/0x230 xfs_inactive+0x2c8/0x380 xfs_inodegc_worker+0xaa/0x180 process_scheduled_works+0x1d4/0x400 worker_thread+0x234/0x2e0 kthread+0x147/0x170 ret_from_fork+0x3e/0x50 ret_from_fork_asm+0x1a/0x30 task:fsync-tester state:D stack:12160 pid:2255943 tgid:2255943 ppid:3988702 flags:0x00004006 Call Trace: __schedule+0x650/0xb10 schedule+0x6d/0xf0 schedule_timeout+0x31/0x180 __down_common+0xbe/0x1f0 __down+0x1d/0x30 down+0x48/0x50 xfs_buf_lock+0x3d/0xe0 xfs_iflush_shutdown_abort+0x51/0x1e0 xfs_icwalk_ag+0x386/0x690 xfs_reclaim_inodes_nr+0x114/0x160 xfs_fs_free_cached_objects+0x19/0x20 super_cache_scan+0x17b/0x1a0 do_shrink_slab+0x180/0x350 shrink_slab+0xf8/0x430 drop_slab+0x97/0xf0 drop_caches_sysctl_handler+0x59/0xc0 proc_sys_call_handler+0x189/0x280 proc_sys_write+0x13/0x20 vfs_write+0x33d/0x3f0 ksys_write+0x7c/0xf0 __x64_sys_write+0x1b/0x30 x64_sys_call+0x271d/0x2ee0 do_syscall_64+0x68/0x130 entry_SYSCALL_64_after_hwframe+0x76/0x7e We can't change the lock order of xfs_ifree_cluster() - XFS_ISTALE and XFS_IFLUSHING are serialised through to journal IO completion by the cluster buffer lock being held. There's quite a few asserts in the code that check that XFS_ISTALE does not occur out of sync with buffer locking (e.g. in xfs_iflush_cluster). There's also a dependency on the inode log item being removed from the buffer before XFS_IFLUSHING is cleared, also with asserts that trigger on this. Further, we don't have a requirement for the inode to be locked when completing or aborting inode flushing because all the inode state updates are serialised by holding the cluster buffer lock across the IO to completion. We can't check for XFS_IRECLAIM in xfs_ifree_mark_inode_stale() and skip the inode, because there is no guarantee that the inode will be reclaimed. Hence it *must* be marked XFS_ISTALE regardless of whether reclaim is preparing to free that inode. Similarly, we can't check for IFLUSHING before locking the inode because that would result in dirty inodes not being marked with ISTALE in the event of racing with XFS_IRECLAIM. Hence we have to address this issue from the xfs_reclaim_inode() side. It is clear that we cannot hold the inode locked here when calling xfs_iflush_shutdown_abort() because it is the inode->buffer lock order that causes the deadlock against xfs_ifree_cluster(). Hence we need to drop the ILOCK before aborting the inode in the shutdown case. Once we've aborted the inode, we can grab the ILOCK again and then immediately reclaim it as it is now guaranteed to be clean. Note that dropping the ILOCK in xfs_reclaim_inode() means that it can now be locked by xfs_ifree_mark_inode_stale() and seen whilst in this state. This is safe because we have left the XFS_IFLUSHING flag on the inode and so xfs_ifree_mark_inode_stale() will simply set XFS_ISTALE and move to the next inode. An ASSERT check in this path needs to be tweaked to take into account this new shutdown interaction. Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit 5f6e3b720694ad771911f637a51930f511427ce1 Author: Yazen Ghannam Date: Tue Jun 24 14:15:59 2025 +0000 x86/mce/amd: Fix threshold limit reset The MCA threshold limit must be reset after servicing the interrupt. Currently, the restart function doesn't have an explicit check for this. It makes some assumptions based on the current limit and what's in the registers. These assumptions don't always hold, so the limit won't be reset in some cases. Make the reset condition explicit. Either an interrupt/overflow has occurred or the bank is being initialized. Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Cc: stable@vger.kernel.org Link: https://lore.kernel.org/20250624-wip-mca-updates-v4-4-236dd74f645f@amd.com commit d66e1e90b16055d2f0ee76e5384e3f119c3c2773 Author: Yazen Ghannam Date: Tue Jun 24 14:15:58 2025 +0000 x86/mce/amd: Add default names for MCA banks and blocks Ensure that sysfs init doesn't fail for new/unrecognized bank types or if a bank has additional blocks available. Most MCA banks have a single thresholding block, so the block takes the same name as the bank. Unified Memory Controllers (UMCs) are a special case where there are two blocks and each has a unique name. However, the microarchitecture allows for five blocks. Any new MCA bank types with more than one block will be missing names for the extra blocks. The MCE sysfs will fail to initialize in this case. Fixes: 87a6d4091bd7 ("x86/mce/AMD: Update sysfs bank names for SMCA systems") Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Cc: stable@vger.kernel.org Link: https://lore.kernel.org/20250624-wip-mca-updates-v4-3-236dd74f645f@amd.com commit 00c092de6f28ebd32208aef83b02d61af2229b60 Author: Yazen Ghannam Date: Tue Jun 24 14:15:57 2025 +0000 x86/mce: Ensure user polling settings are honored when restarting timer Users can disable MCA polling by setting the "ignore_ce" parameter or by setting "check_interval=0". This tells the kernel to *not* start the MCE timer on a CPU. If the user did not disable CMCI, then storms can occur. When these happen, the MCE timer will be started with a fixed interval. After the storm subsides, the timer's next interval is set to check_interval. This disregards the user's input through "ignore_ce" and "check_interval". Furthermore, if "check_interval=0", then the new timer will run faster than expected. Create a new helper to check these conditions and use it when a CMCI storm ends. [ bp: Massage. ] Fixes: 7eae17c4add5 ("x86/mce: Add per-bank CMCI storm mitigation") Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Cc: stable@vger.kernel.org Link: https://lore.kernel.org/20250624-wip-mca-updates-v4-2-236dd74f645f@amd.com commit f40213cd93e608ee78b5e25db042c42ec07139fe Author: Johannes Berg Date: Fri Jun 6 09:56:52 2025 +0200 i2c: scx200_acb: depends on HAS_IOPORT It already depends on X86_32, but that's also set for ARCH=um. Recent changes made UML no longer have IO port access since it's not needed, but this driver uses it. Build it only for HAS_IOPORT. This is pretty much the same as depending on X86, but on the off-chance that HAS_IOPORT will ever be optional on x86 HAS_IOPORT is the real prerequisite. Signed-off-by: Johannes Berg Signed-off-by: Wolfram Sang commit 955853cf83657faa58572ef3f08b44f0f88885c1 Author: Bibo Mao Date: Fri Jun 27 18:27:44 2025 +0800 LoongArch: KVM: Disable updating of "num_cpu" and "feature" Property "num_cpu" and "feature" are read-only once eiointc is created, which are set with KVM_DEV_LOONGARCH_EXTIOI_GRP_CTRL attr group before device creation. Attr group KVM_DEV_LOONGARCH_EXTIOI_GRP_SW_STATUS is to update register and software state for migration and reset usage, property "num_cpu" and "feature" can not be update again if it is created already. Here discard write operation with property "num_cpu" and "feature" in attr group KVM_DEV_LOONGARCH_EXTIOI_GRP_CTRL. Cc: stable@vger.kernel.org Fixes: 1ad7efa552fd ("LoongArch: KVM: Add EIOINTC user mode read and write functions") Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit cc8d5b209e09d3b52bca1ffe00045876842d96ae Author: Bibo Mao Date: Fri Jun 27 18:27:44 2025 +0800 LoongArch: KVM: Check validity of "num_cpu" from user space The maximum supported cpu number is EIOINTC_ROUTE_MAX_VCPUS about irqchip EIOINTC, here add validation about cpu number to avoid array pointer overflow. Cc: stable@vger.kernel.org Fixes: 1ad7efa552fd ("LoongArch: KVM: Add EIOINTC user mode read and write functions") Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 45515c643d0abb75c2cc760a6bc6b235eadafd66 Author: Bibo Mao Date: Fri Jun 27 18:27:44 2025 +0800 LoongArch: KVM: Check interrupt route from physical CPU With EIOINTC interrupt controller, physical CPU ID is set for irq route. However the function kvm_get_vcpu() is used to get destination vCPU when delivering irq. With API kvm_get_vcpu(), the logical CPU ID is used. With API kvm_get_vcpu_by_cpuid(), vCPU ID can be searched from physical CPU ID. Cc: stable@vger.kernel.org Fixes: 3956a52bc05b ("LoongArch: KVM: Add EIOINTC read and write functions") Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit c34bbc2c990700ba07b271fc7c8113b0bc3e4093 Author: Bibo Mao Date: Fri Jun 27 18:27:44 2025 +0800 LoongArch: KVM: Fix interrupt route update with EIOINTC With function eiointc_update_sw_coremap(), there is forced assignment like val = *(u64 *)pvalue. Parameter pvalue may be pointer to char type or others, there is problem with forced assignment with u64 type. Here the detailed value is passed rather address pointer. Cc: stable@vger.kernel.org Fixes: 3956a52bc05b ("LoongArch: KVM: Add EIOINTC read and write functions") Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 9159c5e733cfa35ec863fa81960a3e7435f831fb Author: Bibo Mao Date: Fri Jun 27 18:27:44 2025 +0800 LoongArch: KVM: Add address alignment check for IOCSR emulation IOCSR instruction supports 1/2/4/8 bytes access, the address should be naturally aligned with its access size. Here address alignment check is added in the EIOINTC kernel emulation. Cc: stable@vger.kernel.org Fixes: 3956a52bc05b ("LoongArch: KVM: Add EIOINTC read and write functions") Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 48e29133ae880a8f30ff098a9843d22e012350e0 Merge: 86731a2a651e58 666c23af755dcc Author: Wolfram Sang Date: Fri Jun 27 11:58:27 2025 +0200 Merge tag 'i2c-host-fixes-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current i2c-host fixes for v6.16-rc4 - imx: fix SMBus protocol compliance during block read - omap: fix error handling path in probe - robotfuzz, tiny-usb: prevent zero-length reads - x86, designware, amdisp: fix build error when modules are disabled commit f6faebc11a8a6d9521e5ab00481bd22ed9c7c67d Author: Maxime Ripard Date: Thu Jun 26 12:05:03 2025 +0200 drm/panel: panel-simple: get rid of panel_dpi hack The empty panel_dpi struct was only ever used as a discriminant, but it's kind of a hack, and with the reworks done in the previous patches, we shouldn't need it anymore. Let's get rid of it. Reviewed-by: Javier Martinez Canillas Tested-by: Francesco Dolcini # Toradex Colibri iMX6 Link: https://lore.kernel.org/r/20250626-drm-panel-simple-fixes-v2-5-5afcaa608bdc@kernel.org Signed-off-by: Maxime Ripard commit 47c08262f34e1cd9c48364431e4d32529029b910 Author: Maxime Ripard Date: Thu Jun 26 12:05:02 2025 +0200 drm/panel: panel-simple: Add function to look panel data up Commit de04bb0089a9 ("drm/panel/panel-simple: Use the new allocation in place of devm_kzalloc()") moved the call to drm_panel_init into the devm_drm_panel_alloc(), which needs a connector type to initialize properly. In the panel-dpi compatible case, the passed panel_desc structure is an empty one used as a discriminant, and the connector type it contains isn't actually initialized. It is initialized through a call to panel_dpi_probe() later in the function, which used to be before the call to drm_panel_init() that got merged into devm_drm_panel_alloc(). So, we do need a proper panel_desc pointer before the call to devm_drm_panel_alloc() now. All cases associate their panel_desc with the panel compatible and use of_device_get_match_data, except for the panel-dpi compatible. In that case, we're expected to call panel_dpi_probe, which will allocate and initialize the panel_desc for us. Let's create such a helper function that would be called first in the driver and will lookup the desc by compatible, or allocate one if relevant. Reported-by: Francesco Dolcini Closes: https://lore.kernel.org/all/20250612081834.GA248237@francesco-nb/ Fixes: de04bb0089a9 ("drm/panel/panel-simple: Use the new allocation in place of devm_kzalloc()") Reviewed-by: Javier Martinez Canillas Tested-by: Francesco Dolcini # Toradex Colibri iMX6 Link: https://lore.kernel.org/r/20250626-drm-panel-simple-fixes-v2-4-5afcaa608bdc@kernel.org Signed-off-by: Maxime Ripard commit 921c41e509746aabecbbb2595ebf41a9d8fdc4e2 Author: Maxime Ripard Date: Thu Jun 26 12:05:01 2025 +0200 drm/panel: panel-simple: Make panel_simple_probe return its panel In order to fix the regession introduced by commit de04bb0089a9 ("drm/panel/panel-simple: Use the new allocation in place of devm_kzalloc()"), we need to move the panel_desc lookup into the common panel_simple_probe() function. There's two callers for that function, the probe implementations of the platform and MIPI-DSI drivers panel-simple implements. The MIPI-DSI driver's probe will need to access the current panel_desc to initialize properly, which won't be possible anymore if we make that lookup in panel_simple_probe(). However, we can make panel_simple_probe() return the initialized panel_simple structure it allocated, which will contain a pointer to the associated panel_desc in its desc field. This doesn't fix de04bb0089a9 ("drm/panel/panel-simple: Use the new allocation in place of devm_kzalloc()") still, but makes progress towards that goal. Fixes: de04bb0089a9 ("drm/panel/panel-simple: Use the new allocation in place of devm_kzalloc()") Reviewed-by: Javier Martinez Canillas Tested-by: Francesco Dolcini # Toradex Colibri iMX6 Link: https://lore.kernel.org/r/20250626-drm-panel-simple-fixes-v2-3-5afcaa608bdc@kernel.org Signed-off-by: Maxime Ripard commit 073667fce1667eab31d6a62cdd7fb795933ec7e8 Author: Maxime Ripard Date: Thu Jun 26 12:05:00 2025 +0200 drm/panel: panel-simple: make panel_dpi_probe return a panel_desc If the panel-simple driver is probed from a panel-dpi compatible, the driver will use an empty panel_desc structure as a descriminant. It will then allocate and fill another panel_desc as part of its probe. However, that allocation needs to happen after the panel_simple structure has been allocated, since panel_dpi_probe(), the function doing the panel_desc allocation and initialization, takes a panel_simple pointer as an argument. This pointer is used to fill the panel_simple->desc pointer that is still initialized with the empty panel_desc when panel_dpi_probe() is called. Since commit de04bb0089a9 ("drm/panel/panel-simple: Use the new allocation in place of devm_kzalloc()"), we will need the panel connector type found in panel_desc to allocate panel_simple. This creates a circular dependency where we need panel_desc to create panel_simple, and need panel_simple to create panel_desc. Let's break that dependency by making panel_dpi_probe simply return the panel_desc it initialized and move the panel_simple->desc assignment to the caller. This will not fix the breaking commit entirely, but will move us towards the right direction. Fixes: de04bb0089a9 ("drm/panel/panel-simple: Use the new allocation in place of devm_kzalloc()") Reviewed-by: Javier Martinez Canillas Tested-by: Francesco Dolcini # Toradex Colibri iMX6 Link: https://lore.kernel.org/r/20250626-drm-panel-simple-fixes-v2-2-5afcaa608bdc@kernel.org Signed-off-by: Maxime Ripard commit 2d22b63f3a5aae2088708941d08cf0f01f430a58 Author: Maxime Ripard Date: Thu Jun 26 12:04:59 2025 +0200 drm/mipi-dsi: Add dev_is_mipi_dsi function This will be especially useful for generic panels (like panel-simple) which can take different code path depending on if they are MIPI-DSI devices or platform devices. Reviewed-by: Javier Martinez Canillas Tested-by: Francesco Dolcini # Toradex Colibri iMX6 Link: https://lore.kernel.org/r/20250626-drm-panel-simple-fixes-v2-1-5afcaa608bdc@kernel.org Signed-off-by: Maxime Ripard commit 62e062a29ad5133f67c20b333ba0a952a99161ae Author: Simon Xue Date: Mon Jun 23 10:00:18 2025 +0800 iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU When two masters share an IOMMU, calling ops->of_xlate during the second master's driver init may overwrite iommu->domain set by the first. This causes the check if (iommu->domain == domain) in rk_iommu_attach_device() to fail, resulting in the same iommu->node being added twice to &rk_domain->iommus, which can lead to an infinite loop in subsequent &rk_domain->iommus operations. Cc: Fixes: 25c2325575cc ("iommu/rockchip: Add missing set_platform_dma_ops callback") Signed-off-by: Simon Xue Reviewed-by: Robin Murphy Link: https://lore.kernel.org/r/20250623020018.584802-1-xxm@rock-chips.com Signed-off-by: Joerg Roedel commit 67a993863163cb88b1b68974c31b0d84ece4293e Merge: 6f2a71a99ebd5d 20d71750cc72e8 Author: Linus Torvalds Date: Thu Jun 26 22:05:24 2025 -0700 Merge tag 'v6.16-p6' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: "This fixes a regression where wp512 can no longer be used with hmac" * tag 'v6.16-p6' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: wp512 - Use API partial block handling commit 6f2a71a99ebd5dfaa7948a2e9c59eae94b741bd8 Merge: 8a20830f2dd180 ef6fac0f9e5d06 Author: Linus Torvalds Date: Thu Jun 26 19:49:12 2025 -0700 Merge tag 'bcachefs-2025-06-26' of git://evilpiepirate.org/bcachefs Pull bcachefs fixes from Kent Overstreet: - Lots of small check/repair fixes, primarily in subvol loop and directory structure loop (when involving snapshots). - Fix a few 6.16 regressions: rare UAF in the foreground allocator path when taking a transaction restart from the transaction bump allocator, and some small fallout from the change to log the error being corrected in the journal when repairing errors, also some fallout from the btree node read error logging improvements. (Alan, Bharadwaj) - New option: journal_rewind This lets the entire filesystem be reset to an earlier point in time. Note that this is only a disaster recovery tool, and right now there are major caveats to using it (discards should be disabled, in particular), but it successfully restored the filesystem of one of the users who was bit by the subvolume deletion bug and didn't have backups. I'll likely be making some changes to the discard path in the future to make this a reliable recovery tool. - Some new btree iterator tracepoints, for tracking down some livelock-ish behaviour we've been seeing in the main data write path. * tag 'bcachefs-2025-06-26' of git://evilpiepirate.org/bcachefs: (51 commits) bcachefs: Plumb correct ip to trans_relock_fail tracepoint bcachefs: Ensure we rewind to run recovery passes bcachefs: Ensure btree node scan runs before checking for scanned nodes bcachefs: btree_root_unreadable_and_scan_found_nothing should not be autofix bcachefs: fix bch2_journal_keys_peek_prev_min() underflow bcachefs: Use wait_on_allocator() when allocating journal bcachefs: Check for bad write buffer key when moving from journal bcachefs: Don't unlock the trans if ret doesn't match BCH_ERR_operation_blocked bcachefs: Fix range in bch2_lookup_indirect_extent() error path bcachefs: fix spurious error_throw bcachefs: Add missing bch2_err_class() to fileattr_set() bcachefs: Add missing key type checks to check_snapshot_exists() bcachefs: Don't log fsck err in the journal if doing repair elsewhere bcachefs: Fix *__bch2_trans_subbuf_alloc() error path bcachefs: Fix missing newlines before ero bcachefs: fix spurious error in read_btree_roots() bcachefs: fsck: Fix oops in key_visible_in_snapshot() bcachefs: fsck: fix unhandled restart in topology repair bcachefs: fsck: Fix check_directory_structure when no check_dirents bcachefs: Fix restart handling in btree_node_scrub_work() ... commit 8a20830f2dd180064f25254d9c55beb243fe9223 Merge: f02769e7f272d6 a8905238c3bbe1 Author: Linus Torvalds Date: Thu Jun 26 17:06:01 2025 -0700 Merge tag 'hid-for-linus-2025062701' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - fix for stalls during suspend/resume cycles with hid-nintendo (Daniel J. Ogorchock) - memory leak and reference count fixes in hid-wacom and in-appletb-kdb (Qasim Ijaz) - race condition (leading to kernel crash) fix during device removal in hid-wacom (Thomas Zeitlhofer) - fix for missed interrupt in intel-thc-hid (Intel-thc-hid:) - support for a bunch of new device IDs * tag 'hid-for-linus-2025062701' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 HID: appletb-kbd: fix "appletb_backlight" backlight device reference counting HID: wacom: fix crash in wacom_aes_battery_handler() HID: intel-ish-hid: ipc: Add Wildcat Lake PCI device ID hid: intel-ish-hid: Use PCI_DEVICE_DATA() macro for ISH device table HID: lenovo: Restrict F7/9/11 mode to compact keyboards only HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY HID: input: lower message severity of 'No inputs registered, leaving' to debug HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras HID: Intel-thc-hid: Intel-quicki2c: Enhance QuickI2C reset flow HID: nintendo: avoid bluetooth suspend/resume stalls HID: wacom: fix kobject reference count leak HID: wacom: fix memory leak on sysfs attribute creation failure HID: wacom: fix memory leak on kobject creation failure commit 6daaa479ac557bc426a7fd2e913b618523fe41fd Merge: b6211ab2ebc1e4 af2b588abe006b Author: Dave Airlie Date: Fri Jun 27 09:13:45 2025 +1000 Merge tag 'drm-xe-fixes-2025-06-26' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes UAPI Changes: Driver Changes: - Missing error check (Haoxiang Li) - Fix xe_hwmon_power_max_write (Karthik) - Move flushes (Maarten and Matthew Auld) - Explicitly exit CT safe mode on unwind (Michal) - Process deferred GGTT node removals on device unwind (Michal) Signed-off-by: Dave Airlie From: Thomas Hellstrom Link: https://lore.kernel.org/r/aF1T6EzzC3xj4K4H@fedora commit b6211ab2ebc1e47c1ce8e42c5edbd75d8161c654 Merge: 06f6516ee0b1fd d02b2103a08b6d Author: Dave Airlie Date: Fri Jun 27 09:09:01 2025 +1000 Merge tag 'drm-intel-fixes-2025-06-26' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Fix for SNPS PHY HDMI for 1080p@120Hz - Correct DP AUX DPCD probe address - Followup build fix for GCOV and AutoFDO enabled config Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://lore.kernel.org/r/aFzsHR9WLYsxg8jy@jlahtine-mobl commit 06f6516ee0b1fd98da2cb781a848b54d504462e8 Merge: 86731a2a651e58 6847b3b6e84ef3 Author: Dave Airlie Date: Fri Jun 27 09:03:42 2025 +1000 Merge tag 'amd-drm-fixes-6.16-2025-25-25' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.16-2025-25-25: amdgpu: - Cleaner shader support for additional GFX9 GPUs - MES firmware compatibility fixes - Discovery error reporting fixes - SDMA6/7 userq fixes - Backlight fix - EDID sanity check Signed-off-by: Dave Airlie From: Alex Deucher Link: https://lore.kernel.org/r/20250625151734.11537-1-alexander.deucher@amd.com commit 8eba2187391e5ab49940cd02d6bd45a5617f4daf Author: Qiu-ji Chen Date: Fri Jun 6 17:00:17 2025 +0800 dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() Fixed a flag reuse bug in the mtk_cqdma_tx_status() function. Fixes: 157ae5ffd76a ("dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status()") Cc: stable@vger.kernel.org Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202505270641.MStzJUfU-lkp@intel.com/ Signed-off-by: Qiu-ji Chen Reviewed-by: Eugen Hristev Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250606090017.5436-1-chenqiuji666@gmail.com Signed-off-by: Vinod Koul commit a628e69b6412dc02757a6a23f7f16ce0c14d71f1 Author: Vijendar Mukunda Date: Fri Jun 20 15:55:19 2025 +0530 soundwire: amd: fix for clearing command status register To clear the valid result status, 1 should be written to ACP_SDW_IMM_CMD_STS register. Update the ACP_SW_IMM_CMD_STS register value as 1. Fixes: d8f48fbdfd9a ("soundwire: amd: Add support for AMD Manager driver") Signed-off-by: Vijendar Mukunda Link: https://lore.kernel.org/r/20250620102617.73437-1-Vijendar.Mukunda@amd.com Signed-off-by: Vinod Koul commit f02769e7f272d6f42b9767f066c5a99afd2338f3 Merge: e34a79b96ab9d4 f75794b6077ec7 Author: Linus Torvalds Date: Thu Jun 26 12:26:39 2025 -0700 Merge tag 'devicetree-fixes-for-6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Convert altr,uart-1.0 and altr,juart-1.0 to DT schema. These were applied for nios2, but never sent upstream. - Fix extra '/' in fsl,ls1028a-reset '$id' path - Fix warnings in ti,sn65dsi83 schema due to unnecessary $ref. * tag 'devicetree-fixes-for-6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: dt-bindings: serial: Convert altr,uart-1.0 to DT schema dt-bindings: serial: Convert altr,juart-1.0 to DT schema dt-bindings: soc: fsl,ls1028a-reset: Drop extra "/" in $id dt-bindings: drm/bridge: ti-sn65dsi83: drop $ref to fix lvds-vod* warnings commit 12ffc3b1513ebc1f11ae77d053948504a94a68a6 Author: Mario Limonciello Date: Fri Jun 13 16:43:44 2025 -0500 PM: Restrict swap use to later in the suspend sequence Currently swap is restricted before drivers have had a chance to do their prepare() PM callbacks. Restricting swap this early means that if a driver needs to evict some content from memory into sawp in it's prepare callback, it won't be able to. On AMD dGPUs this can lead to failed suspends under memory pressure situations as all VRAM must be evicted to system memory or swap. Move the swap restriction to right after all devices have had a chance to do the prepare() callback. If there is any problem with the sequence, restore swap in the appropriate dpm resume callbacks or error handling paths. Closes: https://github.com/ROCm/ROCK-Kernel-Driver/issues/174 Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/2362 Signed-off-by: Mario Limonciello Tested-by: Nat Wittstock Tested-by: Lucian Langa Link: https://patch.msgid.link/20250613214413.4127087-1-superm1@kernel.org Signed-off-by: Rafael J. Wysocki commit 178b8ff66ff827c41b4fa105e9aabb99a0b5c537 Author: Jens Axboe Date: Thu Jun 26 12:17:48 2025 -0600 io_uring/kbuf: flag partial buffer mappings A previous commit aborted mapping more for a non-incremental ring for bundle peeking, but depending on where in the process this peeking happened, it would not necessarily prevent a retry by the user. That can create gaps in the received/read data. Add struct buf_sel_arg->partial_map, which can pass this information back. The networking side can then map that to internal state and use it to gate retry as well. Since this necessitates a new flag, change io_sr_msg->retry to a retry_flags member, and store both the retry and partial map condition in there. Cc: stable@vger.kernel.org Fixes: 26ec15e4b0c1 ("io_uring/kbuf: don't truncate end buffer for multiple buffer peeks") Signed-off-by: Jens Axboe commit 38074de35b015df5623f524d6f2b49a0cd395c40 Author: Trond Myklebust Date: Thu Jun 19 15:16:11 2025 -0400 NFSv4/flexfiles: Fix handling of NFS level errors in I/O Allow the flexfiles error handling to recognise NFS level errors (as opposed to RPC level errors) and handle them separately. The main motivator is the NFSERR_PERM errors that get returned if the NFS client connects to the data server through a port number that is lower than 1024. In that case, the client should disconnect and retry a READ on a different data server, or it should retry a WRITE after reconnecting. Reviewed-by: Tigran Mkrtchyan Fixes: d67ae825a59d ("pnfs/flexfiles: Add the FlexFile Layout Driver") Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 618c810a7b2163517ab1875bd56b633ca3cb3328 Author: Gabor Juhos Date: Wed Jun 25 19:32:35 2025 +0200 interconnect: icc-clk: destroy nodes in case of memory allocation failures When memory allocation fails during creating the name of the nodes in icc_clk_register(), the code continues on the error path and it calls icc_nodes_remove() to destroy the already created nodes. However that function only destroys the nodes which were already added to the provider and the newly created nodes are never destroyed in case of error. In order to avoid a memory leaks, change the code to destroy the newly created nodes explicitly in case of memory allocation failures. Fixes: 44c5aa73ccd1 ("interconnect: icc-clk: check return values of devm_kasprintf()") Signed-off-by: Gabor Juhos Reviewed-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20250625-icc-clk-memleak-fix-v1-1-4151484cd24f@gmail.com Signed-off-by: Georgi Djakov commit 1809db75bd1fa71e27e199e4c5cc9072741f6052 Author: Gabor Juhos Date: Wed Jun 25 15:34:23 2025 +0200 interconnect: increase ICC_DYN_ID_START Since commit d30f83d278a9 ("interconnect: core: Add dynamic id allocation support"), interconnect node ids greater than or equal to ICC_DYN_ID_START are reserved for dynamic id allocation. Yet the icc_node_create_nolock() function allows to directly use such ids for creating nodes. This can cause problems by executing dynamic id related codepaths even for nodes intended to use static ids. For example, the 'nsscc-ipq9574' driver creates interconnect nodes with static ids starting from 19148. Because these ids belongs to the dynamic id range, the icc_node_add() function replaces the node names unexpectedly. The node names looked like this before the change: # grep nss_cc /sys/kernel/debug/interconnect/interconnect_summary nss_cc_nssnoc_ppe_clk_master 0 0 nss_cc_nssnoc_ppe_clk_slave 0 0 nss_cc_nssnoc_ppe_cfg_clk_master 0 0 ... And those have an unexpected suffix now: # grep nss_cc /sys/kernel/debug/interconnect/interconnect_summary nss_cc_nssnoc_ppe_clk_master@39b00000.clock-controller 0 0 nss_cc_nssnoc_ppe_clk_slave@39b00000.clock-controller 0 0 nss_cc_nssnoc_ppe_cfg_clk_master@39b00000.clock-controller 0 0 ... Increase the value of ICC_DYN_ID_START to avoid this. Also, add sanity check to the icc_node_create_nolock() function to prevent directly creating nodes with ids reserved for dynamic allocation in order to detect these kind of problems. Fixes: d30f83d278a9 ("interconnect: core: Add dynamic id allocation support") Signed-off-by: Gabor Juhos Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250625-icc-dyn-id-fix-v1-1-127cb5498449@gmail.com Signed-off-by: Georgi Djakov commit e34a79b96ab9d49ed8b605fee11099cf3efbb428 Merge: ee88bddf7f2f5d 85720e04d9af0b Author: Linus Torvalds Date: Thu Jun 26 09:13:27 2025 -0700 Merge tag 'net-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from bluetooth and wireless. Current release - regressions: - bridge: fix use-after-free during router port configuration Current release - new code bugs: - eth: wangxun: fix the creation of page_pool Previous releases - regressions: - netpoll: initialize UDP checksum field before checksumming - wifi: mac80211: finish link init before RCU publish - bluetooth: fix use-after-free in vhci_flush() - eth: - ionic: fix DMA mapping test - bnxt: properly flush XDP redirect lists Previous releases - always broken: - netlink: specs: enforce strict naming of properties - unix: don't leave consecutive consumed OOB skbs. - vsock: fix linux/vm_sockets.h userspace compilation errors - selftests: fix TCP packet checksum" * tag 'net-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (38 commits) net: libwx: fix the creation of page_pool net: selftests: fix TCP packet checksum atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). netlink: specs: enforce strict naming of properties netlink: specs: tc: replace underscores with dashes in names netlink: specs: rt-link: replace underscores with dashes in names netlink: specs: mptcp: replace underscores with dashes in names netlink: specs: ovs_flow: replace underscores with dashes in names netlink: specs: devlink: replace underscores with dashes in names netlink: specs: dpll: replace underscores with dashes in names netlink: specs: ethtool: replace underscores with dashes in names netlink: specs: fou: replace underscores with dashes in names netlink: specs: nfsd: replace underscores with dashes in names net: enetc: Correct endianness handling in _enetc_rd_reg64 atm: idt77252: Add missing `dma_map_error()` bnxt: properly flush XDP redirect lists vsock/uapi: fix linux/vm_sockets.h userspace compilation errors wifi: mac80211: finish link init before RCU publish wifi: iwlwifi: mvm: assume '1' as the default mac_config_cmd version selftest: af_unix: Add tests for -ECONNRESET. ... commit 263debecb4aa7cec0a86487e6f409814f6194a21 Author: David Howells Date: Wed Apr 2 20:27:26 2025 +0100 cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code When performing a file read from RDMA, smbd_recv() prints an "Invalid msg type 4" error and fails the I/O. This is due to the switch-statement there not handling the ITER_FOLIOQ handed down from netfslib. Fix this by collapsing smbd_recv_buf() and smbd_recv_page() into smbd_recv() and just using copy_to_iter() instead of memcpy(). This future-proofs the function too, in case more ITER_* types are added. Fixes: ee4cdf7ba857 ("netfs: Speed up buffered reading") Reported-by: Stefan Metzmacher Signed-off-by: David Howells cc: Tom Talpey cc: Paulo Alcantara (Red Hat) cc: Matthew Wilcox cc: linux-cifs@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French commit 43e7e284fc77b710d899569360ea46fa3374ae22 Author: David Howells Date: Wed Jun 25 14:15:04 2025 +0100 cifs: Fix the smbd_response slab to allow usercopy The handling of received data in the smbdirect client code involves using copy_to_iter() to copy data from the smbd_reponse struct's packet trailer to a folioq buffer provided by netfslib that encapsulates a chunk of pagecache. If, however, CONFIG_HARDENED_USERCOPY=y, this will result in the checks then performed in copy_to_iter() oopsing with something like the following: CIFS: Attempting to mount //172.31.9.1/test CIFS: VFS: RDMA transport established usercopy: Kernel memory exposure attempt detected from SLUB object 'smbd_response_0000000091e24ea1' (offset 81, size 63)! ------------[ cut here ]------------ kernel BUG at mm/usercopy.c:102! ... RIP: 0010:usercopy_abort+0x6c/0x80 ... Call Trace: __check_heap_object+0xe3/0x120 __check_object_size+0x4dc/0x6d0 smbd_recv+0x77f/0xfe0 [cifs] cifs_readv_from_socket+0x276/0x8f0 [cifs] cifs_read_from_socket+0xcd/0x120 [cifs] cifs_demultiplex_thread+0x7e9/0x2d50 [cifs] kthread+0x396/0x830 ret_from_fork+0x2b8/0x3b0 ret_from_fork_asm+0x1a/0x30 The problem is that the smbd_response slab's packet field isn't marked as being permitted for usercopy. Fix this by passing parameters to kmem_slab_create() to indicate that copy_to_iter() is permitted from the packet region of the smbd_response slab objects, less the header space. Fixes: ee4cdf7ba857 ("netfs: Speed up buffered reading") Reported-by: Stefan Metzmacher Link: https://lore.kernel.org/r/acb7f612-df26-4e2a-a35d-7cd040f513e1@samba.org/ Signed-off-by: David Howells Reviewed-by: Stefan Metzmacher Tested-by: Stefan Metzmacher cc: Paulo Alcantara cc: linux-cifs@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French commit 711741f94ac3cf9f4e3aa73aa171e76d188c0819 Author: Paulo Alcantara Date: Wed Jun 25 12:22:38 2025 -0300 smb: client: fix potential deadlock when reconnecting channels Fix cifs_signal_cifsd_for_reconnect() to take the correct lock order and prevent the following deadlock from happening ====================================================== WARNING: possible circular locking dependency detected 6.16.0-rc3-build2+ #1301 Tainted: G S W ------------------------------------------------------ cifsd/6055 is trying to acquire lock: ffff88810ad56038 (&tcp_ses->srv_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0x134/0x200 but task is already holding lock: ffff888119c64330 (&ret_buf->chan_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0xcf/0x200 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&ret_buf->chan_lock){+.+.}-{3:3}: validate_chain+0x1cf/0x270 __lock_acquire+0x60e/0x780 lock_acquire.part.0+0xb4/0x1f0 _raw_spin_lock+0x2f/0x40 cifs_setup_session+0x81/0x4b0 cifs_get_smb_ses+0x771/0x900 cifs_mount_get_session+0x7e/0x170 cifs_mount+0x92/0x2d0 cifs_smb3_do_mount+0x161/0x460 smb3_get_tree+0x55/0x90 vfs_get_tree+0x46/0x180 do_new_mount+0x1b0/0x2e0 path_mount+0x6ee/0x740 do_mount+0x98/0xe0 __do_sys_mount+0x148/0x180 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x76/0x7e -> #1 (&ret_buf->ses_lock){+.+.}-{3:3}: validate_chain+0x1cf/0x270 __lock_acquire+0x60e/0x780 lock_acquire.part.0+0xb4/0x1f0 _raw_spin_lock+0x2f/0x40 cifs_match_super+0x101/0x320 sget+0xab/0x270 cifs_smb3_do_mount+0x1e0/0x460 smb3_get_tree+0x55/0x90 vfs_get_tree+0x46/0x180 do_new_mount+0x1b0/0x2e0 path_mount+0x6ee/0x740 do_mount+0x98/0xe0 __do_sys_mount+0x148/0x180 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x76/0x7e -> #0 (&tcp_ses->srv_lock){+.+.}-{3:3}: check_noncircular+0x95/0xc0 check_prev_add+0x115/0x2f0 validate_chain+0x1cf/0x270 __lock_acquire+0x60e/0x780 lock_acquire.part.0+0xb4/0x1f0 _raw_spin_lock+0x2f/0x40 cifs_signal_cifsd_for_reconnect+0x134/0x200 __cifs_reconnect+0x8f/0x500 cifs_handle_standard+0x112/0x280 cifs_demultiplex_thread+0x64d/0xbc0 kthread+0x2f7/0x310 ret_from_fork+0x2a/0x230 ret_from_fork_asm+0x1a/0x30 other info that might help us debug this: Chain exists of: &tcp_ses->srv_lock --> &ret_buf->ses_lock --> &ret_buf->chan_lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&ret_buf->chan_lock); lock(&ret_buf->ses_lock); lock(&ret_buf->chan_lock); lock(&tcp_ses->srv_lock); *** DEADLOCK *** 3 locks held by cifsd/6055: #0: ffffffff857de398 (&cifs_tcp_ses_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0x7b/0x200 #1: ffff888119c64060 (&ret_buf->ses_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0x9c/0x200 #2: ffff888119c64330 (&ret_buf->chan_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0xcf/0x200 Cc: linux-cifs@vger.kernel.org Reported-by: David Howells Fixes: d7d7a66aacd6 ("cifs: avoid use of global locks for high contention data") Reviewed-by: David Howells Tested-by: David Howells Signed-off-by: Paulo Alcantara (Red Hat) Signed-off-by: David Howells Signed-off-by: Steve French commit 4c113a5b28bfd589e2010b5fc8867578b0135ed7 Author: Yazen Ghannam Date: Tue Jun 24 14:15:56 2025 +0000 x86/mce: Don't remove sysfs if thresholding sysfs init fails Currently, the MCE subsystem sysfs interface will be removed if the thresholding sysfs interface fails to be created. A common failure is due to new MCA bank types that are not recognized and don't have a short name set. The MCA thresholding feature is optional and should not break the common MCE sysfs interface. Also, new MCA bank types are occasionally introduced, and updates will be needed to recognize them. But likewise, this should not break the common sysfs interface. Keep the MCE sysfs interface regardless of the status of the thresholding sysfs interface. Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Qiuxu Zhuo Reviewed-by: Tony Luck Tested-by: Tony Luck Cc: stable@vger.kernel.org Link: https://lore.kernel.org/20250624-wip-mca-updates-v4-1-236dd74f645f@amd.com commit 50b6914fc53c718c5426fb6e9cd9484f9ae967c2 Author: Armin Wolf Date: Fri Jun 20 00:14:40 2025 +0200 platform/x86: wmi: Update documentation of WCxx/WExx ACPI methods Inform potential firmware developers that WExx ACPI methods are always called by the WMI driver core even if the associated WMI event is not marked as being expensive. Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20250619221440.6737-2-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit cf0b812500e64a7d5e2957abed38c3a97917b34f Author: Armin Wolf Date: Fri Jun 20 00:14:39 2025 +0200 platform/x86: wmi: Fix WMI event enablement It turns out that the Windows WMI-ACPI driver always enables/disables WMI events regardless of whether they are marked as expensive or not. This finding is further reinforced when reading the documentation of the WMI_FUNCTION_CONTROL_CALLBACK callback used by Windows drivers for enabling/disabling WMI devices: The DpWmiFunctionControl routine enables or disables notification of events, and enables or disables data collection for data blocks that the driver registered as expensive to collect. Follow this behavior to fix the WMI event used for reporting hotkey events on the Dell Latitude 5400 and likely many more devices. Reported-by: Dmytro Bagrii Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220246 Tested-by: Dmytro Bagrii Fixes: 656f0961d126 ("platform/x86: wmi: Rework WCxx/WExx ACPI method handling") Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20250619221440.6737-1-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a49e1e2e785fb3621f2d748581881b23a364998a Author: Mathias Nyman Date: Thu Jun 26 16:01:02 2025 +0300 usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm Delayed work to prevent USB3 hubs from runtime-suspending immediately after resume was added in commit 8f5b7e2bec1c ("usb: hub: fix detection of high tier USB3 devices behind suspended hubs"). This delayed work needs be flushed if system suspends, or hub needs to be quiesced for other reasons right after resume. Not flushing it triggered issues on QC SC8280XP CRD board during suspend/resume testing. Fix it by flushing the delayed resume work in hub_quiesce() The delayed work item that allow hub runtime suspend is also scheduled just before calling autopm get. Alan pointed out there is a small risk that work is run before autopm get, which would call autopm put before get, and mess up the runtime pm usage order. Swap the order of work sheduling and calling autopm get to solve this. Cc: stable Fixes: 8f5b7e2bec1c ("usb: hub: fix detection of high tier USB3 devices behind suspended hubs") Reported-by: Konrad Dybcio Closes: https://lore.kernel.org/linux-usb/acaaa928-832c-48ca-b0ea-d202d5cd3d6c@oss.qualcomm.com Reported-by: Alan Stern Closes: https://lore.kernel.org/linux-usb/c73fbead-66d7-497a-8fa1-75ea4761090a@rowland.harvard.edu Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20250626130102.3639861-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit d07143b507c51c04c091081627c5a130e9d3c517 Author: Alok Tiwari Date: Sun Jun 22 00:29:12 2025 -0700 platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message change error log to use correct bus number from main_mux_devs instead of cpld_devs. Fixes: 662f24826f95 ("platform/mellanox: Add support for new SN2201 system") Signed-off-by: Alok Tiwari Reviewed-by: Vadim Pasternak Link: https://lore.kernel.org/r/20250622072921.4111552-2-alok.a.tiwari@oracle.com Signed-off-by: Ilpo Järvinen commit c3ac7e30309b8221a8321c3882d289ba519b4104 Author: Alok Tiwari Date: Sun Jun 22 00:29:11 2025 -0700 platform/mellanox: Fix spelling and comment clarity in Mellanox drivers This commit corrects several minor typographical errors in comments and error messages across multiple Mellanox platform driver. Fixed spelling of "thresholds", "region", "platform", "default", and removed redundant spaces in comment strings and error logs. These changes are cosmetic and do not affect runtime behavior. Signed-off-by: Alok Tiwari Reviewed-by: Vadim Pasternak Reviewed-by: David Thompson Link: https://lore.kernel.org/r/20250622072921.4111552-1-alok.a.tiwari@oracle.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit c007062188d8e402c294117db53a24b2bed2b83f Author: Yu Kuai Date: Thu Jun 26 19:57:43 2025 +0800 block: fix false warning in bdev_count_inflight_rw() While bdev_count_inflight is interating all cpus, if some IOs are issued from traversed cpu and then completed from the cpu that is not traversed yet: cpu0 cpu1 bdev_count_inflight //for_each_possible_cpu // cpu0 is 0 infliht += 0 // issue a io blk_account_io_start // cpu0 inflight ++ cpu2 // the io is done blk_account_io_done // cpu2 inflight -- // cpu 1 is 0 inflight += 0 // cpu2 is -1 inflight += -1 ... In this case, the total inflight will be -1, causing lots of false warning. Fix the problem by removing the warning. Noted there is still a valid warning for nvme-mpath(From Yi) that is not fixed yet. Fixes: f5482ee5edb9 ("block: WARN if bdev inflight counter is negative") Reported-by: Yi Zhang Closes: https://lore.kernel.org/linux-block/aFtUXy-lct0WxY2w@mozart.vkv.me/T/#mae89155a5006463d0a21a4a2c35ae0034b26a339 Reported-and-tested-by: Calvin Owens Closes: https://lore.kernel.org/linux-block/aFtUXy-lct0WxY2w@mozart.vkv.me/T/#m1d935a00070bf95055d0ac84e6075158b08acaef Reported-by: Dave Chinner Closes: https://lore.kernel.org/linux-block/aFuypjqCXo9-5_En@dread.disaster.area/ Signed-off-by: Yu Kuai Link: https://lore.kernel.org/r/20250626115743.1641443-1-yukuai3@huawei.com Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 5990b776fb79a444f91431d35d24b0bdc622984b Merge: 969127bf0783a4 f46d273449ba65 Author: Jens Axboe Date: Thu Jun 26 07:31:52 2025 -0600 Merge tag 'nvme-6.16-2025-06-26' of git://git.infradead.org/nvme into block-6.16 Pull NVMe fixes from Christoph: " - reset delayed remove_work after reconnect (Keith Busch) - fix atomic write size validation (Christoph Hellwig)" * tag 'nvme-6.16-2025-06-26' of git://git.infradead.org/nvme: nvme: fix atomic write size validation nvme: refactor the atomic write unit detection nvme: reset delayed remove_work after reconnect commit 969127bf0783a4ac0c8a27e633a9e8ea1738583f Author: Ronnie Sahlberg Date: Thu Jun 26 12:20:45 2025 +1000 ublk: sanity check add_dev input for underflow Add additional checks that queue depth and number of queues are non-zero. Signed-off-by: Ronnie Sahlberg Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250626022046.235018-1-ronniesahlberg@gmail.com Signed-off-by: Jens Axboe commit af2b588abe006bd55ddd358c4c3b87523349c475 Author: Michal Wajdeczko Date: Fri Jun 13 00:09:36 2025 +0200 drm/xe: Process deferred GGTT node removals on device unwind While we are indirectly draining our dedicated workqueue ggtt->wq that we use to complete asynchronous removal of some GGTT nodes, this happends as part of the managed-drm unwinding (ggtt_fini_early), which could be later then manage-device unwinding, where we could already unmap our MMIO/GMS mapping (mmio_fini). This was recently observed during unsuccessful VF initialization: [ ] xe 0000:00:02.1: probe with driver xe failed with error -62 [ ] xe 0000:00:02.1: DEVRES REL ffff88811e747340 __xe_bo_unpin_map_no_vm (16 bytes) [ ] xe 0000:00:02.1: DEVRES REL ffff88811e747540 __xe_bo_unpin_map_no_vm (16 bytes) [ ] xe 0000:00:02.1: DEVRES REL ffff88811e747240 __xe_bo_unpin_map_no_vm (16 bytes) [ ] xe 0000:00:02.1: DEVRES REL ffff88811e747040 tiles_fini (16 bytes) [ ] xe 0000:00:02.1: DEVRES REL ffff88811e746840 mmio_fini (16 bytes) [ ] xe 0000:00:02.1: DEVRES REL ffff88811e747f40 xe_bo_pinned_fini (16 bytes) [ ] xe 0000:00:02.1: DEVRES REL ffff88811e746b40 devm_drm_dev_init_release (16 bytes) [ ] xe 0000:00:02.1: [drm:drm_managed_release] drmres release begin [ ] xe 0000:00:02.1: [drm:drm_managed_release] REL ffff88810ef81640 __fini_relay (8 bytes) [ ] xe 0000:00:02.1: [drm:drm_managed_release] REL ffff88810ef80d40 guc_ct_fini (8 bytes) [ ] xe 0000:00:02.1: [drm:drm_managed_release] REL ffff88810ef80040 __drmm_mutex_release (8 bytes) [ ] xe 0000:00:02.1: [drm:drm_managed_release] REL ffff88810ef80140 ggtt_fini_early (8 bytes) and this was leading to: [ ] BUG: unable to handle page fault for address: ffffc900058162a0 [ ] #PF: supervisor write access in kernel mode [ ] #PF: error_code(0x0002) - not-present page [ ] Oops: Oops: 0002 [#1] SMP NOPTI [ ] Tainted: [W]=WARN [ ] Workqueue: xe-ggtt-wq ggtt_node_remove_work_func [xe] [ ] RIP: 0010:xe_ggtt_set_pte+0x6d/0x350 [xe] [ ] Call Trace: [ ] [ ] xe_ggtt_clear+0xb0/0x270 [xe] [ ] ggtt_node_remove+0xbb/0x120 [xe] [ ] ggtt_node_remove_work_func+0x30/0x50 [xe] [ ] process_one_work+0x22b/0x6f0 [ ] worker_thread+0x1e8/0x3d Add managed-device action that will explicitly drain the workqueue with all pending node removals prior to releasing MMIO/GSM mapping. Fixes: 919bb54e989c ("drm/xe: Fix missing runtime outer protection for ggtt_remove_node") Signed-off-by: Michal Wajdeczko Cc: Rodrigo Vivi Cc: Lucas De Marchi Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250612220937.857-2-michal.wajdeczko@intel.com (cherry picked from commit 89d2835c3680ab1938e22ad81b1c9f8c686bd391) Signed-off-by: Thomas Hellström commit ad40098da5c3b43114d860a5b5740e7204158534 Author: Michal Wajdeczko Date: Fri Jun 13 00:09:37 2025 +0200 drm/xe/guc: Explicitly exit CT safe mode on unwind During driver probe we might be briefly using CT safe mode, which is based on a delayed work, but usually we are able to stop this once we have IRQ fully operational. However, if we abort the probe quite early then during unwind we might try to destroy the workqueue while there is still a pending delayed work that attempts to restart itself which triggers a WARN. This was recently observed during unsuccessful VF initialization: [ ] xe 0000:00:02.1: probe with driver xe failed with error -62 [ ] ------------[ cut here ]------------ [ ] workqueue: cannot queue safe_mode_worker_func [xe] on wq xe-g2h-wq [ ] WARNING: CPU: 9 PID: 0 at kernel/workqueue.c:2257 __queue_work+0x287/0x710 [ ] RIP: 0010:__queue_work+0x287/0x710 [ ] Call Trace: [ ] delayed_work_timer_fn+0x19/0x30 [ ] call_timer_fn+0xa1/0x2a0 Exit the CT safe mode on unwind to avoid that warning. Fixes: 09b286950f29 ("drm/xe/guc: Allow CTB G2H processing without G2H IRQ") Signed-off-by: Michal Wajdeczko Cc: Matthew Brost Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250612220937.857-3-michal.wajdeczko@intel.com (cherry picked from commit 2ddbb73ec20b98e70a5200cb85deade22ccea2ec) Signed-off-by: Thomas Hellström commit f16873f42a06b620669d48a4b5c3f888cb3653a1 Author: Matthew Auld Date: Fri Jun 6 11:45:48 2025 +0100 drm/xe: move DPT l2 flush to a more sensible place Only need the flush for DPT host updates here. Normal GGTT updates don't need special flush. Fixes: 01570b446939 ("drm/xe/bmg: implement Wa_16023588340") Signed-off-by: Matthew Auld Cc: Maarten Lankhorst Cc: stable@vger.kernel.org # v6.12+ Reviewed-by: Ville Syrjälä Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250606104546.1996818-4-matthew.auld@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 35db1da40c8cfd7511dc42f342a133601eb45449) Signed-off-by: Thomas Hellström commit a4b1b51ae132ac199412028a2df7b6c267888190 Author: Maarten Lankhorst Date: Fri Jun 6 11:45:47 2025 +0100 drm/xe: Move DSB l2 flush to a more sensible place Flushing l2 is only needed after all data has been written. Fixes: 01570b446939 ("drm/xe/bmg: implement Wa_16023588340") Signed-off-by: Maarten Lankhorst Cc: Matthew Auld Cc: stable@vger.kernel.org # v6.12+ Reviewed-by: Matthew Auld Signed-off-by: Matthew Auld Reviewed-by: Lucas De Marchi Reviewed-by: Ville Syrjälä Link: https://lore.kernel.org/r/20250606104546.1996818-3-matthew.auld@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 0dd2dd0182bc444a62652e89d08c7f0e4fde15ba) Signed-off-by: Thomas Hellström commit 080e8d2ecdfde588897aa8a87a8884061f4dbbbb Author: Bibo Mao Date: Thu Jun 26 20:07:27 2025 +0800 LoongArch: KVM: Avoid overflow with array index The variable index is modified and reused as array index when modify register EIOINTC_ENABLE. There will be array index overflow problem. Cc: stable@vger.kernel.org Fixes: 3956a52bc05b ("LoongArch: KVM: Add EIOINTC read and write functions") Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit a0137c9048252ea965a0436895c77d1c917dfe2a Author: Kees Cook Date: Thu Jun 26 20:07:18 2025 +0800 LoongArch: Handle KCOV __init vs inline mismatches When the KCOV is enabled all functions get instrumented, unless the __no_sanitize_coverage attribute is used. To prepare for __no_sanitize_coverage being applied to __init functions, we have to handle differences in how GCC's inline optimizations get resolved. For LoongArch this exposed several places where __init annotations were missing but ended up being "accidentally correct". So fix these cases. Signed-off-by: Kees Cook Signed-off-by: Huacai Chen commit 39503fc84b4ea94f2bedca481de5e225e0df729d Author: Ming Wang Date: Thu Jun 26 20:07:18 2025 +0800 LoongArch: Reserve the EFI memory map region The EFI memory map at 'boot_memmap' is crucial for kdump to understand the primary kernel's memory layout. This memory region, typically part of EFI Boot Services (BS) data, can be overwritten after ExitBootServices if not explicitly preserved by the kernel. This commit addresses this by: 1. Calling memblock_reserve() to reserve the entire physical region occupied by the EFI memory map (header + descriptors). This prevents the primary kernel from reallocating and corrupting this area. 2. Setting the EFI_PRESERVE_BS_REGIONS flag in efi.flags. This indicates that efforts have been made to preserve critical BS code/data regions which can be useful for other kernel subsystems or debugging. These changes ensure the original EFI memory map data remains intact, improving kdump reliability and potentially aiding other EFI-related functionalities that might rely on preserved BS code/data. Signed-off-by: Ming Wang Signed-off-by: Huacai Chen commit 7d69294b8a8d0e19600797711ed3bc047fead1c1 Author: Huacai Chen Date: Thu Jun 26 20:07:18 2025 +0800 LoongArch: Fix build warnings about export.h After commit a934a57a42f64a4 ("scripts/misc-check: check missing #include when W=1") and 7d95680d64ac8e836c ("scripts/misc-check: check unnecessary #include when W=1"), we get some build warnings with W=1: arch/loongarch/kernel/acpi.c: warning: EXPORT_SYMBOL() is used, but #include is missing arch/loongarch/kernel/alternative.c: warning: EXPORT_SYMBOL() is used, but #include is missing arch/loongarch/kernel/kfpu.c: warning: EXPORT_SYMBOL() is used, but #include is missing arch/loongarch/kernel/traps.c: warning: EXPORT_SYMBOL() is used, but #include is missing arch/loongarch/kernel/unwind_guess.c: warning: EXPORT_SYMBOL() is used, but #include is missing arch/loongarch/kernel/unwind_orc.c: warning: EXPORT_SYMBOL() is used, but #include is missing arch/loongarch/kernel/unwind_prologue.c: warning: EXPORT_SYMBOL() is used, but #include is missing arch/loongarch/lib/crc32-loongarch.c: warning: EXPORT_SYMBOL() is used, but #include is missing arch/loongarch/lib/csum.c: warning: EXPORT_SYMBOL() is used, but #include is missing arch/loongarch/kernel/elf.c: warning: EXPORT_SYMBOL() is not used, but #include is present arch/loongarch/kernel/paravirt.c: warning: EXPORT_SYMBOL() is not used, but #include is present arch/loongarch/pci/pci.c: warning: EXPORT_SYMBOL() is not used, but #include is present So fix these build warnings for LoongArch. Reviewed-by: Masahiro Yamada Signed-off-by: Huacai Chen commit f0ef0b02af381418973a952867052b12194f9c16 Author: Thomas Huth Date: Thu Jun 26 20:07:10 2025 +0800 LoongArch: Replace __ASSEMBLY__ with __ASSEMBLER__ in headers While the GCC and Clang compilers already define __ASSEMBLER__ automatically when compiling assembler code, __ASSEMBLY__ is a macro that only gets defined by the Makefiles in the kernel. This is bad since macros starting with two underscores are names that are reserved by the C language. It can also be very confusing for the developers when switching between userspace and kernelspace coding, or when dealing with uapi headers that rather should use __ASSEMBLER__ instead. So let's now standardize on the __ASSEMBLER__ macro that is provided by the compilers. This is almost a completely mechanical patch (done with a simple "sed -i" statement), with one comment tweaked manually in the arch/loongarch/include/asm/cpu.h file (it was missing the trailing underscores). Signed-off-by: Thomas Huth Signed-off-by: Huacai Chen commit f46d273449ba65afd53f3dd8fe0182c9df877e08 Author: Christoph Hellwig Date: Wed Jun 11 06:54:56 2025 +0200 nvme: fix atomic write size validation Don't mix the namespace and controller values, and validate the per-controller limit when probing the controller. This avoid spurious failures for controllers with namespaces that have different namespaces with different logical block sizes, or report the per-namespace values only for some namespaces. It also fixes a missing queue_limits_cancel_update in an error path by removing that error path. Fixes: 8695f060a029 ("nvme: all namespaces in a subsystem must adhere to a common atomic write size") Reported-by: Yi Zhang Signed-off-by: Christoph Hellwig Reviewed-by: Luis Chamberlain Reviewed-by: John Garry Tested-by: Yi Zhang commit b2e607fecac15e07f50269c080e2e71b5049dfa2 Author: Christoph Hellwig Date: Wed Jun 11 07:09:21 2025 +0200 nvme: refactor the atomic write unit detection Move all the code out of nvme_update_disk_info into the helper, and rename the helper to have a somewhat less clumsy name. Signed-off-by: Christoph Hellwig Reviewed-by: Luis Chamberlain Reviewed-by: John Garry commit dd2c18548964ae7ad48d208a765d909cd35448a1 Author: Keith Busch Date: Wed Jun 11 06:50:47 2025 +0200 nvme: reset delayed remove_work after reconnect The remove_work will proceed with permanently disconnecting on the initial final path failure if the head shows no paths after the delay. If a new path connects while the remove_work is pending, and if that new path happens to disconnect before that remove_work executes, the delayed removal should reset based on the most recent path disconnect time, but queue_delayed_work() won't do anything if the work is already pending. Attempt to cancel the delayed work when a new path connects, and use mod_delayed_work() in case the remove_work remains pending anyway. Signed-off-by: Keith Busch Reviewed-by: Nilay Shroff Signed-off-by: Christoph Hellwig commit 0e02219f9cf4f0c0aa3dbf3c820e6612bf3f0c8c Author: Quentin Perret Date: Thu Jun 26 10:10:14 2025 +0000 KVM: arm64: Don't free hyp pages with pKVM on GICv2 Marc reported that enabling protected mode on a device with GICv2 doesn't fail gracefully as one would expect, and leads to a host kernel crash. As it turns out, the first half of pKVM init happens before the vgic probe, and so by the time we find out we have a GICv2 we're already committed to keeping the pKVM vectors installed at EL2 -- pKVM rejects stub HVCs for obvious security reasons. However, the error path on KVM init leads to teardown_hyp_mode() which unconditionally frees hypervisor allocations (including the EL2 stacks and per-cpu pages) under the assumption that a previous cpu_hyp_uninit() execution has reset the vectors back to the stubs, which is false with pKVM. Interestingly, host stage-2 protection is not enabled yet at this point, so this use-after-free may go unnoticed for a while. The issue becomes more obvious after the finalize_pkvm() call. Fix this by keeping track of the CPUs on which pKVM is initialized in the kvm_hyp_initialized per-cpu variable, and use it from teardown_hyp_mode() to skip freeing pages that are in fact used. Fixes: a770ee80e662 ("KVM: arm64: pkvm: Disable GICv2 support") Reported-by: Marc Zyngier Signed-off-by: Quentin Perret Link: https://lore.kernel.org/r/20250626101014.1519345-1-qperret@google.com Signed-off-by: Marc Zyngier commit 85720e04d9af0b77f8092b12a06661a8d459d4a0 Author: Jiawen Wu Date: Wed Jun 25 10:39:24 2025 +0800 net: libwx: fix the creation of page_pool 'rx_ring->size' means the count of ring descriptors multiplied by the size of one descriptor. When increasing the count of ring descriptors, it may exceed the limit of pool size. [ 864.209610] page_pool_create_percpu() gave up with errno -7 [ 864.209613] txgbe 0000:11:00.0: Page pool creation failed: -7 Fix to set the pool_size to the count of ring descriptors. Fixes: 850b971110b2 ("net: libwx: Allocate Rx and Tx resources") Cc: stable@vger.kernel.org Signed-off-by: Jiawen Wu Reviewed-by: Simon Horman Reviewed-by: Mina Almasry Link: https://patch.msgid.link/434C72BFB40E350A+20250625023924.21821-1-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni commit 8d89661a36dd3bb8c9902cff36dc0c144dce3faf Author: Jakub Kicinski Date: Tue Jun 24 11:32:58 2025 -0700 net: selftests: fix TCP packet checksum The length in the pseudo header should be the length of the L3 payload AKA the L4 header+payload. The selftest code builds the packet from the lower layers up, so all the headers are pushed already when it constructs L4. We need to subtract the lower layer headers from skb->len. Fixes: 3e1e58d64c3d ("net: add generic selftest support") Signed-off-by: Jakub Kicinski Reviewed-by: Gerhard Engleder Reported-by: Oleksij Rempel Tested-by: Oleksij Rempel Reviewed-by: Oleksij Rempel Link: https://patch.msgid.link/20250624183258.3377740-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit 1476b218327b89bbb64c14619a2d34f0c320f2c3 Author: Leo Yan Date: Wed Jun 25 18:07:37 2025 +0100 perf/aux: Fix pending disable flow when the AUX ring buffer overruns If an AUX event overruns, the event core layer intends to disable the event by setting the 'pending_disable' flag. Unfortunately, the event is not actually disabled afterwards. In commit: ca6c21327c6a ("perf: Fix missing SIGTRAPs") the 'pending_disable' flag was changed to a boolean. However, the AUX event code was not updated accordingly. The flag ends up holding a CPU number. If this number is zero, the flag is taken as false and the IRQ work is never triggered. Later, with commit: 2b84def990d3 ("perf: Split __perf_pending_irq() out of perf_pending_irq()") a new IRQ work 'pending_disable_irq' was introduced to handle event disabling. The AUX event path was not updated to kick off the work queue. To fix this bug, when an AUX ring buffer overrun is detected, call perf_event_disable_inatomic() to initiate the pending disable flow. Also update the outdated comment for setting the flag, to reflect the boolean values (0 or 1). Fixes: 2b84def990d3 ("perf: Split __perf_pending_irq() out of perf_pending_irq()") Fixes: ca6c21327c6a ("perf: Fix missing SIGTRAPs") Signed-off-by: Leo Yan Signed-off-by: Ingo Molnar Reviewed-by: James Clark Reviewed-by: Yeoreum Yun Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Ian Rogers Cc: Jiri Olsa Cc: Liang Kan Cc: Marco Elver Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Sebastian Andrzej Siewior Cc: linux-perf-users@vger.kernel.org Link: https://lore.kernel.org/r/20250625170737.2918295-1-leo.yan@arm.com commit 9a2b9416fd1d18d97ce1b737a11fcbc521140e5d Author: Mostafa Saleh Date: Wed Jun 25 12:30:58 2025 +0000 KVM: arm64: Fix error path in init_hyp_mode() In the unlikely case pKVM failed to allocate carveout, the error path tries to access NULL ptr when it de-reference the SVE state from the uninitialized nVHE per-cpu base. [ 1.575420] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 1.576010] pc : teardown_hyp_mode+0xe4/0x180 [ 1.576920] lr : teardown_hyp_mode+0xd0/0x180 [ 1.577308] sp : ffff8000826fb9d0 [ 1.577600] x29: ffff8000826fb9d0 x28: 0000000000000000 x27: ffff80008209b000 [ 1.578383] x26: ffff800081dde000 x25: ffff8000820493c0 x24: ffff80008209eb00 [ 1.579180] x23: 0000000000000040 x22: 0000000000000001 x21: 0000000000000000 [ 1.579881] x20: 0000000000000002 x19: ffff800081d540b8 x18: 0000000000000000 [ 1.580544] x17: ffff800081205230 x16: 0000000000000152 x15: 00000000fffffff8 [ 1.581183] x14: 0000000000000008 x13: fff00000ff7f6880 x12: 000000000000003e [ 1.581813] x11: 0000000000000002 x10: 00000000000000ff x9 : 0000000000000000 [ 1.582503] x8 : 0000000000000000 x7 : 7f7f7f7f7f7f7f7f x6 : 43485e525851ff30 [ 1.583140] x5 : fff00000ff6e9030 x4 : fff00000ff6e8f80 x3 : 0000000000000000 [ 1.583780] x2 : 0000000000000000 x1 : 0000000000000002 x0 : 0000000000000000 [ 1.584526] Call trace: [ 1.584945] teardown_hyp_mode+0xe4/0x180 (P) [ 1.585578] init_hyp_mode+0x920/0x994 [ 1.586005] kvm_arm_init+0xb4/0x25c [ 1.586387] do_one_initcall+0xe0/0x258 [ 1.586819] do_initcall_level+0xa0/0xd4 [ 1.587224] do_initcalls+0x54/0x94 [ 1.587606] do_basic_setup+0x1c/0x28 [ 1.587998] kernel_init_freeable+0xc8/0x130 [ 1.588409] kernel_init+0x20/0x1a4 [ 1.588768] ret_from_fork+0x10/0x20 [ 1.589568] Code: f875db48 8b1c0109 f100011f 9a8903e8 (f9463100) [ 1.590332] ---[ end trace 0000000000000000 ]--- As Quentin pointed, the order of free is also wrong, we need to free SVE state first before freeing the per CPU ptrs. I initially observed this on 6.12, but I could also repro in master. Signed-off-by: Mostafa Saleh Fixes: 66d5b53e20a6 ("KVM: arm64: Allocate memory mapped at hyp for host sve state in pKVM") Reviewed-by: Quentin Perret Link: https://lore.kernel.org/r/20250625123058.875179-1-smostafa@google.com Signed-off-by: Marc Zyngier commit e728e705802fec20f65d974a5d5eb91217ac618d Author: Quentin Perret Date: Wed Jun 25 10:55:48 2025 +0000 KVM: arm64: Adjust range correctly during host stage-2 faults host_stage2_adjust_range() tries to find the largest block mapping that fits within a memory or mmio region (represented by a kvm_mem_range in this function) during host stage-2 faults under pKVM. To do so, it walks the host stage-2 page-table, finds the faulting PTE and its level, and then progressively increments the level until it finds a granule of the appropriate size. However, the condition in the loop implementing the above is broken as it checks kvm_level_supports_block_mapping() for the next level instead of the current, so pKVM may attempt to map a region larger than can be covered with a single block. This is not a security problem and is quite rare in practice (the kvm_mem_range check usually forces host_stage2_adjust_range() to choose a smaller granule), but this is clearly not the expected behaviour. Refactor the loop to fix the bug and improve readability. Fixes: c4f0935e4d95 ("KVM: arm64: Optimize host memory aborts") Signed-off-by: Quentin Perret Link: https://lore.kernel.org/r/20250625105548.984572-1-qperret@google.com Signed-off-by: Marc Zyngier commit af040a9a296044fd4b748786c2516f172a7617f1 Author: Wei-Lin Chang Date: Wed Jun 25 16:47:09 2025 +0800 KVM: arm64: nv: Fix MI line level calculation in vgic_v3_nested_update_mi() The state of the vcpu's MI line should be asserted when its ICH_HCR_EL2.En is set and ICH_MISR_EL2 is non-zero. Using bitwise AND (&=) directly for this calculation will not give us the correct result when the LSB of the vcpu's ICH_MISR_EL2 isn't set. Correct this by directly computing the line level with a logical AND operation. Signed-off-by: Wei-Lin Chang Link: https://lore.kernel.org/r/20250625084709.3968844-1-r09922117@csie.ntu.edu.tw [maz: drop the level check from the original code] Signed-off-by: Marc Zyngier commit 7ab6847a03229e73bb7c58ca397630f699e79b53 Author: Salvatore Bonaccorso Date: Wed Jun 25 20:41:28 2025 +0200 ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR The built-in mic of ASUS VivoBook X507UAR is broken recently by the fix of the pin sort. The fixup ALC256_FIXUP_ASUS_MIC_NO_PRESENCE is working for addressing the regression, too. Fixes: 3b4309546b48 ("ALSA: hda: Fix headset detection failure due to unstable sort") Reported-by: Igor Tamara Closes: https://bugs.debian.org/1108069 Signed-off-by: Salvatore Bonaccorso Link: https://lore.kernel.org/CADdHDco7_o=4h_epjEAb92Dj-vUz_PoTC2-W9g5ncT2E0NzfeQ@mail.gmail.com Signed-off-by: Takashi Iwai commit 346bd8a977fc559ef41099f727cdb0805f66bd10 Merge: 5e9571750c4e53 6c038b58a2dc5a Author: Takashi Iwai Date: Thu Jun 26 07:59:33 2025 +0200 Merge tag 'asoc-fix-v6.16-rc3' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.16 A small collection of fixes, the main one being a fix for resume from hibernation on AMD systems, plus a few new quirk entries for AMD systems. commit ccafe2821cfaa880cf4461307111b76df07c48fb Author: Herbert Xu Date: Wed Jun 25 11:42:27 2025 +0800 crypto: qat - Use crypto_shash_export_core Use crypto_shash_export_core to export the core hash state without the partial blocks. Signed-off-by: Herbert Xu commit d9408b8eea6dfb2c6cf1aef06b8344eac8052664 Author: Herbert Xu Date: Wed Jun 25 11:37:35 2025 +0800 crypto: chelsio - Use crypto_shash_export_core Use crypto_shash_export_core to export the core hash state without the partial blocks. Signed-off-by: Herbert Xu commit ee88bddf7f2f5d1f1da87dd7bedc734048b70e88 Merge: c5c2a8b497d69f 5e9388f7984a9c Author: Linus Torvalds Date: Wed Jun 25 21:09:02 2025 -0700 Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: - Fix use-after-free in libbpf when map is resized (Adin Scannell) - Fix verifier assumptions about 2nd argument of bpf_sysctl_get_name (Jerome Marchand) - Fix verifier assumption of nullness of d_inode in dentry (Song Liu) - Fix global starvation of LRU map (Willem de Bruijn) - Fix potential NULL dereference in btf_dump__free (Yuan Chen) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: adapt one more case in test_lru_map to the new target_free libbpf: Fix possible use-after-free for externs selftests/bpf: Convert test_sysctl to prog_tests bpf: Specify access type of bpf_sysctl_get_name args libbpf: Fix null pointer dereference in btf_dump__free on allocation failure bpf: Adjust free target to avoid global starvation of LRU map bpf: Mark dentry->d_inode as trusted_or_null commit ef6fac0f9e5d0695cee1d820c727fe753eca52d5 Author: Kent Overstreet Date: Wed Jun 25 14:55:59 2025 -0400 bcachefs: Plumb correct ip to trans_relock_fail tracepoint Signed-off-by: Kent Overstreet commit 64b6a788bd96a0cdc11073a2d1f85413b078c1f2 Author: Kent Overstreet Date: Wed Jun 25 00:48:14 2025 -0400 bcachefs: Ensure we rewind to run recovery passes Fix a 6.16 regression from the recovery pass rework, which introduced a bug where calling bch2_run_explicit_recovery_pass() would only return the error code to rewind recovery for the first call that scheduled that recovery pass. If the error code from the first call was swallowed (because it was called by an asynchronous codepath), subsequent calls would go "ok, this pass is already marked as needing to run" and return 0. Fixing this ensures that check_topology bails out to run btree_node_scan before doing any repair. Signed-off-by: Kent Overstreet commit 3e72acb78b73ccffeaf929c039dc5a0a7a147535 Author: Kent Overstreet Date: Wed Jun 25 12:45:11 2025 -0400 bcachefs: Ensure btree node scan runs before checking for scanned nodes Previously, calling bch2_btree_has_scanned_nodes() when btree node scan hadn't actually run would erroniously return false - causing us to think a btree was entirely gone. This fixes a 6.16 regression from moving the scheduling of btree node scan out of bch2_btree_lost_data() (fixing the bug where we'd schedule it persistently in the superblock) and only scheduling it when check_toploogy() is asking for scanned btree nodes. Signed-off-by: Kent Overstreet commit 1dcea07810c8bb4aba1bfed0bbe015b2d708a903 Author: Kent Overstreet Date: Wed Jun 25 12:17:51 2025 -0400 bcachefs: btree_root_unreadable_and_scan_found_nothing should not be autofix Autofix is specified in btree_gc.c if it's not an important btree. Signed-off-by: Kent Overstreet commit c5c2a8b497d69fb01d2563e383615a4eb69c72bc Merge: c4dce0c094a89b 0748e553df0225 Author: Linus Torvalds Date: Wed Jun 25 20:48:48 2025 -0700 Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull mount fixes from Al Viro: "Several mount-related fixes" * tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: userns and mnt_idmap leak in open_tree_attr(2) attach_recursive_mnt(): do not lock the covering tree when sliding something under it replace collect_mounts()/drop_collected_mounts() with a safer variant commit a433791aeaea6e84df709e0b9584b9bbe040cd1c Author: Kuniyuki Iwashima Date: Tue Jun 24 14:45:00 2025 -0700 atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). syzbot reported a warning below during atm_dev_register(). [0] Before creating a new device and procfs/sysfs for it, atm_dev_register() looks up a duplicated device by __atm_dev_lookup(). These operations are done under atm_dev_mutex. However, when removing a device in atm_dev_deregister(), it releases the mutex just after removing the device from the list that __atm_dev_lookup() iterates over. So, there will be a small race window where the device does not exist on the device list but procfs/sysfs are still not removed, triggering the splat. Let's hold the mutex until procfs/sysfs are removed in atm_dev_deregister(). [0]: proc_dir_entry 'atm/atmtcp:0' already registered WARNING: CPU: 0 PID: 5919 at fs/proc/generic.c:377 proc_register+0x455/0x5f0 fs/proc/generic.c:377 Modules linked in: CPU: 0 UID: 0 PID: 5919 Comm: syz-executor284 Not tainted 6.16.0-rc2-syzkaller-00047-g52da431bf03b #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:proc_register+0x455/0x5f0 fs/proc/generic.c:377 Code: 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 a2 01 00 00 48 8b 44 24 10 48 c7 c7 20 c0 c2 8b 48 8b b0 d8 00 00 00 e8 0c 02 1c ff 90 <0f> 0b 90 90 48 c7 c7 80 f2 82 8e e8 0b de 23 09 48 8b 4c 24 28 48 RSP: 0018:ffffc9000466fa30 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817ae248 RDX: ffff888026280000 RSI: ffffffff817ae255 RDI: 0000000000000001 RBP: ffff8880232bed48 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: ffff888076ed2140 R13: dffffc0000000000 R14: ffff888078a61340 R15: ffffed100edda444 FS: 00007f38b3b0c6c0(0000) GS:ffff888124753000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f38b3bdf953 CR3: 0000000076d58000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: proc_create_data+0xbe/0x110 fs/proc/generic.c:585 atm_proc_dev_register+0x112/0x1e0 net/atm/proc.c:361 atm_dev_register+0x46d/0x890 net/atm/resources.c:113 atmtcp_create+0x77/0x210 drivers/atm/atmtcp.c:369 atmtcp_attach drivers/atm/atmtcp.c:403 [inline] atmtcp_ioctl+0x2f9/0xd60 drivers/atm/atmtcp.c:464 do_vcc_ioctl+0x12c/0x930 net/atm/ioctl.c:159 sock_do_ioctl+0x115/0x280 net/socket.c:1190 sock_ioctl+0x227/0x6b0 net/socket.c:1311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __x64_sys_ioctl+0x18b/0x210 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f38b3b74459 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f38b3b0c198 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f38b3bfe318 RCX: 00007f38b3b74459 RDX: 0000000000000000 RSI: 0000000000006180 RDI: 0000000000000005 RBP: 00007f38b3bfe310 R08: 65732f636f72702f R09: 65732f636f72702f R10: 65732f636f72702f R11: 0000000000000246 R12: 00007f38b3bcb0ac R13: 00007f38b3b0c1a0 R14: 0000200000000200 R15: 00007f38b3bcb03b Fixes: 64bf69ddff76 ("[ATM]: deregistration removes device from atm_devs list immediately") Reported-by: syzbot+8bd335d2ad3b93e80715@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/685316de.050a0220.216029.0087.GAE@google.com/ Tested-by: syzbot+8bd335d2ad3b93e80715@syzkaller.appspotmail.com Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250624214505.570679-1-kuni1840@gmail.com Signed-off-by: Jakub Kicinski commit c0cb210a87fcdda3c25f43b5a64420e6b07d3f53 Author: Lorenzo Stoakes Date: Wed Jun 25 10:52:31 2025 +0100 MAINTAINERS: add Lorenzo as THP co-maintainer I am doing a great deal of review and getting ever more involved in THP with intent to do more so in future also, so add myself as co-maintainer to help David with workload. Link: https://lkml.kernel.org/r/20250625095231.42874-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: David Hildenbrand Acked-by: Baolin Wang Acked-by: Dev Jain Acked-by: Zi Yan Acked-by: Oscar Salvador Cc: Barry Song Cc: Liam Howlett Cc: Mariano Pache Cc: Ryan Roberts Signed-off-by: Andrew Morton commit 02d67850aecaf2306d849a3c804a125bb4f9c5f6 Author: Duje Mihanović Date: Fri Jun 20 11:25:35 2025 +0200 mailmap: update Duje Mihanović's email address I'm switching to a new mail address, so map my old one to it. Link: https://lkml.kernel.org/r/20250620-mailmap-v1-1-a6b4b72dbd07@dujemihanovic.xyz Signed-off-by: Duje Mihanović Cc: Karel Balej Signed-off-by: Andrew Morton commit 7c942f87cc0be5699b1ce434d369eccd8b5321d4 Author: Dev Jain Date: Fri Jun 20 16:41:50 2025 +0530 selftests/mm: fix validate_addr() helper validate_addr() checks whether the address returned by mmap() lies in the low or high VA space, according to whether a high addr hint was passed or not. The fix commit mentioned below changed the code in such a way that this function will always return failure when passed high_addr == 1; addr will be >= HIGH_ADDR_MARK always, we will fall down to "if (addr > HIGH_ADDR_MARK)" and return failure. Fix this. Link: https://lkml.kernel.org/r/20250620111150.50344-1-dev.jain@arm.com Fixes: d1d86ce28d0f ("selftests/mm: virtual_address_range: conform to TAP format output") Signed-off-by: Dev Jain Reviewed-by: Donet Tom Acked-by: David Hildenbrand Cc: Anshuman Khandual Cc: Lorenzo Stoakes Cc: Ryan Roberts Cc: Shuah Khan Signed-off-by: Andrew Morton commit b6f5e748587063d4ad3294d07ca29886851d9cd7 Author: Arnd Bergmann Date: Fri Jun 20 13:21:22 2025 +0200 crashdump: add CONFIG_KEYS dependency The dm_crypt code fails to build without CONFIG_KEYS: kernel/crash_dump_dm_crypt.c: In function 'restore_dm_crypt_keys_to_thread_keyring': kernel/crash_dump_dm_crypt.c:105:9: error: unknown type name 'key_ref_t'; did you mean 'key_ref_put'? There is a mix of 'select KEYS' and 'depends on KEYS' in Kconfig, so there is no single obvious solution here, but generally using 'depends on' makes more sense and is less likely to cause dependency loops. Link: https://lkml.kernel.org/r/20250620112140.3396316-1-arnd@kernel.org Fixes: 62f17d9df692 ("crash_dump: retrieve dm crypt keys in kdump kernel") Signed-off-by: Arnd Bergmann Cc: Alexander Graf Cc: Baoquan He Cc: Coiby Xu Cc: Dave Vasilevsky Cc: Eric Biggers Cc: Michael Ellerman Signed-off-by: Andrew Morton commit c9e8efa0b384c43670852f955567b31a5eb4ac2b Author: Zijun Hu Date: Fri Jun 20 19:53:54 2025 +0800 mailmap: correct name for a historical account of Zijun Hu Correct the name for from 'zijun_hu' to 'Zijun Hu'. Link: https://lkml.kernel.org/r/20250620-my_mailmap-v1-2-11ea3db8ba1e@oss.qualcomm.com Signed-off-by: Zijun Hu Cc: Hans verkuil Signed-off-by: Andrew Morton commit b160a5cc6ac761f341e58e48ae3f03a04d310677 Author: Zijun Hu Date: Fri Jun 20 19:53:53 2025 +0800 mailmap: add entries for Zijun Hu Map my old qualcomm email addresses: Zijun Hu Zijun Hu To the current one: Zijun Hu Link: https://lkml.kernel.org/r/20250620-my_mailmap-v1-1-11ea3db8ba1e@oss.qualcomm.com Signed-off-by: Zijun Hu Cc: Hans verkuil Signed-off-by: Andrew Morton commit befd9a71d859ea625eaa84dae1b243efb3df3eca Author: Haiyue Wang Date: Sun Jun 22 01:13:51 2025 +0800 fuse: fix runtime warning on truncate_folio_batch_exceptionals() The WARN_ON_ONCE is introduced on truncate_folio_batch_exceptionals() to capture whether the filesystem has removed all DAX entries or not. And the fix has been applied on the filesystem xfs and ext4 by the commit 0e2f80afcfa6 ("fs/dax: ensure all pages are idle prior to filesystem unmount"). Apply the missed fix on filesystem fuse to fix the runtime warning: [ 2.011450] ------------[ cut here ]------------ [ 2.011873] WARNING: CPU: 0 PID: 145 at mm/truncate.c:89 truncate_folio_batch_exceptionals+0x272/0x2b0 [ 2.012468] Modules linked in: [ 2.012718] CPU: 0 UID: 1000 PID: 145 Comm: weston Not tainted 6.16.0-rc2-WSL2-STABLE #2 PREEMPT(undef) [ 2.013292] RIP: 0010:truncate_folio_batch_exceptionals+0x272/0x2b0 [ 2.013704] Code: 48 63 d0 41 29 c5 48 8d 1c d5 00 00 00 00 4e 8d 6c 2a 01 49 c1 e5 03 eb 09 48 83 c3 08 49 39 dd 74 83 41 f6 44 1c 08 01 74 ef <0f> 0b 49 8b 34 1e 48 89 ef e8 10 a2 17 00 eb df 48 8b 7d 00 e8 35 [ 2.014845] RSP: 0018:ffffa47ec33f3b10 EFLAGS: 00010202 [ 2.015279] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 2.015884] RDX: 0000000000000000 RSI: ffffa47ec33f3ca0 RDI: ffff98aa44f3fa80 [ 2.016377] RBP: ffff98aa44f3fbf0 R08: ffffa47ec33f3ba8 R09: 0000000000000000 [ 2.016942] R10: 0000000000000001 R11: 0000000000000000 R12: ffffa47ec33f3ca0 [ 2.017437] R13: 0000000000000008 R14: ffffa47ec33f3ba8 R15: 0000000000000000 [ 2.017972] FS: 000079ce006afa40(0000) GS:ffff98aade441000(0000) knlGS:0000000000000000 [ 2.018510] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2.018987] CR2: 000079ce03e74000 CR3: 000000010784f006 CR4: 0000000000372eb0 [ 2.019518] Call Trace: [ 2.019729] [ 2.019901] truncate_inode_pages_range+0xd8/0x400 [ 2.020280] ? timerqueue_add+0x66/0xb0 [ 2.020574] ? get_nohz_timer_target+0x2a/0x140 [ 2.020904] ? timerqueue_add+0x66/0xb0 [ 2.021231] ? timerqueue_del+0x2e/0x50 [ 2.021646] ? __remove_hrtimer+0x39/0x90 [ 2.022017] ? srso_alias_untrain_ret+0x1/0x10 [ 2.022497] ? psi_group_change+0x136/0x350 [ 2.023046] ? _raw_spin_unlock+0xe/0x30 [ 2.023514] ? finish_task_switch.isra.0+0x8d/0x280 [ 2.024068] ? __schedule+0x532/0xbd0 [ 2.024551] fuse_evict_inode+0x29/0x190 [ 2.025131] evict+0x100/0x270 [ 2.025641] ? _atomic_dec_and_lock+0x39/0x50 [ 2.026316] ? __pfx_generic_delete_inode+0x10/0x10 [ 2.026843] __dentry_kill+0x71/0x180 [ 2.027335] dput+0xeb/0x1b0 [ 2.027725] __fput+0x136/0x2b0 [ 2.028054] __x64_sys_close+0x3d/0x80 [ 2.028469] do_syscall_64+0x6d/0x1b0 [ 2.028832] ? clear_bhb_loop+0x30/0x80 [ 2.029182] ? clear_bhb_loop+0x30/0x80 [ 2.029533] ? clear_bhb_loop+0x30/0x80 [ 2.029902] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 2.030423] RIP: 0033:0x79ce03d0d067 [ 2.030820] Code: b8 ff ff ff ff e9 3e ff ff ff 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 c3 a7 f8 ff [ 2.032354] RSP: 002b:00007ffef0498948 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 2.032939] RAX: ffffffffffffffda RBX: 00007ffef0498960 RCX: 000079ce03d0d067 [ 2.033612] RDX: 0000000000000003 RSI: 0000000000001000 RDI: 000000000000000d [ 2.034289] RBP: 00007ffef0498a30 R08: 000000000000000d R09: 0000000000000000 [ 2.034944] R10: 00007ffef0498978 R11: 0000000000000246 R12: 0000000000000001 [ 2.035610] R13: 00007ffef0498960 R14: 000079ce03e09ce0 R15: 0000000000000003 [ 2.036301] [ 2.036532] ---[ end trace 0000000000000000 ]--- Link: https://lkml.kernel.org/r/20250621171507.3770-1-haiyuewa@163.com Fixes: bde708f1a65d ("fs/dax: always remove DAX page-cache entries when breaking layouts") Signed-off-by: Haiyue Wang Cc: Alistair Popple Cc: Dan Williams Cc: Miklos Szeredi Cc: Signed-off-by: Andrew Morton commit 79300ac805b672a84b64d80d4cbc374d83411599 Author: Florian Fainelli Date: Thu Jun 19 15:51:05 2025 -0700 scripts/gdb: fix dentry_name() lookup The "d_iname" member was replaced with "d_shortname.string" in the commit referenced in the Fixes tag. This prevented the GDB script "lx-mount" command to properly function: (gdb) lx-mounts mount super_block devname pathname fstype options 0xff11000002d21180 0xff11000002d24800 rootfs / rootfs rw 0 0 0xff11000002e18a80 0xff11000003713000 /dev/root / ext4 rw,relatime 0 0 Python Exception : There is no member named d_iname. Error occurred in Python: There is no member named d_iname. Link: https://lkml.kernel.org/r/20250619225105.320729-1-florian.fainelli@broadcom.com Fixes: 58cf9c383c5c ("dcache: back inline names with a struct-wrapped array of unsigned long") Signed-off-by: Florian Fainelli Cc: Al Viro Cc: Jan Kara Cc: Jan Kiszka Cc: Jeff Layton Cc: Kieran Bingham Cc: Signed-off-by: Andrew Morton commit 4f489fe6afb395dbc79840efa3c05440b760d883 Author: SeongJae Park Date: Thu Jun 19 11:36:07 2025 -0700 mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write memcg_path_store() assigns a newly allocated memory buffer to filter->memcg_path, without deallocating the previously allocated and assigned memory buffer. As a result, users can leak kernel memory by continuously writing a data to memcg_path DAMOS sysfs file. Fix the leak by deallocating the previously set memory buffer. Link: https://lkml.kernel.org/r/20250619183608.6647-2-sj@kernel.org Fixes: 7ee161f18b5d ("mm/damon/sysfs-schemes: implement filter directory") Signed-off-by: SeongJae Park Cc: Shuah Khan Cc: [6.3.x] Signed-off-by: Andrew Morton commit f5769359c5b241978e6933672bb78b3adc36aa18 Author: Hao Ge Date: Fri Jun 20 02:31:54 2025 +0800 mm/alloc_tag: fix the kmemleak false positive issue in the allocation of the percpu variable tag->counters When loading a module, as long as the module has memory allocation operations, kmemleak produces a false positive report that resembles the following: unreferenced object (percpu) 0x7dfd232a1650 (size 16): comm "modprobe", pid 1301, jiffies 4294940249 hex dump (first 16 bytes on cpu 2): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 0): kmemleak_alloc_percpu+0xb4/0xd0 pcpu_alloc_noprof+0x700/0x1098 load_module+0xd4/0x348 codetag_module_init+0x20c/0x450 codetag_load_module+0x70/0xb8 load_module+0xef8/0x1608 init_module_from_file+0xec/0x158 idempotent_init_module+0x354/0x608 __arm64_sys_finit_module+0xbc/0x150 invoke_syscall+0xd4/0x258 el0_svc_common.constprop.0+0xb4/0x240 do_el0_svc+0x48/0x68 el0_svc+0x40/0xf8 el0t_64_sync_handler+0x10c/0x138 el0t_64_sync+0x1ac/0x1b0 This is because the module can only indirectly reference alloc_tag_counters through the alloc_tag section, which misleads kmemleak. However, we don't have a kmemleak ignore interface for percpu allocations yet. So let's create one and invoke it for tag->counters. [gehao@kylinos.cn: fix build error when CONFIG_DEBUG_KMEMLEAK=n, s/igonore/ignore/] Link: https://lkml.kernel.org/r/20250620093102.2416767-1-hao.ge@linux.dev Link: https://lkml.kernel.org/r/20250619183154.2122608-1-hao.ge@linux.dev Fixes: 12ca42c23775 ("alloc_tag: allocate percpu counters for module tags dynamically") Signed-off-by: Hao Ge Reviewed-by: Catalin Marinas Acked-by: Suren Baghdasaryan [lib/alloc_tag.c] Cc: Kent Overstreet Signed-off-by: Andrew Morton commit df831e97739405ecbaddb85516bc7d4d1c933d6b Author: Yu Kuai Date: Thu Jun 19 21:26:55 2025 +0800 lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() While testing null_blk with configfs, echo 0 > poll_queues will trigger following panic: BUG: kernel NULL pointer dereference, address: 0000000000000010 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 27 UID: 0 PID: 920 Comm: bash Not tainted 6.15.0-02023-gadbdb95c8696-dirty #1238 PREEMPT(undef) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:__bitmap_or+0x48/0x70 Call Trace: __group_cpus_evenly+0x822/0x8c0 group_cpus_evenly+0x2d9/0x490 blk_mq_map_queues+0x1e/0x110 null_map_queues+0xc9/0x170 [null_blk] blk_mq_update_queue_map+0xdb/0x160 blk_mq_update_nr_hw_queues+0x22b/0x560 nullb_update_nr_hw_queues+0x71/0xf0 [null_blk] nullb_device_poll_queues_store+0xa4/0x130 [null_blk] configfs_write_iter+0x109/0x1d0 vfs_write+0x26e/0x6f0 ksys_write+0x79/0x180 __x64_sys_write+0x1d/0x30 x64_sys_call+0x45c4/0x45f0 do_syscall_64+0xa5/0x240 entry_SYSCALL_64_after_hwframe+0x76/0x7e Root cause is that numgrps is set to 0, and ZERO_SIZE_PTR is returned from kcalloc(), and later ZERO_SIZE_PTR will be deferenced. Fix the problem by checking numgrps first in group_cpus_evenly(), and return NULL directly if numgrps is zero. [yukuai3@huawei.com: also fix the non-SMP version] Link: https://lkml.kernel.org/r/20250620010958.1265984-1-yukuai1@huaweicloud.com Link: https://lkml.kernel.org/r/20250619132655.3318883-1-yukuai1@huaweicloud.com Fixes: 6a6dcae8f486 ("blk-mq: Build default queue map via group_cpus_evenly()") Signed-off-by: Yu Kuai Reviewed-by: Ming Lei Reviewed-by: Jens Axboe Cc: ErKun Yang Cc: John Garry Cc: Thomas Gleinxer Cc: "zhangyi (F)" Cc: Signed-off-by: Andrew Morton commit 344ef45b03336e7f74658814f66483b5417c9cf1 Author: Ge Yang Date: Tue May 27 11:36:50 2025 +0800 mm/hugetlb: remove unnecessary holding of hugetlb_lock In isolate_or_dissolve_huge_folio(), after acquiring the hugetlb_lock, it is only for the purpose of obtaining the correct hstate, which is then passed to alloc_and_dissolve_hugetlb_folio(). alloc_and_dissolve_hugetlb_folio() itself also acquires the hugetlb_lock. We can have alloc_and_dissolve_hugetlb_folio() obtain the hstate by itself, so that isolate_or_dissolve_huge_folio() no longer needs to acquire the hugetlb_lock. In addition, we keep the folio_test_hugetlb() check within isolate_or_dissolve_huge_folio(). By doing so, we can avoid disrupting the normal path by vainly holding the hugetlb_lock. replace_free_hugepage_folios() has the same issue, and we should address it as well. Addresses a possible performance problem which was added by the hotfix 113ed54ad276 ("mm/hugetlb: fix kernel NULL pointer dereference when replacing free hugetlb folios"). Link: https://lkml.kernel.org/r/1748317010-16272-1-git-send-email-yangge1116@126.com Fixes: 113ed54ad276 ("mm/hugetlb: fix kernel NULL pointer dereference when replacing free hugetlb folios") Signed-off-by: Ge Yang Suggested-by: Oscar Salvador Reviewed-by: Muchun Song Cc: Baolin Wang Cc: Barry Song <21cnbao@gmail.com> Cc: David Hildenbrand Cc: Signed-off-by: Andrew Morton commit 3746351e876b42f5221c2f85ba60965b38494ff2 Author: Lorenzo Stoakes Date: Wed Jun 18 11:59:53 2025 +0100 MAINTAINERS: add missing files to mm page alloc section There are a number of files within memory management which appear to be most suitably placed within the page allocation section of MAINTAINERS and are otherwise unassigned, so place these there. Link: https://lkml.kernel.org/r/20250618105953.67630-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: Vlastimil Babka Acked-by: Brendan Jackman Acked-by: Zi Yan Acked-by: David Hildenbrand Cc: Johannes Weiner Cc: Michal Hocko Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 71aa17fd981be2ef683bf83326128c505abe070c Author: Mike Rapoport (Microsoft) Date: Wed Jun 18 19:47:52 2025 +0300 MAINTAINERS: add tree entry to mm init block Link: https://lkml.kernel.org/r/aFLubPfiO5hqfhCe@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Cc: Lorenzo Stoakes Signed-off-by: Andrew Morton commit 86bc5752a9173589271439911b33b4d952b0a91f Author: Michal Hocko Date: Tue Jun 17 10:58:19 2025 +0200 mm: add OOM killer maintainer structure Add MAINTAINERS info for the oom-killer. [akpm@linux-foundation.org: fix mhocko email address (SeongJae), add files (Lorenzo)] [akpm@linux-foundation.org: fix ordering] Link: https://lkml.kernel.org/r/20250617085819.355838-1-mhocko@kernel.org Signed-off-by: Michal Hocko Acked-by: David Rientjes Acked-by: Shakeel Butt Acked-by: Lorenzo Stoakes Acked-by: SeongJae Park Acked-by: Vlastimil Babka Cc: Michal Hocko Signed-off-by: Andrew Morton commit 4a5e85f4eb8fd18b1266342d100e4f0849544ca0 Author: David Hildenbrand Date: Tue Jun 17 16:35:32 2025 +0200 fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio is_zero_pfn() does not work for the huge zero folio. Fix it by using is_huge_zero_pmd(). This can cause the PAGEMAP_SCAN ioctl against /proc/pid/pagemap to present pages as PAGE_IS_PRESENT rather than as PAGE_IS_PFNZERO. Found by code inspection. Link: https://lkml.kernel.org/r/20250617143532.2375383-1-david@redhat.com Fixes: 52526ca7fdb9 ("fs/proc/task_mmu: implement IOCTL to get and optionally clear info about PTEs") Signed-off-by: David Hildenbrand Cc: Muhammad Usama Anjum Cc: Signed-off-by: Andrew Morton commit 9186c43c1f000ce18069b429afcc725c2997d040 Merge: 7b515f35a911fd af852f1f1c951d Author: Jakub Kicinski Date: Wed Jun 25 15:36:30 2025 -0700 Merge branch 'netlink-specs-enforce-strict-naming-of-properties' Jakub Kicinski says: ==================== netlink: specs: enforce strict naming of properties I got annoyed once again by the name properties in the ethtool spec which use underscore instead of dash. I previously assumed that there is a lot of such properties in the specs so fixing them now would be near impossible. On a closer look, however, I only found 22 (rough grep suggests we have ~4.8k names in the specs, so bad ones are just 0.46%). Add a regex to the JSON schema to enforce the naming, fix the few bad names. I was hoping we could start enforcing this from newer families, but there's no correlation between the protocol and the number of errors. If anything classic netlink has more recently added specs so it has fewer errors. The regex is just for name properties which will end up visible to the user (in Python or YNL CLI). I left the c-name properties alone, those don't matter as much. C codegen rewrites them, anyway. I'm not updating the spec for genetlink-c. Looks like it has no users, new families use genetlink, all old ones need genetlink-legacy. If these patches are merged I will remove genetlink-c completely in net-next. ==================== Link: https://patch.msgid.link/20250624211002.3475021-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit af852f1f1c951d43b36881302fd10d9f898cdb54 Author: Jakub Kicinski Date: Tue Jun 24 14:10:02 2025 -0700 netlink: specs: enforce strict naming of properties Add a regexp to make sure all names which may end up being visible to the user consist of lower case characters, numbers and dashes. Underscores keep sneaking into the specs, which is not visible in the C code but makes the Python and alike inconsistent. Note that starting with a number is okay, as in C the full name will include the family name. For legacy families we can't enforce the naming in the family name or the multicast group names, as these are part of the binary uAPI of the kernel. For classic netlink we need to allow capital letters in names of struct members. TC has some structs with capitalized members. Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250624211002.3475021-11-kuba@kernel.org Signed-off-by: Jakub Kicinski commit eef0eaeca7fa8e358a31e89802f564451b797718 Author: Jakub Kicinski Date: Tue Jun 24 14:10:01 2025 -0700 netlink: specs: tc: replace underscores with dashes in names We're trying to add a strict regexp for the name format in the spec. Underscores will not be allowed, dashes should be used instead. This makes no difference to C (codegen, if used, replaces special chars in names) but it gives more uniform naming in Python. Fixes: a1bcfde83669 ("doc/netlink/specs: Add a spec for tc") Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250624211002.3475021-10-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 8d7e211ea925e050882c762ddf8cf2da78856dfb Author: Jakub Kicinski Date: Tue Jun 24 14:10:00 2025 -0700 netlink: specs: rt-link: replace underscores with dashes in names We're trying to add a strict regexp for the name format in the spec. Underscores will not be allowed, dashes should be used instead. This makes no difference to C (codegen, if used, replaces special chars in names) but it gives more uniform naming in Python. Fixes: b2f63d904e72 ("doc/netlink: Add spec for rt link messages") Reviewed-by: Jacob Keller Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250624211002.3475021-9-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 9e6dd4c256d0774701637b958ba682eff4991277 Author: Jakub Kicinski Date: Tue Jun 24 14:09:59 2025 -0700 netlink: specs: mptcp: replace underscores with dashes in names We're trying to add a strict regexp for the name format in the spec. Underscores will not be allowed, dashes should be used instead. This makes no difference to C (codegen, if used, replaces special chars in names) but it gives more uniform naming in Python. Fixes: bc8aeb2045e2 ("Documentation: netlink: add a YAML spec for mptcp") Reviewed-by: Davide Caratti Reviewed-by: Donald Hunter Reviewed-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250624211002.3475021-8-kuba@kernel.org Signed-off-by: Jakub Kicinski commit e40d3d0931d2b1e86ba2ca0e9c95f90ac6dd5525 Author: Jakub Kicinski Date: Tue Jun 24 14:09:58 2025 -0700 netlink: specs: ovs_flow: replace underscores with dashes in names We're trying to add a strict regexp for the name format in the spec. Underscores will not be allowed, dashes should be used instead. This makes no difference to C (codegen, if used, replaces special chars in names) but it gives more uniform naming in Python. Fixes: 93b230b549bc ("netlink: specs: add ynl spec for ovs_flow") Reviewed-by: Donald Hunter Reviewed-by: Ilya Maximets Reviewed-by: Eelco Chaudron Link: https://patch.msgid.link/20250624211002.3475021-7-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 9407680945145cc34fafd0e9f802b03574620d43 Author: Jakub Kicinski Date: Tue Jun 24 14:09:57 2025 -0700 netlink: specs: devlink: replace underscores with dashes in names We're trying to add a strict regexp for the name format in the spec. Underscores will not be allowed, dashes should be used instead. This makes no difference to C (codegen, if used, replaces special chars in names) but it gives more uniform naming in Python. Fixes: 429ac6211494 ("devlink: define enum for attr types of dynamic attributes") Fixes: f2f9dd164db0 ("netlink: specs: devlink: add the remaining command to generate complete split_ops") Reviewed-by: Jacob Keller Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250624211002.3475021-6-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 354592f19c7b0ac5983d56d8594a76aa3437f0a6 Author: Jakub Kicinski Date: Tue Jun 24 14:09:56 2025 -0700 netlink: specs: dpll: replace underscores with dashes in names We're trying to add a strict regexp for the name format in the spec. Underscores will not be allowed, dashes should be used instead. This makes no difference to C (codegen, if used, replaces special chars in names) but it gives more uniform naming in Python. Fixes: 3badff3a25d8 ("dpll: spec: Add Netlink spec in YAML") Reviewed-by: Vadim Fedorenko Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250624211002.3475021-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 07caaf875c937e5f0a262a1dbad307d08ecc8673 Author: Jakub Kicinski Date: Tue Jun 24 14:09:55 2025 -0700 netlink: specs: ethtool: replace underscores with dashes in names We're trying to add a strict regexp for the name format in the spec. Underscores will not be allowed, dashes should be used instead. This makes no difference to C (codegen replaces special chars in names) but gives more uniform naming in Python. Fixes: 13e59344fb9d ("net: ethtool: add support for symmetric-xor RSS hash") Fixes: 46fb3ba95b93 ("ethtool: Add an interface for flashing transceiver modules' firmware") Reviewed-by: Kory Maincent Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250624211002.3475021-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 791a9ed0a40dfa70fe793dcecf950273255cbb84 Author: Jakub Kicinski Date: Tue Jun 24 14:09:54 2025 -0700 netlink: specs: fou: replace underscores with dashes in names We're trying to add a strict regexp for the name format in the spec. Underscores will not be allowed, dashes should be used instead. This makes no difference to C (codegen, if used, replaces special chars in names) but it gives more uniform naming in Python. Fixes: 4eb77b4ecd3c ("netlink: add a proto specification for FOU") Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250624211002.3475021-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 2434ccb94dfc8e036c81e9d7c77fca6dc1dc2590 Author: Jakub Kicinski Date: Tue Jun 24 14:09:53 2025 -0700 netlink: specs: nfsd: replace underscores with dashes in names We're trying to add a strict regexp for the name format in the spec. Underscores will not be allowed, dashes should be used instead. This makes no difference to C (codegen, if used, replaces special chars in names) but it gives more uniform naming in Python. Fixes: 13727f85b49b ("NFSD: introduce netlink stubs") Reviewed-by: Donald Hunter Reviewed-by: Jeff Layton Link: https://patch.msgid.link/20250624211002.3475021-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 7b515f35a911fdc31fbde6531828dcd6ae9803d3 Author: Simon Horman Date: Tue Jun 24 17:35:12 2025 +0100 net: enetc: Correct endianness handling in _enetc_rd_reg64 enetc_hw.h provides two versions of _enetc_rd_reg64. One which simply calls ioread64() when available. And another that composes the 64-bit result from ioread32() calls. In the second case the code appears to assume that each ioread32() call returns a little-endian value. However both the shift and logical or used to compose the return value would not work correctly on big endian systems if this were the case. Moreover, this is inconsistent with the first case where the return value of ioread64() is assumed to be in host byte order. It appears that the correct approach is for both versions to treat the return value of ioread*() functions as being in host byte order. And this patch corrects the ioread32()-based version to do so. This is a bug but would only manifest on big endian systems that make use of the ioread32-based implementation of _enetc_rd_reg64. While all in-tree users of this driver are little endian and make use of the ioread64-based implementation of _enetc_rd_reg64. Thus, no in-tree user of this driver is affected by this bug. Flagged by Sparse. Compile tested only. Fixes: 16eb4c85c964 ("enetc: Add ethtool statistics") Closes: https://lore.kernel.org/all/AM9PR04MB850500D3FC24FE23DEFCEA158879A@AM9PR04MB8505.eurprd04.prod.outlook.com/ Signed-off-by: Simon Horman Reviewed-by: Wei Fang Link: https://patch.msgid.link/20250624-etnetc-le-v1-1-a73a95d96e4e@kernel.org Signed-off-by: Jakub Kicinski commit c4890963350dcf4e9a909bae23665921fba4ad27 Author: Thomas Fourier Date: Tue Jun 24 08:41:47 2025 +0200 atm: idt77252: Add missing `dma_map_error()` The DMA map functions can fail and should be tested for errors. Signed-off-by: Thomas Fourier Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250624064148.12815-3-fourier.thomas@gmail.com Signed-off-by: Jakub Kicinski commit 5e9388f7984a9cc7e659a105113f6ccf0aebedd0 Author: Willem de Bruijn Date: Wed Jun 25 17:03:55 2025 -0400 selftests/bpf: adapt one more case in test_lru_map to the new target_free The below commit that updated BPF_MAP_TYPE_LRU_HASH free target, also updated tools/testing/selftests/bpf/test_lru_map to match. But that missed one case that passes with 4 cores, but fails at higher cpu counts. Update test_lru_sanity3 to also adjust its expectation of target_free. This time tested with 1, 4, 16, 64 and 384 cpu count. Fixes: d4adf1c9ee77 ("bpf: Adjust free target to avoid global starvation of LRU map") Signed-off-by: Willem de Bruijn Link: https://lore.kernel.org/r/20250625210412.2732970-1-willemdebruijn.kernel@gmail.com Signed-off-by: Alexei Starovoitov commit 666c23af755dccca8c25b5d5200ca28153c69a05 Author: Christophe JAILLET Date: Sat Jun 14 16:59:26 2025 +0200 i2c: omap: Fix an error handling path in omap_i2c_probe() If an error occurs after calling mux_state_select(), mux_state_deselect() should be called as already done in the remove function. Fixes: b6ef830c60b6 ("i2c: omap: Add support for setting mux") Signed-off-by: Christophe JAILLET Cc: # v6.15+ Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/998542981b6d2435c057dd8b9fe71743927babab.1749913149.git.christophe.jaillet@wanadoo.fr commit 577c1e0ef351e41aba764816232a9feb7a9b3969 Author: Pratap Nirujogi Date: Mon Jun 9 11:53:57 2025 -0400 platform/x86: Use i2c adapter name to fix build errors Use adapater->name inplace of adapter->owner->name to fix build issues when CONFIG_MODULES is not defined. Fixes: 90b85567e457 ("platform/x86: Add AMD ISP platform config for OV05C10") Reported-by: Randy Dunlap Link: https://lore.kernel.org/all/04577a46-9add-420c-b181-29bad582026d@infradead.org Tested-by: Randy Dunlap Signed-off-by: Pratap Nirujogi Requires: 942e1aece13e ("i2c: designware: Initialize adapter name only when not set" Requires: c8dc57916973 ("i2c: amd-isp: Initialize unique adapter name") Acked-by: Ilpo Järvinen Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250609155601.1477055-4-pratap.nirujogi@amd.com commit c8dc579169738a3546f57ecb38e62d3872a3cc04 Author: Pratap Nirujogi Date: Mon Jun 9 11:53:56 2025 -0400 i2c: amd-isp: Initialize unique adapter name Initialize unique name for amdisp i2c adapter, which is used in the platform driver to detect the matching adapter for i2c_client creation. Add definition of amdisp i2c adapter name in a new header file (include/linux/soc/amd/isp4_misc.h) as it is referred in different driver modules. Tested-by: Randy Dunlap Signed-off-by: Pratap Nirujogi Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250609155601.1477055-3-pratap.nirujogi@amd.com commit 942e1aece13e4007656e41d3182c0adf05cf08b8 Author: Pratap Nirujogi Date: Mon Jun 9 11:53:55 2025 -0400 i2c: designware: Initialize adapter name only when not set Check if the adapter name is already set in the driver prior to initializing with generic name in i2c_dw_probe_master(). This check allows to retain the unique adapter name driver has initialized, which platform driver can use to distinguish it from other i2c designware adapters. Tested-by: Randy Dunlap Signed-off-by: Pratap Nirujogi Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250609155601.1477055-2-pratap.nirujogi@amd.com commit cbdb25ccf7566eee0c2b945e35cb98baf9ed0aa6 Author: Wolfram Sang Date: Thu May 22 08:43:49 2025 +0200 i2c: tiny-usb: disable zero-length read messages This driver passes the length of an i2c_msg directly to usb_control_msg(). If the message is now a read and of length 0, it violates the USB protocol and a warning will be printed. Enable the I2C_AQ_NO_ZERO_LEN_READ quirk for this adapter thus forbidding 0-length read messages altogether. Fixes: e8c76eed2ecd ("i2c: New i2c-tiny-usb bus driver") Signed-off-by: Wolfram Sang Cc: # v2.6.22+ Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250522064349.3823-2-wsa+renesas@sang-engineering.com commit 56ad91c1aa9c18064348edf69308080b03c9dc48 Author: Wolfram Sang Date: Thu May 22 08:42:35 2025 +0200 i2c: robotfuzz-osif: disable zero-length read messages This driver passes the length of an i2c_msg directly to usb_control_msg(). If the message is now a read and of length 0, it violates the USB protocol and a warning will be printed. Enable the I2C_AQ_NO_ZERO_LEN_READ quirk for this adapter thus forbidding 0-length read messages altogether. Fixes: 83e53a8f120f ("i2c: Add bus driver for for OSIF USB i2c device.") Signed-off-by: Wolfram Sang Cc: # v3.14+ Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250522064234.3721-2-wsa+renesas@sang-engineering.com commit a5d0b9e32745277644cda8d7d334e7080bd339bf Author: Lukasz Kucharczyk Date: Tue May 20 14:22:52 2025 +0200 i2c: imx: fix emulated smbus block read Acknowledge the byte count submitted by the target. When I2C_SMBUS_BLOCK_DATA read operation is executed by i2c_smbus_xfer_emulated(), the length of the second (read) message is set to 1. Length of the block is supposed to be obtained from the target by the underlying bus driver. The i2c_imx_isr_read() function should emit the acknowledge on i2c bus after reading the first byte (i.e., byte count) while processing such message (as defined in Section 6.5.7 of System Management Bus Specification [1]). Without this acknowledge, the target does not submit subsequent bytes and the controller only reads 0xff's. In addition, store the length of block data obtained from the target in the buffer provided by i2c_smbus_xfer_emulated() - otherwise the first byte of actual data is erroneously interpreted as length of the data block. [1] https://smbus.org/specs/SMBus_3_3_20240512.pdf Fixes: 5f5c2d4579ca ("i2c: imx: prevent rescheduling in non dma mode") Signed-off-by: Lukasz Kucharczyk Cc: # v6.13+ Acked-by: Oleksij Rempel Reviewed-by: Stefan Eichenberger Reviewed-by: Carlos Song Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250520122252.1475403-1-lukasz.kucharczyk@leica-geosystems.com commit fa6f092cc0a02d0fcee37e9e8172eda372a03d33 Author: Adin Scannell Date: Tue Jun 24 22:02:15 2025 -0700 libbpf: Fix possible use-after-free for externs The `name` field in `obj->externs` points into the BTF data at initial open time. However, some functions may invalidate this after opening and before loading (e.g. `bpf_map__set_value_size`), which results in pointers into freed memory and undefined behavior. The simplest solution is to simply `strdup` these strings, similar to the `essent_name`, and free them at the same time. In order to test this path, the `global_map_resize` BPF selftest is modified slightly to ensure the presence of an extern, which causes this test to fail prior to the fix. Given there isn't an obvious API or error to test against, I opted to add this to the existing test as an aspect of the resizing feature rather than duplicate the test. Fixes: 9d0a23313b1a ("libbpf: Add capability for resizing datasec maps") Signed-off-by: Adin Scannell Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250625050215.2777374-1-amscanne@meta.com commit 0a46f60a9fe16f5596b6b4b3ee1a483ea7854136 Author: Li Ming Date: Fri Jun 20 13:29:24 2025 +0800 cxl/edac: Fix using wrong repair type to check dram event record cxl_find_rec_dram() is used to find a DRAM event record based on the inputted attributes. Different repair_type of the inputted attributes will check the DRAM event record in different ways. When EDAC driver is performing a memory rank sparing, it should use CXL_RANK_SPARING rather than CXL_BANK_SPARING as repair_type for DRAM event record checking. Fixes: 588ca944c277 ("cxl/edac: Add CXL memory device memory sparing control feature") Signed-off-by: Li Ming Reviewed-by: Shiju Jose Reviewed-by: Jonathan Cameron Reviewed-by: Ira Weiny Reviewed-by: Fan Ni Link: https://patch.msgid.link/20250620052924.138892-1-ming.li@zohomail.com Signed-off-by: Dave Jiang commit c4dce0c094a89b1bc8fde1163342bd6fe29c0370 Merge: 92ca6c498a5e6e b07f349d1864ab Author: Linus Torvalds Date: Wed Jun 25 11:54:04 2025 -0700 Merge tag 'spi-fix-v6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fix from Mark Brown: "One fix for a runtime PM underflow when removing the Cadence QuadSPI driver" * tag 'spi-fix-v6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: spi-cadence-quadspi: Fix pm runtime unbalance commit e97f9540ce001503a4539f337da742c1dfa7d86a Author: Stefan Metzmacher Date: Wed Jun 25 10:13:04 2025 +0200 smb: client: remove \t from TP_printk statements The generate '[FAILED TO PARSE]' strings in trace-cmd report output like this: rm-5298 [001] 6084.533748493: smb3_exit_err: [FAILED TO PARSE] xid=972 func_name=cifs_rmdir rc=-39 rm-5298 [001] 6084.533959234: smb3_enter: [FAILED TO PARSE] xid=973 func_name=cifs_closedir rm-5298 [001] 6084.533967630: smb3_close_enter: [FAILED TO PARSE] xid=973 fid=94489281833 tid=1 sesid=96758029877361 rm-5298 [001] 6084.534004008: smb3_cmd_enter: [FAILED TO PARSE] tid=1 sesid=96758029877361 cmd=6 mid=566 rm-5298 [001] 6084.552248232: smb3_cmd_done: [FAILED TO PARSE] tid=1 sesid=96758029877361 cmd=6 mid=566 rm-5298 [001] 6084.552280542: smb3_close_done: [FAILED TO PARSE] xid=973 fid=94489281833 tid=1 sesid=96758029877361 rm-5298 [001] 6084.552316034: smb3_exit_done: [FAILED TO PARSE] xid=973 func_name=cifs_closedir Cc: stable@vger.kernel.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 92ca6c498a5e6e2083b520b82d318e7e525f3e7c Merge: 2dca89df0d1116 85d6fbc47c3087 Author: Linus Torvalds Date: Wed Jun 25 11:20:14 2025 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Fixes all in drivers. ufs and megaraid_sas are small and obvious. The large diffstat in fnic comes from two pieces: the addition of quite a bit of logging (no change to function) and the reworking of the timeout allocation path for the two conditions that can occur simultaneously to prevent reusing the same abort frame and then both trying to free it" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: fnic: Fix missing DMA mapping error in fnic_send_frame() scsi: fnic: Set appropriate logging level for log message scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths scsi: fnic: Turn off FDMI ACTIVE flags on link down scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out scsi: ufs: core: Fix clk scaling to be conditional in reset and restore scsi: megaraid_sas: Fix invalid node index commit 2dca89df0d1116f722b4be100e4bfcff858058e8 Merge: 7595b66ae9de66 2d65fc13be85c3 Author: Linus Torvalds Date: Wed Jun 25 11:13:31 2025 -0700 Merge tag 'uml-for-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux Pull UML fixes from Johannes Berg: - fix FP registers in seccomp mode - prevent duplicate devices in VFIO support - don't ignore errors in UBD thread start - reduce stack use with clang 19 * tag 'uml-for-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux: um: vector: Reduce stack usage in vector_eth_configure() um: Use correct data source in fpregs_legacy_set() um: vfio: Prevent duplicate device assignments um: ubd: Add missing error check in start_io_thread() commit 010c40c1f50eecab3cdeaa895808294ad0c4f000 Merge: 9caca6ac0e26cd 95b922dd04f74a Author: Jakub Kicinski Date: Wed Jun 25 10:26:16 2025 -0700 Merge tag 'wireless-2025-06-25' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Just a few fixes: - iwlegacy: work around large stack with clang/kasan - mac80211: fix integer overflow - mac80211: fix link struct init vs. RCU publish - iwlwifi: fix warning on IFF_UP * tag 'wireless-2025-06-25' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: mac80211: finish link init before RCU publish wifi: iwlwifi: mvm: assume '1' as the default mac_config_cmd version wifi: mac80211: fix beacon interval calculation overflow wifi: iwlegacy: work around excessive stack usage on clang/kasan ==================== Link: https://patch.msgid.link/20250625115433.41381-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 9a709b7e98e6fa51600b5f2d24c5068efa6d39de Author: Jens Axboe Date: Wed Jun 25 10:17:06 2025 -0600 io_uring/net: mark iov as dynamically allocated even for single segments A bigger array of vecs could've been allocated, but io_ring_buffers_peek() still decided to cap the mapped range depending on how much data was available. Hence don't rely on the segment count to know if the request should be marked as needing cleanup, always check upfront if the iov array is different than the fast_iov array. Fixes: 26ec15e4b0c1 ("io_uring/kbuf: don't truncate end buffer for multiple buffer peeks") Signed-off-by: Jens Axboe commit fa787ac07b3ceb56dd88a62d1866038498e96230 Author: Manuel Andreas Date: Wed Jun 25 15:53:19 2025 +0200 KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush In KVM guests with Hyper-V hypercalls enabled, the hypercalls HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST and HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST_EX allow a guest to request invalidation of portions of a virtual TLB. For this, the hypercall parameter includes a list of GVAs that are supposed to be invalidated. However, when non-canonical GVAs are passed, there is currently no filtering in place and they are eventually passed to checked invocations of INVVPID on Intel / INVLPGA on AMD. While AMD's INVLPGA silently ignores non-canonical addresses (effectively a no-op), Intel's INVVPID explicitly signals VM-Fail and ultimately triggers the WARN_ONCE in invvpid_error(): invvpid failed: ext=0x0 vpid=1 gva=0xaaaaaaaaaaaaa000 WARNING: CPU: 6 PID: 326 at arch/x86/kvm/vmx/vmx.c:482 invvpid_error+0x91/0xa0 [kvm_intel] Modules linked in: kvm_intel kvm 9pnet_virtio irqbypass fuse CPU: 6 UID: 0 PID: 326 Comm: kvm-vm Not tainted 6.15.0 #14 PREEMPT(voluntary) RIP: 0010:invvpid_error+0x91/0xa0 [kvm_intel] Call Trace: vmx_flush_tlb_gva+0x320/0x490 [kvm_intel] kvm_hv_vcpu_flush_tlb+0x24f/0x4f0 [kvm] kvm_arch_vcpu_ioctl_run+0x3013/0x5810 [kvm] Hyper-V documents that invalid GVAs (those that are beyond a partition's GVA space) are to be ignored. While not completely clear whether this ruling also applies to non-canonical GVAs, it is likely fine to make that assumption, and manual testing on Azure confirms "real" Hyper-V interprets the specification in the same way. Skip non-canonical GVAs when processing the list of address to avoid tripping the INVVPID failure. Alternatively, KVM could filter out "bad" GVAs before inserting into the FIFO, but practically speaking the only downside of pushing validation to the final processing is that doing so is suboptimal for the guest, and no well-behaved guest will request TLB flushes for non-canonical addresses. Fixes: 260970862c88 ("KVM: x86: hyper-v: Handle HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST{,EX} calls gently") Cc: stable@vger.kernel.org Signed-off-by: Manuel Andreas Suggested-by: Vitaly Kuznetsov Link: https://lore.kernel.org/r/c090efb3-ef82-499f-a5e0-360fc8420fb7@tum.de Signed-off-by: Sean Christopherson commit 1944f6ab4967db7ad8d4db527dceae8c77de76e9 Author: Stefan Metzmacher Date: Wed Jun 25 10:16:38 2025 +0200 smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data We should not send smbdirect_data_transfer messages larger than the negotiated max_send_size, typically 1364 bytes, which means 24 bytes of the smbdirect_data_transfer header + 1340 payload bytes. This happened when doing an SMB2 write with more than 1340 bytes (which is done inline as it's below rdma_readwrite_threshold). It means the peer resets the connection. When testing between cifs.ko and ksmbd.ko something like this is logged: client: CIFS: VFS: RDMA transport re-established siw: got TERMINATE. layer 1, type 2, code 2 siw: got TERMINATE. layer 1, type 2, code 2 siw: got TERMINATE. layer 1, type 2, code 2 siw: got TERMINATE. layer 1, type 2, code 2 siw: got TERMINATE. layer 1, type 2, code 2 siw: got TERMINATE. layer 1, type 2, code 2 siw: got TERMINATE. layer 1, type 2, code 2 siw: got TERMINATE. layer 1, type 2, code 2 siw: got TERMINATE. layer 1, type 2, code 2 CIFS: VFS: \\carina Send error in SessSetup = -11 smb2_reconnect: 12 callbacks suppressed CIFS: VFS: reconnect tcon failed rc = -11 CIFS: VFS: reconnect tcon failed rc = -11 CIFS: VFS: reconnect tcon failed rc = -11 CIFS: VFS: SMB: Zero rsize calculated, using minimum value 65536 and: CIFS: VFS: RDMA transport re-established siw: got TERMINATE. layer 1, type 2, code 2 CIFS: VFS: smbd_recv:1894 disconnected siw: got TERMINATE. layer 1, type 2, code 2 The ksmbd dmesg is showing things like: smb_direct: Recv error. status='local length error (1)' opcode=128 smb_direct: disconnected smb_direct: Recv error. status='local length error (1)' opcode=128 ksmbd: smb_direct: disconnected ksmbd: sock_read failed: -107 As smbd_post_send_iter() limits the transmitted number of bytes we need loop over it in order to transmit the whole iter. Reviewed-by: David Howells Tested-by: David Howells Tested-by: Meetakshi Setiya Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: # sp->max_send_size should be info->max_send_size in backports Fixes: 3d78fe73fa12 ("cifs: Build the RDMA SGE list directly from an iterator") Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 55e8ff842051b1150461d7595d8f1d033c69d66b Author: Jayesh Choudhary Date: Tue Jun 24 10:18:35 2025 +0530 drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type By default, HPD was disabled on SN65DSI86 bridge. When the driver was added (commit "a095f15c00e27"), the HPD_DISABLE bit was set in pre-enable call which was moved to other function calls subsequently. Later on, commit "c312b0df3b13" added detect utility for DP mode. But with HPD_DISABLE bit set, all the HPD events are disabled[0] and the debounced state always return 1 (always connected state). Set HPD_DISABLE bit conditionally based on display sink's connector type. Since the HPD_STATE is reflected correctly only after waiting for debounce time (~100-400ms) and adding this delay in detect() is not feasible owing to the performace impact (glitches and frame drop), remove runtime calls in detect() and add hpd_enable()/disable() bridge hooks with runtime calls, to detect hpd properly without any delay. [0]: (Pg. 32) Fixes: c312b0df3b13 ("drm/bridge: ti-sn65dsi86: Implement bridge connector operations for DP") Cc: Max Krummenacher Reviewed-by: Douglas Anderson Tested-by: Ernest Van Hoecke Signed-off-by: Jayesh Choudhary Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250624044835.165708-1-j-choudhary@ti.com commit a3f3040657417aeadb9622c629d4a0c2693a0f93 Author: Avadhut Naik Date: Thu May 29 20:50:04 2025 +0000 EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs Each Chip-Select (CS) of a Unified Memory Controller (UMC) on AMD Zen-based SOCs has an Address Mask and a Secondary Address Mask register associated with it. The amd64_edac module logs DIMM sizes on a per-UMC per-CS granularity during init using these two registers. Currently, the module primarily considers only the Address Mask register for computing DIMM sizes. The Secondary Address Mask register is only considered for odd CS. Additionally, if it has been considered, the Address Mask register is ignored altogether for that CS. For power-of-two DIMMs i.e. DIMMs whose total capacity is a power of two (32GB, 64GB, etc), this is not an issue since only the Address Mask register is used. For non-power-of-two DIMMs i.e., DIMMs whose total capacity is not a power of two (48GB, 96GB, etc), however, the Secondary Address Mask register is used in conjunction with the Address Mask register. However, since the module only considers either of the two registers for a CS, the size computed by the module is incorrect. The Secondary Address Mask register is not considered for even CS, and the Address Mask register is not considered for odd CS. Introduce a new helper function so that both Address Mask and Secondary Address Mask registers are considered, when valid, for computing DIMM sizes. Furthermore, also rename some variables for greater clarity. Fixes: 81f5090db843 ("EDAC/amd64: Support asymmetric dual-rank DIMMs") Closes: https://lore.kernel.org/dbec22b6-00f2-498b-b70d-ab6f8a5ec87e@natrix.lt Reported-by: Žilvinas Žaltiena Signed-off-by: Avadhut Naik Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Yazen Ghannam Tested-by: Žilvinas Žaltiena Cc: stable@vger.kernel.org Link: https://lore.kernel.org/20250529205013.403450-1-avadhut.naik@amd.com commit 51a4273dcab39dd1e850870945ccec664352d383 Author: Nikunj A Dadhania Date: Tue Apr 8 15:02:11 2025 +0530 KVM: SVM: Add missing member in SNP_LAUNCH_START command structure The sev_data_snp_launch_start structure should include a 4-byte desired_tsc_khz field before the gosvw field, which was missed in the initial implementation. As a result, the structure is 4 bytes shorter than expected by the firmware, causing the gosvw field to start 4 bytes early. Fix this by adding the missing 4-byte member for the desired TSC frequency. Fixes: 3a45dc2b419e ("crypto: ccp: Define the SEV-SNP commands") Cc: stable@vger.kernel.org Suggested-by: Tom Lendacky Reviewed-by: Tom Lendacky Tested-by: Vaishali Thakkar Signed-off-by: Nikunj A Dadhania Link: https://lore.kernel.org/r/20250408093213.57962-3-nikunj@amd.com Signed-off-by: Sean Christopherson commit 7cac633a42a7b3c8146eb1db76fb80dc652998de Author: Penglei Jiang Date: Wed Jun 25 03:27:03 2025 -0700 io_uring: fix resource leak in io_import_dmabuf() Replace the return statement with setting ret = -EINVAL and jumping to the err label to ensure resources are released via io_release_dmabuf. Fixes: a5c98e942457 ("io_uring/zcrx: dmabuf backed zerocopy receive") Signed-off-by: Penglei Jiang Link: https://lore.kernel.org/r/20250625102703.68336-1-superman.xpt@gmail.com Signed-off-by: Jens Axboe commit 0c84b534047dcf843f4344108bc3f2c2344b7e31 Author: Binbin Wu Date: Wed Jun 25 09:48:29 2025 +0800 Documentation: KVM: Fix unexpected unindent warnings Add proper indentations to bullet list items to resolve the warning: "Bullet list ends without a blank line; unexpected unindent." Closes:https://lore.kernel.org/kvm/20250623162110.6e2f4241@canb.auug.org.au/ Fixes: cf207eac06f6 ("KVM: TDX: Handle TDG.VP.VMCALL") Fixes: 25e8b1dd4883 ("KVM: TDX: Exit to userspace for GetTdVmCallInfo") Reported-by: Stephen Rothwell Signed-off-by: Binbin Wu Reviewed-by: Bagas Sanjaya Link: https://lore.kernel.org/r/20250625014829.82289-1-binbin.wu@linux.intel.com Signed-off-by: Sean Christopherson commit 3e0809b1664b9dc650d9dbca9a2d3ac690d4f661 Author: Niklas Cassel Date: Tue Jun 24 09:40:30 2025 +0200 ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk ASUS store the board name in DMI_PRODUCT_NAME rather than DMI_PRODUCT_VERSION. (Apparently it is only Lenovo that stores the model-name in DMI_PRODUCT_VERSION.) Use the correct DMI identifier, DMI_PRODUCT_NAME, to match the ASUSPRO-D840SA board, such that the quirk actually gets applied. Cc: stable@vger.kernel.org Reported-by: Andy Yang Tested-by: Andy Yang Closes: https://lore.kernel.org/linux-ide/aFb3wXAwJSSJUB7o@ryzen/ Fixes: b5acc3628898 ("ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard") Reviewed-by: Hans de Goede Reviewed-by: Damien Le Moal Link: https://lore.kernel.org/r/20250624074029.963028-2-cassel@kernel.org Signed-off-by: Niklas Cassel commit ec54c0a20709ed6e56f40a8d59eee725c31a916b Author: Sergey Senozhatsky Date: Wed Jun 25 14:20:37 2025 +0900 mtk-sd: reset host->mrq on prepare_data() error Do not leave host with dangling ->mrq pointer if we hit the msdc_prepare_data() error out path. Signed-off-by: Sergey Senozhatsky Reviewed-by: Masami Hiramatsu (Google) Fixes: f5de469990f1 ("mtk-sd: Prevent memory corruption from DMA map failure") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250625052106.584905-1-senozhatsky@chromium.org Signed-off-by: Ulf Hansson commit 173bbec6693f3f3f00dac144f3aa0cd62fb60d33 Author: Alok Tiwari Date: Wed Jun 18 23:05:00 2025 -0700 platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 same ID (103) was assigned to both GDC_BANK0_G_RSE_PIPE_CACHE_DATA0 and GDC_BANK0_G_RSE_PIPE_CACHE_DATA1. This could lead to incorrect event mapping. Updated the ID to 104 to ensure uniqueness. Fixes: 423c3361855c ("platform/mellanox: mlxbf-pmc: Add support for BlueField-3") Signed-off-by: Alok Tiwari Reviewed-by: David Thompson Link: https://lore.kernel.org/r/20250619060502.3594350-1-alok.a.tiwari@oracle.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit b511bbfe4242e14c27a4f80da95dabc4a99d73b2 Author: Mark Pearson Date: Fri Jun 20 14:11:10 2025 -0400 platform/x86: thinkpad_acpi: handle HKEY 0x1402 event 2025 Thinkpads F11 key launch the Intel Unison app on Windows, which does some sort of smart sharing between laptop and phone. Map this key event to KEY_LINK_PHONE as the closest thing we have. This prevents an error message being displayed on key press. Reported-by: Damjan Georgievski Closes: https://sourceforge.net/p/ibm-acpi/mailman/message/59189556/ Signed-off-by: Mark Pearson Link: https://lore.kernel.org/r/20250620181119.2519546-1-mpearson-lenovo@squebb.ca [ij: converted directory to pre-lenovo move as this is fixes material.] Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 7dc6b2d3b5503bcafebbeaf9818112bf367107b4 Author: Rahul Chandra Date: Tue Jun 24 03:33:01 2025 -0400 platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA Add a DMI quirk entry for the ASUS Zenbook Duo UX8406CA 2025 model to use the existing zenbook duo keyboard quirk. Signed-off-by: Rahul Chandra Link: https://lore.kernel.org/r/20250624073301.602070-1-rahul@chandra.net Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d0f8ee81a8fe63cd29d01b905eead72b88326ef2 Author: Paul Menzel Date: Sun Jun 22 10:07:20 2025 +0200 platform/x86: dell-lis3lv02d: Add Latitude 5500 Add 0x29 as the accelerometer address for the Dell Latitude 5500 to lis3lv02d_devices[]. The address was verified as below: $ cd /sys/bus/pci/drivers/i801_smbus/0000:00:1f.4 $ ls -d i2c-? i2c-2 $ sudo modprobe i2c-dev $ sudo i2cdetect 2 WARNING! This program can confuse your I2C bus, cause data loss and worse! I will probe file /dev/i2c-2. I will probe address range 0x08-0x77. Continue? [Y/n] Y 0 1 2 3 4 5 6 7 8 9 a b c d e f 00: 08 -- -- -- -- -- -- -- 10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 20: -- -- -- -- -- -- -- -- -- 29 -- -- -- -- -- -- 30: 30 -- -- -- -- 35 UU UU -- -- -- -- -- -- -- -- 40: -- -- -- -- 44 -- -- -- -- -- -- -- -- -- -- -- 50: UU -- 52 -- -- -- -- -- -- -- -- -- -- -- -- -- 60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 70: -- -- -- -- -- -- -- -- $ echo lis3lv02d 0x29 | sudo tee /sys/bus/i2c/devices/i2c-2/new_device lis3lv02d 0x29 $ sudo dmesg [ 0.000000] Linux version 6.12.32-amd64 (debian-kernel@lists.debian.org) (x86_64-linux-gnu-gcc-14 (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44) #1 SMP PREEMPT_DYNAMIC Debian 6.12.32-1 (2025-06-07) […] [ 0.000000] DMI: Dell Inc. Latitude 5500/0M14W7, BIOS 1.38.0 03/06/2025 […] [ 609.063488] i2c_dev: i2c /dev entries driver [ 639.135020] i2c i2c-2: new_device: Instantiated device lis3lv02d at 0x29 Signed-off-by: Paul Menzel Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250622080721.4661-1-pmenzel@molgen.mpg.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 95b922dd04f74a45fb86b34a25cda62f427a2b5c Merge: d87c3ca0f8f1ca 93598167dcb635 Author: Johannes Berg Date: Wed Jun 25 10:19:39 2025 +0200 Merge tag 'iwlwifi-fixes-2025-06-25' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next Miri Korenblit says: ==================== iwlwifi-fixes: fix failure in interface up ==================== Signed-off-by: Johannes Berg commit a9a9e68954f29b1e197663f76289db4879fd51bb Author: Patrisious Haddad Date: Mon Jun 16 12:14:54 2025 +0300 RDMA/mlx5: Fix vport loopback for MPV device Always enable vport loopback for both MPV devices on driver start. Previously in some cases related to MPV RoCE, packets weren't correctly executing loopback check at vport in FW, since it was disabled. Due to complexity of identifying such cases for MPV always enable vport loopback for both GVMIs when binding the slave to the master port. Fixes: 0042f9e458a5 ("RDMA/mlx5: Enable vport loopback when user context or QP mandate") Signed-off-by: Patrisious Haddad Reviewed-by: Mark Bloch Link: https://patch.msgid.link/d4298f5ebb2197459e9e7221c51ecd6a34699847.1750064969.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit acd245b1e33fc4b9d0f2e3372021d632f7ee0652 Author: Patrisious Haddad Date: Mon Jun 16 12:14:53 2025 +0300 RDMA/mlx5: Fix CC counters query for MPV In case, CC counters are querying for the second port use the correct core device for the query instead of always using the master core device. Fixes: aac4492ef23a ("IB/mlx5: Update counter implementation for dual port RoCE") Signed-off-by: Patrisious Haddad Reviewed-by: Michael Guralnik Link: https://patch.msgid.link/9cace74dcf106116118bebfa9146d40d4166c6b0.1750064969.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 3cc1dbfddf88dc5ecce0a75185061403b1f7352d Author: Patrisious Haddad Date: Mon Jun 16 12:14:52 2025 +0300 RDMA/mlx5: Fix HW counters query for non-representor devices To get the device HW counters, a non-representor switchdev device should use the mlx5_ib_query_q_counters() function and query all of the available counters. While a representor device in switchdev mode should use the mlx5_ib_query_q_counters_vport() function and query only the Q_Counters without the PPCNT counters and congestion control counters, since they aren't relevant for a representor device. Currently a non-representor switchdev device skips querying the PPCNT counters and congestion control counters, leaving them unupdated. Fix that by properly querying those counters for non-representor devices. Fixes: d22467a71ebe ("RDMA/mlx5: Expand switchdev Q-counters to expose representor statistics") Signed-off-by: Patrisious Haddad Reviewed-by: Maher Sanalla Link: https://patch.msgid.link/56bf8af4ca8c58e3fb9f7e47b1dca2009eeeed81.1750064969.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 3f5f6321f129ad5a30aa03c99c196b4612be68a8 Author: Or Har-Toov Date: Mon Jun 16 11:16:03 2025 +0300 IB/core: Annotate umem_mutex acquisition under fs_reclaim for lockdep Following the fix in the previous commit ("IB/mlx5: Fix potential deadlock in MR deregistration"), teach lockdep explicitly about the locking order between fs_reclaim and umem_mutex. The previous commit resolved a potential deadlock scenario where kzalloc(GFP_KERNEL) was called while holding umem_mutex, which could lead to reclaim and eventually invoke the MMU notifier (mlx5_ib_invalidate_range()), causing a recursive acquisition of umem_mutex. To prevent such issues from reoccurring unnoticed in future code changes, add a lockdep annotation in ib_init_umem_odp() that simulates taking umem_mutex inside a reclaim context. This makes lockdep aware of this locking dependency and ensures that future violations—such as calling kzalloc() or any memory allocator that may enter reclaim while holding umem_mutex—will immediately raise a lockdep warning. Signed-off-by: Or Har-Toov Reviewed-by: Michael Guralnik Link: https://patch.msgid.link/9d31b9d8fe1db648a9f47cec3df6b8463319dee5.1750061698.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 2ed25aa7f7711f508b6120e336f05cd9d49943c0 Author: Or Har-Toov Date: Mon Jun 16 11:14:09 2025 +0300 IB/mlx5: Fix potential deadlock in MR deregistration The issue arises when kzalloc() is invoked while holding umem_mutex or any other lock acquired under umem_mutex. This is problematic because kzalloc() can trigger fs_reclaim_aqcuire(), which may, in turn, invoke mmu_notifier_invalidate_range_start(). This function can lead to mlx5_ib_invalidate_range(), which attempts to acquire umem_mutex again, resulting in a deadlock. The problematic flow: CPU0 | CPU1 ---------------------------------------|------------------------------------------------ mlx5_ib_dereg_mr() | → revoke_mr() | → mutex_lock(&umem_odp->umem_mutex) | | mlx5_mkey_cache_init() | → mutex_lock(&dev->cache.rb_lock) | → mlx5r_cache_create_ent_locked() | → kzalloc(GFP_KERNEL) | → fs_reclaim() | → mmu_notifier_invalidate_range_start() | → mlx5_ib_invalidate_range() | → mutex_lock(&umem_odp->umem_mutex) → cache_ent_find_and_store() | → mutex_lock(&dev->cache.rb_lock) | Additionally, when kzalloc() is called from within cache_ent_find_and_store(), we encounter the same deadlock due to re-acquisition of umem_mutex. Solve by releasing umem_mutex in dereg_mr() after umr_revoke_mr() and before acquiring rb_lock. This ensures that we don't hold umem_mutex while performing memory allocations that could trigger the reclaim path. This change prevents the deadlock by ensuring proper lock ordering and avoiding holding locks during memory allocation operations that could trigger the reclaim path. The following lockdep warning demonstrates the deadlock: python3/20557 is trying to acquire lock: ffff888387542128 (&umem_odp->umem_mutex){+.+.}-{4:4}, at: mlx5_ib_invalidate_range+0x5b/0x550 [mlx5_ib] but task is already holding lock: ffffffff82f6b840 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}, at: unmap_vmas+0x7b/0x1a0 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}: fs_reclaim_acquire+0x60/0xd0 mem_cgroup_css_alloc+0x6f/0x9b0 cgroup_init_subsys+0xa4/0x240 cgroup_init+0x1c8/0x510 start_kernel+0x747/0x760 x86_64_start_reservations+0x25/0x30 x86_64_start_kernel+0x73/0x80 common_startup_64+0x129/0x138 -> #2 (fs_reclaim){+.+.}-{0:0}: fs_reclaim_acquire+0x91/0xd0 __kmalloc_cache_noprof+0x4d/0x4c0 mlx5r_cache_create_ent_locked+0x75/0x620 [mlx5_ib] mlx5_mkey_cache_init+0x186/0x360 [mlx5_ib] mlx5_ib_stage_post_ib_reg_umr_init+0x3c/0x60 [mlx5_ib] __mlx5_ib_add+0x4b/0x190 [mlx5_ib] mlx5r_probe+0xd9/0x320 [mlx5_ib] auxiliary_bus_probe+0x42/0x70 really_probe+0xdb/0x360 __driver_probe_device+0x8f/0x130 driver_probe_device+0x1f/0xb0 __driver_attach+0xd4/0x1f0 bus_for_each_dev+0x79/0xd0 bus_add_driver+0xf0/0x200 driver_register+0x6e/0xc0 __auxiliary_driver_register+0x6a/0xc0 do_one_initcall+0x5e/0x390 do_init_module+0x88/0x240 init_module_from_file+0x85/0xc0 idempotent_init_module+0x104/0x300 __x64_sys_finit_module+0x68/0xc0 do_syscall_64+0x6d/0x140 entry_SYSCALL_64_after_hwframe+0x4b/0x53 -> #1 (&dev->cache.rb_lock){+.+.}-{4:4}: __mutex_lock+0x98/0xf10 __mlx5_ib_dereg_mr+0x6f2/0x890 [mlx5_ib] mlx5_ib_dereg_mr+0x21/0x110 [mlx5_ib] ib_dereg_mr_user+0x85/0x1f0 [ib_core] uverbs_free_mr+0x19/0x30 [ib_uverbs] destroy_hw_idr_uobject+0x21/0x80 [ib_uverbs] uverbs_destroy_uobject+0x60/0x3d0 [ib_uverbs] uobj_destroy+0x57/0xa0 [ib_uverbs] ib_uverbs_cmd_verbs+0x4d5/0x1210 [ib_uverbs] ib_uverbs_ioctl+0x129/0x230 [ib_uverbs] __x64_sys_ioctl+0x596/0xaa0 do_syscall_64+0x6d/0x140 entry_SYSCALL_64_after_hwframe+0x4b/0x53 -> #0 (&umem_odp->umem_mutex){+.+.}-{4:4}: __lock_acquire+0x1826/0x2f00 lock_acquire+0xd3/0x2e0 __mutex_lock+0x98/0xf10 mlx5_ib_invalidate_range+0x5b/0x550 [mlx5_ib] __mmu_notifier_invalidate_range_start+0x18e/0x1f0 unmap_vmas+0x182/0x1a0 exit_mmap+0xf3/0x4a0 mmput+0x3a/0x100 do_exit+0x2b9/0xa90 do_group_exit+0x32/0xa0 get_signal+0xc32/0xcb0 arch_do_signal_or_restart+0x29/0x1d0 syscall_exit_to_user_mode+0x105/0x1d0 do_syscall_64+0x79/0x140 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Chain exists of: &dev->cache.rb_lock --> mmu_notifier_invalidate_range_start --> &umem_odp->umem_mutex Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&umem_odp->umem_mutex); lock(mmu_notifier_invalidate_range_start); lock(&umem_odp->umem_mutex); lock(&dev->cache.rb_lock); *** DEADLOCK *** Fixes: abb604a1a9c8 ("RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error") Signed-off-by: Or Har-Toov Reviewed-by: Michael Guralnik Link: https://patch.msgid.link/3c8f225a8a9fade647d19b014df1172544643e4a.1750061612.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 2d65fc13be85c336c56af7077f08ccd3a3a15a4a Author: Tiwei Bie Date: Mon Jun 23 19:08:29 2025 +0800 um: vector: Reduce stack usage in vector_eth_configure() When compiling with clang (19.1.7), initializing *vp using a compound literal may result in excessive stack usage. Fix it by initializing the required fields of *vp individually. Without this patch: $ objdump -d arch/um/drivers/vector_kern.o | ./scripts/checkstack.pl x86_64 0 ... 0x0000000000000540 vector_eth_configure [vector_kern.o]:1472 ... With this patch: $ objdump -d arch/um/drivers/vector_kern.o | ./scripts/checkstack.pl x86_64 0 ... 0x0000000000000540 vector_eth_configure [vector_kern.o]:208 ... Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506221017.WtB7Usua-lkp@intel.com/ Signed-off-by: Tiwei Bie Link: https://patch.msgid.link/20250623110829.314864-1-tiwei.btw@antgroup.com Signed-off-by: Johannes Berg commit 8948941276024fcfb08fdb3d678867dc1f7b1c16 Author: Tiwei Bie Date: Fri Jun 6 20:44:28 2025 +0800 um: Use correct data source in fpregs_legacy_set() Read from the buffer pointed to by 'from' instead of '&buf', as 'buf' contains no valid data when 'ubuf' is NULL. Fixes: b1e1bd2e6943 ("um: Add helper functions to get/set state for SECCOMP") Signed-off-by: Tiwei Bie Link: https://patch.msgid.link/20250606124428.148164-5-tiwei.btw@antgroup.com Signed-off-by: Johannes Berg commit bc4e2ae08183d9017f43bf88aa7cfdf84e76f573 Author: Tiwei Bie Date: Fri Jun 6 20:44:27 2025 +0800 um: vfio: Prevent duplicate device assignments Ensure devices are assigned only once. Reject subsequent requests for duplicate assignments. Fixes: a0e2cb6a9063 ("um: Add VFIO-based virtual PCI driver") Signed-off-by: Tiwei Bie Link: https://patch.msgid.link/20250606124428.148164-4-tiwei.btw@antgroup.com Signed-off-by: Johannes Berg commit c55c7a85e02a7bfee20a3ffebdff7cbeb41613ef Author: Tiwei Bie Date: Fri Jun 6 20:44:25 2025 +0800 um: ubd: Add missing error check in start_io_thread() The subsequent call to os_set_fd_block() overwrites the previous return value. OR the two return values together to fix it. Fixes: f88f0bdfc32f ("um: UBD Improvements") Signed-off-by: Tiwei Bie Link: https://patch.msgid.link/20250606124428.148164-2-tiwei.btw@antgroup.com Signed-off-by: Johannes Berg commit d02b2103a08b6d6908f1d3d8e8783d3f342555ac Author: Arnd Bergmann Date: Fri Jun 20 13:18:18 2025 +0200 drm/i915: fix build error some more An earlier patch fixed a build failure with clang, but I still see the same problem with some configurations using gcc: drivers/gpu/drm/i915/i915_pmu.c: In function 'config_mask': include/linux/compiler_types.h:568:38: error: call to '__compiletime_assert_462' declared with attribute error: BUILD_BUG_ON failed: bit > BITS_PER_TYPE(typeof_member(struct i915_pmu, enable)) - 1 drivers/gpu/drm/i915/i915_pmu.c:116:3: note: in expansion of macro 'BUILD_BUG_ON' 116 | BUILD_BUG_ON(bit > As I understand it, the problem is that the function is not always fully inlined, but the __builtin_constant_p() can still evaluate the argument as being constant. Marking it as __always_inline so far works for me in all configurations. Fixes: a7137b1825b5 ("drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled") Fixes: a644fde77ff7 ("drm/i915/pmu: Change bitmask of enabled events to u32") Reviewed-by: Rodrigo Vivi Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250620111824.3395007-1-arnd@kernel.org Signed-off-by: Rodrigo Vivi (cherry picked from commit ef69f9dd1cd7301cdf04ba326ed28152a3affcf6) Signed-off-by: Joonas Lahtinen commit 5e9571750c4e53d16727a04159455c693d7b31cb Author: Pei Xiao Date: Tue Jun 24 17:00:47 2025 +0800 ALSA: usb: qcom: fix NULL pointer dereference in qmi_stop_session The find_substream() call may return NULL, but the error path dereferenced 'subs' unconditionally via dev_err(&subs->dev->dev, ...), causing a NULL pointer dereference when subs is NULL. Fix by switching to &uadev[idx].udev->dev which is always valid in this context. Signed-off-by: Pei Xiao Link: https://patch.msgid.link/86ac2939273ac853535049e60391c09d7688714e.1750755508.git.xiaopei01@kylinos.cn Signed-off-by: Takashi Iwai commit e1d7727b73a1f78035316ac35ee184d477059f0b Author: Pavel Begunkov Date: Tue Jun 24 14:40:35 2025 +0100 io_uring: don't assume uaddr alignment in io_vec_fill_bvec There is no guaranteed alignment for user pointers. Don't use mask trickery and adjust the offset by bv_offset. Cc: stable@vger.kernel.org Reported-by: David Hildenbrand Fixes: 9ef4cbbcb4ac3 ("io_uring: add infra for importing vectored reg buffers") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/io-uring/19530391f5c361a026ac9b401ff8e123bde55d98.1750771718.git.asml.silence@gmail.com/ Signed-off-by: Jens Axboe commit 3a3c6d61577dbb23c09df3e21f6f9eda1ecd634b Author: Pavel Begunkov Date: Tue Jun 24 14:40:34 2025 +0100 io_uring/rsrc: don't rely on user vaddr alignment There is no guaranteed alignment for user pointers, however the calculation of an offset of the first page into a folio after coalescing uses some weird bit mask logic, get rid of it. Cc: stable@vger.kernel.org Reported-by: David Hildenbrand Fixes: a8edbb424b139 ("io_uring/rsrc: enable multi-hugepage buffer coalescing") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/io-uring/e387b4c78b33f231105a601d84eefd8301f57954.1750771718.git.asml.silence@gmail.com/ Signed-off-by: Jens Axboe commit 5afb4bf9fc62d828647647ec31745083637132e4 Author: Pavel Begunkov Date: Tue Jun 24 14:40:33 2025 +0100 io_uring/rsrc: fix folio unpinning syzbot complains about an unmapping failure: [ 108.070381][ T14] kernel BUG at mm/gup.c:71! [ 108.070502][ T14] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 108.123672][ T14] Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20250221-8.fc42 02/21/2025 [ 108.127458][ T14] Workqueue: iou_exit io_ring_exit_work [ 108.174205][ T14] Call trace: [ 108.175649][ T14] sanity_check_pinned_pages+0x7cc/0x7d0 (P) [ 108.178138][ T14] unpin_user_page+0x80/0x10c [ 108.180189][ T14] io_release_ubuf+0x84/0xf8 [ 108.182196][ T14] io_free_rsrc_node+0x250/0x57c [ 108.184345][ T14] io_rsrc_data_free+0x148/0x298 [ 108.186493][ T14] io_sqe_buffers_unregister+0x84/0xa0 [ 108.188991][ T14] io_ring_ctx_free+0x48/0x480 [ 108.191057][ T14] io_ring_exit_work+0x764/0x7d8 [ 108.193207][ T14] process_one_work+0x7e8/0x155c [ 108.195431][ T14] worker_thread+0x958/0xed8 [ 108.197561][ T14] kthread+0x5fc/0x75c [ 108.199362][ T14] ret_from_fork+0x10/0x20 We can pin a tail page of a folio, but then io_uring will try to unpin the head page of the folio. While it should be fine in terms of keeping the page actually alive, mm folks say it's wrong and triggers a debug warning. Use unpin_user_folio() instead of unpin_user_page*. Cc: stable@vger.kernel.org Debugged-by: David Hildenbrand Reported-by: syzbot+1d335893772467199ab6@syzkaller.appspotmail.com Closes: https://lkml.kernel.org/r/683f1551.050a0220.55ceb.0017.GAE@google.com Fixes: a8edbb424b139 ("io_uring/rsrc: enable multi-hugepage buffer coalescing") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/io-uring/a28b0f87339ac2acf14a645dad1e95bbcbf18acd.1750771718.git.asml.silence@gmail.com/ [axboe: adapt to current tree, massage commit message] Signed-off-by: Jens Axboe commit 4c8a951787ffc4b61a547db9866196104971b5fd Author: Ming Lei Date: Tue Jun 24 18:41:21 2025 +0800 ublk: setup ublk_io correctly in case of ublk_get_data() failure If ublk_get_data() fails, -EIOCBQUEUED is returned and the current command becomes ASYNC. And the only reason is that mapping data can't move on, because of no enough pages or pending signal, then the current ublk request has to be requeued. Once the request need to be requeued, we have to setup `ublk_io` correctly, including io->cmd and flags, otherwise the request may not be forwarded to ublk server successfully. Fixes: 9810362a57cb ("ublk: don't call ublk_dispatch_req() for NEED_GET_DATA") Reported-by: Changhui Zhong Closes: https://lore.kernel.org/linux-block/CAGVVp+VN9QcpHUz_0nasFf5q9i1gi8H8j-G-6mkBoqa3TyjRHA@mail.gmail.com/ Signed-off-by: Ming Lei Tested-by: Changhui Zhong Link: https://lore.kernel.org/r/20250624104121.859519-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 81b4d1a1d03301dcca8af5c58eded9e535f1f6ed Author: Caleb Sander Mateos Date: Sat Jun 21 11:10:14 2025 -0600 ublk: update UBLK_F_SUPPORT_ZERO_COPY comment in UAPI header UBLK_F_SUPPORT_ZERO_COPY has a very old comment describing the initial idea for how zero-copy would be implemented. The actual implementation added in commit 1f6540e2aabb ("ublk: zc register/unregister bvec") uses io_uring registered buffers rather than shared memory mapping. Remove the inaccurate remarks about mapping ublk request memory into the ublk server's address space and requiring 4K block size. Replace them with a description of the current zero-copy mechanism. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250621171015.354932-1-csander@purestorage.com Signed-off-by: Jens Axboe commit 67caa528ae08cd05e485c0ea6aea0baaf6579b06 Author: Caleb Sander Mateos Date: Sat Jun 21 10:28:41 2025 -0600 ublk: fix narrowing warnings in UAPI header When a C++ file compiled with -Wc++11-narrowing includes the UAPI header linux/ublk_cmd.h, ublk_sqe_addr_to_auto_buf_reg()'s assignments of u64 values to u8, u16, and u32 fields result in compiler warnings. Add explicit casts to the intended types to avoid these warnings. Drop the unnecessary bitmasks. Reported-by: Uday Shankar Signed-off-by: Caleb Sander Mateos Fixes: 99c1e4eb6a3f ("ublk: register buffer to local io_uring with provided buf index via UBLK_F_AUTO_BUF_REG") Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250621162842.337452-1-csander@purestorage.com Signed-off-by: Jens Axboe commit 5223372e672eaa576c892984b438875426d8ff2b Author: Ming Lei Date: Mon Jun 23 09:19:27 2025 +0800 selftests: ublk: don't take same backing file for more than one ublk devices Don't use same backing file for more than one ublk devices, and avoid concurrent write on same file from more ublk disks. Fixes: 8ccebc19ee3d ("selftests: ublk: support UBLK_F_AUTO_BUF_REG") Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250623011934.741788-3-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 524346e9d79f63a6e5aaa645140da3d1ec7a8a0f Author: Ming Lei Date: Wed Jun 25 10:25:54 2025 +0800 ublk: build batch from IOs in same io_ring_ctx and io task ublk_queue_cmd_list() dispatches the whole batch list by scheduling task work via the tail request's io_uring_cmd, this way is fine even though more than one io_ring_ctx are involved for this batch since it is just one running context. However, the task work handler ublk_cmd_list_tw_cb() takes `issue_flags` of tail uring_cmd's io_ring_ctx for completing all commands. This way is wrong if any uring_cmd is issued from different io_ring_ctx. Fixes it by always building batch IOs from same io_ring_ctx and io task because ublk_dispatch_req() does validate task context, and IO needs to be aborted in case of running from fallback task work context. For typical per-queue or per-io daemon implementation, this way shouldn't make difference from performance viewpoint, because single io_ring_ctx is taken in each daemon for normal use case. Fixes: d796cea7b9f3 ("ublk: implement ->queue_rqs()") Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250625022554.883571-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 021f243627ead17eb6500170256d3d9be787dad8 Author: Bart Van Assche Date: Tue Jun 24 11:16:44 2025 -0700 scsi: ufs: core: Fix spelling of a sysfs attribute name Change "resourse" into "resource" in the name of a sysfs attribute. Fixes: d829fc8a1058 ("scsi: ufs: sysfs: unit descriptor") Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20250624181658.336035-1-bvanassche@acm.org Reviewed-by: Avri Altman Signed-off-by: Martin K. Petersen commit 4937e604ca24c41cae3296d069c871c2f3f519c8 Author: Christoph Hellwig Date: Tue Jun 24 14:52:28 2025 +0200 scsi: core: Enforce unlimited max_segment_size when virt_boundary_mask is set The virt_boundary_mask limit requires an unlimited max_segment_size for bio splitting to not corrupt data. Historically, the block layer tried to validate this, although the check was half-hearted until the addition of the atomic queue limits API. The full blown check then triggered issues with stacked devices incorrectly inheriting limits such as the virt boundary and got disabled in commit b561ea56a264 ("block: allow device to have both virt_boundary_mask and max segment size") instead of fixing the issue properly. Ensure that the SCSI mid layer doesn't set the default low max_segment_size limit for this case, and check for invalid max_segment_size values in the host template, similar to the original block layer check given that SCSI devices can't be stacked. This fixes reported data corruption on storvsc, although as far as I can tell storvsc always failed to properly set the max_segment_size limit as the SCSI APIs historically applied that when setting up the host, while storvsc only set the virt_boundary_mask when configuring the scsi_device. Fixes: 81988a0e6b03 ("storvsc: get rid of bounce buffer") Fixes: b561ea56a264 ("block: allow device to have both virt_boundary_mask and max segment size") Reported-by: Ming Lei Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20250624125233.219635-3-hch@lst.de Reviewed-by: John Garry Reviewed-by: Ming Lei Reviewed-by: Hannes Reinecke Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 844c6a160e69cc6d1da4b666f8672f6fc5f4f862 Author: Christoph Hellwig Date: Tue Jun 24 14:52:27 2025 +0200 scsi: RDMA/srp: Don't set a max_segment_size when virt_boundary_mask is set virt_boundary_mask implies an unlimited max_segment_size. Setting both can lead to data corruption because __blk_rq_map_sg() can split requests so that the virt_boundary_mask is not respected if max_segment_size is not UINT_MAX. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20250624125233.219635-2-hch@lst.de Reviewed-by: Hannes Reinecke Reviewed-by: John Garry Acked-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 8889676cd62161896f1d861ce294adc29c4f2cb5 Author: jackysliu <1972843537@qq.com> Date: Thu Jun 19 12:03:02 2025 +0800 scsi: sd: Fix VPD page 0xb7 length check sd_read_block_limits_ext() currently assumes that vpd->len excludes the size of the page header. However, vpd->len describes the size of the entire VPD page, therefore the sanity check is incorrect. In practice this is not really a problem since we don't attach VPD pages unless they actually report data trailing the header. But fix the length check regardless. This issue was identified by Wukong-Agent (formerly Tencent Woodpecker), a code security AI agent, through static code analysis. [mkp: rewrote patch description] Signed-off-by: jackysliu <1972843537@qq.com> Link: https://lore.kernel.org/r/tencent_ADA5210D1317EEB6CD7F3DE9FE9DA4591D05@qq.com Fixes: 96b171d6dba6 ("scsi: core: Query the Block Limits Extension VPD page") Signed-off-by: Martin K. Petersen commit 9caca6ac0e26cd20efd490d8b3b2ffb1c7c00f6f Author: Yan Zhai Date: Mon Jun 23 09:06:38 2025 -0700 bnxt: properly flush XDP redirect lists We encountered following crash when testing a XDP_REDIRECT feature in production: [56251.579676] list_add corruption. next->prev should be prev (ffff93120dd40f30), but was ffffb301ef3a6740. (next=ffff93120dd 40f30). [56251.601413] ------------[ cut here ]------------ [56251.611357] kernel BUG at lib/list_debug.c:29! [56251.621082] Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [56251.632073] CPU: 111 UID: 0 PID: 0 Comm: swapper/111 Kdump: loaded Tainted: P O 6.12.33-cloudflare-2025.6. 3 #1 [56251.653155] Tainted: [P]=PROPRIETARY_MODULE, [O]=OOT_MODULE [56251.663877] Hardware name: MiTAC GC68B-B8032-G11P6-GPU/S8032GM-HE-CFR, BIOS V7.020.B10-sig 01/22/2025 [56251.682626] RIP: 0010:__list_add_valid_or_report+0x4b/0xa0 [56251.693203] Code: 0e 48 c7 c7 68 e7 d9 97 e8 42 16 fe ff 0f 0b 48 8b 52 08 48 39 c2 74 14 48 89 f1 48 c7 c7 90 e7 d9 97 48 89 c6 e8 25 16 fe ff <0f> 0b 4c 8b 02 49 39 f0 74 14 48 89 d1 48 c7 c7 e8 e7 d9 97 4c 89 [56251.725811] RSP: 0018:ffff93120dd40b80 EFLAGS: 00010246 [56251.736094] RAX: 0000000000000075 RBX: ffffb301e6bba9d8 RCX: 0000000000000000 [56251.748260] RDX: 0000000000000000 RSI: ffff9149afda0b80 RDI: ffff9149afda0b80 [56251.760349] RBP: ffff9131e49c8000 R08: 0000000000000000 R09: ffff93120dd40a18 [56251.772382] R10: ffff9159cf2ce1a8 R11: 0000000000000003 R12: ffff911a80850000 [56251.784364] R13: ffff93120fbc7000 R14: 0000000000000010 R15: ffff9139e7510e40 [56251.796278] FS: 0000000000000000(0000) GS:ffff9149afd80000(0000) knlGS:0000000000000000 [56251.809133] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [56251.819561] CR2: 00007f5e85e6f300 CR3: 00000038b85e2006 CR4: 0000000000770ef0 [56251.831365] PKRU: 55555554 [56251.838653] Call Trace: [56251.845560] [56251.851943] cpu_map_enqueue.cold+0x5/0xa [56251.860243] xdp_do_redirect+0x2d9/0x480 [56251.868388] bnxt_rx_xdp+0x1d8/0x4c0 [bnxt_en] [56251.877028] bnxt_rx_pkt+0x5f7/0x19b0 [bnxt_en] [56251.885665] ? cpu_max_write+0x1e/0x100 [56251.893510] ? srso_alias_return_thunk+0x5/0xfbef5 [56251.902276] __bnxt_poll_work+0x190/0x340 [bnxt_en] [56251.911058] bnxt_poll+0xab/0x1b0 [bnxt_en] [56251.919041] ? srso_alias_return_thunk+0x5/0xfbef5 [56251.927568] ? srso_alias_return_thunk+0x5/0xfbef5 [56251.935958] ? srso_alias_return_thunk+0x5/0xfbef5 [56251.944250] __napi_poll+0x2b/0x160 [56251.951155] bpf_trampoline_6442548651+0x79/0x123 [56251.959262] __napi_poll+0x5/0x160 [56251.966037] net_rx_action+0x3d2/0x880 [56251.973133] ? srso_alias_return_thunk+0x5/0xfbef5 [56251.981265] ? srso_alias_return_thunk+0x5/0xfbef5 [56251.989262] ? __hrtimer_run_queues+0x162/0x2a0 [56251.996967] ? srso_alias_return_thunk+0x5/0xfbef5 [56252.004875] ? srso_alias_return_thunk+0x5/0xfbef5 [56252.012673] ? bnxt_msix+0x62/0x70 [bnxt_en] [56252.019903] handle_softirqs+0xcf/0x270 [56252.026650] irq_exit_rcu+0x67/0x90 [56252.032933] common_interrupt+0x85/0xa0 [56252.039498] [56252.044246] [56252.048935] asm_common_interrupt+0x26/0x40 [56252.055727] RIP: 0010:cpuidle_enter_state+0xb8/0x420 [56252.063305] Code: dc 01 00 00 e8 f9 79 3b ff e8 64 f7 ff ff 49 89 c5 0f 1f 44 00 00 31 ff e8 a5 32 3a ff 45 84 ff 0f 85 ae 01 00 00 fb 45 85 f6 <0f> 88 88 01 00 00 48 8b 04 24 49 63 ce 4c 89 ea 48 6b f1 68 48 29 [56252.088911] RSP: 0018:ffff93120c97fe98 EFLAGS: 00000202 [56252.096912] RAX: ffff9149afd80000 RBX: ffff9141d3a72800 RCX: 0000000000000000 [56252.106844] RDX: 00003329176c6b98 RSI: ffffffe36db3fdc7 RDI: 0000000000000000 [56252.116733] RBP: 0000000000000002 R08: 0000000000000002 R09: 000000000000004e [56252.126652] R10: ffff9149afdb30c4 R11: 071c71c71c71c71c R12: ffffffff985ff860 [56252.136637] R13: 00003329176c6b98 R14: 0000000000000002 R15: 0000000000000000 [56252.146667] ? cpuidle_enter_state+0xab/0x420 [56252.153909] cpuidle_enter+0x2d/0x40 [56252.160360] do_idle+0x176/0x1c0 [56252.166456] cpu_startup_entry+0x29/0x30 [56252.173248] start_secondary+0xf7/0x100 [56252.179941] common_startup_64+0x13e/0x141 [56252.186886] From the crash dump, we found that the cpu_map_flush_list inside redirect info is partially corrupted: its list_head->next points to itself, but list_head->prev points to a valid list of unflushed bq entries. This turned out to be a result of missed XDP flush on redirect lists. By digging in the actual source code, we found that commit 7f0a168b0441 ("bnxt_en: Add completion ring pointer in TX and RX ring structures") incorrectly overwrites the event mask for XDP_REDIRECT in bnxt_rx_xdp. We can stably reproduce this crash by returning XDP_TX and XDP_REDIRECT randomly for incoming packets in a naive XDP program. Properly propagate the XDP_REDIRECT events back fixes the crash. Fixes: a7559bc8c17c ("bnxt: support transmit and free of aggregation buffers") Tested-by: Andrew Rzeznik Signed-off-by: Yan Zhai Acked-by: Jesper Dangaard Brouer Reviewed-by: Michael Chan Reviewed-by: Andy Gospodarek Link: https://patch.msgid.link/aFl7jpCNzscumuN2@debian.debian Signed-off-by: Jakub Kicinski commit 7595b66ae9de667bf35a8c99e8f1bfc4792e207e Merge: 78f4e737a53e11 fde46f60f6c513 Author: Linus Torvalds Date: Tue Jun 24 17:20:43 2025 -0700 Merge tag 'selinux-pr-20250624' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux fix from Paul Moore: "Another small SELinux patch to fix a problem seen by the dracut-ng folks during early boot when SELinux is enabled, but the policy has yet to be loaded" * tag 'selinux-pr-20250624' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: change security_compute_sid to return the ssid or tsid on match commit 22bbc1dcd0d6785fb390c41f0dd5b5e218d23bdd Author: Stefano Garzarella Date: Mon Jun 23 12:00:53 2025 +0200 vsock/uapi: fix linux/vm_sockets.h userspace compilation errors If a userspace application just include will fail to build with the following errors: /usr/include/linux/vm_sockets.h:182:39: error: invalid application of ‘sizeof’ to incomplete type ‘struct sockaddr’ 182 | unsigned char svm_zero[sizeof(struct sockaddr) - | ^~~~~~ /usr/include/linux/vm_sockets.h:183:39: error: ‘sa_family_t’ undeclared here (not in a function) 183 | sizeof(sa_family_t) - | Include for userspace (guarded by ifndef __KERNEL__) where `struct sockaddr` and `sa_family_t` are defined. We already do something similar in and . Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") Reported-by: Daan De Meyer Signed-off-by: Stefano Garzarella Link: https://patch.msgid.link/20250623100053.40979-1-sgarzare@redhat.com Signed-off-by: Jakub Kicinski commit 1f8aede70d491a1d5867f575ca44c86fe2e335ae Author: Kent Overstreet Date: Tue Jun 24 16:04:32 2025 -0400 bcachefs: fix bch2_journal_keys_peek_prev_min() underflow Signed-off-by: Kent Overstreet commit f5109c201cf2bc304a05ecc40c2aabb119b27833 Author: Kent Overstreet Date: Tue Jun 24 17:53:00 2025 -0400 bcachefs: Use wait_on_allocator() when allocating journal wait_on_allocator() emits debug info when we hang trying to allocate. Signed-off-by: Kent Overstreet commit fa7d0f83c5c4223a01598876352473cb3d3bd4d7 Author: Xin Li (Intel) Date: Fri Jun 20 16:15:04 2025 -0700 x86/traps: Initialize DR7 by writing its architectural reset value Initialize DR7 by writing its architectural reset value to always set bit 10, which is reserved to '1', when "clearing" DR7 so as not to trigger unanticipated behavior if said bit is ever unreserved, e.g. as a feature enabling flag with inverted polarity. Signed-off-by: Xin Li (Intel) Signed-off-by: Dave Hansen Reviewed-by: H. Peter Anvin (Intel) Reviewed-by: Sohil Mehta Acked-by: Peter Zijlstra (Intel) Acked-by: Sean Christopherson Tested-by: Sohil Mehta Cc:stable@vger.kernel.org Link: https://lore.kernel.org/all/20250620231504.2676902-3-xin%40zytor.com commit 5f465c148c61e876b6d6eacd8e8e365f2d47758f Author: Xin Li (Intel) Date: Fri Jun 20 16:15:03 2025 -0700 x86/traps: Initialize DR6 by writing its architectural reset value Initialize DR6 by writing its architectural reset value to avoid incorrectly zeroing DR6 to clear DR6.BLD at boot time, which leads to a false bus lock detected warning. The Intel SDM says: 1) Certain debug exceptions may clear bits 0-3 of DR6. 2) BLD induced #DB clears DR6.BLD and any other debug exception doesn't modify DR6.BLD. 3) RTM induced #DB clears DR6.RTM and any other debug exception sets DR6.RTM. To avoid confusion in identifying debug exceptions, debug handlers should set DR6.BLD and DR6.RTM, and clear other DR6 bits before returning. The DR6 architectural reset value 0xFFFF0FF0, already defined as macro DR6_RESERVED, satisfies these requirements, so just use it to reinitialize DR6 whenever needed. Since clear_all_debug_regs() no longer zeros all debug registers, rename it to initialize_debug_regs() to better reflect its current behavior. Since debug_read_clear_dr6() no longer clears DR6, rename it to debug_read_reset_dr6() to better reflect its current behavior. Fixes: ebb1064e7c2e9 ("x86/traps: Handle #DB for bus lock") Reported-by: Sohil Mehta Suggested-by: H. Peter Anvin (Intel) Signed-off-by: Xin Li (Intel) Signed-off-by: Dave Hansen Reviewed-by: H. Peter Anvin (Intel) Reviewed-by: Sohil Mehta Acked-by: Peter Zijlstra (Intel) Tested-by: Sohil Mehta Link: https://lore.kernel.org/lkml/06e68373-a92b-472e-8fd9-ba548119770c@intel.com/ Cc:stable@vger.kernel.org Link: https://lore.kernel.org/all/20250620231504.2676902-2-xin%40zytor.com commit 0048ca5e9945f487fc055dad987ee4c7fdc1ed18 Author: Chenyi Qiang Date: Fri Jun 20 14:22:18 2025 +0800 KVM: selftests: Add back the missing check of MONITOR/MWAIT availability The revamp of monitor/mwait test missed the original check of feature availability [*]. If MONITOR/MWAIT is not supported or is disabled by IA32_MISC_ENABLE on the host, executing MONITOR or MWAIT instruction from guest doesn't cause monitor/mwait VM exits, but a #UD. [*] https://lore.kernel.org/all/20240411210237.34646-1-zide.chen@intel.com/ Reported-by: Xuelian Guo Fixes: 80fd663590cf ("selftests: kvm: revamp MONITOR/MWAIT tests") Signed-off-by: Chenyi Qiang Link: https://lore.kernel.org/r/20250620062219.342930-1-chenyi.qiang@intel.com Signed-off-by: Sean Christopherson commit 865ad1dbf13244b349e3da2731c1188476ad17b8 Author: Kent Overstreet Date: Mon Jun 23 18:42:42 2025 -0400 bcachefs: Check for bad write buffer key when moving from journal Signed-off-by: Kent Overstreet commit 5c4acbc8ce9025fe6e318966af8d3c42ffc6e9ca Author: Alan Huang Date: Wed Jun 25 03:10:27 2025 +0800 bcachefs: Don't unlock the trans if ret doesn't match BCH_ERR_operation_blocked Reported-by: syzbot+d540192e763531d307ff@syzkaller.appspotmail.com Signed-off-by: Alan Huang Signed-off-by: Kent Overstreet commit 47bb584237cc285e3a860b70c01f7bda9dcfb05b Author: Liam Merwick Date: Mon Jun 9 09:11:19 2025 +0000 KVM: Allow CPU to reschedule while setting per-page memory attributes When running an SEV-SNP guest with a sufficiently large amount of memory (1TB+), the host can experience CPU soft lockups when running an operation in kvm_vm_set_mem_attributes() to set memory attributes on the whole range of guest memory. watchdog: BUG: soft lockup - CPU#8 stuck for 26s! [qemu-kvm:6372] CPU: 8 UID: 0 PID: 6372 Comm: qemu-kvm Kdump: loaded Not tainted 6.15.0-rc7.20250520.el9uek.rc1.x86_64 #1 PREEMPT(voluntary) Hardware name: Oracle Corporation ORACLE SERVER E4-2c/Asm,MB Tray,2U,E4-2c, BIOS 78016600 11/13/2024 RIP: 0010:xas_create+0x78/0x1f0 Code: 00 00 00 41 80 fc 01 0f 84 82 00 00 00 ba 06 00 00 00 bd 06 00 00 00 49 8b 45 08 4d 8d 65 08 41 39 d6 73 20 83 ed 06 48 85 c0 <74> 67 48 89 c2 83 e2 03 48 83 fa 02 75 0c 48 3d 00 10 00 00 0f 87 RSP: 0018:ffffad890a34b940 EFLAGS: 00000286 RAX: ffff96f30b261daa RBX: ffffad890a34b9c8 RCX: 0000000000000000 RDX: 000000000000001e RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000018 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffad890a356868 R13: ffffad890a356860 R14: 0000000000000000 R15: ffffad890a356868 FS: 00007f5578a2a400(0000) GS:ffff97ed317e1000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f015c70fb18 CR3: 00000001109fd006 CR4: 0000000000f70ef0 PKRU: 55555554 Call Trace: xas_store+0x58/0x630 __xa_store+0xa5/0x130 xa_store+0x2c/0x50 kvm_vm_set_mem_attributes+0x343/0x710 [kvm] kvm_vm_ioctl+0x796/0xab0 [kvm] __x64_sys_ioctl+0xa3/0xd0 do_syscall_64+0x8c/0x7a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f5578d031bb Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 2d 4c 0f 00 f7 d8 64 89 01 48 RSP: 002b:00007ffe0a742b88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000004020aed2 RCX: 00007f5578d031bb RDX: 00007ffe0a742c80 RSI: 000000004020aed2 RDI: 000000000000000b RBP: 0000010000000000 R08: 0000010000000000 R09: 0000017680000000 R10: 0000000000000080 R11: 0000000000000246 R12: 00005575e5f95120 R13: 00007ffe0a742c80 R14: 0000000000000008 R15: 00005575e5f961e0 While looping through the range of memory setting the attributes, call cond_resched() to give the scheduler a chance to run a higher priority task on the runqueue if necessary and avoid staying in kernel mode long enough to trigger the lockup. Fixes: 5a475554db1e ("KVM: Introduce per-page memory attributes") Cc: stable@vger.kernel.org # 6.12.x Suggested-by: Sean Christopherson Signed-off-by: Liam Merwick Reviewed-by: Pankaj Gupta Link: https://lore.kernel.org/r/20250609091121.2497429-2-liam.merwick@oracle.com Signed-off-by: Sean Christopherson commit a7f4dff21fd744d08fa956c243d2b1795f23cbf7 Author: David Woodhouse Date: Thu May 8 13:30:12 2025 -0700 KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. To avoid imposing an ordering constraint on userspace, allow 'invalid' event channel targets to be configured in the IRQ routing table. This is the same as accepting interrupts targeted at vCPUs which don't exist yet, which is already the case for both Xen event channels *and* for MSIs (which don't do any filtering of permitted APIC ID targets at all). If userspace actually *triggers* an IRQ with an invalid target, that will fail cleanly, as kvm_xen_set_evtchn_fast() also does the same range check. If KVM enforced that the IRQ target must be valid at the time it is *configured*, that would force userspace to create all vCPUs and do various other parts of setup (in this case, setting the Xen long_mode) before restoring the IRQ table. Cc: stable@vger.kernel.org Signed-off-by: David Woodhouse Reviewed-by: Paul Durrant Link: https://lore.kernel.org/r/e489252745ac4b53f1f7f50570b03fb416aa2065.camel@infradead.org [sean: massage comment] Signed-off-by: Sean Christopherson commit 0b6f4a5f0878c410677a8201c48127fda0bfd843 Author: Sean Christopherson Date: Fri Jun 13 12:39:22 2025 -0700 KVM: x86/hyper-v: Use preallocated per-vCPU buffer for de-sparsified vCPU masks Use a preallocated per-vCPU bitmap for tracking the unpacked set of vCPUs being targeted for Hyper-V's paravirt TLB flushing. If KVM_MAX_NR_VCPUS is set to 4096 (which is allowed even for MAXSMP=n builds), putting the vCPU mask on-stack pushes kvm_hv_flush_tlb() past the default FRAME_WARN limit. arch/x86/kvm/hyperv.c:2001:12: error: stack frame size (1288) exceeds limit (1024) in 'kvm_hv_flush_tlb' [-Werror,-Wframe-larger-than] 2001 | static u64 kvm_hv_flush_tlb(struct kvm_vcpu *vcpu, struct kvm_hv_hcall *hc) | ^ 1 error generated. Note, sparse_banks was given the same treatment by commit 7d5e88d301f8 ("KVM: x86: hyper-v: Use preallocated buffer in 'struct kvm_vcpu_hv' instead of on-stack 'sparse_banks'"), for the exact same reason. Reported-by: Abinash Lalotra Closes: https://lore.kernel.org/all/20250613111023.786265-1-abinashsinghlalotra@gmail.com Link: https://lore.kernel.org/all/aEylI-O8kFnFHrOH@google.com Signed-off-by: Sean Christopherson commit 48f15f624189762e7ff2d95bcbb68e21c2d56077 Author: Sean Christopherson Date: Mon Jun 2 15:44:59 2025 -0700 KVM: SVM: Initialize vmsa_pa in VMCB to INVALID_PAGE if VMSA page is NULL When creating an SEV-ES vCPU for intra-host migration, set its vmsa_pa to INVALID_PAGE to harden against doing VMRUN with a bogus VMSA (KVM checks for a valid VMSA page in pre_sev_run()). Cc: Tom Lendacky Reviewed-by: Liam Merwick Tested-by: Liam Merwick Link: https://lore.kernel.org/r/20250602224459.41505-3-seanjc@google.com Signed-off-by: Sean Christopherson commit ecf371f8b02d5e31b9aa1da7f159f1b2107bdb01 Author: Sean Christopherson Date: Mon Jun 2 15:44:58 2025 -0700 KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight Reject migration of SEV{-ES} state if either the source or destination VM is actively creating a vCPU, i.e. if kvm_vm_ioctl_create_vcpu() is in the section between incrementing created_vcpus and online_vcpus. The bulk of vCPU creation runs _outside_ of kvm->lock to allow creating multiple vCPUs in parallel, and so sev_info.es_active can get toggled from false=>true in the destination VM after (or during) svm_vcpu_create(), resulting in an SEV{-ES} VM effectively having a non-SEV{-ES} vCPU. The issue manifests most visibly as a crash when trying to free a vCPU's NULL VMSA page in an SEV-ES VM, but any number of things can go wrong. BUG: unable to handle page fault for address: ffffebde00000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP KASAN NOPTI CPU: 227 UID: 0 PID: 64063 Comm: syz.5.60023 Tainted: G U O 6.15.0-smp-DEV #2 NONE Tainted: [U]=USER, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.52.0-0 10/28/2024 RIP: 0010:constant_test_bit arch/x86/include/asm/bitops.h:206 [inline] RIP: 0010:arch_test_bit arch/x86/include/asm/bitops.h:238 [inline] RIP: 0010:_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline] RIP: 0010:PageHead include/linux/page-flags.h:866 [inline] RIP: 0010:___free_pages+0x3e/0x120 mm/page_alloc.c:5067 Code: <49> f7 06 40 00 00 00 75 05 45 31 ff eb 0c 66 90 4c 89 f0 4c 39 f0 RSP: 0018:ffff8984551978d0 EFLAGS: 00010246 RAX: 0000777f80000001 RBX: 0000000000000000 RCX: ffffffff918aeb98 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffebde00000000 RBP: 0000000000000000 R08: ffffebde00000007 R09: 1ffffd7bc0000000 R10: dffffc0000000000 R11: fffff97bc0000001 R12: dffffc0000000000 R13: ffff8983e19751a8 R14: ffffebde00000000 R15: 1ffffd7bc0000000 FS: 0000000000000000(0000) GS:ffff89ee661d3000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffebde00000000 CR3: 000000793ceaa000 CR4: 0000000000350ef0 DR0: 0000000000000000 DR1: 0000000000000b5f DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Call Trace: sev_free_vcpu+0x413/0x630 arch/x86/kvm/svm/sev.c:3169 svm_vcpu_free+0x13a/0x2a0 arch/x86/kvm/svm/svm.c:1515 kvm_arch_vcpu_destroy+0x6a/0x1d0 arch/x86/kvm/x86.c:12396 kvm_vcpu_destroy virt/kvm/kvm_main.c:470 [inline] kvm_destroy_vcpus+0xd1/0x300 virt/kvm/kvm_main.c:490 kvm_arch_destroy_vm+0x636/0x820 arch/x86/kvm/x86.c:12895 kvm_put_kvm+0xb8e/0xfb0 virt/kvm/kvm_main.c:1310 kvm_vm_release+0x48/0x60 virt/kvm/kvm_main.c:1369 __fput+0x3e4/0x9e0 fs/file_table.c:465 task_work_run+0x1a9/0x220 kernel/task_work.c:227 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x7f0/0x25b0 kernel/exit.c:953 do_group_exit+0x203/0x2d0 kernel/exit.c:1102 get_signal+0x1357/0x1480 kernel/signal.c:3034 arch_do_signal_or_restart+0x40/0x690 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x67/0xb0 kernel/entry/common.c:218 do_syscall_64+0x7c/0x150 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f87a898e969 Modules linked in: gq(O) gsmi: Log Shutdown Reason 0x03 CR2: ffffebde00000000 ---[ end trace 0000000000000000 ]--- Deliberately don't check for a NULL VMSA when freeing the vCPU, as crashing the host is likely desirable due to the VMSA being consumed by hardware. E.g. if KVM manages to allow VMRUN on the vCPU, hardware may read/write a bogus VMSA page. Accessing PFN 0 is "fine"-ish now that it's sequestered away thanks to L1TF, but panicking in this scenario is preferable to potentially running with corrupted state. Reported-by: Alexander Potapenko Tested-by: Alexander Potapenko Fixes: 0b020f5af092 ("KVM: SEV: Add support for SEV-ES intra host migration") Fixes: b56639318bb2 ("KVM: SEV: Add support for SEV intra host migration") Cc: stable@vger.kernel.org Cc: James Houghton Cc: Peter Gonda Reviewed-by: Liam Merwick Tested-by: Liam Merwick Reviewed-by: James Houghton Link: https://lore.kernel.org/r/20250602224459.41505-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 9a96876e3c6578031fa5dc5dde7759d383b2fb75 Author: Nicolin Chen Date: Tue Jun 24 11:00:48 2025 -0700 iommufd/selftest: Fix build warnings due to uninitialized mfd Commit 869c788909b9 ("selftests: harness: Stop using setjmp()/longjmp()") changed the harness structure. For some unknown reason, two build warnings occur to the iommufd selftest: iommufd.c: In function ‘wrapper_iommufd_mock_domain_all_aligns’: iommufd.c:1807:17: warning: ‘mfd’ may be used uninitialized in this function 1807 | close(mfd); | ^~~~~~~~~~ iommufd.c:1767:13: note: ‘mfd’ was declared here 1767 | int mfd; | ^~~ iommufd.c: In function ‘wrapper_iommufd_mock_domain_all_aligns_copy’: iommufd.c:1870:17: warning: ‘mfd’ may be used uninitialized in this function 1870 | close(mfd); | ^~~~~~~~~~ iommufd.c:1819:13: note: ‘mfd’ was declared here 1819 | int mfd; | ^~~ All the mfd have been used in the variant->file path only, so it's likely a false alarm. FWIW, the commit mentioned above does not cause this, yet it might affect gcc in a certain way that resulted in the warnings. It is also found that ading a dummy setjmp (which doesn't make sense) could mute the warnings: https://lore.kernel.org/all/aEi8DV+ReF3v3Rlf@nvidia.com/ The job of this selftest is to catch kernel bug, while such warnings will unlikely disrupt its role. Mute the warning by force initializing the mfd and add an ASSERT_GT(). Link: https://patch.msgid.link/r/6951d85d5cd34cbf22abab7714542654e63ecc44.1750787928.git.nicolinc@nvidia.com Reviewed-by: Jason Gunthorpe Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit a9bf67ee170514b17541038c60bb94cb2cf5732f Author: Nicolin Chen Date: Tue Jun 24 11:00:47 2025 -0700 iommufd/selftest: Add asserts testing global mfd The mfd and mfd_buffer will be used in the tests directly without an extra check. Test them in setup_sizes() to ensure they are safe to use. Fixes: 0bcceb1f51c7 ("iommufd: Selftest coverage for IOMMU_IOAS_MAP_FILE") Link: https://patch.msgid.link/r/94bdc11d2b6d5db337b1361c5e5fce0ed494bb40.1750787928.git.nicolinc@nvidia.com Cc: stable@vger.kernel.org Reviewed-by: Jason Gunthorpe Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit 4b75e3babb85238912f50bbe0647bae08242a9b6 Author: Nicolin Chen Date: Tue Jun 24 11:00:46 2025 -0700 iommufd/selftest: Add missing close(mfd) in memfd_mmap() Do not forget to close mfd in the error paths, since none of the callers would close it when ASSERT_NE(MAP_FAILED, buf) fails. Fixes: 0bcceb1f51c7 ("iommufd: Selftest coverage for IOMMU_IOAS_MAP_FILE") Link: https://patch.msgid.link/r/a363a69dbf453d4bc1bde276f3b16778620488e1.1750787928.git.nicolinc@nvidia.com Cc: stable@vger.kernel.org Reviewed-by: Jason Gunthorpe Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit 818625570558cd91082c9bafd6f2b59b73241a69 Author: Nicolin Chen Date: Tue Jun 24 11:00:45 2025 -0700 iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes The hugepage test cases of iommufd_dirty_tracking have the 64MB and 128MB coverages. Both of them are smaller than the default hugepage size 512MB, when CONFIG_PAGE_SIZE_64KB=y. However, these test cases have a variant of using huge pages, which would mmap(MAP_HUGETLB) using these smaller sizes than the system hugepag size. This results in the kernel aligning up the smaller size to 512MB. If a memory was located between the upper 64/128MB size boundary and the hugepage 512MB boundary, it would get wiped out: https://lore.kernel.org/all/aEoUhPYIAizTLADq@nvidia.com/ Given that this aligning up behavior is well documented, we have no choice but to allocate a hugepage aligned size to avoid this unintended wipe out. Instead of relying on the kernel's internal force alignment, pass the same size to posix_memalign() and map(). Also, fix the FIXTURE_TEARDOWN() misusing munmap() to free the memory from posix_memalign(), as munmap() doesn't destroy the allocator meta data. So, call free() instead. Fixes: a9af47e382a4 ("iommufd/selftest: Test IOMMU_HWPT_GET_DIRTY_BITMAP") Link: https://patch.msgid.link/r/1ea8609ae6d523fdd4d8efb179ddee79c8582cb6.1750787928.git.nicolinc@nvidia.com Cc: stable@vger.kernel.org Suggested-by: Jason Gunthorpe Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit 9127a69c7193ad47047ff968a2de9161d5c93d37 Author: Karthik Poosa Date: Tue Jun 17 17:30:30 2025 +0530 drm/xe/hwmon: Fix xe_hwmon_power_max_write Prevent other bits of mailbox power limit from being overwritten with 0. This issue was due to a missing read and modify of current power limit, before setting a requested mailbox power limit, which is added in this patch. v2: - Improve commit message. (Anshuman) v3: - Rebase. - Rephrase commit message. (Riana) - Add read-modify-write variant of xe_hwmon_pcode_write_power_limit() i.e. xe_hwmon_pcode_rmw_power_limit(). (Badal) - Use xe_hwmon_pcode_rmw_power_limit() to set mailbox power limits. - Remove xe_hwmon_pcode_write_power_limit() as all mailbox power limits writes use xe_hwmon_pcode_rmw_power_limit() only. v4: - Use PWR_LIM in place of (PWR_LIM_EN | PWR_LIM_VAL) wherever applicable. (Riana) Fixes: 25a2aa779fc3 ("drm/xe/hwmon: Add support to manage power limits though mailbox") Reviewed-by: Riana Tauro Signed-off-by: Karthik Poosa Reviewed-by: Badal Nilawar Link: https://lore.kernel.org/r/20250617120030.612819-1-karthik.poosa@intel.com Signed-off-by: Rodrigo Vivi (cherry picked from commit 8aa7306631f088881759398972d503757cf0c901) Signed-off-by: Thomas Hellström commit 62207293479e6c03ef498a70f2914c51f4d31d2c Author: Haoxiang Li Date: Fri May 16 15:16:55 2025 +0300 drm/xe/display: Add check for alloc_ordered_workqueue() Add check for the return value of alloc_ordered_workqueue() in xe_display_create() to catch potential exception. Fixes: 44e694958b95 ("drm/xe/display: Implement display support") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/4ee1b0e5d1626ce1dde2e82af05c2edaed50c3aa.1747397638.git.jani.nikula@intel.com Signed-off-by: Jani Nikula (cherry picked from commit 5b62d63395d5b7d4094e7cd380bccae4b25415cb) Signed-off-by: Thomas Hellström commit b07f349d1864abe29436f45e3047da2bdd476462 Author: Khairul Anuar Romli Date: Mon Jun 16 09:13:53 2025 +0800 spi: spi-cadence-quadspi: Fix pm runtime unbalance Having PM put sync in remove function is causing PM underflow during remove operation. This is caused by the function, runtime_pm_get_sync, not being called anywhere during the op. Ensure that calls to pm_runtime_enable()/pm_runtime_disable() and pm_runtime_get_sync()/pm_runtime_put_sync() match. echo 108d2000.spi > /sys/bus/platform/drivers/cadence-qspi/unbind [ 49.644256] Deleting MTD partitions on "108d2000.spi.0": [ 49.649575] Deleting u-boot MTD partition [ 49.684087] Deleting root MTD partition [ 49.724188] cadence-qspi 108d2000.spi: Runtime PM usage count underflow! Continuous bind/unbind will result in an "Unbalanced pm_runtime_enable" error. Subsequent unbind attempts will return a "No such device" error, while bind attempts will return a "Resource temporarily unavailable" error. [ 47.592434] cadence-qspi 108d2000.spi: Runtime PM usage count underflow! [ 49.592233] cadence-qspi 108d2000.spi: detected FIFO depth (1024) different from config (128) [ 53.232309] cadence-qspi 108d2000.spi: Runtime PM usage count underflow! [ 55.828550] cadence-qspi 108d2000.spi: detected FIFO depth (1024) different from config (128) [ 57.940627] cadence-qspi 108d2000.spi: Runtime PM usage count underflow! [ 59.912490] cadence-qspi 108d2000.spi: detected FIFO depth (1024) different from config (128) [ 61.876243] cadence-qspi 108d2000.spi: Runtime PM usage count underflow! [ 61.883000] platform 108d2000.spi: Unbalanced pm_runtime_enable! [ 532.012270] cadence-qspi 108d2000.spi: probe with driver cadence-qspi failed1 Also, change clk_disable_unprepare() to clk_disable() since continuous bind and unbind operations will trigger a warning indicating that the clock is already unprepared. Fixes: 4892b374c9b7 ("mtd: spi-nor: cadence-quadspi: Add runtime PM support") cc: stable@vger.kernel.org # 6.6+ Signed-off-by: Khairul Anuar Romli Reviewed-by: Matthew Gerlach Link: https://patch.msgid.link/4e7a4b8aba300e629b45a04f90bddf665fbdb335.1749601877.git.khairul.anuar.romli@altera.com Signed-off-by: Mark Brown commit 6c038b58a2dc5a008c7e7a1297f5aaa4deaaaa7e Author: Tamura Dai Date: Mon Jun 16 08:55:48 2025 +0900 ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. sof_pdata->tplg_filename can have address allocated by kstrdup() and can be overwritten. Memory leak was detected with kmemleak: unreferenced object 0xffff88812391ff60 (size 16): comm "kworker/4:1", pid 161, jiffies 4294802931 hex dump (first 16 bytes): 73 6f 66 2d 68 64 61 2d 67 65 6e 65 72 69 63 00 sof-hda-generic. backtrace (crc 4bf1675c): __kmalloc_node_track_caller_noprof+0x49c/0x6b0 kstrdup+0x46/0xc0 hda_machine_select.cold+0x1de/0x12cf [snd_sof_intel_hda_generic] sof_init_environment+0x16f/0xb50 [snd_sof] sof_probe_continue+0x45/0x7c0 [snd_sof] sof_probe_work+0x1e/0x40 [snd_sof] process_one_work+0x894/0x14b0 worker_thread+0x5e5/0xfb0 kthread+0x39d/0x760 ret_from_fork+0x31/0x70 ret_from_fork_asm+0x1a/0x30 Signed-off-by: Tamura Dai Link: https://patch.msgid.link/20250615235548.8591-1-kirinode0@gmail.com Signed-off-by: Mark Brown commit 099cf1fbb8afc3771f408109f62bdec66f85160e Author: Andrei Kuchynski Date: Tue Jun 24 13:32:46 2025 +0000 usb: typec: displayport: Fix potential deadlock The deadlock can occur due to a recursive lock acquisition of `cros_typec_altmode_data::mutex`. The call chain is as follows: 1. cros_typec_altmode_work() acquires the mutex 2. typec_altmode_vdm() -> dp_altmode_vdm() -> 3. typec_altmode_exit() -> cros_typec_altmode_exit() 4. cros_typec_altmode_exit() attempts to acquire the mutex again To prevent this, defer the `typec_altmode_exit()` call by scheduling it rather than calling it directly from within the mutex-protected context. Cc: stable Fixes: b4b38ffb38c9 ("usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode") Signed-off-by: Andrei Kuchynski Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20250624133246.3936737-1-akuchynski@chromium.org Signed-off-by: Greg Kroah-Hartman commit af4db5a35a4ef7a68046883bfd12468007db38f1 Author: RD Babiera Date: Wed Jun 18 22:49:42 2025 +0000 usb: typec: altmodes/displayport: do not index invalid pin_assignments A poorly implemented DisplayPort Alt Mode port partner can indicate that its pin assignment capabilities are greater than the maximum value, DP_PIN_ASSIGN_F. In this case, calls to pin_assignment_show will cause a BRK exception due to an out of bounds array access. Prevent for loop in pin_assignment_show from accessing invalid values in pin_assignments by adding DP_PIN_ASSIGN_MAX value in typec_dp.h and using i < DP_PIN_ASSIGN_MAX as a loop condition. Fixes: 0e3bb7d6894d ("usb: typec: Add driver for DisplayPort alternate mode") Cc: stable Signed-off-by: RD Babiera Reviewed-by: Badhri Jagan Sridharan Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20250618224943.3263103-2-rdbabiera@google.com Signed-off-by: Greg Kroah-Hartman commit 2831a81077f5162f104ba5a97a7d886eb371c21c Author: Pawel Laszczak Date: Fri Jun 20 08:23:12 2025 +0000 usb: cdnsp: Fix issue with CV Bad Descriptor test The SSP2 controller has extra endpoint state preserve bit (ESP) which setting causes that endpoint state will be preserved during Halt Endpoint command. It is used only for EP0. Without this bit the Command Verifier "TD 9.10 Bad Descriptor Test" failed. Setting this bit doesn't have any impact for SSP controller. Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver") Cc: stable Signed-off-by: Pawel Laszczak Acked-by: Peter Chen Link: https://lore.kernel.org/r/PH7PR07MB95382CCD50549DABAEFD6156DD7CA@PH7PR07MB9538.namprd07.prod.outlook.com Signed-off-by: Greg Kroah-Hartman commit bec15191d52300defa282e3fd83820f69e447116 Author: RD Babiera Date: Wed Jun 18 23:06:04 2025 +0000 usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach This patch fixes Type-C compliance test TD 4.7.6 - Try.SNK DRP Connect SNKAS. tVbusON has a limit of 275ms when entering SRC_ATTACHED. Compliance testers can interpret the TryWait.Src to Attached.Src transition after Try.Snk as being in Attached.Src the entire time, so ~170ms is lost to the debounce timer. Setting the data role can be a costly operation in host mode, and when completed after 100ms can cause Type-C compliance test check TD 4.7.5.V.4 to fail. Turn VBUS on before tcpm_set_roles to meet timing requirement. Fixes: f0690a25a140 ("staging: typec: USB Type-C Port Manager (tcpm)") Cc: stable Signed-off-by: RD Babiera Reviewed-by: Badhri Jagan Sridharan Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20250618230606.3272497-2-rdbabiera@google.com Signed-off-by: Greg Kroah-Hartman commit 6847b3b6e84ef37451c074e6a8db3fbd250c8dbf Author: Takashi Iwai Date: Mon Jun 16 18:08:41 2025 +0200 drm/amd/display: Add sanity checks for drm_edid_raw() When EDID is retrieved via drm_edid_raw(), it doesn't guarantee to return proper EDID bytes the caller wants: it may be either NULL (that leads to an Oops) or with too long bytes over the fixed size raw_edid array (that may lead to memory corruption). The latter was reported actually when connected with a bad adapter. Add sanity checks for drm_edid_raw() to address the above corner cases, and return EDID_BAD_INPUT accordingly. Fixes: 48edb2a4256e ("drm/amd/display: switch amdgpu_dm_connector to use struct drm_edid") Link: https://bugzilla.suse.com/show_bug.cgi?id=1236415 Signed-off-by: Takashi Iwai Signed-off-by: Alex Deucher (cherry picked from commit 648d3f4d209725d51900d6a3ed46b7b600140cdf) Cc: stable@vger.kernel.org commit 66abb996999de0d440a02583a6e70c2c24deab45 Author: Mario Limonciello Date: Mon Jun 23 12:11:13 2025 -0500 drm/amd/display: Fix AMDGPU_MAX_BL_LEVEL value [Why] commit 16dc8bc27c2a ("drm/amd/display: Export full brightness range to userspace") adjusted the brightness range to scale to larger values, but missed updating AMDGPU_MAX_BL_LEVEL which is needed to make sure that scaling works properly with custom brightness curves. [How] As the change for max brightness of 0xFFFF only applies to devices supporting DC, use existing DC define MAX_BACKLIGHT_LEVEL. Fixes: 16dc8bc27c2a ("drm/amd/display: Export full brightness range to userspace") Acked-by: Alex Deucher Link: https://lore.kernel.org/r/20250623171114.1156451-1-mario.limonciello@amd.com Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit 5b852044eb0d3e1f1c946d32e05fcb068e0a20a0) Cc: stable@vger.kernel.org commit 31135cc99c40247bec924dcdcd74a58e866c52d8 Author: Alex Deucher Date: Fri Jun 20 11:39:22 2025 -0400 drm/amdgpu/sdma7: add ucode version checks for userq support SDMA 7.0.0/1: 7836028 Reviewed-by: Jesse Zhang Signed-off-by: Alex Deucher (cherry picked from commit 8c011408ed842dfccdd50a90a9cf6bccdb85cc0e) commit 899dec4e885f839da2065803e21b7ab003a5c609 Author: Alex Deucher Date: Thu Jun 19 17:56:29 2025 -0400 drm/amdgpu/sdma6: add ucode version checks for userq support SDMA 6.0.0 version 24 SDMA 6.0.2 version 21 SDMA 6.0.3 version 25 Reviewed-by: Jesse Zhang Signed-off-by: Alex Deucher (cherry picked from commit e8cca30d8b34f1c4101c237914c53068d4a55e73) commit 73eab78721f7b85216f1ca8c7b732f13213b5b32 Author: Mario Limonciello Date: Tue Jun 17 13:30:52 2025 -0500 drm/amd: Adjust output for discovery error handling commit 017fbb6690c2 ("drm/amdgpu/discovery: check ip_discovery fw file available") added support for reading an amdgpu IP discovery bin file for some specific products. If it's not found then it will fallback to hardcoded values. However if it's not found there is also a lot of noise about missing files and errors. Adjust the error handling to decrease most messages to DEBUG and to show users less about missing files. Reviewed-by: Lijo Lazar Reported-by: Marcus Seyfarth Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4312 Tested-by: Marcus Seyfarth Fixes: 017fbb6690c2 ("drm/amdgpu/discovery: check ip_discovery fw file available") Acked-by: Alex Deucher Link: https://lore.kernel.org/r/20250617183052.1692059-1-superm1@kernel.org Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit 49f1f9f6c3c9febf8ba93f94a8d9c8d03e1ea0a1) commit 99579c55c3d6132a5236926652c0a72a526b809d Author: Alex Deucher Date: Tue May 20 10:02:14 2025 -0400 drm/amdgpu/mes: add compatibility checks for set_hw_resource_1 Seems some older MES firmware versions do not properly support this packet. Add back some the compatibility checks. v2: switch to fw version check (Shaoyun) Fixes: f81cd793119e ("drm/amd/amdgpu: Fix MES init sequence") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4295 Cc: Shaoyun Liu Reviewed-by: shaoyun.liu Signed-off-by: Alex Deucher (cherry picked from commit 0180e0a5dd5c6ff118043ee42dbbbddaf881f283) Cc: stable@vger.kernel.org commit 0043ec26d827ddb1e85bd9786693152aa6f55d16 Author: Srinivasan Shanmugam Date: Thu Jun 12 20:11:14 2025 +0530 drm/amdgpu/gfx9: Add Cleaner Shader Support for GFX9.x GPUs Enable the cleaner shader for other GFX9.x series of GPUs to provide data isolation between GPU workloads. The cleaner shader is responsible for clearing the Local Data Store (LDS), Vector General Purpose Registers (VGPRs), and Scalar General Purpose Registers (SGPRs), which helps prevent data leakage and ensures accurate computation results. This update extends cleaner shader support to GFX9.x GPUs, previously available for GFX9.4.2. It enhances security by clearing GPU memory between processes and maintains a consistent GPU state across KGD and KFD workloads. Cc: Manu Rastogi Cc: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 99808926d0ea6234a89e35240a7cb088368de9e1) commit 09812134071b3941fb81def30b61ed36d3a5dfb5 Author: Yao Zi Date: Mon Jun 23 09:34:45 2025 +0000 dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive The 8250 binding before converting to json-schema states, - clock-frequency : the input clock frequency for the UART or - clocks phandle to refer to the clk used as per Documentation/devicetree for clock-related properties, where "or" indicates these properties shouldn't exist at the same time. Additionally, the behavior of Linux's driver is strange when both clocks and clock-frequency are specified: it ignores clocks and obtains the frequency from clock-frequency, left the specified clocks unclaimed. It may even be disabled, which is undesired most of the time. But "anyOf" doesn't prevent these two properties from coexisting, as it considers the object valid as long as there's at LEAST one match. Let's switch to "oneOf" and disallows the other property if one exists, precisely matching the original binding and avoiding future confusion on the driver's behavior. Fixes: e69f5dc623f9 ("dt-bindings: serial: Convert 8250 to json-schema") Cc: stable Signed-off-by: Yao Zi Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20250623093445.62327-1-ziyao@disroot.org Signed-off-by: Greg Kroah-Hartman commit f23c52aafb1675ab1d1f46914556d8e29cbbf7b3 Author: Fabio Estevam Date: Thu Jun 19 08:46:17 2025 -0300 serial: imx: Restore original RXTL for console to fix data loss Commit 7a637784d517 ("serial: imx: reduce RX interrupt frequency") introduced a regression on the i.MX6UL EVK board. The issue can be reproduced with the following steps: - Open vi on the board. - Paste a text file (~150 characters). - Save the file, then repeat the process. - Compare the sha256sum of the saved files. The checksums do not match due to missing characters or entire lines. Fix this by restoring the RXTL value to 1 when the UART is used as a console. This ensures timely RX interrupts and reliable data reception in console mode. With this change, pasted content is saved correctly, and checksums are always consistent. Cc: stable Fixes: 7a637784d517 ("serial: imx: reduce RX interrupt frequency") Signed-off-by: Fabio Estevam Reviewed-by: Stefan Wahren Link: https://lore.kernel.org/r/20250619114617.2791939-1-festevam@gmail.com Signed-off-by: Greg Kroah-Hartman commit 0748e553df0225754c316a92af3a77fdc057b358 Author: Al Viro Date: Tue Jun 24 10:25:04 2025 -0400 userns and mnt_idmap leak in open_tree_attr(2) Once want_mount_setattr() has returned a positive, it does require finish_mount_kattr() to release ->mnt_userns. Failing do_mount_setattr() does not change that. As the result, we can end up leaking userns and possibly mnt_idmap as well. Fixes: c4a16820d901 ("fs: add open_tree_attr()") Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 08d82d0cad51c2b1d454fe41ea1ff96ade676961 Author: Hugo Villeneuve Date: Thu May 29 16:29:22 2025 -0400 rtc: pcf2127: add missing semicolon after statement Replace comma with semicolon at the end of the statement when setting config.max_register. Fixes: fd28ceb4603f ("rtc: pcf2127: add variant-specific configuration structure") Cc: stable@vger.kernel.org Cc: Elena Popa Signed-off-by: Hugo Villeneuve Link: https://lore.kernel.org/r/20250529202923.1552560-1-hugo@hugovil.com Signed-off-by: Alexandre Belloni commit fa78e9b606a472495ef5b6b3d8b45c37f7727f9d Author: Elena Popa Date: Fri May 30 13:40:00 2025 +0300 rtc: pcf2127: fix SPI command byte for PCF2131 PCF2131 was not responding to read/write operations using SPI. PCF2131 has a different command byte definition, compared to PCF2127/29. Added the new command byte definition when PCF2131 is detected. Fixes: afc505bf9039 ("rtc: pcf2127: add support for PCF2131 RTC") Cc: stable@vger.kernel.org Signed-off-by: Elena Popa Acked-by: Hugo Villeneuve Link: https://lore.kernel.org/r/20250530104001.957977-1-elena.popa@nxp.com Signed-off-by: Alexandre Belloni commit d87c3ca0f8f1ca4c25f2ed819e954952f4d8d709 Author: Johannes Berg Date: Tue Jun 24 13:07:49 2025 +0200 wifi: mac80211: finish link init before RCU publish Since the link/conf pointers can be accessed without any protection other than RCU, make sure the data is actually set up before publishing the structures. Fixes: b2e8434f1829 ("wifi: mac80211: set up/tear down client vif links properly") Link: https://patch.msgid.link/20250624130749.9a308b713c74.I4a80f5eead112a38730939ea591d2e275c721256@changeid Signed-off-by: Johannes Berg commit ff21a6ec0f27c126db0a86d96751bd6e5d1d9874 Author: Jack Yu Date: Tue Jun 24 02:59:28 2025 +0000 ASoC: rt721-sdca: fix boost gain calculation error Fix the boost gain calculation error in rt721_sdca_set_gain_get. This patch is specific for "FU33 Boost Volume". Signed-off-by: Jack Yu Link: https://patch.msgid.link/1b18fcde41c64d6fa85451d523c0434a@realtek.com Signed-off-by: Mark Brown commit dcc3bcfc5b50c625b475dcc25d167b6b947a6637 Author: Ulf Hansson Date: Tue Jun 24 13:09:32 2025 +0200 Revert "mmc: sdhci: Disable SD card clock before changing parameters" It has turned out the trying to strictly conform to the SDHCI specification is causing problems. Let's revert and start over. This reverts commit fb3bbc46c94f261b6156ee863c1b06c84cf157dc. Cc: Erick Shepherd Cc: stable@vger.kernel.org Fixes: fb3bbc46c94f ("mmc: sdhci: Disable SD card clock before changing parameters") Suggested-by: Adrian Hunter Reported-by: Jonathan Liu Reported-by: Salvatore Bonaccorso Closes: https://bugs.debian.org/1108065 Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20250624110932.176925-1-ulf.hansson@linaro.org commit 1fd26729e013d0c829eb0675d5b6ad77ff497ab3 Merge: c3f429388c192e 1d6123102e9fbe Author: Paolo Abeni Date: Tue Jun 24 12:40:54 2025 +0200 Merge tag 'for-net-2025-06-23' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - L2CAP: Fix L2CAP MTU negotiation - hci_core: Fix use-after-free in vhci_flush() - btintel_pcie: Fix potential race condition in firmware download - hci_qca: fix unable to load the BT driver * tag 'for-net-2025-06-23' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: hci_core: Fix use-after-free in vhci_flush() driver: bluetooth: hci_qca:fix unable to load the BT driver Bluetooth: L2CAP: Fix L2CAP MTU negotiation Bluetooth: btintel_pcie: Fix potential race condition in firmware download ==================== Link: https://patch.msgid.link/20250623165405.227619-1-luiz.dentz@gmail.com Signed-off-by: Paolo Abeni commit 49b14db035135341f6cf4de7af6ac2cbc8ad29b6 Author: Victor Shih Date: Fri Jun 6 19:01:21 2025 +0800 mmc: sdhci-uhs2: Adjust some error messages and register dump for SD UHS-II card Adjust some error messages to debug mode and register dump to dynamic debug mode to avoid causing misunderstanding it is an error. Signed-off-by: Victor Shih Acked-by: Adrian Hunter Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250606110121.96314-4-victorshihgli@gmail.com Signed-off-by: Ulf Hansson commit 2881ba9af073faa8ee7408a8d1e0575e50eb3f6c Author: Victor Shih Date: Fri Jun 6 19:01:20 2025 +0800 mmc: sdhci: Add a helper function for dump register in dynamic debug mode Add a helper function for dump register in dynamic debug mode. Signed-off-by: Victor Shih Acked-by: Adrian Hunter Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250606110121.96314-3-victorshihgli@gmail.com Signed-off-by: Ulf Hansson commit 14633da0f416fdbb6844d1b295cdc828b666e273 Author: Victor Shih Date: Fri Jun 6 19:01:19 2025 +0800 mmc: core: Adjust some error messages for SD UHS-II cards Adjust some error messages to debug mode to avoid causing misunderstanding it is an error. Signed-off-by: Victor Shih Acked-by: Adrian Hunter Fixes: 9a9f7e13952b ("mmc: core: Support UHS-II card control and access") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250606110121.96314-2-victorshihgli@gmail.com Signed-off-by: Ulf Hansson commit dbee298cb7bba3aa112a0265b208f2f3861c5744 Author: Joanne Koong Date: Fri Jun 13 17:01:14 2025 -0700 fuse: fix fuse_fill_write_pages() upper bound calculation This fixes a bug in commit 63c69ad3d18a ("fuse: refactor fuse_fill_write_pages()") where max_pages << PAGE_SHIFT is mistakenly used as the calculation for the max_pages upper limit but there's the possibility that copy_folio_from_iter_atomic() may copy over bytes from the iov_iter that are less than the full length of the folio, which would lead to exceeding max_pages. This commit fixes it by adding a 'ap->num_folios < max_folios' check. Signed-off-by: Joanne Koong Link: https://lore.kernel.org/20250614000114.910380-1-joannelkoong@gmail.com Fixes: 63c69ad3d18a ("fuse: refactor fuse_fill_write_pages()") Tested-by: Brian Foster Reported-by: Brian Foster Closes: https://lore.kernel.org/linux-fsdevel/aEq4haEQScwHIWK6@bfoster/ Signed-off-by: Christian Brauner commit 08f49cdb71f3759368fded4dbc9dde35a404ec2b Author: Slark Xiao Date: Fri Jun 20 11:57:21 2025 +0800 USB: serial: option: add Foxconn T99W640 T99W640 is designed based on Qualconn SDX72 chip. There are 3 serial ports to be enumerated: Diag, NMEA and AT. Test evidence as below: T: Bus=04 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 1 P: Vendor=0489 ProdID=e167 Rev=05.15 S: Manufacturer=QCOM S: Product=SDXPINNL USB WWAN Adapter S: SerialNumber=cc1f1d92 C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms 0&1: MBIM, 2:Modem, 3:GNSS(non-serial port), 4: NMEA, 5:Diag Signed-off-by: Slark Xiao Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 93598167dcb6351ba40449d994244696168f1094 Author: Miri Korenblit Date: Tue Jun 24 10:14:27 2025 +0300 wifi: iwlwifi: mvm: assume '1' as the default mac_config_cmd version Unfortunately, FWs of some devices don't have the version of the iwl_mac_config_cmd defined in the TLVs. We send 0 as the 'def argument to iwl_fw_lookup_cmd_ver, so for such FWs, the return value will be 0, leading to a warning, and to not sending the command. Fix this by assuming that the default version is 1. Fixes: 83f3ac2848b4 ("wifi: iwlwifi: Fix incorrect logic on cmd_ver range checking") Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250624071427.2662621-1-miriam.rachel.korenblit@intel.com commit b272f42547d85356b035e46273ddaf2aa4e161b8 Author: Harshit Mogalapalli Date: Mon Jun 23 07:26:27 2025 -0700 ALSA: qc_audio_offload: Fix missing error code in prepare_qmi_response() When snd_soc_usb_find_priv_data() fails, return failure instead of success. While we are at it also use direct returns at first few error paths where there is no additional cleanup needed. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/Z_40qL4JnyjR4j0O@stanley.mountain/ Fixes: 326bbc348298 ("ALSA: usb-audio: qcom: Introduce QC USB SND offloading support") Signed-off-by: Harshit Mogalapalli Link: https://patch.msgid.link/20250623142639.2938056-1-harshit.m.mogalapalli@oracle.com Signed-off-by: Takashi Iwai commit c3f429388c192eeb17aafa17eb315cb01f5d2aa8 Merge: 7544f3f5b0b58c 632f55fa60c481 Author: Paolo Abeni Date: Tue Jun 24 10:10:09 2025 +0200 Merge branch 'af_unix-fix-two-oob-issues' Kuniyuki Iwashima says: ==================== af_unix: Fix two OOB issues. From: Kuniyuki Iwashima Recently, two issues are reported regarding MSG_OOB. Patch 1 fixes issues that happen when multiple consumed OOB skbs are placed consecutively in the recv queue. Patch 2 fixes an inconsistent behaviour that close()ing a socket with a consumed OOB skb at the head of the recv queue triggers -ECONNRESET on the peer's recv(). v1: https://lore.kernel.org/netdev/20250618043453.281247-1-kuni1840@gmail.com/ ==================== Link: https://patch.msgid.link/20250619041457.1132791-1-kuni1840@gmail.com Signed-off-by: Paolo Abeni commit 632f55fa60c481035297739ecd374d945c9b32c7 Author: Kuniyuki Iwashima Date: Wed Jun 18 21:13:58 2025 -0700 selftest: af_unix: Add tests for -ECONNRESET. A new function resetpair() calls close() for the receiver and checks the return value from recv() on the initial sender side. Now resetpair() is added to each test case and some additional test cases. Note that TCP sets -ECONNRESET to the consumed OOB, but we have decided not to touch TCP MSG_OOB code in the past. Before: # RUN msg_oob.no_peek.ex_oob_ex_oob ... # msg_oob.c:236:ex_oob_ex_oob:AF_UNIX :Connection reset by peer # msg_oob.c:237:ex_oob_ex_oob:Expected: # msg_oob.c:239:ex_oob_ex_oob:Expected ret[0] (-1) == expected_len (0) # ex_oob_ex_oob: Test terminated by assertion # FAIL msg_oob.no_peek.ex_oob_ex_oob not ok 14 msg_oob.no_peek.ex_oob_ex_oob ... # FAILED: 36 / 48 tests passed. # Totals: pass:36 fail:12 xfail:0 xpass:0 skip:0 error:0 After: # RUN msg_oob.no_peek.ex_oob_ex_oob ... # msg_oob.c:244:ex_oob_ex_oob:AF_UNIX : # msg_oob.c:245:ex_oob_ex_oob:TCP :Connection reset by peer # OK msg_oob.no_peek.ex_oob_ex_oob ok 14 msg_oob.no_peek.ex_oob_ex_oob ... # PASSED: 48 / 48 tests passed. # Totals: pass:48 fail:0 xfail:0 xpass:0 skip:0 error:0 Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250619041457.1132791-5-kuni1840@gmail.com Signed-off-by: Paolo Abeni commit 2a5a4841846b079b5fca5752fe94e59346fbda40 Author: Kuniyuki Iwashima Date: Wed Jun 18 21:13:57 2025 -0700 af_unix: Don't set -ECONNRESET for consumed OOB skb. Christian Brauner reported that even after MSG_OOB data is consumed, calling close() on the receiver socket causes the peer's recv() to return -ECONNRESET: 1. send() and recv() an OOB data. >>> from socket import * >>> s1, s2 = socketpair(AF_UNIX, SOCK_STREAM) >>> s1.send(b'x', MSG_OOB) 1 >>> s2.recv(1, MSG_OOB) b'x' 2. close() for s2 sets ECONNRESET to s1->sk_err even though s2 consumed the OOB data >>> s2.close() >>> s1.recv(10, MSG_DONTWAIT) ... ConnectionResetError: [Errno 104] Connection reset by peer Even after being consumed, the skb holding the OOB 1-byte data stays in the recv queue to mark the OOB boundary and break recv() at that point. This must be considered while close()ing a socket. Let's skip the leading consumed OOB skb while checking the -ECONNRESET condition in unix_release_sock(). Fixes: 314001f0bf92 ("af_unix: Add OOB support") Reported-by: Christian Brauner Closes: https://lore.kernel.org/netdev/20250529-sinkt-abfeuern-e7b08200c6b0@brauner/ Signed-off-by: Kuniyuki Iwashima Acked-by: Christian Brauner Link: https://patch.msgid.link/20250619041457.1132791-4-kuni1840@gmail.com Signed-off-by: Paolo Abeni commit e1ca44e85f652a6ebd657c67c394894c1fdfb403 Author: Kuniyuki Iwashima Date: Wed Jun 18 21:13:56 2025 -0700 af_unix: Add test for consecutive consumed OOB. Let's add a test case where consecutive concumed OOB skbs stay at the head of the queue. Without the previous patch, ioctl(SIOCATMARK) assertion fails. Before: # RUN msg_oob.no_peek.ex_oob_ex_oob_oob ... # msg_oob.c:305:ex_oob_ex_oob_oob:Expected answ[0] (0) == oob_head (1) # ex_oob_ex_oob_oob: Test terminated by assertion # FAIL msg_oob.no_peek.ex_oob_ex_oob_oob not ok 12 msg_oob.no_peek.ex_oob_ex_oob_oob After: # RUN msg_oob.no_peek.ex_oob_ex_oob_oob ... # OK msg_oob.no_peek.ex_oob_ex_oob_oob ok 12 msg_oob.no_peek.ex_oob_ex_oob_oob Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250619041457.1132791-3-kuni1840@gmail.com Signed-off-by: Paolo Abeni commit 32ca245464e1479bfea8592b9db227fdc1641705 Author: Kuniyuki Iwashima Date: Wed Jun 18 21:13:55 2025 -0700 af_unix: Don't leave consecutive consumed OOB skbs. Jann Horn reported a use-after-free in unix_stream_read_generic(). The following sequences reproduce the issue: $ python3 from socket import * s1, s2 = socketpair(AF_UNIX, SOCK_STREAM) s1.send(b'x', MSG_OOB) s2.recv(1, MSG_OOB) # leave a consumed OOB skb s1.send(b'y', MSG_OOB) s2.recv(1, MSG_OOB) # leave a consumed OOB skb s1.send(b'z', MSG_OOB) s2.recv(1) # recv 'z' illegally s2.recv(1, MSG_OOB) # access 'z' skb (use-after-free) Even though a user reads OOB data, the skb holding the data stays on the recv queue to mark the OOB boundary and break the next recv(). After the last send() in the scenario above, the sk2's recv queue has 2 leading consumed OOB skbs and 1 real OOB skb. Then, the following happens during the next recv() without MSG_OOB 1. unix_stream_read_generic() peeks the first consumed OOB skb 2. manage_oob() returns the next consumed OOB skb 3. unix_stream_read_generic() fetches the next not-yet-consumed OOB skb 4. unix_stream_read_generic() reads and frees the OOB skb , and the last recv(MSG_OOB) triggers KASAN splat. The 3. above occurs because of the SO_PEEK_OFF code, which does not expect unix_skb_len(skb) to be 0, but this is true for such consumed OOB skbs. while (skip >= unix_skb_len(skb)) { skip -= unix_skb_len(skb); skb = skb_peek_next(skb, &sk->sk_receive_queue); ... } In addition to this use-after-free, there is another issue that ioctl(SIOCATMARK) does not function properly with consecutive consumed OOB skbs. So, nothing good comes out of such a situation. Instead of complicating manage_oob(), ioctl() handling, and the next ECONNRESET fix by introducing a loop for consecutive consumed OOB skbs, let's not leave such consecutive OOB unnecessarily. Now, while receiving an OOB skb in unix_stream_recv_urg(), if its previous skb is a consumed OOB skb, it is freed. [0]: BUG: KASAN: slab-use-after-free in unix_stream_read_actor (net/unix/af_unix.c:3027) Read of size 4 at addr ffff888106ef2904 by task python3/315 CPU: 2 UID: 0 PID: 315 Comm: python3 Not tainted 6.16.0-rc1-00407-gec315832f6f9 #8 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-4.fc42 04/01/2014 Call Trace: dump_stack_lvl (lib/dump_stack.c:122) print_report (mm/kasan/report.c:409 mm/kasan/report.c:521) kasan_report (mm/kasan/report.c:636) unix_stream_read_actor (net/unix/af_unix.c:3027) unix_stream_read_generic (net/unix/af_unix.c:2708 net/unix/af_unix.c:2847) unix_stream_recvmsg (net/unix/af_unix.c:3048) sock_recvmsg (net/socket.c:1063 (discriminator 20) net/socket.c:1085 (discriminator 20)) __sys_recvfrom (net/socket.c:2278) __x64_sys_recvfrom (net/socket.c:2291 (discriminator 1) net/socket.c:2287 (discriminator 1) net/socket.c:2287 (discriminator 1)) do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) RIP: 0033:0x7f8911fcea06 Code: 5d e8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 75 19 83 e2 39 83 fa 08 75 11 e8 26 ff ff ff 66 0f 1f 44 00 00 48 8b 45 10 0f 05 <48> 8b 5d f8 c9 c3 0f 1f 40 00 f3 0f 1e fa 55 48 89 e5 48 83 ec 08 RSP: 002b:00007fffdb0dccb0 EFLAGS: 00000202 ORIG_RAX: 000000000000002d RAX: ffffffffffffffda RBX: 00007fffdb0dcdc8 RCX: 00007f8911fcea06 RDX: 0000000000000001 RSI: 00007f8911a5e060 RDI: 0000000000000006 RBP: 00007fffdb0dccd0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000202 R12: 00007f89119a7d20 R13: ffffffffc4653600 R14: 0000000000000000 R15: 0000000000000000 Allocated by task 315: kasan_save_stack (mm/kasan/common.c:48) kasan_save_track (mm/kasan/common.c:60 (discriminator 1) mm/kasan/common.c:69 (discriminator 1)) __kasan_slab_alloc (mm/kasan/common.c:348) kmem_cache_alloc_node_noprof (./include/linux/kasan.h:250 mm/slub.c:4148 mm/slub.c:4197 mm/slub.c:4249) __alloc_skb (net/core/skbuff.c:660 (discriminator 4)) alloc_skb_with_frags (./include/linux/skbuff.h:1336 net/core/skbuff.c:6668) sock_alloc_send_pskb (net/core/sock.c:2993) unix_stream_sendmsg (./include/net/sock.h:1847 net/unix/af_unix.c:2256 net/unix/af_unix.c:2418) __sys_sendto (net/socket.c:712 (discriminator 20) net/socket.c:727 (discriminator 20) net/socket.c:2226 (discriminator 20)) __x64_sys_sendto (net/socket.c:2233 (discriminator 1) net/socket.c:2229 (discriminator 1) net/socket.c:2229 (discriminator 1)) do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Freed by task 315: kasan_save_stack (mm/kasan/common.c:48) kasan_save_track (mm/kasan/common.c:60 (discriminator 1) mm/kasan/common.c:69 (discriminator 1)) kasan_save_free_info (mm/kasan/generic.c:579 (discriminator 1)) __kasan_slab_free (mm/kasan/common.c:271) kmem_cache_free (mm/slub.c:4643 (discriminator 3) mm/slub.c:4745 (discriminator 3)) unix_stream_read_generic (net/unix/af_unix.c:3010) unix_stream_recvmsg (net/unix/af_unix.c:3048) sock_recvmsg (net/socket.c:1063 (discriminator 20) net/socket.c:1085 (discriminator 20)) __sys_recvfrom (net/socket.c:2278) __x64_sys_recvfrom (net/socket.c:2291 (discriminator 1) net/socket.c:2287 (discriminator 1) net/socket.c:2287 (discriminator 1)) do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) The buggy address belongs to the object at ffff888106ef28c0 which belongs to the cache skbuff_head_cache of size 224 The buggy address is located 68 bytes inside of freed 224-byte region [ffff888106ef28c0, ffff888106ef29a0) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888106ef3cc0 pfn:0x106ef2 head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x200000000000040(head|node=0|zone=2) page_type: f5(slab) raw: 0200000000000040 ffff8881001d28c0 ffffea000422fe00 0000000000000004 raw: ffff888106ef3cc0 0000000080190010 00000000f5000000 0000000000000000 head: 0200000000000040 ffff8881001d28c0 ffffea000422fe00 0000000000000004 head: ffff888106ef3cc0 0000000080190010 00000000f5000000 0000000000000000 head: 0200000000000001 ffffea00041bbc81 00000000ffffffff 00000000ffffffff head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888106ef2800: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc ffff888106ef2880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb >ffff888106ef2900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888106ef2980: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc ffff888106ef2a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Fixes: 314001f0bf92 ("af_unix: Add OOB support") Reported-by: Jann Horn Signed-off-by: Kuniyuki Iwashima Reviewed-by: Jann Horn Link: https://patch.msgid.link/20250619041457.1132791-2-kuni1840@gmail.com Signed-off-by: Paolo Abeni commit 7a3750ff0f2e8fee338a9c168f429f6c37f0e820 Author: Lachlan Hodges Date: Sat Jun 21 22:32:09 2025 +1000 wifi: mac80211: fix beacon interval calculation overflow As we are converting from TU to usecs, a beacon interval of 100*1024 usecs will lead to integer wrapping. To fix change to use a u32. Fixes: 057d5f4ba1e4 ("mac80211: sync dtim_count to TSF") Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20250621123209.511796-1-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg commit 0e7facea6da2bd360361440786785752aa5b0e30 Author: Arnd Bergmann Date: Fri Jun 20 13:39:42 2025 +0200 wifi: iwlegacy: work around excessive stack usage on clang/kasan In some rare randconfig builds, I seem to trigger a bug in clang where it unrolls a loop but then runs out of registers, which then get spilled to the stack: net/wireless/intel/iwlegacy/4965-rs.c:2262:1: error: stack frame size (1696) exceeds limit (1280) in 'il4965_rs_rate_init' [-Werror,-Wframe-larger-than] This seems to be the same one I saw in the omapdrm driver, and there is an easy workaround by not inlining the il4965_rs_rate_scale_clear_win function. Link: https://github.com/llvm/llvm-project/issues/143908 Signed-off-by: Arnd Bergmann Acked-by: Stanislaw Gruszka Link: https://patch.msgid.link/20250620113946.3987160-1-arnd@kernel.org Signed-off-by: Johannes Berg commit 190113989ae01da7f5925877815a3ac75856d9ed Merge: aa485e8789d56a b8a205486ed5c0 Author: Alexei Starovoitov Date: Mon Jun 23 21:50:44 2025 -0700 Merge branch 'bpf-specify-access-type-of-bpf_sysctl_get_name-args' Jerome Marchand says: ==================== bpf: Specify access type of bpf_sysctl_get_name args The second argument of bpf_sysctl_get_name() helper is a pointer to a buffer that is being written to. However that isn't specify in the prototype. Until commit 37cce22dbd51a ("bpf: verifier: Refactor helper access type tracking") that mistake was hidden by the way the verifier treated helper accesses. Since then, the verifier, working on wrong infromation from the prototype, can make faulty optimization that would had been caught by the test_sysctl selftests if it was run by the CI. The first patch fixes bpf_sysctl_get_name prototype. The second patch converts the test_sysctl to prog_tests so that it will be run by the CI and catch similar issues in the future. Changes in v3: - Use ASSERT* macro instead of CHECK_FAIL. - Remove useless code. Changes in v2: - Replace ARG_PTR_TO_UNINIT_MEM by ARG_PTR_TO_MEM | MEM_WRITE. - Converts test_sysctl to prog_tests. ==================== Link: https://patch.msgid.link/20250619140603.148942-1-jmarchan@redhat.com Signed-off-by: Alexei Starovoitov commit b8a205486ed5c0c5c0386e472157a81ce686af25 Author: Jerome Marchand Date: Thu Jun 19 16:06:03 2025 +0200 selftests/bpf: Convert test_sysctl to prog_tests Convert test_sysctl test to prog_tests with minimal change to the tests themselves. Signed-off-by: Jerome Marchand Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20250619140603.148942-3-jmarchan@redhat.com Signed-off-by: Alexei Starovoitov commit 2eb7648558a7911f2208e8940cd22ca40e93cc76 Author: Jerome Marchand Date: Thu Jun 19 16:06:02 2025 +0200 bpf: Specify access type of bpf_sysctl_get_name args The second argument of bpf_sysctl_get_name() helper is a pointer to a buffer that is being written to. However that isn't specify in the prototype. Until commit 37cce22dbd51a ("bpf: verifier: Refactor helper access type tracking"), all helper accesses were considered as a possible write access by the verifier, so no big harm was done. However, since then, the verifier might make wrong asssumption about the content of that address which might lead it to make faulty optimizations (such as removing code that was wrongly labeled dead). This is what happens in test_sysctl selftest to the tests related to sysctl_get_name. Add MEM_WRITE flag the second argument of bpf_sysctl_get_name(). Signed-off-by: Jerome Marchand Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20250619140603.148942-2-jmarchan@redhat.com Signed-off-by: Alexei Starovoitov commit 7544f3f5b0b58c396f374d060898b5939da31709 Author: Ido Schimmel Date: Thu Jun 19 21:22:28 2025 +0300 bridge: mcast: Fix use-after-free during router port configuration The bridge maintains a global list of ports behind which a multicast router resides. The list is consulted during forwarding to ensure multicast packets are forwarded to these ports even if the ports are not member in the matching MDB entry. When per-VLAN multicast snooping is enabled, the per-port multicast context is disabled on each port and the port is removed from the global router port list: # ip link add name br1 up type bridge vlan_filtering 1 mcast_snooping 1 # ip link add name dummy1 up master br1 type dummy # ip link set dev dummy1 type bridge_slave mcast_router 2 $ bridge -d mdb show | grep router router ports on br1: dummy1 # ip link set dev br1 type bridge mcast_vlan_snooping 1 $ bridge -d mdb show | grep router However, the port can be re-added to the global list even when per-VLAN multicast snooping is enabled: # ip link set dev dummy1 type bridge_slave mcast_router 0 # ip link set dev dummy1 type bridge_slave mcast_router 2 $ bridge -d mdb show | grep router router ports on br1: dummy1 Since commit 4b30ae9adb04 ("net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions"), when per-VLAN multicast snooping is enabled, multicast disablement on a port will disable the per-{port, VLAN} multicast contexts and not the per-port one. As a result, a port will remain in the global router port list even after it is deleted. This will lead to a use-after-free [1] when the list is traversed (when adding a new port to the list, for example): # ip link del dev dummy1 # ip link add name dummy2 up master br1 type dummy # ip link set dev dummy2 type bridge_slave mcast_router 2 Similarly, stale entries can also be found in the per-VLAN router port list. When per-VLAN multicast snooping is disabled, the per-{port, VLAN} contexts are disabled on each port and the port is removed from the per-VLAN router port list: # ip link add name br1 up type bridge vlan_filtering 1 mcast_snooping 1 mcast_vlan_snooping 1 # ip link add name dummy1 up master br1 type dummy # bridge vlan add vid 2 dev dummy1 # bridge vlan global set vid 2 dev br1 mcast_snooping 1 # bridge vlan set vid 2 dev dummy1 mcast_router 2 $ bridge vlan global show dev br1 vid 2 | grep router router ports: dummy1 # ip link set dev br1 type bridge mcast_vlan_snooping 0 $ bridge vlan global show dev br1 vid 2 | grep router However, the port can be re-added to the per-VLAN list even when per-VLAN multicast snooping is disabled: # bridge vlan set vid 2 dev dummy1 mcast_router 0 # bridge vlan set vid 2 dev dummy1 mcast_router 2 $ bridge vlan global show dev br1 vid 2 | grep router router ports: dummy1 When the VLAN is deleted from the port, the per-{port, VLAN} multicast context will not be disabled since multicast snooping is not enabled on the VLAN. As a result, the port will remain in the per-VLAN router port list even after it is no longer member in the VLAN. This will lead to a use-after-free [2] when the list is traversed (when adding a new port to the list, for example): # ip link add name dummy2 up master br1 type dummy # bridge vlan add vid 2 dev dummy2 # bridge vlan del vid 2 dev dummy1 # bridge vlan set vid 2 dev dummy2 mcast_router 2 Fix these issues by removing the port from the relevant (global or per-VLAN) router port list in br_multicast_port_ctx_deinit(). The function is invoked during port deletion with the per-port multicast context and during VLAN deletion with the per-{port, VLAN} multicast context. Note that deleting the multicast router timer is not enough as it only takes care of the temporary multicast router states (1 or 3) and not the permanent one (2). [1] BUG: KASAN: slab-out-of-bounds in br_multicast_add_router.part.0+0x3f1/0x560 Write of size 8 at addr ffff888004a67328 by task ip/384 [...] Call Trace: dump_stack_lvl+0x6f/0xa0 print_address_description.constprop.0+0x6f/0x350 print_report+0x108/0x205 kasan_report+0xdf/0x110 br_multicast_add_router.part.0+0x3f1/0x560 br_multicast_set_port_router+0x74e/0xac0 br_setport+0xa55/0x1870 br_port_slave_changelink+0x95/0x120 __rtnl_newlink+0x5e8/0xa40 rtnl_newlink+0x627/0xb00 rtnetlink_rcv_msg+0x6fb/0xb70 netlink_rcv_skb+0x11f/0x350 netlink_unicast+0x426/0x710 netlink_sendmsg+0x75a/0xc20 __sock_sendmsg+0xc1/0x150 ____sys_sendmsg+0x5aa/0x7b0 ___sys_sendmsg+0xfc/0x180 __sys_sendmsg+0x124/0x1c0 do_syscall_64+0xbb/0x360 entry_SYSCALL_64_after_hwframe+0x4b/0x53 [2] BUG: KASAN: slab-use-after-free in br_multicast_add_router.part.0+0x378/0x560 Read of size 8 at addr ffff888009f00840 by task bridge/391 [...] Call Trace: dump_stack_lvl+0x6f/0xa0 print_address_description.constprop.0+0x6f/0x350 print_report+0x108/0x205 kasan_report+0xdf/0x110 br_multicast_add_router.part.0+0x378/0x560 br_multicast_set_port_router+0x6f9/0xac0 br_vlan_process_options+0x8b6/0x1430 br_vlan_rtm_process_one+0x605/0xa30 br_vlan_rtm_process+0x396/0x4c0 rtnetlink_rcv_msg+0x2f7/0xb70 netlink_rcv_skb+0x11f/0x350 netlink_unicast+0x426/0x710 netlink_sendmsg+0x75a/0xc20 __sock_sendmsg+0xc1/0x150 ____sys_sendmsg+0x5aa/0x7b0 ___sys_sendmsg+0xfc/0x180 __sys_sendmsg+0x124/0x1c0 do_syscall_64+0xbb/0x360 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Fixes: 2796d846d74a ("net: bridge: vlan: convert mcast router global option to per-vlan entry") Fixes: 4b30ae9adb04 ("net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions") Reported-by: syzbot+7bfa4b72c6a5da128d32@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/684c18bd.a00a0220.279073.000b.GAE@google.com/T/ Signed-off-by: Ido Schimmel Link: https://patch.msgid.link/20250619182228.1656906-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit d5e3241c5a386a2425823c8c7afb77a465bd040f Author: Thomas Fourier Date: Thu Jun 19 11:45:30 2025 +0200 ethernet: ionic: Fix DMA mapping tests Change error values of `ionic_tx_map_single()` and `ionic_tx_map_frag()` from 0 to `DMA_MAPPING_ERROR` to prevent collision with 0 as a valid address. This also fixes the use of `dma_mapping_error()` to test against 0 in `ionic_xdp_post_frame()` Fixes: 0f3154e6bcb3 ("ionic: Add Tx and Rx handling") Fixes: 56e41ee12d2d ("ionic: better dma-map error handling") Fixes: ac8813c0ab7d ("ionic: convert Rx queue buffers to use page_pool") Signed-off-by: Thomas Fourier Reviewed-by: Brett Creeley Link: https://patch.msgid.link/20250619094538.283723-2-fourier.thomas@gmail.com Signed-off-by: Jakub Kicinski commit c5136add3f9b4c23b8bbe5f4d722c95d4cfb936e Author: Klara Modin Date: Tue Jun 17 14:58:47 2025 +0200 riscv: export boot_cpu_hartid The mailbox controller driver for the Microchip Inter-processor Communication can be built as a module. It uses cpuid_to_hartid_map and commit 4783ce32b080 ("riscv: export __cpuid_to_hartid_map") enables that to work for SMP. However, cpuid_to_hartid_map uses boot_cpu_hartid on non-SMP kernels and this driver can be useful in such configurations[1]. Export boot_cpu_hartid so the driver can be built as a module on non-SMP kernels as well. Link: https://lore.kernel.org/lkml/20250617-confess-reimburse-876101e099cb@spud/ [1] Cc: stable@vger.kernel.org Fixes: e4b1d67e7141 ("mailbox: add Microchip IPC support") Signed-off-by: Klara Modin Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250617125847.23829-1-klarasmodin@gmail.com Signed-off-by: Palmer Dabbelt commit 890ba5be6335dbbbc99af14ea007befb5f83f174 Author: Nam Cao Date: Thu Jun 19 17:58:58 2025 +0200 Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" This reverts commit ad5643cf2f69 ("riscv: Define TASK_SIZE_MAX for __access_ok()"). This commit changes TASK_SIZE_MAX to be LONG_MAX to optimize access_ok(), because the previous TASK_SIZE_MAX (default to TASK_SIZE) requires some computation. The reasoning was that all user addresses are less than LONG_MAX, and all kernel addresses are greater than LONG_MAX. Therefore access_ok() can filter kernel addresses. Addresses between TASK_SIZE and LONG_MAX are not valid user addresses, but access_ok() let them pass. That was thought to be okay, because they are not valid addresses at hardware level. Unfortunately, one case is missed: get_user_pages_fast() happily accepts addresses between TASK_SIZE and LONG_MAX. futex(), for instance, uses get_user_pages_fast(). This causes the problem reported by Robert [1]. Therefore, revert this commit. TASK_SIZE_MAX is changed to the default: TASK_SIZE. This unfortunately reduces performance, because TASK_SIZE is more expensive to compute compared to LONG_MAX. But correctness first, we can think about optimization later, if required. Reported-by: Closes: https://lore.kernel.org/linux-riscv/77605.1750245028@localhost/ Signed-off-by: Nam Cao Cc: stable@vger.kernel.org Reviewed-by: Alexandre Ghiti Fixes: ad5643cf2f69 ("riscv: Define TASK_SIZE_MAX for __access_ok()") Link: https://lore.kernel.org/r/20250619155858.1249789-1-namcao@linutronix.de Signed-off-by: Palmer Dabbelt commit b0843f836126c980fb31923563c86ec52e8b9514 Author: Alexandre Ghiti Date: Fri Jun 20 12:08:11 2025 +0000 riscv: Fix sparse warning in vendor_extensions/sifive.c sparse reports the following warning: arch/riscv/kernel/vendor_extensions/sifive.c:11:33: sparse: sparse: symbol 'riscv_isa_vendor_ext_sifive' was not declared. Should it be static? So as this struct is only used in this file, make it static. Fixes: 2d147d77ae6e ("riscv: Add SiFive xsfvqmaccdod and xsfvqmaccqoq vendor extensions") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202505072100.TZlEp8h1-lkp@intel.com/ Signed-off-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20250620-dev-alex-fix_sparse_sifive_v1-v1-1-efa3a6f93846@rivosinc.com Signed-off-by: Palmer Dabbelt commit 2f73c62d4e13df67380ff6faca39eec2bf08dd93 Author: Nam Cao Date: Fri Jun 20 13:09:39 2025 +0200 Revert "riscv: misaligned: fix sleeping function called during misaligned access handling" This reverts commit 61a74ad25462 ("riscv: misaligned: fix sleeping function called during misaligned access handling"). The commit addresses a sleeping in atomic context problem, but it is not the correct fix as explained by Clément: "Using nofault would lead to failure to read from user memory that is paged out for instance. This is not really acceptable, we should handle user misaligned access even at an address that would generate a page fault." This bug has been properly fixed by commit 453805f0a28f ("riscv: misaligned: enable IRQs while handling misaligned accesses"). Revert this improper fix. Link: https://lore.kernel.org/linux-riscv/b779beed-e44e-4a5e-9551-4647682b0d21@rivosinc.com/ Signed-off-by: Nam Cao Cc: stable@vger.kernel.org Reviewed-by: Clément Léger Reviewed-by: Alexandre Ghiti Fixes: 61a74ad25462 ("riscv: misaligned: fix sleeping function called during misaligned access handling") Link: https://lore.kernel.org/r/20250620110939.1642735-1-namcao@linutronix.de Signed-off-by: Palmer Dabbelt commit 00a39d8652ff9088de07a6fe6e9e1893452fe0dd Author: Mateusz Jończyk Date: Sat Jun 7 23:06:08 2025 +0200 rtc: cmos: use spin_lock_irqsave in cmos_interrupt cmos_interrupt() can be called in a non-interrupt context, such as in an ACPI event handler (which runs in an interrupt thread). Therefore, usage of spin_lock(&rtc_lock) is insecure. Use spin_lock_irqsave() / spin_unlock_irqrestore() instead. Before a misguided commit 6950d046eb6e ("rtc: cmos: Replace spin_lock_irqsave with spin_lock in hard IRQ") the cmos_interrupt() function used spin_lock_irqsave(). That commit changed it to spin_lock() and broke locking, which was partially fixed in commit 13be2efc390a ("rtc: cmos: Disable irq around direct invocation of cmos_interrupt()") That second commit did not take account of the ACPI fixed event handler pathway, however. It introduced local_irq_disable() workarounds in cmos_check_wkalrm(), which can cause problems on PREEMPT_RT kernels and are now unnecessary. Add an explicit comment so that this change will not be reverted by mistake. Cc: stable@vger.kernel.org Fixes: 6950d046eb6e ("rtc: cmos: Replace spin_lock_irqsave with spin_lock in hard IRQ") Signed-off-by: Mateusz Jończyk Reviewed-by: Sebastian Andrzej Siewior Tested-by: Chris Bainbridge Reported-by: Chris Bainbridge Closes: https://lore.kernel.org/all/aDtJ92foPUYmGheF@debian.local/ Link: https://lore.kernel.org/r/20250607210608.14835-1-mat.jonczyk@o2.pl Signed-off-by: Alexandre Belloni commit 10357824151262636fda879845f8b64553541106 Author: Chaoyi Chen Date: Fri Jun 20 09:16:16 2025 +0800 drm/bridge-connector: Fix bridge in drm_connector_hdmi_audio_init() The bridge used in drm_connector_hdmi_audio_init() does not correctly point to the required audio bridge, which lead to incorrect audio configuration input. Fixes: 231adeda9f67 ("drm/bridge-connector: hook DisplayPort audio support") Signed-off-by: Chaoyi Chen Reviewed-by: Dmitry Baryshkov Tested-by: Stephan Gerhold Link: https://lore.kernel.org/r/20250620011616.118-1-kernel@airkyi.com Signed-off-by: Dmitry Baryshkov commit 78f4e737a53e1163ded2687a922fce138aee73f5 Merge: cb0de0e220d223 db53805156f1e0 Author: Linus Torvalds Date: Mon Jun 23 15:02:57 2025 -0700 Merge tag 'for-6.16/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mikulas Patocka: - dm-crypt: fix a crash on 32-bit machines - dm-raid: replace "rdev" with correct loop variable name "r" * tag 'for-6.16/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm-raid: fix variable in journal device check dm-crypt: Extend state buffer size in crypt_iv_lmk_one commit b1248da008362323f75e8b84874586e9ea4c0b31 Author: André Draszik Date: Wed Apr 9 21:37:52 2025 +0100 rtc: s5m: replace open-coded read/modify/write registers with regmap helpers Instead of the open-coded read/modify/write sequence, we can simply use the regmap helpers regmap_set_bits() and regmap_update_bits() respectively. This makes the code easier to read, and avoids extra work in case the underlying bus supports updating bits via struct regmap_bus::reg_update_bits() directly (which is the case for S2MPG10 on gs101 where this driver communicates via ACPM). Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250409-s2mpg10-v4-31-d66d5f39b6bf@linaro.org Signed-off-by: Alexandre Belloni commit f5adb1fa04d08731a13db48afafd1a5f4384d3c9 Author: André Draszik Date: Wed Apr 9 21:37:51 2025 +0100 rtc: s5m: replace regmap_update_bits with regmap_clear/set_bits The regmap_clear_bits() and regmap_set_bits() helper macros state the intention a bit more obviously. Use those. Reviewed-by: Krzysztof Kozlowski Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250409-s2mpg10-v4-30-d66d5f39b6bf@linaro.org Signed-off-by: Alexandre Belloni commit 1dd609587414f8b2844e551d1fe0505f12871992 Author: André Draszik Date: Wed Apr 9 21:37:50 2025 +0100 rtc: s5m: switch to devm_device_init_wakeup To release memory allocated by device_init_wakeup(true), drivers have to call device_init_wakeup(false) in error paths and unbind. Switch to the new devres managed version devm_device_init_wakeup() to plug this memleak. Reviewed-by: Krzysztof Kozlowski Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250409-s2mpg10-v4-29-d66d5f39b6bf@linaro.org Signed-off-by: Alexandre Belloni commit 972a3b47f6e191a0c5afcc45f4de74bf3d043a75 Author: André Draszik Date: Wed Apr 9 21:37:49 2025 +0100 rtc: s5m: fix a typo: peding -> pending Fix this minor typo, and adjust the a related incorrect alignment to avoid a checkpatch error. Reviewed-by: Krzysztof Kozlowski Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250409-s2mpg10-v4-28-d66d5f39b6bf@linaro.org Signed-off-by: Alexandre Belloni commit e64180846e7e4397938bbd0acf0640836f0f8051 Author: André Draszik Date: Wed Apr 9 21:37:48 2025 +0100 rtc: s5m: add support for S2MPG10 RTC Add support for Samsung's S2MPG10 PMIC RTC, which is similar to the existing PMIC RTCs supported by this driver. S2MPG10 doesn't use I2C, so we expect the core driver to have created a regmap for us. Additionally, it can be used for doing a cold-reset. If requested to do so (via DT), S2MPG10 is programmed with a watchdog configuration that will perform a full power cycle upon watchdog expiry. Reviewed-by: Krzysztof Kozlowski Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250409-s2mpg10-v4-27-d66d5f39b6bf@linaro.org Signed-off-by: Alexandre Belloni commit a57743bf009e788ada3607ac6b74ae9ebbd4ed74 Author: André Draszik Date: Wed Apr 9 21:37:47 2025 +0100 rtc: s5m: prepare for external regmap The Samsung S2MPG10 PMIC is not connected via I2C as this driver assumes, hence this driver's current approach of creating an I2C-based regmap doesn't work for it, and this driver should use the regmap provided by the parent (core) driver instead for that PMIC. To prepare this driver for s2mpg support, restructure the code to only create a regmap if one isn't provided by the parent. No functional changes, since the parent doesn't provide a regmap for any of the PMICs currently supported by this driver. Having this change separate will simply make the addition of S2MPG10 support more self-contained, without additional restructuring. Reviewed-by: Krzysztof Kozlowski Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250409-s2mpg10-v4-26-d66d5f39b6bf@linaro.org Signed-off-by: Alexandre Belloni commit 002cc0ee90e6172ef40ae95c248bf6ce67fb3f3f Author: André Draszik Date: Wed Apr 9 21:37:46 2025 +0100 rtc: s5m: cache device type during probe platform_get_device_id() is called mulitple times during probe to retrieve the device type. This makes the code harder to read than necessary. Just get the type once, which also trims the lengths of the lines involved. Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250409-s2mpg10-v4-25-d66d5f39b6bf@linaro.org Signed-off-by: Alexandre Belloni commit cb0de0e220d2233a84a2ff1afb8ffba7597d02fa Merge: 5ca7fe213ba311 ba8dac350faf16 Author: Linus Torvalds Date: Mon Jun 23 14:55:40 2025 -0700 Merge tag 'f2fs-for-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs Pull f2fs fixes from Jaegeuk Kim: - fix double-unlock introduced by the recent folio conversion - fix stale page content beyond EOF complained by xfstests/generic/363 * tag 'f2fs-for-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: f2fs: fix to zero post-eof page f2fs: Fix __write_node_folio() conversion commit 2b8be57fa0c88ac824a906f29c04d728f9f6047a Author: Zhe Qiao Date: Thu Jun 19 15:26:08 2025 +0800 Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" This reverts commit 631b2af2f357 ("PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()"). The reverted patch causes the 'ri->cfg' and 'root_ops' resources to be released multiple times. When acpi_pci_root_create() fails, these resources have already been released internally by the __acpi_pci_root_release_info() function. Releasing them again in pci_acpi_scan_root() leads to incorrect behavior and potential memory issues. We plan to resolve the issue using a more appropriate fix. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/aEmdnuw715btq7Q5@stanley.mountain/ Signed-off-by: Zhe Qiao Acked-by: Dan Carpenter Link: https://patch.msgid.link/20250619072608.2075475-1-qiaozhe@iscas.ac.cn Signed-off-by: Rafael J. Wysocki commit f5990207026987a353d5a95204c4d9cb725637fd Author: Breno Leitao Date: Fri Jun 20 11:48:55 2025 -0700 net: netpoll: Initialize UDP checksum field before checksumming commit f1fce08e63fe ("netpoll: Eliminate redundant assignment") removed the initialization of the UDP checksum, which was wrong and broke netpoll IPv6 transmission due to bad checksumming. udph->check needs to be set before calling csum_ipv6_magic(). Fixes: f1fce08e63fe ("netpoll: Eliminate redundant assignment") Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250620-netpoll_fix-v1-1-f9f0b82bc059@debian.org Signed-off-by: Jakub Kicinski commit 5ca7fe213ba3113dde19c4cd46347c16d9e69f81 Merge: c06944560a5628 c0d90a79e8e65b Author: Linus Torvalds Date: Mon Jun 23 11:16:38 2025 -0700 Merge tag 'for-6.16-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "Fixes: - fix invalid inode pointer dereferences during log replay - fix a race between renames and directory logging - fix shutting down delayed iput worker - fix device byte accounting when dropping chunk - in zoned mode, fix offset calculations for DUP profile when conventional and sequential zones are used together Regression fixes: - fix possible double unlock of extent buffer tree (xarray conversion) - in zoned mode, fix extent buffer refcount when writing out extents (xarray conversion) Error handling fixes and updates: - handle unexpected extent type when replaying log - check and warn if there are remaining delayed inodes when putting a root - fix assertion when building free space tree - handle csum tree error with mount option 'rescue=ibadroot' Other: - error message updates: add prefix to all scrub related messages, include other information in messages" * tag 'for-6.16-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: zoned: fix alloc_offset calculation for partly conventional block groups btrfs: handle csum tree error with rescue=ibadroots correctly btrfs: fix race between async reclaim worker and close_ctree() btrfs: fix assertion when building free space tree btrfs: don't silently ignore unexpected extent type when replaying log btrfs: fix invalid inode pointer dereferences during log replay btrfs: fix double unlock of buffer_tree xarray when releasing subpage eb btrfs: update superblock's device bytes_used when dropping chunk btrfs: fix a race between renames and directory logging btrfs: scrub: add prefix for the error messages btrfs: warn if leaking delayed_nodes in btrfs_put_root() btrfs: fix delayed ref refcount leak in debug assertion btrfs: include root in error message when unlinking inode btrfs: don't drop a reference if btrfs_check_write_meta_pointer() fails commit aa485e8789d56a4573f7c8d000a182b749eaa64d Author: Yuan Chen Date: Wed Jun 18 09:19:33 2025 +0800 libbpf: Fix null pointer dereference in btf_dump__free on allocation failure When btf_dump__new() fails to allocate memory for the internal hashmap (btf_dump->type_names), it returns an error code. However, the cleanup function btf_dump__free() does not check if btf_dump->type_names is NULL before attempting to free it. This leads to a null pointer dereference when btf_dump__free() is called on a btf_dump object. Fixes: 351131b51c7a ("libbpf: add btf_dump API for BTF-to-C conversion") Signed-off-by: Yuan Chen Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250618011933.11423-1-chenyuan_fl@163.com commit ce7df19686530920f2f6b636e71ce5eb1d9303ef Author: Al Viro Date: Sun Jun 22 18:03:29 2025 -0400 attach_recursive_mnt(): do not lock the covering tree when sliding something under it If we are propagating across the userns boundary, we need to lock the mounts added there. However, in case when something has already been mounted there and we end up sliding a new tree under that, the stuff that had been there before should not get locked. IOW, lock_mnt_tree() should be called before we reparent the preexisting tree on top of what we are adding. Fixes: 3bd045cc9c4b ("separate copying and locking mount tree on cross-userns copies") Signed-off-by: Al Viro commit 7484e15dbb016d9d40f8c6e0475810212ae181db Author: Al Viro Date: Tue Jun 17 00:09:51 2025 -0400 replace collect_mounts()/drop_collected_mounts() with a safer variant collect_mounts() has several problems - one can't iterate over the results directly, so it has to be done with callback passed to iterate_mounts(); it has an oopsable race with d_invalidate(); it creates temporary clones of mounts invisibly for sync umount (IOW, you can have non-lazy umount succeed leaving filesystem not mounted anywhere and yet still busy). A saner approach is to give caller an array of struct path that would pin every mount in a subtree, without cloning any mounts. * collect_mounts()/drop_collected_mounts()/iterate_mounts() is gone * collect_paths(where, preallocated, size) gives either ERR_PTR(-E...) or a pointer to array of struct path, one for each chunk of tree visible under 'where' (i.e. the first element is a copy of where, followed by (mount,root) for everything mounted under it - the same set collect_mounts() would give). Unlike collect_mounts(), the mounts are *not* cloned - we just get pinning references to the roots of subtrees in the caller's namespace. Array is terminated by {NULL, NULL} struct path. If it fits into preallocated array (on-stack, normally), that's where it goes; otherwise it's allocated by kmalloc_array(). Passing 0 as size means that 'preallocated' is ignored (and expected to be NULL). * drop_collected_paths(paths, preallocated) is given the array returned by an earlier call of collect_paths() and the preallocated array passed to that call. All mount/dentry references are dropped and array is kfree'd if it's not equal to 'preallocated'. * instead of iterate_mounts(), users should just iterate over array of struct path - nothing exotic is needed for that. Existing users (all in audit_tree.c) are converted. [folded a fix for braino reported by Venkat Rao Bagalkote ] Fixes: 80b5dce8c59b0 ("vfs: Add a function to lazily unmount all mounts from any dentry") Tested-by: Venkat Rao Bagalkote Signed-off-by: Al Viro commit 5aa326a6a2ff0a7e7c6e11777045e66704c2d5e4 Author: Manivannan Sadhasivam Date: Sun Jun 8 09:03:05 2025 +0530 PCI/PTM: Build debugfs code only if CONFIG_DEBUG_FS is enabled Otherwise, the following build error will happen for CONFIG_DEBUG_FS=n && CONFIG_PCIE_PTM=y: drivers/pci/pcie/ptm.c:498:25: error: redefinition of 'pcie_ptm_create_debugfs' 498 | struct pci_ptm_debugfs *pcie_ptm_create_debugfs(struct device *dev, void *pdata, | ^ ./include/linux/pci.h:1915:2: note: previous definition is here 1915 | *pcie_ptm_create_debugfs(struct device *dev, void *pdata, | ^ drivers/pci/pcie/ptm.c:546:6: error: redefinition of 'pcie_ptm_destroy_debugfs' 546 | void pcie_ptm_destroy_debugfs(struct pci_ptm_debugfs *ptm_debugfs) | ^ ./include/linux/pci.h:1918:1: note: previous definition is here 1918 | pcie_ptm_destroy_debugfs(struct pci_ptm_debugfs *ptm_debugfs) { } | Fixes: 132833405e61 ("PCI: Add debugfs support for exposing PTM context") Reported-by: Eric Biggers Closes: https://lore.kernel.org/linux-pci/20250607025506.GA16607@sol Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Eric Biggers Reviewed-by: Kuppuswamy Sathyanarayanan Link: https://patch.msgid.link/20250608033305.15214-1-manivannan.sadhasivam@linaro.org commit 00f452a1b084efbe8dcb60a29860527944a002a1 Author: Thomas Fourier Date: Wed Jun 18 09:17:37 2025 +0200 scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() dma_map_XXX() can fail and should be tested for errors with dma_mapping_error(). Fixes: b3a271a94d00 ("[SCSI] qla4xxx: support iscsiadm session mgmt") Signed-off-by: Thomas Fourier Link: https://lore.kernel.org/r/20250618071742.21822-2-fourier.thomas@gmail.com Signed-off-by: Martin K. Petersen commit c3b214719a87735d4f67333a8ef3c0e31a34837c Author: Thomas Fourier Date: Tue Jun 17 18:11:11 2025 +0200 scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() dma_map_XXX() functions return as error values DMA_MAPPING_ERROR which is often ~0. The error value should be tested with dma_mapping_error() like it was done in qla26xx_dport_diagnostics(). Fixes: 818c7f87a177 ("scsi: qla2xxx: Add changes in preparation for vendor extended FDMI/RDP") Signed-off-by: Thomas Fourier Link: https://lore.kernel.org/r/20250617161115.39888-2-fourier.thomas@gmail.com Signed-off-by: Martin K. Petersen commit c06944560a562828d507166b4f87c01c367cc9c1 Merge: 86731a2a651e58 c742d127d2d831 Author: Linus Torvalds Date: Mon Jun 23 09:20:39 2025 -0700 Merge tag 'mm-hotfixes-stable-2025-06-22-18-52' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "20 hotfixes. 7 are cc:stable and the remainder address post-6.15 issues or aren't considered necessary for -stable kernels. Only 4 are for MM. - The series `Revert "bcache: update min_heap_callbacks to use default builtin swap"' from Kuan-Wei Chiu backs out the author's recent min_heap changes due to a performance regression. A fix for this regression has been developed but we felt it best to go back to the known-good version to give the new code more bake time. - A lot of MAINTAINERS maintenance. I like to get these changes upstreamed promptly because they can't break things and more accurate/complete MAINTAINERS info hopefully improves the speed and accuracy of our responses to submitters and reporters" * tag 'mm-hotfixes-stable-2025-06-22-18-52' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: MAINTAINERS: add additional mmap-related files to mmap section MAINTAINERS: add memfd, shmem quota files to shmem section MAINTAINERS: add stray rmap file to mm rmap section MAINTAINERS: add hugetlb_cgroup.c to hugetlb section MAINTAINERS: add further init files to mm init block MAINTAINERS: update maintainers for HugeTLB maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() MAINTAINERS: add missing test files to mm gup section MAINTAINERS: add missing mm/workingset.c file to mm reclaim section selftests/mm: skip uprobe vma merge test if uprobes are not enabled bcache: remove unnecessary select MIN_HEAP Revert "bcache: remove heap-related macros and switch to generic min_heap" Revert "bcache: update min_heap_callbacks to use default builtin swap" selftests/mm: add configs to fix testcase failure kho: initialize tail pages for higher order folios properly MAINTAINERS: add linux-mm@ list to Kexec Handover mm: userfaultfd: fix race of userfaultfd_move and swap cache mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" selftests/mm: increase timeout from 180 to 900 seconds mm/shmem, swap: fix softlockup with mTHP swapin commit 41c66461cb2e8d3934a5395f27e572ebe63696b4 Author: Takashi Iwai Date: Mon Jun 23 17:18:39 2025 +0200 ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 ASUS UM5606* models use the quirk to set up the bass speakers, but it missed the mic-mute LED configuration. Other similar models have the AMD ACP dmic, and the mic-mute is set up for that, but those models don't have AMD ACP but rather built-in mics of Realtek codec, hence the Realtek driver should set it up, instead. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220125 Link: https://patch.msgid.link/20250623151841.28810-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit fb4e2a6e8f28a3c0ad382e363aeb9cd822007b8a Author: Youngjun Lee Date: Mon Jun 23 20:05:25 2025 +0900 ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() In snd_usb_get_audioformat_uac3(), the length value returned from snd_usb_ctl_msg() is used directly for memory allocation without validation. This length is controlled by the USB device. The allocated buffer is cast to a uac3_cluster_header_descriptor and its fields are accessed without verifying that the buffer is large enough. If the device returns a smaller than expected length, this leads to an out-of-bounds read. Add a length check to ensure the buffer is large enough for uac3_cluster_header_descriptor. Signed-off-by: Youngjun Lee Fixes: 9a2fe9b801f5 ("ALSA: usb: initial USB Audio Device Class 3.0 support") Link: https://patch.msgid.link/20250623-uac3-oob-fix-v1-1-527303eaf40a@samsung.com Signed-off-by: Takashi Iwai commit 9a07ca9a4015f8f71e2b594ee76ac55483babd89 Author: Chris Chiu Date: Mon Jun 23 14:30:23 2025 +0800 ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 6 G1a HP EliteBook 6 G1a laptops use ALC236 codec and need the fixup ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF to make the mic/micmute LEDs work. Signed-off-by: Chris Chiu Link: https://patch.msgid.link/20250623063023.374920-1-chris.chiu@canonical.com Signed-off-by: Takashi Iwai commit c01776287414ca43412d1319d2877cbad65444ac Author: Benjamin Coddington Date: Thu Jun 19 11:02:21 2025 -0400 NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN We found a few different systems hung up in writeback waiting on the same page lock, and one task waiting on the NFS_LAYOUT_DRAIN bit in pnfs_update_layout(), however the pnfs_layout_hdr's plh_outstanding count was zero. It seems most likely that this is another race between the waiter and waker similar to commit ed0172af5d6f ("SUNRPC: Fix a race to wake a sync task"). Fix it up by applying the advised barrier. Fixes: 880265c77ac4 ("pNFS: Avoid a live lock condition in pnfs_update_layout()") Signed-off-by: Benjamin Coddington Signed-off-by: Anna Schumaker commit e8d6f3ab59468e230f3253efe5cb63efa35289f7 Author: Kuniyuki Iwashima Date: Thu Jun 12 14:52:50 2025 -0700 nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. syzbot reported a warning below [1] following a fault injection in nfs_fs_proc_net_init(). [0] When nfs_fs_proc_net_init() fails, /proc/net/rpc/nfs is not removed. Later, rpc_proc_exit() tries to remove /proc/net/rpc, and the warning is logged as the directory is not empty. Let's handle the error of nfs_fs_proc_net_init() properly. [0]: FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 UID: 0 PID: 6120 Comm: syz.2.27 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: dump_stack_lvl (lib/dump_stack.c:123) should_fail_ex (lib/fault-inject.c:73 lib/fault-inject.c:174) should_failslab (mm/failslab.c:46) kmem_cache_alloc_noprof (mm/slub.c:4178 mm/slub.c:4204) __proc_create (fs/proc/generic.c:427) proc_create_reg (fs/proc/generic.c:554) proc_create_net_data (fs/proc/proc_net.c:120) nfs_fs_proc_net_init (fs/nfs/client.c:1409) nfs_net_init (fs/nfs/inode.c:2600) ops_init (net/core/net_namespace.c:138) setup_net (net/core/net_namespace.c:443) copy_net_ns (net/core/net_namespace.c:576) create_new_namespaces (kernel/nsproxy.c:110) unshare_nsproxy_namespaces (kernel/nsproxy.c:218 (discriminator 4)) ksys_unshare (kernel/fork.c:3123) __x64_sys_unshare (kernel/fork.c:3190) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [1]: remove_proc_entry: removing non-empty directory 'net/rpc', leaking at least 'nfs' WARNING: CPU: 1 PID: 6120 at fs/proc/generic.c:727 remove_proc_entry+0x45e/0x530 fs/proc/generic.c:727 Modules linked in: CPU: 1 UID: 0 PID: 6120 Comm: syz.2.27 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:remove_proc_entry+0x45e/0x530 fs/proc/generic.c:727 Code: 3c 02 00 0f 85 85 00 00 00 48 8b 93 d8 00 00 00 4d 89 f0 4c 89 e9 48 c7 c6 40 ba a2 8b 48 c7 c7 60 b9 a2 8b e8 33 81 1d ff 90 <0f> 0b 90 90 e9 5f fe ff ff e8 04 69 5e ff 90 48 b8 00 00 00 00 00 RSP: 0018:ffffc90003637b08 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff88805f534140 RCX: ffffffff817a92c8 RDX: ffff88807da99e00 RSI: ffffffff817a92d5 RDI: 0000000000000001 RBP: ffff888033431ac0 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffff888033431a00 R13: ffff888033431ae4 R14: ffff888033184724 R15: dffffc0000000000 FS: 0000555580328500(0000) GS:ffff888124a62000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f71733743e0 CR3: 000000007f618000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: sunrpc_exit_net+0x46/0x90 net/sunrpc/sunrpc_syms.c:76 ops_exit_list net/core/net_namespace.c:200 [inline] ops_undo_list+0x2eb/0xab0 net/core/net_namespace.c:253 setup_net+0x2e1/0x510 net/core/net_namespace.c:457 copy_net_ns+0x2a6/0x5f0 net/core/net_namespace.c:574 create_new_namespaces+0x3ea/0xa90 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:218 ksys_unshare+0x45b/0xa40 kernel/fork.c:3121 __do_sys_unshare kernel/fork.c:3192 [inline] __se_sys_unshare kernel/fork.c:3190 [inline] __x64_sys_unshare+0x31/0x40 kernel/fork.c:3190 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa1a6b8e929 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff3a090368 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 RAX: ffffffffffffffda RBX: 00007fa1a6db5fa0 RCX: 00007fa1a6b8e929 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000080 RBP: 00007fa1a6c10b39 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fa1a6db5fa0 R14: 00007fa1a6db5fa0 R15: 0000000000000001 Fixes: d47151b79e32 ("nfs: expose /proc/net/sunrpc/nfs in net namespaces") Reported-by: syzbot+a4cc4ac22daa4a71b87c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a4cc4ac22daa4a71b87c Tested-by: syzbot+a4cc4ac22daa4a71b87c@syzkaller.appspotmail.com Signed-off-by: Kuniyuki Iwashima Signed-off-by: Anna Schumaker commit 9c19b3315cef8b62d2c037616a66b4446b966f6d Author: Nikhil Jha Date: Wed Jun 11 15:46:39 2025 -0400 sunrpc: fix loop in gss seqno cache There was a silly bug in the initial implementation where a loop variable was not incremented. This commit increments the loop variable. This bug is somewhat tricky to catch because it can only happen on loops of two or more. If it is hit, it locks up a kernel thread in an infinite loop. Signed-off-by: Nikhil Jha Tested-by: Nikhil Jha Fixes: 08d6ee6d8a10 ("sunrpc: implement rfc2203 rpcsec_gss seqnum cache") Reviewed-by: Benjamin Coddington Signed-off-by: Anna Schumaker commit 1d6123102e9fbedc8d25bf4731da6d513173e49e Author: Kuniyuki Iwashima Date: Tue Jun 17 09:58:13 2025 -0700 Bluetooth: hci_core: Fix use-after-free in vhci_flush() syzbot reported use-after-free in vhci_flush() without repro. [0] From the splat, a thread close()d a vhci file descriptor while its device was being used by iotcl() on another thread. Once the last fd refcnt is released, vhci_release() calls hci_unregister_dev(), hci_free_dev(), and kfree() for struct vhci_data, which is set to hci_dev->dev->driver_data. The problem is that there is no synchronisation after unlinking hdev from hci_dev_list in hci_unregister_dev(). There might be another thread still accessing the hdev which was fetched before the unlink operation. We can use SRCU for such synchronisation. Let's run hci_dev_reset() under SRCU and wait for its completion in hci_unregister_dev(). Another option would be to restore hci_dev->destruct(), which was removed in commit 587ae086f6e4 ("Bluetooth: Remove unused hci-destruct cb"). However, this would not be a good solution, as we should not run hci_unregister_dev() while there are in-flight ioctl() requests, which could lead to another data-race KCSAN splat. Note that other drivers seem to have the same problem, for exmaple, virtbt_remove(). [0]: BUG: KASAN: slab-use-after-free in skb_queue_empty_lockless include/linux/skbuff.h:1891 [inline] BUG: KASAN: slab-use-after-free in skb_queue_purge_reason+0x99/0x360 net/core/skbuff.c:3937 Read of size 8 at addr ffff88807cb8d858 by task syz.1.219/6718 CPU: 1 UID: 0 PID: 6718 Comm: syz.1.219 Not tainted 6.16.0-rc1-syzkaller-00196-g08207f42d3ff #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xd2/0x2b0 mm/kasan/report.c:521 kasan_report+0x118/0x150 mm/kasan/report.c:634 skb_queue_empty_lockless include/linux/skbuff.h:1891 [inline] skb_queue_purge_reason+0x99/0x360 net/core/skbuff.c:3937 skb_queue_purge include/linux/skbuff.h:3368 [inline] vhci_flush+0x44/0x50 drivers/bluetooth/hci_vhci.c:69 hci_dev_do_reset net/bluetooth/hci_core.c:552 [inline] hci_dev_reset+0x420/0x5c0 net/bluetooth/hci_core.c:592 sock_do_ioctl+0xd9/0x300 net/socket.c:1190 sock_ioctl+0x576/0x790 net/socket.c:1311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fcf5b98e929 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fcf5c7b9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fcf5bbb6160 RCX: 00007fcf5b98e929 RDX: 0000000000000000 RSI: 00000000400448cb RDI: 0000000000000009 RBP: 00007fcf5ba10b39 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fcf5bbb6160 R15: 00007ffd6353d528 Allocated by task 6535: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4359 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1039 [inline] vhci_open+0x57/0x360 drivers/bluetooth/hci_vhci.c:635 misc_open+0x2bc/0x330 drivers/char/misc.c:161 chrdev_open+0x4c9/0x5e0 fs/char_dev.c:414 do_dentry_open+0xdf0/0x1970 fs/open.c:964 vfs_open+0x3b/0x340 fs/open.c:1094 do_open fs/namei.c:3887 [inline] path_openat+0x2ee5/0x3830 fs/namei.c:4046 do_filp_open+0x1fa/0x410 fs/namei.c:4073 do_sys_openat2+0x121/0x1c0 fs/open.c:1437 do_sys_open fs/open.c:1452 [inline] __do_sys_openat fs/open.c:1468 [inline] __se_sys_openat fs/open.c:1463 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1463 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 6535: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2381 [inline] slab_free mm/slub.c:4643 [inline] kfree+0x18e/0x440 mm/slub.c:4842 vhci_release+0xbc/0xd0 drivers/bluetooth/hci_vhci.c:671 __fput+0x44c/0xa70 fs/file_table.c:465 task_work_run+0x1d1/0x260 kernel/task_work.c:227 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x6ad/0x22e0 kernel/exit.c:955 do_group_exit+0x21c/0x2d0 kernel/exit.c:1104 __do_sys_exit_group kernel/exit.c:1115 [inline] __se_sys_exit_group kernel/exit.c:1113 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1113 x64_sys_call+0x21ba/0x21c0 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88807cb8d800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 88 bytes inside of freed 1024-byte region [ffff88807cb8d800, ffff88807cb8dc00) Fixes: bf18c7118cf8 ("Bluetooth: vhci: Free driver_data on file release") Reported-by: syzbot+2faa4825e556199361f9@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f62d64848fc4c7c30cd6 Signed-off-by: Kuniyuki Iwashima Acked-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz commit b44f12ae21f661e5d97fb4a8b234d6689f68f706 Author: Johan Hovold Date: Mon Jun 23 16:24:37 2025 +0200 interconnect: exynos: handle node name allocation failure Add the missing error handling in case node name allocation ever fails. Fixes: 2f95b9d5cf0b ("interconnect: Add generic interconnect driver for Exynos SoCs") Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20250623142437.23068-1-johan+linaro@kernel.org Signed-off-by: Georgi Djakov commit 88a80066af1617fab444776135d840467414beb6 Author: Fengnan Chang Date: Mon Jun 23 19:02:18 2025 +0800 io_uring: make fallocate be hashed work Like ftruncate and write, fallocate operations on the same file cannot be executed in parallel, so it is better to make fallocate be hashed work. Signed-off-by: Fengnan Chang Link: https://lore.kernel.org/r/20250623110218.61490-1-changfengnan@bytedance.com Signed-off-by: Jens Axboe commit 886a94f008dd1a1702ee66dd035c266f70fd9e90 Author: Xilin Wu Date: Fri Jun 13 22:53:38 2025 +0800 interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node This allows adding interconnect paths for PCIe 1 in device tree later. Fixes: 46bdcac533cc ("interconnect: qcom: Add SC7280 interconnect provider driver") Signed-off-by: Xilin Wu Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250613-sc7280-icc-pcie1-fix-v1-1-0b09813e3b09@radxa.com Signed-off-by: Georgi Djakov commit db53805156f1e0aa6d059c0d3f9ac660d4ef3eb4 Author: Heinz Mauelshagen Date: Tue Jun 10 20:53:30 2025 +0200 dm-raid: fix variable in journal device check Replace "rdev" with correct loop variable name "r". Signed-off-by: Heinz Mauelshagen Cc: stable@vger.kernel.org Fixes: 63c32ed4afc2 ("dm raid: add raid4/5/6 journaling support") Signed-off-by: Mikulas Patocka commit ff8abbd248c1f52df0c321690b88454b13ff54b2 Author: Paulo Alcantara Date: Sun Jun 22 14:13:40 2025 -0300 smb: client: fix regression with native SMB symlinks Some users and customers reported that their backup/copy tools started to fail when the directory being copied contained symlink targets that the client couldn't parse - even when those symlinks weren't followed. Fix this by allowing lstat(2) and readlink(2) to succeed even when the client can't resolve the symlink target, restoring old behavior. Cc: linux-cifs@vger.kernel.org Cc: stable@vger.kernel.org Reported-by: Remy Monsen Closes: https://lore.kernel.org/r/CAN+tdP7y=jqw3pBndZAGjQv0ObFq8Q=+PUDHgB36HdEz9QA6FQ@mail.gmail.com Reported-by: Pierguido Lambri Fixes: 12b466eb52d9 ("cifs: Fix creating and resolving absolute NT-style symlinks") Signed-off-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French commit 95b6759a81833d0e8c7456430186c2f6d174764e Author: Arnd Bergmann Date: Fri Jun 20 15:09:53 2025 +0200 net: qed: reduce stack usage for TLV processing clang gets a bit confused by the code in the qed_mfw_process_tlv_req and ends up spilling registers to the stack hundreds of times. When sanitizers are enabled, this can end up blowing the stack warning limit: drivers/net/ethernet/qlogic/qed/qed_mng_tlv.c:1244:5: error: stack frame size (1824) exceeds limit (1280) in 'qed_mfw_process_tlv_req' [-Werror,-Wframe-larger-than] Apparently the problem is the complexity of qed_mfw_update_tlvs() after inlining, and marking the four main branches of that function as noinline_for_stack makes this problem completely go away, the stack usage goes down to 100 bytes. Signed-off-by: Arnd Bergmann Reviewed-by: Alexander Lobakin Signed-off-by: David S. Miller commit dc6458ed95e40146699f9c523e34cb13ff127170 Author: Vijendar Mukunda Date: Mon Jun 23 14:14:55 2025 +0530 ASoC: amd: ps: fix for soundwire failures during hibernation exit sequence During the hibernate entry sequence, ACP registers will be reset to default values and acp ip will be completely powered off including acp SoundWire pads. During resume sequence, if acp SoundWire pad keeper enable register is not restored along with pad pulldown control register value, then SoundWire manager links won't be powered on correctly results in peripheral register access failures and completely audio function is broken. Add code to store the acp SoundWire pad keeper enable register and acp pad pulldown ctrl register values before entering into suspend state and restore the register values during resume sequence based on condition check for acp SoundWire pad keeper enable register for ACP6.3, ACP7.0 & ACP7.1 platforms. Fixes: 491628388005 ("ASoC: amd: ps: add callback functions for acp pci driver pm ops") Signed-off-by: Vijendar Mukunda Link: https://patch.msgid.link/20250623084630.3100279-1-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown commit a3ef3c2da675a8a564c8bea1a511cdd0a2a9aa49 Author: Imre Deak Date: Thu Jun 5 11:28:46 2025 +0300 drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS Reading DPCD registers has side-effects in general. In particular accessing registers outside of the link training register range (0x102-0x106, 0x202-0x207, 0x200c-0x200f, 0x2216) is explicitly forbidden by the DP v2.1 Standard, see 3.6.5.1 DPTX AUX Transaction Handling Mandates 3.6.7.4 128b/132b DP Link Layer LTTPR Link Training Mandates Based on my tests, accessing the DPCD_REV register during the link training of an UHBR TBT DP tunnel sink leads to link training failures. Solve the above by using the DP_LANE0_1_STATUS (0x202) register for the DPCD register access quirk. Cc: Cc: Ville Syrjälä Cc: Jani Nikula Acked-by: Jani Nikula Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250605082850.65136-2-imre.deak@intel.com (cherry picked from commit a40c5d727b8111b5db424a1e43e14a1dcce1e77f) Signed-off-by: Joonas Lahtinen commit a24cc6ce1933eade12aa2b9859de0fcd2dac2c06 Author: Sebastian Andrzej Siewior Date: Mon Jun 23 10:34:08 2025 +0200 futex: Initialize futex_phash_new during fork(). During a hash resize operation the new private hash is stored in mm_struct::futex_phash_new if the current hash can not be immediately replaced. The new hash must not be copied during fork() into the new task. Doing so will lead to a double-free of the memory by the two tasks. Initialize the mm_struct::futex_phash_new during fork(). Closes: https://lore.kernel.org/all/aFBQ8CBKmRzEqIfS@mozart.vkv.me/ Fixes: bd54df5ea7cad ("futex: Allow to resize the private local hash") Reported-by: Calvin Owens Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Peter Zijlstra (Intel) Tested-by: Calvin Owens Link: https://lkml.kernel.org/r/20250623083408.jTiJiC6_@linutronix.de commit 9205999e9f13a07cb29d5a8836c25afdca186007 Author: Ankit Nautiyal Date: Wed Jun 18 18:39:50 2025 +0530 drm/i915/snps_hdmi_pll: Fix 64-bit divisor truncation by using div64_u64 DIV_ROUND_CLOSEST_ULL uses do_div(), which expects a 32-bit divisor. When passing a 64-bit constant like CURVE2_MULTIPLIER, the value is silently truncated to u32, potentially leading to incorrect results on large divisors. Replace DIV_ROUND_CLOSEST_ULL with DIV64_U64_ROUND_CLOSEST which correctly handles full 64-bit division. v2: Use DIV64_U64_ROUND_CLOSEST instead of div64_u64 macro. (Jani) Fixes: 5947642004bf ("drm/i915/display: Add support for SNPS PHY HDMI PLL algorithm for DG2") Reported-by: Vas Novikov Closes: https://lore.kernel.org/all/8d7c7958-9558-4c8a-a81a-e9310f2d8852@gmail.com/ Cc: Ankit Nautiyal Cc: Suraj Kandpal Cc: Jani Nikula Cc: Vas Novikov Cc: stable@vger.kernel.org # v6.15+ Reviewed-by: Jani Nikula Signed-off-by: Ankit Nautiyal Link: https://lore.kernel.org/r/20250618130951.1596587-2-ankit.k.nautiyal@intel.com (cherry picked from commit b300a175a11e6a934d728317dc39787723cc7917) Signed-off-by: Joonas Lahtinen commit b872f562c8cef59743993b48eb458c2d87c1651e Author: Herbert Xu Date: Mon Jun 23 19:11:50 2025 +0800 dm-crypt: Extend state buffer size in crypt_iv_lmk_one Add a macro CRYPTO_MD5_STATESIZE for the Crypto API export state size of md5 and use that in dm-crypt instead of relying on the size of struct md5_state (the latter is currently undergoing a transition and may shrink). This commit fixes a crash on 32-bit machines: Oops: Oops: 0000 [#1] SMP CPU: 1 UID: 0 PID: 12 Comm: kworker/u16:0 Not tainted 6.16.0-rc2+ #993 PREEMPT(full) Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 Workqueue: kcryptd-254:0-1 kcryptd_crypt [dm_crypt] EIP: __crypto_shash_export+0xf/0x90 Code: 4a c1 c7 40 20 a0 b4 4a c1 81 cf 0e 00 04 08 89 78 50 e9 2b ff ff ff 8d 74 26 00 55 89 e5 57 56 53 89 c3 89 d6 8b 00 8b 40 14 <8b> 50 fc f6 40 13 01 74 04 4a 2b 50 14 85 c9 74 10 89 f2 89 d8 ff EAX: 303a3435 EBX: c3007c90 ECX: 00000000 EDX: c3007c38 ESI: c3007c38 EDI: c3007c90 EBP: c3007bfc ESP: c3007bf0 DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 EFLAGS: 00010216 CR0: 80050033 CR2: 303a3431 CR3: 04fbe000 CR4: 00350e90 Call Trace: crypto_shash_export+0x65/0xc0 crypt_iv_lmk_one+0x106/0x1a0 [dm_crypt] Fixes: efd62c85525e ("crypto: md5-generic - Use API partial block handling") Reported-by: Milan Broz Signed-off-by: Herbert Xu Tested-by: Milan Broz Closes: https://lore.kernel.org/linux-crypto/f1625ddc-e82e-4b77-80c2-dc8e45b54848@gmail.com/T/ Signed-off-by: Mikulas Patocka commit cbe4134ea4bc493239786220bd69cb8a13493190 Author: Shivank Garg Date: Fri Jun 20 07:03:30 2025 +0000 fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass Export anon_inode_make_secure_inode() to allow KVM guest_memfd to create anonymous inodes with proper security context. This replaces the current pattern of calling alloc_anon_inode() followed by inode_init_security_anon() for creating security context manually. This change also fixes a security regression in secretmem where the S_PRIVATE flag was not cleared after alloc_anon_inode(), causing LSM/SELinux checks to be bypassed for secretmem file descriptors. As guest_memfd currently resides in the KVM module, we need to export this symbol for use outside the core kernel. In the future, guest_memfd might be moved to core-mm, at which point the symbols no longer would have to be exported. When/if that happens is still unclear. Fixes: 2bfe15c52612 ("mm: create security context for memfd_secret inodes") Suggested-by: David Hildenbrand Suggested-by: Mike Rapoport Signed-off-by: Shivank Garg Link: https://lore.kernel.org/20250620070328.803704-3-shivankg@amd.com Acked-by: "Mike Rapoport (Microsoft)" Signed-off-by: Christian Brauner commit 6a68d28066b6257b8d09b1daa91db43d56dbb6ad Author: Nam Cao Date: Fri Jun 20 13:02:52 2025 +0200 selftests/coredump: Fix "socket_detect_userspace_client" test failure The coredump.socket_detect_userspace_client test occasionally fails: # RUN coredump.socket_detect_userspace_client ... # stackdump_test.c:500:socket_detect_userspace_client:Expected 0 (0) != WIFEXITED(status) (0) # socket_detect_userspace_client: Test terminated by assertion # FAIL coredump.socket_detect_userspace_client not ok 3 coredump.socket_detect_userspace_client because there is no guarantee that client's write() happens before server's close(). The client gets terminated SIGPIPE, and thus the test fails. Add a read() to server to make sure server's close() doesn't happen before client's write(). Fixes: 7b6724fe9a6b ("selftests/coredump: add tests for AF_UNIX coredumps") Signed-off-by: Nam Cao Link: https://lore.kernel.org/20250620110252.1640391-1-namcao@linutronix.de Signed-off-by: Christian Brauner commit 2cdde91c14ec358087f43287513946d493aef940 Author: Alok Tiwari Date: Sun Jun 22 10:17:02 2025 -0700 thunderbolt: Fix bit masking in tb_dp_port_set_hops() The tb_dp_port_set_hops() function was incorrectly clearing ADP_DP_CS_1_AUX_RX_HOPID_MASK twice. According to the function's purpose, it should clear both TX and RX AUX HopID fields. Replace the first instance with ADP_DP_CS_1_AUX_TX_HOPID_MASK to ensure proper configuration of both AUX directions. Fixes: 98176380cbe5 ("thunderbolt: Convert DP adapter register names to follow the USB4 spec") Cc: stable@vger.kernel.org Signed-off-by: Alok Tiwari Signed-off-by: Mika Westerberg commit 58d71d4242ce057955c783a14c82270c71f9e1e8 Author: Mario Limonciello Date: Thu Jun 19 16:38:30 2025 -0500 thunderbolt: Fix wake on connect at runtime commit 1a760d10ded37 ("thunderbolt: Fix a logic error in wake on connect") fixated on the USB4 port sysfs wakeup file not working properly to control policy, but it had an unintended side effect that the sysfs file controls policy both at runtime and at suspend time. The sysfs file is supposed to only control behavior while system is suspended. Pass whether programming a port for runtime into usb4_switch_set_wake() and if runtime then ignore the value in the sysfs file. Cc: stable@vger.kernel.org Reported-by: Alexander Kovacs Tested-by: Alexander Kovacs Fixes: 1a760d10ded37 ("thunderbolt: Fix a logic error in wake on connect") Signed-off-by: Mario Limonciello Signed-off-by: Mika Westerberg commit 20d71750cc72e80859d52548cf5c2a7513983b0d Author: Herbert Xu Date: Fri Jun 20 20:15:03 2025 +0800 crypto: wp512 - Use API partial block handling Use the Crypto API partial block handling. Signed-off-by: Herbert Xu Tested-by: Milan Broz Signed-off-by: Herbert Xu commit fb721b2c35b1829b8ecf62e3adb41cf30260316a Author: Louis Chauvet Date: Tue Apr 29 10:36:23 2025 +0200 drm: writeback: Fix drm_writeback_connector_cleanup signature The drm_writeback_connector_cleanup have the signature: static void drm_writeback_connector_cleanup( struct drm_device *dev, struct drm_writeback_connector *wb_connector) But it is stored and used as a drmres_release_t typedef void (*drmres_release_t)(struct drm_device *dev, void *res); While the current code is valid and does not produce any warning, the CFI runtime check (CONFIG_CFI_CLANG) can fail because the function signature is not the same as drmres_release_t. In order to fix this, change the function signature to match what is expected by drmres_release_t. Fixes: 1914ba2b91ea ("drm: writeback: Create drmm variants for drm_writeback_connector initialization") Suggested-by: Mark Yacoub Reviewed-by: Maíra Canal Link: https://lore.kernel.org/r/20250429-drm-fix-writeback-cleanup-v2-1-548ff3a4e284@bootlin.com Signed-off-by: Louis Chauvet commit bf39286adc5e10ce3e32eb86ad316ae56f3b52a0 Author: Oliver Schramm Date: Sun Jun 22 00:30:01 2025 +0200 ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 It's smaller brother has already received the patch to enable the microphone, now add it too to the DMI quirk table. Cc: stable@vger.kernel.org Signed-off-by: Oliver Schramm Link: https://patch.msgid.link/20250621223000.11817-2-oliver.schramm97@gmail.com Signed-off-by: Mark Brown commit 7186b81807b4a08f8bf834b6bdc72d6ed8ba1587 Author: Yuzuru10 Date: Sun Jun 22 22:58:00 2025 +0000 ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic This patch adds DMI-based quirk for the Acer Nitro ANV15-41, allowing the internal microphone to be detected correctly on machines with "RB" as board vendor. Signed-off-by: Yuzuru Link: https://patch.msgid.link/20250622225754.20856-1-yuzuru_10@proton.me Signed-off-by: Mark Brown commit 999fb9d51f939ee23cbb9313ae558d29d6987804 Author: Luca Weiss Date: Tue Jun 17 14:20:12 2025 +0200 ASoC: qcom: sm8250: Fix possibly undefined reference With CONFIG_SND_SOC_SM8250=y and CONFIG_SND_SOC_QCOM_OFFLOAD_UTILS=m selected in kconfig, the build will fail due to trying to link against a symbol only found in the module. aarch64-linux-gnu-ld: sound/soc/qcom/sm8250.o: in function `sm8250_snd_exit': sound/soc/qcom/sm8250.c:52:(.text+0x210): undefined reference to `qcom_snd_usb_offload_jack_remove' Fix this by declaring the dependency that forces CONFIG_SND_SOC_SM8250=m when CONFIG_SND_SOC_QCOM_OFFLOAD_UTILS is =m. Reported-by: Matthew Croughan Fixes: 1b8d0d87b934 ("ASoC: qcom: qdsp6: Add headphone jack for offload connection status") Signed-off-by: Luca Weiss Link: https://patch.msgid.link/20250617-snd-sm8250-dep-fix-v1-1-879af8906ec4@fairphone.com Signed-off-by: Mark Brown commit 86731a2a651e58953fc949573895f2fa6d456841 Author: Linus Torvalds Date: Sun Jun 22 13:30:08 2025 -0700 Linux 6.16-rc3 commit b993ea46b3b601915ceaaf3c802adf11e7d6bac6 Author: Eric Dumazet Date: Fri Jun 20 14:28:44 2025 +0000 atm: clip: prevent NULL deref in clip_push() Blamed commit missed that vcc_destroy_socket() calls clip_push() with a NULL skb. If clip_devs is NULL, clip_push() then crashes when reading skb->truesize. Fixes: 93a2014afbac ("atm: fix a UAF in lec_arp_clear_vccs()") Reported-by: syzbot+1316233c4c6803382a8b@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68556f59.a00a0220.137b3.004e.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Cc: Cong Wang Cc: Gengming Liu Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit b67ec639010f7d2ce2b467cef36f3e5e785d8d50 Merge: 5c00eca95a9a20 a6c23dac756b95 Author: Linus Torvalds Date: Sun Jun 22 10:50:36 2025 -0700 Merge tag 'i2c-for-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: - subsystem: convert drivers to use recent callbacks of struct i2c_algorithm A typical after-rc1 cleanup, which I couldn't send in time for rc2 - tegra: fix YAML conversion of device tree bindings - k1: re-add a check which got lost during upstreaming * tag 'i2c-for-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: k1: check for transfer error i2c: use inclusive callbacks in struct i2c_algorithm dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties commit 5c00eca95a9a20e662bd290c3ef3f2e07dfa9baa Merge: 33efa7dbabcf62 2aebf5ee43bf0e Author: Linus Torvalds Date: Sun Jun 22 10:30:44 2025 -0700 Merge tag 'x86_urgent_for_v6.16_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: - Make sure the array tracking which kernel text positions need to be alternatives-patched doesn't get mishandled by out-of-order modifications, leading to it overflowing and causing page faults when patching - Avoid an infinite loop when early code does a ranged TLB invalidation before the broadcast TLB invalidation count of how many pages it can flush, has been read from CPUID - Fix a CONFIG_MODULES typo - Disable broadcast TLB invalidation when PTI is enabled to avoid an overflow of the bitmap tracking dynamic ASIDs which need to be flushed when the kernel switches between the user and kernel address space - Handle the case of a CPU going offline and thus reporting zeroes when reading top-level events in the resctrl code * tag 'x86_urgent_for_v6.16_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/alternatives: Fix int3 handling failure from broken text_poke array x86/mm: Fix early boot use of INVPLGB x86/its: Fix an ifdef typo in its_alloc() x86/mm: Disable INVLPGB when PTI is enabled x86,fs/resctrl: Remove inappropriate references to cacheinfo in the resctrl subsystem commit 33efa7dbabcf62491c2eac9631752d52b8e159f8 Merge: 17ef32ae66b1af 3085ef9d9e7ab5 Author: Linus Torvalds Date: Sun Jun 22 10:17:51 2025 -0700 Merge tag 'irq_urgent_for_v6.16_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Borislav Petkov: - Fix missing prototypes warnings - Properly initialize work context when allocating it - Remove a method tracking when managed interrupts are suspended during hotplug, in favor of the code using a IRQ disable depth tracking now, and have interrupts get properly enabled again on restore - Make sure multiple CPUs getting hotplugged don't cause wrong tracking of the managed IRQ disable depth * tag 'irq_urgent_for_v6.16_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/ath79-misc: Fix missing prototypes warnings genirq/irq_sim: Initialize work context pointers properly genirq/cpuhotplug: Restore affinity even for suspended IRQ genirq/cpuhotplug: Rebalance managed interrupts across multi-CPU hotplug commit 302251f1fdfd302ce99a619aac1a5164d0bb7c4b Author: Faisal Bukhari Date: Sat Jun 21 16:02:04 2025 +0530 Fix typo in marvell octeontx2 documentation Documentation/networking/device_drivers/ethernet/marvell/octeontx2.rst Fixes a spelling mistake: "funcionality" → "functionality". Signed-off-by: Faisal Bukhari Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 17ef32ae66b1afc9fa6dbea40eb18a13edba9c31 Merge: aff2a7e23f2373 b0823d5fbacb1c Author: Linus Torvalds Date: Sun Jun 22 10:11:45 2025 -0700 Merge tag 'perf_urgent_for_v6.16_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Borislav Petkov: - Avoid a crash on a heterogeneous machine where not all cores support the same hw events features - Avoid a deadlock when throttling events - Document the perf event states more - Make sure a number of perf paths switching off or rescheduling events call perf_cgroup_event_disable() - Make sure perf does task sampling before its userspace mapping is torn down, and not after * tag 'perf_urgent_for_v6.16_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/intel: Fix crash in icl_update_topdown_event() perf: Fix the throttle error of some clock events perf: Add comment to enum perf_event_state perf/core: Fix WARN in perf_cgroup_switch() perf: Fix dangling cgroup pointer in cpuctx perf: Fix cgroup state vs ERROR perf: Fix sample vs do_exit() commit aff2a7e23f23738ca3cd62e4ce5be2d62a3d52ad Merge: 73543bad766486 69a14d146f3b87 Author: Linus Torvalds Date: Sun Jun 22 10:09:23 2025 -0700 Merge tag 'locking_urgent_for_v6.16_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fixes from Borislav Petkov: - Make sure the switch to the global hash is requested always under a lock so that two threads requesting that simultaneously cannot get to inconsistent state - Reject negative NUMA nodes earlier in the futex NUMA interface handling code - Selftests fixes * tag 'locking_urgent_for_v6.16_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: futex: Verify under the lock if hash can be replaced futex: Handle invalid node numbers supplied by user selftests/futex: Set the home_node in futex_numa_mpol selftests/futex: getopt() requires int as return value. commit 73543bad766486c3cdbf6fa9d1faf7d0c4bcc7af Merge: e669e322c52c49 88efa0de3285be Author: Linus Torvalds Date: Sun Jun 22 10:05:33 2025 -0700 Merge tag 'edac_urgent_for_v6.16_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC fixes from Borislav Petkov: - amd64: Correct the number of memory controllers on some AMD Zen clients - igen6: Handle firmware-disabled memory controllers properly * tag 'edac_urgent_for_v6.16_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/igen6: Fix NULL pointer dereference EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh commit e669e322c52c49c161e46492963e64319fbb53a8 Merge: 75f99f8cf445d5 25e8b1dd4883e6 Author: Linus Torvalds Date: Sun Jun 22 09:58:23 2025 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "ARM: - Fix another set of FP/SIMD/SVE bugs affecting NV, and plugging some missing synchronisation - A small fix for the irqbypass hook fixes, tightening the check and ensuring that we only deal with MSI for both the old and the new route entry - Rework the way the shadow LRs are addressed in a nesting configuration, plugging an embarrassing bug as well as simplifying the whole process - Add yet another fix for the dreaded arch_timer_edge_cases selftest RISC-V: - Fix the size parameter check in SBI SFENCE calls - Don't treat SBI HFENCE calls as NOPs x86 TDX: - Complete API for handling complex TDVMCALLs in userspace. This was delayed because the spec lacked a way for userspace to deny supporting these calls; the new exit code is now approved" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: TDX: Exit to userspace for GetTdVmCallInfo KVM: TDX: Handle TDG.VP.VMCALL KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs KVM: arm64: VHE: Centralize ISBs when returning to host KVM: arm64: Remove cpacr_clear_set() KVM: arm64: Remove ad-hoc CPTR manipulation from kvm_hyp_handle_fpsimd() KVM: arm64: Remove ad-hoc CPTR manipulation from fpsimd_sve_sync() KVM: arm64: Reorganise CPTR trap manipulation KVM: arm64: VHE: Synchronize CPTR trap deactivation KVM: arm64: VHE: Synchronize restore of host debug registers KVM: arm64: selftests: Close the GIC FD in arch_timer_edge_cases KVM: arm64: Explicitly treat routing entry type changes as changes KVM: arm64: nv: Fix tracking of shadow list registers RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls commit 75f99f8cf445d577132ed97514032d9a3d3e2758 Merge: 739a6c93cc755c 27e9d5d021dbaa Author: Linus Torvalds Date: Sun Jun 22 09:46:11 2025 -0700 Merge tag 'v6.16-rc2-smb3-client-fixes-v2' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - Multichannel channel allocation fix for Kerberos mounts - Two reconnect fixes - Fix netfs_writepages crash with smbdirect/RDMA - Directory caching fix - Three minor cleanup fixes - Log error when close cached dirs fails * tag 'v6.16-rc2-smb3-client-fixes-v2' of git://git.samba.org/sfrench/cifs-2.6: smb: minor fix to use SMB2_NTLMV2_SESSKEY_SIZE for auth_key size smb: minor fix to use sizeof to initialize flags_string buffer smb: Use loff_t for directory position in cached_dirents smb: Log an error when close_all_cached_dirs fails cifs: Fix prepare_write to negotiate wsize if needed smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() smb: client: fix first command failure during re-negotiation cifs: Remove duplicate fattr->cf_dtype assignment from wsl_to_fattr() function smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels commit 68cc9d3c8e44afe90e43cbbd2960da15c2f31e23 Author: Yasmin Fitzgerald Date: Sat Jun 21 01:36:14 2025 -0400 ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 The HP Pavilion Laptop 15-eg100 has Realtek HDA codec ALC287. It needs the ALC287_FIXUP_HP_GPIO_LED quirk to enable the mute LED. Signed-off-by: Yasmin Fitzgerald Link: https://patch.msgid.link/20250621053832.52950-1-sunoflife1.git@gmail.com Signed-off-by: Takashi Iwai commit e41687b511d5e5437db5d2151e23c115dba30411 Author: Tim Crawford Date: Fri Jun 20 14:43:29 2025 -0600 ALSA: hda/realtek: Add quirks for some Clevo laptops Add audio quirks to fix speaker output and headset detection on the following Clevo models: - V350ENC - V350WNPQ - V540TU - X560WNR - X580WNS Signed-off-by: Tim Crawford Link: https://patch.msgid.link/20250620204329.35878-1-tcrawford@system76.com Signed-off-by: Takashi Iwai commit 72c0d9cb0fc48b6d382c3b5b6f702108a612cfdb Author: Kent Overstreet Date: Thu Jun 19 23:06:01 2025 -0400 bcachefs: Fix range in bch2_lookup_indirect_extent() error path Before calling bch2_indirect_extent_missing_error(), we have to calculate the missing range, which is the intersection of the reflink pointer and the non-indirect-extent we found. The calculation didn't take into account that the returned extent may span the iter position, leading to an infinite loop when we (unnecessarily) resized the extent we were returning to one that didn't extend past the offset we were looking up. Signed-off-by: Kent Overstreet commit abcb6bd4be19d935795611c022d7d19ab69363b0 Author: Kent Overstreet Date: Thu Jun 19 17:06:43 2025 -0400 bcachefs: fix spurious error_throw Signed-off-by: Kent Overstreet commit bb378314ceee4d181e26bfe180deca852ae80c5c Author: Kent Overstreet Date: Thu Jun 19 16:51:32 2025 -0400 bcachefs: Add missing bch2_err_class() to fileattr_set() Make sure we return a standard error code. Signed-off-by: Kent Overstreet commit a6c23dac756b9541b33aa3bcd30f464df2879209 Author: Alex Elder Date: Mon Jun 16 07:51:36 2025 -0500 i2c: k1: check for transfer error If spacemit_i2c_xfer_msg() times out waiting for a message transfer to complete, or if the hardware reports an error, it returns a negative error code (-ETIMEDOUT, -EAGAIN, -ENXIO. or -EIO). The sole caller of spacemit_i2c_xfer_msg() is spacemit_i2c_xfer(), which is the i2c_algorithm->xfer callback function. It currently does not save the value returned by spacemit_i2c_xfer_msg(). The result is that transfer errors go unreported, and a caller has no indication anything is wrong. When this code was out for review, the return value *was* checked in early versions. But for some reason, that assignment got dropped between versions 5 and 6 of the series, perhaps related to reworking the code to merge spacemit_i2c_xfer_core() into spacemit_i2c_xfer(). Simply assigning the value returned to "ret" fixes the problem. Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC") Signed-off-by: Alex Elder Cc: # v6.15+ Reviewed-by: Troy Mitchell Link: https://lore.kernel.org/r/20250616125137.1555453-1-elder@riscstar.com Signed-off-by: Andi Shyti Signed-off-by: Wolfram Sang commit 739a6c93cc755c0daf3a7e57e018a8c61047cd90 Merge: 1f9378d4a7dd86 94d10a4dba0bc4 Author: Linus Torvalds Date: Sat Jun 21 09:20:15 2025 -0700 Merge tag 'nfsd-6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: - Two fixes for commits in the nfsd-6.16 merge - One fix for the recently-added NFSD netlink facility - One fix for a remote SunRPC crasher * tag 'nfsd-6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error nfsd: use threads array as-is in netlink interface SUNRPC: Cleanup/fix initial rq_pages allocation NFSD: Avoid corruption of a referring call list commit 1f9378d4a7dd862b28d83a062a2dcc6ef1a0daa7 Merge: f7301f856d351f 417b8af2e30d7f Author: Linus Torvalds Date: Sat Jun 21 09:15:08 2025 -0700 Merge tag 'erofs-for-6.16-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs fixes from Gao Xiang: - Use the mounter’s credentials for file-backed mounts to resolve Android SELinux permission issues - Remove the unused trace event `erofs_destroy_inode` - Error out on crafted out-of-file-range encoded extents - Remove an incorrect check for encoded extents * tag 'erofs-for-6.16-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: remove a superfluous check for encoded extents erofs: refuse crafted out-of-file-range encoded extents erofs: remove unused trace event erofs_destroy_inode erofs: impersonate the opener's credentials when accessing backing file commit 27e9d5d021dbaa1211836d07a240078bf84b284e Author: Bharath SM Date: Thu Jun 19 21:05:34 2025 +0530 smb: minor fix to use SMB2_NTLMV2_SESSKEY_SIZE for auth_key size Replaced hardcoded value 16 with SMB2_NTLMV2_SESSKEY_SIZE in the auth_key definition and memcpy call. Reviewed-by: Paulo Alcantara (Red Hat) Signed-off-by: Bharath SM Signed-off-by: Steve French commit 4d360cfe8cbac3b62bd9e1df9889bde8a9d5b1d7 Author: Bharath SM Date: Thu Jun 19 21:05:33 2025 +0530 smb: minor fix to use sizeof to initialize flags_string buffer Replaced hardcoded length with sizeof(flags_string). Reviewed-by: Paulo Alcantara (Red Hat) Signed-off-by: Bharath SM Signed-off-by: Steve French commit 4eb11a34b72c86d559f437fdadc47e512bba41d2 Author: Bharath SM Date: Thu Jun 19 21:05:32 2025 +0530 smb: Use loff_t for directory position in cached_dirents Change the pos field in struct cached_dirents from int to loff_t to support large directory offsets. This avoids overflow and matches kernel conventions for directory positions. Reviewed-by: Paulo Alcantara (Red Hat) Signed-off-by: Bharath SM Signed-off-by: Steve French commit a2182743a8b4969481f64aec4908ff162e8a206c Author: Paul Aurich Date: Wed Nov 20 08:01:54 2024 -0800 smb: Log an error when close_all_cached_dirs fails Under low-memory conditions, close_all_cached_dirs() can't move the dentries to a separate list to dput() them once the locks are dropped. This will result in a "Dentry still in use" error, so add an error message that makes it clear this is what happened: [ 495.281119] CIFS: VFS: \\otters.example.com\share Out of memory while dropping dentries [ 495.281595] ------------[ cut here ]------------ [ 495.281887] BUG: Dentry ffff888115531138{i=78,n=/} still in use (2) [unmount of cifs cifs] [ 495.282391] WARNING: CPU: 1 PID: 2329 at fs/dcache.c:1536 umount_check+0xc8/0xf0 Also, bail out of looping through all tcons as soon as a single allocation fails, since we're already in trouble, and kmalloc() attempts for subseqeuent tcons are likely to fail just like the first one did. Signed-off-by: Paul Aurich Acked-by: Bharath SM Suggested-by: Ruben Devos Cc: stable@vger.kernel.org Signed-off-by: Steve French commit 2c4fd3d141465ef1afc8318c95e7b916d9a8c49c Author: David Howells Date: Wed Jun 18 16:39:47 2025 +0100 cifs: Fix prepare_write to negotiate wsize if needed Fix cifs_prepare_write() to negotiate the wsize if it is unset. Reviewed-by: Shyam Prasad N Reviewed-by: Bharath SM Signed-off-by: David Howells cc: Paulo Alcantara cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit a379a8a2a0032e12e7ef397197c9c2ad011588d6 Author: Stefan Metzmacher Date: Wed Jun 18 18:51:40 2025 +0200 smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() This fixes the following problem: [ 749.901015] [ T8673] run fstests cifs/001 at 2025-06-17 09:40:30 [ 750.346409] [ T9870] ================================================================== [ 750.346814] [ T9870] BUG: KASAN: slab-out-of-bounds in smb_set_sge+0x2cc/0x3b0 [cifs] [ 750.347330] [ T9870] Write of size 8 at addr ffff888011082890 by task xfs_io/9870 [ 750.347705] [ T9870] [ 750.348077] [ T9870] CPU: 0 UID: 0 PID: 9870 Comm: xfs_io Kdump: loaded Not tainted 6.16.0-rc2-metze.02+ #1 PREEMPT(voluntary) [ 750.348082] [ T9870] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 750.348085] [ T9870] Call Trace: [ 750.348086] [ T9870] [ 750.348088] [ T9870] dump_stack_lvl+0x76/0xa0 [ 750.348106] [ T9870] print_report+0xd1/0x640 [ 750.348116] [ T9870] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 750.348120] [ T9870] ? kasan_complete_mode_report_info+0x26/0x210 [ 750.348124] [ T9870] kasan_report+0xe7/0x130 [ 750.348128] [ T9870] ? smb_set_sge+0x2cc/0x3b0 [cifs] [ 750.348262] [ T9870] ? smb_set_sge+0x2cc/0x3b0 [cifs] [ 750.348377] [ T9870] __asan_report_store8_noabort+0x17/0x30 [ 750.348381] [ T9870] smb_set_sge+0x2cc/0x3b0 [cifs] [ 750.348496] [ T9870] smbd_post_send_iter+0x1990/0x3070 [cifs] [ 750.348625] [ T9870] ? __pfx_smbd_post_send_iter+0x10/0x10 [cifs] [ 750.348741] [ T9870] ? update_stack_state+0x2a0/0x670 [ 750.348749] [ T9870] ? cifs_flush+0x153/0x320 [cifs] [ 750.348870] [ T9870] ? cifs_flush+0x153/0x320 [cifs] [ 750.348990] [ T9870] ? update_stack_state+0x2a0/0x670 [ 750.348995] [ T9870] smbd_send+0x58c/0x9c0 [cifs] [ 750.349117] [ T9870] ? __pfx_smbd_send+0x10/0x10 [cifs] [ 750.349231] [ T9870] ? unwind_get_return_address+0x65/0xb0 [ 750.349235] [ T9870] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 750.349242] [ T9870] ? arch_stack_walk+0xa7/0x100 [ 750.349250] [ T9870] ? stack_trace_save+0x92/0xd0 [ 750.349254] [ T9870] __smb_send_rqst+0x931/0xec0 [cifs] [ 750.349374] [ T9870] ? kernel_text_address+0x173/0x190 [ 750.349379] [ T9870] ? kasan_save_stack+0x39/0x70 [ 750.349382] [ T9870] ? kasan_save_track+0x18/0x70 [ 750.349385] [ T9870] ? __kasan_slab_alloc+0x9d/0xa0 [ 750.349389] [ T9870] ? __pfx___smb_send_rqst+0x10/0x10 [cifs] [ 750.349508] [ T9870] ? smb2_mid_entry_alloc+0xb4/0x7e0 [cifs] [ 750.349626] [ T9870] ? cifs_call_async+0x277/0xb00 [cifs] [ 750.349746] [ T9870] ? cifs_issue_write+0x256/0x610 [cifs] [ 750.349867] [ T9870] ? netfs_do_issue_write+0xc2/0x340 [netfs] [ 750.349900] [ T9870] ? netfs_advance_write+0x45b/0x1270 [netfs] [ 750.349929] [ T9870] ? netfs_write_folio+0xd6c/0x1be0 [netfs] [ 750.349958] [ T9870] ? netfs_writepages+0x2e9/0xa80 [netfs] [ 750.349987] [ T9870] ? do_writepages+0x21f/0x590 [ 750.349993] [ T9870] ? filemap_fdatawrite_wbc+0xe1/0x140 [ 750.349997] [ T9870] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 750.350002] [ T9870] smb_send_rqst+0x22e/0x2f0 [cifs] [ 750.350131] [ T9870] ? __pfx_smb_send_rqst+0x10/0x10 [cifs] [ 750.350255] [ T9870] ? local_clock_noinstr+0xe/0xd0 [ 750.350261] [ T9870] ? kasan_save_alloc_info+0x37/0x60 [ 750.350268] [ T9870] ? __kasan_check_write+0x14/0x30 [ 750.350271] [ T9870] ? _raw_spin_lock+0x81/0xf0 [ 750.350275] [ T9870] ? __pfx__raw_spin_lock+0x10/0x10 [ 750.350278] [ T9870] ? smb2_setup_async_request+0x293/0x580 [cifs] [ 750.350398] [ T9870] cifs_call_async+0x477/0xb00 [cifs] [ 750.350518] [ T9870] ? __pfx_smb2_writev_callback+0x10/0x10 [cifs] [ 750.350636] [ T9870] ? __pfx_cifs_call_async+0x10/0x10 [cifs] [ 750.350756] [ T9870] ? __pfx__raw_spin_lock+0x10/0x10 [ 750.350760] [ T9870] ? __kasan_check_write+0x14/0x30 [ 750.350763] [ T9870] ? __smb2_plain_req_init+0x933/0x1090 [cifs] [ 750.350891] [ T9870] smb2_async_writev+0x15ff/0x2460 [cifs] [ 750.351008] [ T9870] ? sched_clock_noinstr+0x9/0x10 [ 750.351012] [ T9870] ? local_clock_noinstr+0xe/0xd0 [ 750.351018] [ T9870] ? __pfx_smb2_async_writev+0x10/0x10 [cifs] [ 750.351144] [ T9870] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 750.351150] [ T9870] ? _raw_spin_unlock+0xe/0x40 [ 750.351154] [ T9870] ? cifs_pick_channel+0x242/0x370 [cifs] [ 750.351275] [ T9870] cifs_issue_write+0x256/0x610 [cifs] [ 750.351554] [ T9870] ? cifs_issue_write+0x256/0x610 [cifs] [ 750.351677] [ T9870] netfs_do_issue_write+0xc2/0x340 [netfs] [ 750.351710] [ T9870] netfs_advance_write+0x45b/0x1270 [netfs] [ 750.351740] [ T9870] ? rolling_buffer_append+0x12d/0x440 [netfs] [ 750.351769] [ T9870] netfs_write_folio+0xd6c/0x1be0 [netfs] [ 750.351798] [ T9870] ? __kasan_check_write+0x14/0x30 [ 750.351804] [ T9870] netfs_writepages+0x2e9/0xa80 [netfs] [ 750.351835] [ T9870] ? __pfx_netfs_writepages+0x10/0x10 [netfs] [ 750.351864] [ T9870] ? exit_files+0xab/0xe0 [ 750.351867] [ T9870] ? do_exit+0x148f/0x2980 [ 750.351871] [ T9870] ? do_group_exit+0xb5/0x250 [ 750.351874] [ T9870] ? arch_do_signal_or_restart+0x92/0x630 [ 750.351879] [ T9870] ? exit_to_user_mode_loop+0x98/0x170 [ 750.351882] [ T9870] ? do_syscall_64+0x2cf/0xd80 [ 750.351886] [ T9870] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 750.351890] [ T9870] do_writepages+0x21f/0x590 [ 750.351894] [ T9870] ? __pfx_do_writepages+0x10/0x10 [ 750.351897] [ T9870] filemap_fdatawrite_wbc+0xe1/0x140 [ 750.351901] [ T9870] __filemap_fdatawrite_range+0xba/0x100 [ 750.351904] [ T9870] ? __pfx___filemap_fdatawrite_range+0x10/0x10 [ 750.351912] [ T9870] ? __kasan_check_write+0x14/0x30 [ 750.351916] [ T9870] filemap_write_and_wait_range+0x7d/0xf0 [ 750.351920] [ T9870] cifs_flush+0x153/0x320 [cifs] [ 750.352042] [ T9870] filp_flush+0x107/0x1a0 [ 750.352046] [ T9870] filp_close+0x14/0x30 [ 750.352049] [ T9870] put_files_struct.part.0+0x126/0x2a0 [ 750.352053] [ T9870] ? __pfx__raw_spin_lock+0x10/0x10 [ 750.352058] [ T9870] exit_files+0xab/0xe0 [ 750.352061] [ T9870] do_exit+0x148f/0x2980 [ 750.352065] [ T9870] ? __pfx_do_exit+0x10/0x10 [ 750.352069] [ T9870] ? __kasan_check_write+0x14/0x30 [ 750.352072] [ T9870] ? _raw_spin_lock_irq+0x8a/0xf0 [ 750.352076] [ T9870] do_group_exit+0xb5/0x250 [ 750.352080] [ T9870] get_signal+0x22d3/0x22e0 [ 750.352086] [ T9870] ? __pfx_get_signal+0x10/0x10 [ 750.352089] [ T9870] ? fpregs_assert_state_consistent+0x68/0x100 [ 750.352101] [ T9870] ? folio_add_lru+0xda/0x120 [ 750.352105] [ T9870] arch_do_signal_or_restart+0x92/0x630 [ 750.352109] [ T9870] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 750.352115] [ T9870] exit_to_user_mode_loop+0x98/0x170 [ 750.352118] [ T9870] do_syscall_64+0x2cf/0xd80 [ 750.352123] [ T9870] ? __kasan_check_read+0x11/0x20 [ 750.352126] [ T9870] ? count_memcg_events+0x1b4/0x420 [ 750.352132] [ T9870] ? handle_mm_fault+0x148/0x690 [ 750.352136] [ T9870] ? _raw_spin_lock_irq+0x8a/0xf0 [ 750.352140] [ T9870] ? __kasan_check_read+0x11/0x20 [ 750.352143] [ T9870] ? fpregs_assert_state_consistent+0x68/0x100 [ 750.352146] [ T9870] ? irqentry_exit_to_user_mode+0x2e/0x250 [ 750.352151] [ T9870] ? irqentry_exit+0x43/0x50 [ 750.352154] [ T9870] ? exc_page_fault+0x75/0xe0 [ 750.352160] [ T9870] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 750.352163] [ T9870] RIP: 0033:0x7858c94ab6e2 [ 750.352167] [ T9870] Code: Unable to access opcode bytes at 0x7858c94ab6b8. [ 750.352175] [ T9870] RSP: 002b:00007858c9248ce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000022 [ 750.352179] [ T9870] RAX: fffffffffffffdfe RBX: 00007858c92496c0 RCX: 00007858c94ab6e2 [ 750.352182] [ T9870] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 750.352184] [ T9870] RBP: 00007858c9248d10 R08: 0000000000000000 R09: 0000000000000000 [ 750.352185] [ T9870] R10: 0000000000000000 R11: 0000000000000246 R12: fffffffffffffde0 [ 750.352187] [ T9870] R13: 0000000000000020 R14: 0000000000000002 R15: 00007ffc072d2230 [ 750.352191] [ T9870] [ 750.352195] [ T9870] [ 750.395206] [ T9870] Allocated by task 9870 on cpu 0 at 750.346406s: [ 750.395523] [ T9870] kasan_save_stack+0x39/0x70 [ 750.395532] [ T9870] kasan_save_track+0x18/0x70 [ 750.395536] [ T9870] kasan_save_alloc_info+0x37/0x60 [ 750.395539] [ T9870] __kasan_slab_alloc+0x9d/0xa0 [ 750.395543] [ T9870] kmem_cache_alloc_noprof+0x13c/0x3f0 [ 750.395548] [ T9870] mempool_alloc_slab+0x15/0x20 [ 750.395553] [ T9870] mempool_alloc_noprof+0x135/0x340 [ 750.395557] [ T9870] smbd_post_send_iter+0x63e/0x3070 [cifs] [ 750.395694] [ T9870] smbd_send+0x58c/0x9c0 [cifs] [ 750.395819] [ T9870] __smb_send_rqst+0x931/0xec0 [cifs] [ 750.395950] [ T9870] smb_send_rqst+0x22e/0x2f0 [cifs] [ 750.396081] [ T9870] cifs_call_async+0x477/0xb00 [cifs] [ 750.396232] [ T9870] smb2_async_writev+0x15ff/0x2460 [cifs] [ 750.396359] [ T9870] cifs_issue_write+0x256/0x610 [cifs] [ 750.396492] [ T9870] netfs_do_issue_write+0xc2/0x340 [netfs] [ 750.396544] [ T9870] netfs_advance_write+0x45b/0x1270 [netfs] [ 750.396576] [ T9870] netfs_write_folio+0xd6c/0x1be0 [netfs] [ 750.396608] [ T9870] netfs_writepages+0x2e9/0xa80 [netfs] [ 750.396639] [ T9870] do_writepages+0x21f/0x590 [ 750.396643] [ T9870] filemap_fdatawrite_wbc+0xe1/0x140 [ 750.396647] [ T9870] __filemap_fdatawrite_range+0xba/0x100 [ 750.396651] [ T9870] filemap_write_and_wait_range+0x7d/0xf0 [ 750.396656] [ T9870] cifs_flush+0x153/0x320 [cifs] [ 750.396787] [ T9870] filp_flush+0x107/0x1a0 [ 750.396791] [ T9870] filp_close+0x14/0x30 [ 750.396795] [ T9870] put_files_struct.part.0+0x126/0x2a0 [ 750.396800] [ T9870] exit_files+0xab/0xe0 [ 750.396803] [ T9870] do_exit+0x148f/0x2980 [ 750.396808] [ T9870] do_group_exit+0xb5/0x250 [ 750.396813] [ T9870] get_signal+0x22d3/0x22e0 [ 750.396817] [ T9870] arch_do_signal_or_restart+0x92/0x630 [ 750.396822] [ T9870] exit_to_user_mode_loop+0x98/0x170 [ 750.396827] [ T9870] do_syscall_64+0x2cf/0xd80 [ 750.396832] [ T9870] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 750.396836] [ T9870] [ 750.397150] [ T9870] The buggy address belongs to the object at ffff888011082800 which belongs to the cache smbd_request_0000000008f3bd7b of size 144 [ 750.397798] [ T9870] The buggy address is located 0 bytes to the right of allocated 144-byte region [ffff888011082800, ffff888011082890) [ 750.398469] [ T9870] [ 750.398800] [ T9870] The buggy address belongs to the physical page: [ 750.399141] [ T9870] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11082 [ 750.399148] [ T9870] flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff) [ 750.399155] [ T9870] page_type: f5(slab) [ 750.399161] [ T9870] raw: 000fffffc0000000 ffff888022d65640 dead000000000122 0000000000000000 [ 750.399165] [ T9870] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 750.399169] [ T9870] page dumped because: kasan: bad access detected [ 750.399172] [ T9870] [ 750.399505] [ T9870] Memory state around the buggy address: [ 750.399863] [ T9870] ffff888011082780: fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 750.400247] [ T9870] ffff888011082800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 750.400618] [ T9870] >ffff888011082880: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 750.400982] [ T9870] ^ [ 750.401370] [ T9870] ffff888011082900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 750.401774] [ T9870] ffff888011082980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 750.402171] [ T9870] ================================================================== [ 750.402696] [ T9870] Disabling lock debugging due to kernel taint [ 750.403202] [ T9870] BUG: unable to handle page fault for address: ffff8880110a2000 [ 750.403797] [ T9870] #PF: supervisor write access in kernel mode [ 750.404204] [ T9870] #PF: error_code(0x0003) - permissions violation [ 750.404581] [ T9870] PGD 5ce01067 P4D 5ce01067 PUD 5ce02067 PMD 78aa063 PTE 80000000110a2021 [ 750.404969] [ T9870] Oops: Oops: 0003 [#1] SMP KASAN PTI [ 750.405394] [ T9870] CPU: 0 UID: 0 PID: 9870 Comm: xfs_io Kdump: loaded Tainted: G B 6.16.0-rc2-metze.02+ #1 PREEMPT(voluntary) [ 750.406510] [ T9870] Tainted: [B]=BAD_PAGE [ 750.406967] [ T9870] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 750.407440] [ T9870] RIP: 0010:smb_set_sge+0x15c/0x3b0 [cifs] [ 750.408065] [ T9870] Code: 48 83 f8 ff 0f 84 b0 00 00 00 48 ba 00 00 00 00 00 fc ff df 4c 89 e1 48 c1 e9 03 80 3c 11 00 0f 85 69 01 00 00 49 8d 7c 24 08 <49> 89 04 24 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f [ 750.409283] [ T9870] RSP: 0018:ffffc90005e2e758 EFLAGS: 00010246 [ 750.409803] [ T9870] RAX: ffff888036c53400 RBX: ffffc90005e2e878 RCX: 1ffff11002214400 [ 750.410323] [ T9870] RDX: dffffc0000000000 RSI: dffffc0000000000 RDI: ffff8880110a2008 [ 750.411217] [ T9870] RBP: ffffc90005e2e798 R08: 0000000000000001 R09: 0000000000000400 [ 750.411770] [ T9870] R10: ffff888011082800 R11: 0000000000000000 R12: ffff8880110a2000 [ 750.412325] [ T9870] R13: 0000000000000000 R14: ffffc90005e2e888 R15: ffff88801a4b6000 [ 750.412901] [ T9870] FS: 0000000000000000(0000) GS:ffff88812bc68000(0000) knlGS:0000000000000000 [ 750.413477] [ T9870] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 750.414077] [ T9870] CR2: ffff8880110a2000 CR3: 000000005b0a6005 CR4: 00000000000726f0 [ 750.414654] [ T9870] Call Trace: [ 750.415211] [ T9870] [ 750.415748] [ T9870] smbd_post_send_iter+0x1990/0x3070 [cifs] [ 750.416449] [ T9870] ? __pfx_smbd_post_send_iter+0x10/0x10 [cifs] [ 750.417128] [ T9870] ? update_stack_state+0x2a0/0x670 [ 750.417685] [ T9870] ? cifs_flush+0x153/0x320 [cifs] [ 750.418380] [ T9870] ? cifs_flush+0x153/0x320 [cifs] [ 750.419055] [ T9870] ? update_stack_state+0x2a0/0x670 [ 750.419624] [ T9870] smbd_send+0x58c/0x9c0 [cifs] [ 750.420297] [ T9870] ? __pfx_smbd_send+0x10/0x10 [cifs] [ 750.420936] [ T9870] ? unwind_get_return_address+0x65/0xb0 [ 750.421456] [ T9870] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 750.421954] [ T9870] ? arch_stack_walk+0xa7/0x100 [ 750.422460] [ T9870] ? stack_trace_save+0x92/0xd0 [ 750.422948] [ T9870] __smb_send_rqst+0x931/0xec0 [cifs] [ 750.423579] [ T9870] ? kernel_text_address+0x173/0x190 [ 750.424056] [ T9870] ? kasan_save_stack+0x39/0x70 [ 750.424813] [ T9870] ? kasan_save_track+0x18/0x70 [ 750.425323] [ T9870] ? __kasan_slab_alloc+0x9d/0xa0 [ 750.425831] [ T9870] ? __pfx___smb_send_rqst+0x10/0x10 [cifs] [ 750.426548] [ T9870] ? smb2_mid_entry_alloc+0xb4/0x7e0 [cifs] [ 750.427231] [ T9870] ? cifs_call_async+0x277/0xb00 [cifs] [ 750.427882] [ T9870] ? cifs_issue_write+0x256/0x610 [cifs] [ 750.428909] [ T9870] ? netfs_do_issue_write+0xc2/0x340 [netfs] [ 750.429425] [ T9870] ? netfs_advance_write+0x45b/0x1270 [netfs] [ 750.429882] [ T9870] ? netfs_write_folio+0xd6c/0x1be0 [netfs] [ 750.430345] [ T9870] ? netfs_writepages+0x2e9/0xa80 [netfs] [ 750.430809] [ T9870] ? do_writepages+0x21f/0x590 [ 750.431239] [ T9870] ? filemap_fdatawrite_wbc+0xe1/0x140 [ 750.431652] [ T9870] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 750.432041] [ T9870] smb_send_rqst+0x22e/0x2f0 [cifs] [ 750.432586] [ T9870] ? __pfx_smb_send_rqst+0x10/0x10 [cifs] [ 750.433108] [ T9870] ? local_clock_noinstr+0xe/0xd0 [ 750.433482] [ T9870] ? kasan_save_alloc_info+0x37/0x60 [ 750.433855] [ T9870] ? __kasan_check_write+0x14/0x30 [ 750.434214] [ T9870] ? _raw_spin_lock+0x81/0xf0 [ 750.434561] [ T9870] ? __pfx__raw_spin_lock+0x10/0x10 [ 750.434903] [ T9870] ? smb2_setup_async_request+0x293/0x580 [cifs] [ 750.435394] [ T9870] cifs_call_async+0x477/0xb00 [cifs] [ 750.435892] [ T9870] ? __pfx_smb2_writev_callback+0x10/0x10 [cifs] [ 750.436388] [ T9870] ? __pfx_cifs_call_async+0x10/0x10 [cifs] [ 750.436881] [ T9870] ? __pfx__raw_spin_lock+0x10/0x10 [ 750.437237] [ T9870] ? __kasan_check_write+0x14/0x30 [ 750.437579] [ T9870] ? __smb2_plain_req_init+0x933/0x1090 [cifs] [ 750.438062] [ T9870] smb2_async_writev+0x15ff/0x2460 [cifs] [ 750.438557] [ T9870] ? sched_clock_noinstr+0x9/0x10 [ 750.438906] [ T9870] ? local_clock_noinstr+0xe/0xd0 [ 750.439293] [ T9870] ? __pfx_smb2_async_writev+0x10/0x10 [cifs] [ 750.439786] [ T9870] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 750.440143] [ T9870] ? _raw_spin_unlock+0xe/0x40 [ 750.440495] [ T9870] ? cifs_pick_channel+0x242/0x370 [cifs] [ 750.440989] [ T9870] cifs_issue_write+0x256/0x610 [cifs] [ 750.441492] [ T9870] ? cifs_issue_write+0x256/0x610 [cifs] [ 750.441987] [ T9870] netfs_do_issue_write+0xc2/0x340 [netfs] [ 750.442387] [ T9870] netfs_advance_write+0x45b/0x1270 [netfs] [ 750.442969] [ T9870] ? rolling_buffer_append+0x12d/0x440 [netfs] [ 750.443376] [ T9870] netfs_write_folio+0xd6c/0x1be0 [netfs] [ 750.443768] [ T9870] ? __kasan_check_write+0x14/0x30 [ 750.444145] [ T9870] netfs_writepages+0x2e9/0xa80 [netfs] [ 750.444541] [ T9870] ? __pfx_netfs_writepages+0x10/0x10 [netfs] [ 750.444936] [ T9870] ? exit_files+0xab/0xe0 [ 750.445312] [ T9870] ? do_exit+0x148f/0x2980 [ 750.445672] [ T9870] ? do_group_exit+0xb5/0x250 [ 750.446028] [ T9870] ? arch_do_signal_or_restart+0x92/0x630 [ 750.446402] [ T9870] ? exit_to_user_mode_loop+0x98/0x170 [ 750.446762] [ T9870] ? do_syscall_64+0x2cf/0xd80 [ 750.447132] [ T9870] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 750.447499] [ T9870] do_writepages+0x21f/0x590 [ 750.447859] [ T9870] ? __pfx_do_writepages+0x10/0x10 [ 750.448236] [ T9870] filemap_fdatawrite_wbc+0xe1/0x140 [ 750.448595] [ T9870] __filemap_fdatawrite_range+0xba/0x100 [ 750.448953] [ T9870] ? __pfx___filemap_fdatawrite_range+0x10/0x10 [ 750.449336] [ T9870] ? __kasan_check_write+0x14/0x30 [ 750.449697] [ T9870] filemap_write_and_wait_range+0x7d/0xf0 [ 750.450062] [ T9870] cifs_flush+0x153/0x320 [cifs] [ 750.450592] [ T9870] filp_flush+0x107/0x1a0 [ 750.450952] [ T9870] filp_close+0x14/0x30 [ 750.451322] [ T9870] put_files_struct.part.0+0x126/0x2a0 [ 750.451678] [ T9870] ? __pfx__raw_spin_lock+0x10/0x10 [ 750.452033] [ T9870] exit_files+0xab/0xe0 [ 750.452401] [ T9870] do_exit+0x148f/0x2980 [ 750.452751] [ T9870] ? __pfx_do_exit+0x10/0x10 [ 750.453109] [ T9870] ? __kasan_check_write+0x14/0x30 [ 750.453459] [ T9870] ? _raw_spin_lock_irq+0x8a/0xf0 [ 750.453787] [ T9870] do_group_exit+0xb5/0x250 [ 750.454082] [ T9870] get_signal+0x22d3/0x22e0 [ 750.454406] [ T9870] ? __pfx_get_signal+0x10/0x10 [ 750.454709] [ T9870] ? fpregs_assert_state_consistent+0x68/0x100 [ 750.455031] [ T9870] ? folio_add_lru+0xda/0x120 [ 750.455347] [ T9870] arch_do_signal_or_restart+0x92/0x630 [ 750.455656] [ T9870] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 750.455967] [ T9870] exit_to_user_mode_loop+0x98/0x170 [ 750.456282] [ T9870] do_syscall_64+0x2cf/0xd80 [ 750.456591] [ T9870] ? __kasan_check_read+0x11/0x20 [ 750.456897] [ T9870] ? count_memcg_events+0x1b4/0x420 [ 750.457280] [ T9870] ? handle_mm_fault+0x148/0x690 [ 750.457616] [ T9870] ? _raw_spin_lock_irq+0x8a/0xf0 [ 750.457925] [ T9870] ? __kasan_check_read+0x11/0x20 [ 750.458297] [ T9870] ? fpregs_assert_state_consistent+0x68/0x100 [ 750.458672] [ T9870] ? irqentry_exit_to_user_mode+0x2e/0x250 [ 750.459191] [ T9870] ? irqentry_exit+0x43/0x50 [ 750.459600] [ T9870] ? exc_page_fault+0x75/0xe0 [ 750.460130] [ T9870] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 750.460570] [ T9870] RIP: 0033:0x7858c94ab6e2 [ 750.461206] [ T9870] Code: Unable to access opcode bytes at 0x7858c94ab6b8. [ 750.461780] [ T9870] RSP: 002b:00007858c9248ce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000022 [ 750.462327] [ T9870] RAX: fffffffffffffdfe RBX: 00007858c92496c0 RCX: 00007858c94ab6e2 [ 750.462653] [ T9870] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 750.462969] [ T9870] RBP: 00007858c9248d10 R08: 0000000000000000 R09: 0000000000000000 [ 750.463290] [ T9870] R10: 0000000000000000 R11: 0000000000000246 R12: fffffffffffffde0 [ 750.463640] [ T9870] R13: 0000000000000020 R14: 0000000000000002 R15: 00007ffc072d2230 [ 750.463965] [ T9870] [ 750.464285] [ T9870] Modules linked in: siw ib_uverbs ccm cmac nls_utf8 cifs cifs_arc4 nls_ucs2_utils rdma_cm iw_cm ib_cm ib_core cifs_md4 netfs softdog vboxsf vboxguest cpuid intel_rapl_msr intel_rapl_common intel_uncore_frequency_common intel_pmc_core pmt_telemetry pmt_class intel_pmc_ssram_telemetry intel_vsec polyval_clmulni ghash_clmulni_intel sha1_ssse3 aesni_intel rapl i2c_piix4 i2c_smbus joydev input_leds mac_hid sunrpc binfmt_misc kvm_intel kvm irqbypass sch_fq_codel efi_pstore nfnetlink vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vsock vmw_vmci dmi_sysfs ip_tables x_tables autofs4 hid_generic vboxvideo usbhid drm_vram_helper psmouse vga16fb vgastate drm_ttm_helper serio_raw hid ahci libahci ttm pata_acpi video wmi [last unloaded: vboxguest] [ 750.467127] [ T9870] CR2: ffff8880110a2000 cc: Tom Talpey cc: linux-cifs@vger.kernel.org Reviewed-by: David Howells Reviewed-by: Tom Talpey Fixes: c45ebd636c32 ("cifs: Provide the capability to extract from ITER_FOLIOQ to RDMA SGEs") Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 34331d7beed7576acfc98e991c39738b96162499 Author: zhangjian Date: Thu Jun 19 09:18:29 2025 +0800 smb: client: fix first command failure during re-negotiation after fabc4ed200f9, server_unresponsive add a condition to check whether client need to reconnect depending on server->lstrp. When client failed to reconnect for some time and abort connection, server->lstrp is updated for the last time. In the following scene, server->lstrp is too old. This cause next command failure in re-negotiation rather than waiting for re-negotiation done. 1. mount -t cifs -o username=Everyone,echo_internal=10 //$server_ip/export /mnt 2. ssh $server_ip "echo b > /proc/sysrq-trigger &" 3. ls /mnt 4. sleep 21s 5. ssh $server_ip "service firewalld stop" 6. ls # return EHOSTDOWN If the interval between 5 and 6 is too small, 6 may trigger sending negotiation request. Before backgrounding cifsd thread try to receive negotiation response from server in cifs_readv_from_socket, server_unresponsive may trigger cifs_reconnect which cause 6 to be failed: ls thread ---------------- smb2_negotiate server->tcpStatus = CifsInNegotiate compound_send_recv wait_for_compound_request cifsd thread ---------------- cifs_readv_from_socket server_unresponsive server->tcpStatus == CifsInNegotiate && jiffies > server->lstrp + 20s cifs_reconnect cifs_abort_connection: mid_state = MID_RETRY_NEEDED ls thread ---------------- cifs_sync_mid_result return EAGAIN smb2_negotiate return EHOSTDOWN Though server->lstrp means last server response time, it is updated in cifs_abort_connection and cifs_get_tcp_session. We can also update server->lstrp before switching into CifsInNegotiate state to avoid failure in 6. Fixes: 7ccc1465465d ("smb: client: fix hang in wait_for_response() for negproto") Acked-by: Paulo Alcantara (Red Hat) Acked-by: Meetakshi Setiya Signed-off-by: zhangjian Signed-off-by: Steve French commit f7301f856d351f068f807d0a3d442b85b2c6a01d Merge: 26fef998eb4df8 51a4598ad5d9eb Author: Linus Torvalds Date: Sat Jun 21 08:40:45 2025 -0700 Merge tag 'io_uring-6.16-20250621' of git://git.kernel.dk/linux Pull io_uring fix from Jens Axboe: "A single fix to hopefully wrap up the saga of receive bundles" * tag 'io_uring-6.16-20250621' of git://git.kernel.dk/linux: io_uring/net: always use current transfer count for buffer put commit 26fef998eb4df8781c038ffa4be8287219a8df0a Merge: f0eeb5f6f645d1 6fcab279154392 Author: Linus Torvalds Date: Sat Jun 21 08:27:12 2025 -0700 Merge tag 'acpi-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "Fix a crash in ACPICA while attempting to evaluate a control method that expects more arguments than are being passed to it, which was exposed by a defective firmware update from a prominent OEM on multiple systems (Rafael Wysocki)" * tag 'acpi-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPICA: Refuse to evaluate a method if arguments are missing commit f0eeb5f6f645d13446649b226b1dc026bab418ed Merge: afa3d8b6e01b46 bbf10cd686835d Author: Linus Torvalds Date: Sat Jun 21 08:21:10 2025 -0700 Merge tag 'pci-v6.16-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull PCI fixes from Bjorn Helgaas: - Set up runtime PM even for devices that lack a PM Capability as we did before 4d4c10f763d7 ("PCI: Explicitly put devices into D0 when initializing"), which broke resume in some VFIO scenarios (Mario Limonciello) - Ignore pciehp Presence Detect Changed events caused by DPC, even if they occur after a Data Link Layer State Changed event, to fix a VFIO GPU passthrough regression in v6.13 (Lukas Wunner) * tag 'pci-v6.16-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI: pciehp: Ignore belated Presence Detect Changed caused by DPC PCI/PM: Set up runtime PM even for devices without PCI PM commit afa3d8b6e01b4637d494bf1b1b8b531fddd1e452 Merge: 7c7f9dd1ea3fc6 33b6a1f155d627 Author: Linus Torvalds Date: Sat Jun 21 08:10:21 2025 -0700 Merge tag 'rcu/fixes-for-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux Pull RCU fix from Joel Fernandes: "We recently got a report of a crash [1] with misuse of call_rcu(). Instead of crashing the kernel, a warning and graceful return is better: - rcu: Return early if callback is not specified (Uladzislau Rezki)" Link: https://lore.kernel.org/all/aEnVuzK7VhGSizWj@pc636/ [1] * tag 'rcu/fixes-for-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux: rcu: Return early if callback is not specified commit 7c7f9dd1ea3fc6b175b7227bb473dc883b925548 Merge: 3f75bfff44be06 d222b6e6fb31e3 Author: Linus Torvalds Date: Sat Jun 21 07:59:45 2025 -0700 Merge tag 'perf-tools-fixes-for-v6.16-1-2025-06-20' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools fixes from Arnaldo Carvalho de Melo: - Fix some file descriptor leaks that stand out with recent changes to 'perf list' - Fix prctl include to fix building 'perf bench futex' hash with musl libc - Restrict 'perf test' uniquifying entry to machines with 'uncore_imc' PMUs - Document new output fields (op, cache, mem, dtlb, snoop) used with 'perf mem' - Synchronize kernel header copies * tag 'perf-tools-fixes-for-v6.16-1-2025-06-20' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: tools headers x86 cpufeatures: Sync with the kernel sources perf bench futex: Fix prctl include in musl libc perf test: Directory file descriptor leak perf evsel: Missed close() when probing hybrid core PMUs tools headers: Synchronize linux/bits.h with the kernel sources tools arch amd ibs: Sync ibs.h with the kernel sources tools arch x86: Sync the msr-index.h copy with the kernel sources tools headers: Syncronize linux/build_bug.h with the kernel sources tools headers: Update the copy of x86's mem{cpy,set}_64.S used in 'perf bench' tools headers UAPI: Sync linux/kvm.h with the kernel sources tools headers UAPI: Sync the drm/drm.h with the kernel sources perf beauty: Update copy of linux/socket.h with the kernel sources tools headers UAPI: Sync kvm header with the kernel sources tools headers x86 svm: Sync svm headers with the kernel sources tools headers UAPI: Sync KVM's vmx.h header with the kernel sources tools kvm headers arm64: Update KVM header from the kernel sources tools headers UAPI: Sync linux/prctl.h with the kernel sources to pick FUTEX knob perf mem: Document new output fields (op, cache, mem, dtlb, snoop) tools headers: Update the fs headers with the kernel sources perf test: Restrict uniquifying test to machines with 'uncore_imc' commit 714db279942b1fb9b97c4243e186825a96750239 Author: Shannon Nelson Date: Thu Jun 19 14:16:07 2025 -0700 CREDITS: Add entry for Shannon Nelson I'm retiring and have already had my name removed from MAINTAINERS. A couple of folks kindly suggested I should have an entry here. Signed-off-by: Shannon Nelson Reviewed-by: Simon Horman Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250619211607.1244217-1-sln@onemain.com Signed-off-by: Jakub Kicinski commit 0b39b055b5b48cbbdf5746a1ca6e3f6b0221e537 Author: Xiaowei Li Date: Fri Jun 20 10:27:02 2025 +0800 net: usb: qmi_wwan: add SIMCom 8230C composition Add support for SIMCom 8230C which is based on Qualcomm SDX35 chip. 0x9071: tty (DM) + tty (NMEA) + tty (AT) + rmnet T: Bus=01 Lev=01 Prnt=01 Port=05 Cnt=02 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1e0e ProdID=9071 Rev= 5.15 S: Manufacturer=SIMCOM S: Product=SDXBAAGHA-IDP _SN:D744C4C5 S: SerialNumber=0123456789ABCDEF C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=86(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=none E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms Signed-off-by: Xiaowei Li Acked-by: Bjørn Mork Link: https://patch.msgid.link/tencent_21D781FAA4969FEACA6ABB460362B52C9409@qq.com Signed-off-by: Jakub Kicinski commit 3f75bfff44be0646580fe4efda45d646f9c1693b Merge: a765b9e6db4082 6463cbe08b0cbf Author: Linus Torvalds Date: Fri Jun 20 22:36:48 2025 -0700 Merge tag 'mtd/fixes-for-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull mtd fixes from Miquel Raynal: "The main fix that really needs to get in is the revert of the patch adding the new mtd_master class, because it entirely fails the partitioning if a specific Kconfig option is set. We need to think how to handle that differently, so let's revert it as we need to get back to the pen and paper situation again. Otherwise the definition of some Winbond SPI NAND chips are receiving some fixes (geometry and maximum frequency, mostly). And finally a small memory leak gets also fixed" * tag 'mtd/fixes-for-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: mtd: spinand: fix memory leak of ECC engine conf mtd: spinand: winbond: Prevent unsupported frequencies on dual/quad I/O variants mtd: spinand: winbond: Increase maximum frequency on an octal operation mtd: spinand: winbond: Fix W35N number of planes/LUN Revert "mtd: core: always create master device" commit a765b9e6db4082eefe6e1581a9495518685e7abf Merge: 11313e2f78128c 2a8a5a5dd06eef Author: Linus Torvalds Date: Fri Jun 20 22:34:52 2025 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Two small and obvious driver fixes" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() commit a42b4dcc4f9f309a23e6de5ae57a680b9fd2ea10 Author: Julien Massot Date: Fri May 16 16:12:13 2025 +0200 dt-bindings: clock: mediatek: Add #reset-cells property for MT8188 The '#reset-cells' property is permitted for some of the MT8188 clock controllers, but not listed as a valid property. Fixes: 9a5cd59640ac ("dt-bindings: clock: mediatek: Add SMI LARBs reset for MT8188") Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Julien Massot Link: https://lore.kernel.org/r/20250516-dtb-check-mt8188-v2-1-fb60bef1b8e1@collabora.com Acked-by: Conor Dooley Signed-off-by: Stephen Boyd commit 64f7548aad63d2fbca2eeb6eb33361c218ebd5a5 Author: Arnd Bergmann Date: Fri Jun 20 21:19:40 2025 +0200 lib/crypto: sha256: Mark sha256_choose_blocks as __always_inline When the compiler chooses to not inline sha256_choose_blocks() in the purgatory code, it fails to link against the missing CPU specific version: x86_64-linux-ld: arch/x86/purgatory/purgatory.ro: in function `sha256_choose_blocks.part.0': sha256.c:(.text+0x6a6): undefined reference to `irq_fpu_usable' sha256.c:(.text+0x6c7): undefined reference to `sha256_blocks_arch' sha256.c:(.text+0x6cc): undefined reference to `sha256_blocks_simd' Mark this function as __always_inline to prevent this, same as sha256_finup(). Fixes: 5b90a779bc54 ("crypto: lib/sha256 - Add helpers for block-based shash") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250620191952.1867578-1-arnd@kernel.org Signed-off-by: Eric Biggers commit 3085ef9d9e7ab5ae4cddbe809e2e3b8dc11cdc75 Author: Shiji Yang Date: Wed Jun 18 23:07:43 2025 +0800 irqchip/ath79-misc: Fix missing prototypes warnings ath79_misc_irq_init() was defined but unused since commit 51fa4f8912c0 ("MIPS: ath79: drop legacy IRQ code"), so it's time to drop it. The build also warns about a missing prototype of get_c0_perfcount_int(). Remove the stale leftover function and add the missing include. Signed-off-by: Shiji Yang Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/OSBPR01MB167032D2017645200787AAEBBC72A@OSBPR01MB1670.jpnprd01.prod.outlook.com commit 33b6a1f155d627f5bd80c7485c598ce45428f74f Author: Uladzislau Rezki (Sony) Date: Tue Jun 10 19:34:48 2025 +0200 rcu: Return early if callback is not specified Currently the call_rcu() API does not check whether a callback pointer is NULL. If NULL is passed, rcu_core() will try to invoke it, resulting in NULL pointer dereference and a kernel crash. To prevent this and improve debuggability, this patch adds a check for NULL and emits a kernel stack trace to help identify a faulty caller. Signed-off-by: Uladzislau Rezki (Sony) Reviewed-by: Joel Fernandes Signed-off-by: Joel Fernandes commit 28224ef02b56fceee2c161fe2a49a0bb197e44f5 Author: Paolo Bonzini Date: Fri Jun 20 14:20:20 2025 -0400 KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities Allow userspace to advertise TDG.VP.VMCALL subfunctions that the kernel also supports. For each output register of GetTdVmCallInfo's leaf 1, add two fields to KVM_TDX_CAPABILITIES: one for kernel-supported TDVMCALLs (userspace can set those blindly) and one for user-supported TDVMCALLs (userspace can set those if it knows how to handle them). Signed-off-by: Paolo Bonzini commit 4580dbef5ce0f95a4bd8ac2d007bc4fbf1539332 Author: Paolo Bonzini Date: Fri Jun 20 13:28:08 2025 -0400 KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt Signed-off-by: Paolo Bonzini commit 25e8b1dd4883e6c251c3db5b347f3c8ae4ade921 Author: Binbin Wu Date: Tue Jun 10 10:14:21 2025 +0800 KVM: TDX: Exit to userspace for GetTdVmCallInfo Exit to userspace for TDG.VP.VMCALL via KVM_EXIT_TDX, to allow userspace to provide information about the support of TDVMCALLs when r12 is 1 for the TDVMCALLs beyond the GHCI base API. GHCI spec defines the GHCI base TDVMCALLs: , , , , <#VE.RequestMMIO>, , , and . They must be supported by VMM to support TDX guests. For GetTdVmCallInfo - When leaf (r12) to enumerate TDVMCALL functionality is set to 0, successful execution indicates all GHCI base TDVMCALLs listed above are supported. Update the KVM TDX document with the set of the GHCI base APIs. - When leaf (r12) to enumerate TDVMCALL functionality is set to 1, it indicates the TDX guest is querying the supported TDVMCALLs beyond the GHCI base TDVMCALLs. Exit to userspace to let userspace set the TDVMCALL sub-function bit(s) accordingly to the leaf outputs. KVM could set the TDVMCALL bit(s) supported by itself when the TDVMCALLs don't need support from userspace after returning from userspace and before entering guest. Currently, no such TDVMCALLs implemented, KVM just sets the values returned from userspace. Suggested-by: Paolo Bonzini Signed-off-by: Binbin Wu [Adjust userspace API. - Paolo] Signed-off-by: Paolo Bonzini commit cf207eac06f661fb692f405d5ab8230df884ee52 Author: Binbin Wu Date: Tue Jun 10 10:14:20 2025 +0800 KVM: TDX: Handle TDG.VP.VMCALL Handle TDVMCALL for GetQuote to generate a TD-Quote. GetQuote is a doorbell-like interface used by TDX guests to request VMM to generate a TD-Quote signed by a service hosting TD-Quoting Enclave operating on the host. A TDX guest passes a TD Report (TDREPORT_STRUCT) in a shared-memory area as parameter. Host VMM can access it and queue the operation for a service hosting TD-Quoting enclave. When completed, the Quote is returned via the same shared-memory area. KVM only checks the GPA from the TDX guest has the shared-bit set and drops the shared-bit before exiting to userspace to avoid bleeding the shared-bit into KVM's exit ABI. KVM forwards the request to userspace VMM (e.g. QEMU) and userspace VMM queues the operation asynchronously. KVM sets the return code according to the 'ret' field set by userspace to notify the TDX guest whether the request has been queued successfully or not. When the request has been queued successfully, the TDX guest can poll the status field in the shared-memory area to check whether the Quote generation is completed or not. When completed, the generated Quote is returned via the same buffer. Add KVM_EXIT_TDX as a new exit reason to userspace. Userspace is required to handle the KVM exit reason as the initial support for TDX, by reentering KVM to ensure that the TDVMCALL is complete. While at it, add a note that KVM_EXIT_HYPERCALL also requires reentry with KVM_RUN. Signed-off-by: Binbin Wu Tested-by: Mikko Ylinen Acked-by: Kai Huang [Adjust userspace API. - Paolo] Signed-off-by: Paolo Bonzini commit b5aafcb4efd2bdacbc37753cf807d69faa6a7304 Author: Binbin Wu Date: Tue Jun 10 10:14:19 2025 +0800 KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs Add the new TDVMCALL status code TDVMCALL_STATUS_SUBFUNC_UNSUPPORTED and return it for unimplemented TDVMCALL subfunctions. Returning TDVMCALL_STATUS_INVALID_OPERAND when a subfunction is not implemented is vague because TDX guests can't tell the error is due to the subfunction is not supported or an invalid input of the subfunction. New GHCI spec adds TDVMCALL_STATUS_SUBFUNC_UNSUPPORTED to avoid the ambiguity. Use it instead of TDVMCALL_STATUS_INVALID_OPERAND. Before the change, for common guest implementations, when a TDX guest receives TDVMCALL_STATUS_INVALID_OPERAND, it has two cases: 1. Some operand is invalid. It could change the operand to another value retry. 2. The subfunction is not supported. For case 1, an invalid operand usually means the guest implementation bug. Since the TDX guest can't tell which case is, the best practice for handling TDVMCALL_STATUS_INVALID_OPERAND is stopping calling such leaf, treating the failure as fatal if the TDVMCALL is essential or ignoring it if the TDVMCALL is optional. With this change, TDVMCALL_STATUS_SUBFUNC_UNSUPPORTED could be sent to old TDX guest that do not know about it, but it is expected that the guest will make the same action as TDVMCALL_STATUS_INVALID_OPERAND. Currently, no known TDX guest checks TDVMCALL_STATUS_INVALID_OPERAND specifically; for example Linux just checks for success. Signed-off-by: Binbin Wu [Return it for untrapped KVM_HC_MAP_GPA_RANGE. - Paolo] Signed-off-by: Paolo Bonzini commit 11313e2f78128c948e9b4eb58b3dacfc30964700 Merge: 299f489f5bad35 10af0273a35ab4 Author: Linus Torvalds Date: Fri Jun 20 10:07:56 2025 -0700 Merge tag 'gpio-fixes-for-v6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - correct the ACPI GPIO access mode in gpio-loongson-64bit - only obtain the interrupt for a single instance of the chip controlled by gpio-mlxbf3 - fix an invalid value return from probe() in gpio-pca953x - add missing MODULE_DEVICE_TABLE() to gpio-spacemit - update the HiSilicon GPIO driver maintainer entry * tag 'gpio-fixes-for-v6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: mlxbf3: only get IRQ for device instance 0 gpio: pca953x: fix wrong error probe return value gpio: spacemit: Add missing MODULE_DEVICE_TABLE gpio: loongson-64bit: Correct Loongson-7A2000 ACPI GPIO access mode MAINTAINERS: Update HiSilicon GPIO driver maintainer commit 2f3fc29ae86f4a4e91c74e066e49657443af7149 Merge: a09e359d434e07 2e7be162996640 Author: Paolo Bonzini Date: Fri Jun 20 13:07:24 2025 -0400 Merge tag 'kvm-riscv-fixes-6.16-1' of https://github.com/kvm-riscv/linux into HEAD KVM/riscv fixes for 6.16, take #1 - Fix the size parameter check in SBI SFENCE calls - Don't treat SBI HFENCE calls as NOPs commit a09e359d434e07941095503dbf21c280143857e4 Merge: e04c78d86a9699 04c5355b2a94ff Author: Paolo Bonzini Date: Fri Jun 20 13:07:10 2025 -0400 Merge tag 'kvmarm-fixes-6.16-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 6.16, take #3 - Fix another set of FP/SIMD/SVE bugs affecting NV, and plugging some missing synchronisation - A small fix for the irqbypass hook fixes, tightening the check and ensuring that we only deal with MSI for both the old and the new route entry - Rework the way the shadow LRs are addressed in a nesting configuration, plugging an embarrassing bug as well as simplifying the whole process - Add yet another fix for the dreaded arch_timer_edge_cases selftest commit 850f0e2433cdd38f36d80a4c1ab59f82029bef74 Author: Drew Fustini Date: Wed Jun 18 20:54:57 2025 -0700 MAINTAINERS: Update Drew Fustini's email address Switch from personal domain to kernel.org address. Signed-off-by: Drew Fustini Link: https://lore.kernel.org/r/20250619035457.331065-1-fustini@kernel.org Signed-off-by: Palmer Dabbelt commit 299f489f5bad3554531f67335d1762225448ff39 Merge: d41fef1ce2f3cd 33bdee12822d24 Author: Linus Torvalds Date: Fri Jun 20 09:59:20 2025 -0700 Merge tag 'sound-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes. All changes are device-specific at this time: - Fixes for Cirrus codecs with SoundWire, including firmware name updates - Fix for i.MX8 SoC DSP - Usual HD-audio, USB-audio, and ASoC AMD quirks - Fixes for legendary SoundBlaster AWE32 ISA device (a real one, we still got a bug report after 25 years) - Minor build fixes" * tag 'sound-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (24 commits) ALSA: hda/realtek: Enable headset Mic on Positivo P15X ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count ASoC: doc: cs35l56: Add CS35L63 to the list of supported devices ASoC: SOF: imx8: add core shutdown operation for imx8/imx8x ALSA: hda/realtek: Add quirk for Asus GA605K ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged ASoC: amd: yc: update quirk data for HP Victus ASoC: apple: mca: Drop default ARCH_APPLE in Kconfig ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic ASoC: doc: cs35l56: Update to add new SoundWire firmware filename suffix ASoC: cs35l56: Use SoundWire address as alternate firmware suffix on L56 B0 ASoC: cs35l56: Use SoundWire address as firmware name suffix for new silicon ASoC: sdw_utils: Fix potential NULL pointer deref in is_sdca_endpoint_present() ALSA: sb: Force to disable DMAs once when DMA mode is changed ALSA: sb: Don't allow changing the DMA mode during operations ALSA: hda/realtek: Add quirk for Asus GU605C ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx ALSA: ctxfi: Replace deprecated strcpy() with strscpy() ... commit d41fef1ce2f3cd9df128d2c3cf6d91ce15130daf Merge: 75f5f23f8787c5 39dfc971e42d88 Author: Linus Torvalds Date: Fri Jun 20 09:54:24 2025 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "There's nothing major (even the vmalloc one is just suppressing a potential warning) but all worth having, nonetheless. - Suppress KASAN false positive in stack unwinding code - Drop redundant reset of the GCS state on exec() - Don't try to descend into a !present PMD when creating a huge vmap() entry at the PUD level - Fix a small typo in the arm64 booting Documentation" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() arm64/gcs: Don't call gcs_free() during flush_gcs() arm64: Restrict pagetable teardown to avoid false warning docs: arm64: Fix ICC_SRE_EL2 register typo in booting.rst commit db0ff7e15923ffa7067874604ca275e92343f1b1 Author: Shuai Zhang Date: Mon Jun 9 18:55:00 2025 +0800 driver: bluetooth: hci_qca:fix unable to load the BT driver Some modules have BT_EN enabled via a hardware pull-up, meaning it is not defined in the DTS and is not controlled through the power sequence. In such cases, fall through to follow the legacy flow. Signed-off-by: Shuai Zhang Signed-off-by: Luiz Augusto von Dentz commit 042bb9603c44620dce98717a2d23235ca57a00d7 Author: Frédéric Danis Date: Thu Jun 12 09:50:34 2025 +0200 Bluetooth: L2CAP: Fix L2CAP MTU negotiation OBEX download from iPhone is currently slow due to small packet size used to transfer data which doesn't follow the MTU negotiated during L2CAP connection, i.e. 672 bytes instead of 32767: < ACL Data TX: Handle 11 flags 0x00 dlen 12 L2CAP: Connection Request (0x02) ident 18 len 4 PSM: 4103 (0x1007) Source CID: 72 > ACL Data RX: Handle 11 flags 0x02 dlen 16 L2CAP: Connection Response (0x03) ident 18 len 8 Destination CID: 14608 Source CID: 72 Result: Connection successful (0x0000) Status: No further information available (0x0000) < ACL Data TX: Handle 11 flags 0x00 dlen 27 L2CAP: Configure Request (0x04) ident 20 len 19 Destination CID: 14608 Flags: 0x0000 Option: Maximum Transmission Unit (0x01) [mandatory] MTU: 32767 Option: Retransmission and Flow Control (0x04) [mandatory] Mode: Enhanced Retransmission (0x03) TX window size: 63 Max transmit: 3 Retransmission timeout: 2000 Monitor timeout: 12000 Maximum PDU size: 1009 > ACL Data RX: Handle 11 flags 0x02 dlen 26 L2CAP: Configure Request (0x04) ident 72 len 18 Destination CID: 72 Flags: 0x0000 Option: Retransmission and Flow Control (0x04) [mandatory] Mode: Enhanced Retransmission (0x03) TX window size: 32 Max transmit: 255 Retransmission timeout: 0 Monitor timeout: 0 Maximum PDU size: 65527 Option: Frame Check Sequence (0x05) [mandatory] FCS: 16-bit FCS (0x01) < ACL Data TX: Handle 11 flags 0x00 dlen 29 L2CAP: Configure Response (0x05) ident 72 len 21 Source CID: 14608 Flags: 0x0000 Result: Success (0x0000) Option: Maximum Transmission Unit (0x01) [mandatory] MTU: 672 Option: Retransmission and Flow Control (0x04) [mandatory] Mode: Enhanced Retransmission (0x03) TX window size: 32 Max transmit: 255 Retransmission timeout: 2000 Monitor timeout: 12000 Maximum PDU size: 1009 > ACL Data RX: Handle 11 flags 0x02 dlen 32 L2CAP: Configure Response (0x05) ident 20 len 24 Source CID: 72 Flags: 0x0000 Result: Success (0x0000) Option: Maximum Transmission Unit (0x01) [mandatory] MTU: 32767 Option: Retransmission and Flow Control (0x04) [mandatory] Mode: Enhanced Retransmission (0x03) TX window size: 63 Max transmit: 3 Retransmission timeout: 2000 Monitor timeout: 12000 Maximum PDU size: 1009 Option: Frame Check Sequence (0x05) [mandatory] FCS: 16-bit FCS (0x01) ... > ACL Data RX: Handle 11 flags 0x02 dlen 680 Channel: 72 len 676 ctrl 0x0202 [PSM 4103 mode Enhanced Retransmission (0x03)] {chan 8} I-frame: Unsegmented TxSeq 1 ReqSeq 2 < ACL Data TX: Handle 11 flags 0x00 dlen 13 Channel: 14608 len 9 ctrl 0x0204 [PSM 4103 mode Enhanced Retransmission (0x03)] {chan 8} I-frame: Unsegmented TxSeq 2 ReqSeq 2 > ACL Data RX: Handle 11 flags 0x02 dlen 680 Channel: 72 len 676 ctrl 0x0304 [PSM 4103 mode Enhanced Retransmission (0x03)] {chan 8} I-frame: Unsegmented TxSeq 2 ReqSeq 3 The MTUs are negotiated for each direction. In this traces 32767 for iPhone->localhost and no MTU for localhost->iPhone, which based on '4.4 L2CAP_CONFIGURATION_REQ' (Core specification v5.4, Vol. 3, Part A): The only parameters that should be included in the L2CAP_CONFIGURATION_REQ packet are those that require different values than the default or previously agreed values. ... Any missing configuration parameters are assumed to have their most recently explicitly or implicitly accepted values. and '5.1 Maximum transmission unit (MTU)': If the remote device sends a positive L2CAP_CONFIGURATION_RSP packet it should include the actual MTU to be used on this channel for traffic flowing into the local device. ... The default value is 672 octets. is set by BlueZ to 672 bytes. It seems that the iPhone used the lowest negotiated value to transfer data to the localhost instead of the negotiated one for the incoming direction. This could be fixed by using the MTU negotiated for the other direction, if exists, in the L2CAP_CONFIGURATION_RSP. This allows to use segmented packets as in the following traces: < ACL Data TX: Handle 11 flags 0x00 dlen 12 L2CAP: Connection Request (0x02) ident 22 len 4 PSM: 4103 (0x1007) Source CID: 72 < ACL Data TX: Handle 11 flags 0x00 dlen 27 L2CAP: Configure Request (0x04) ident 24 len 19 Destination CID: 2832 Flags: 0x0000 Option: Maximum Transmission Unit (0x01) [mandatory] MTU: 32767 Option: Retransmission and Flow Control (0x04) [mandatory] Mode: Enhanced Retransmission (0x03) TX window size: 63 Max transmit: 3 Retransmission timeout: 2000 Monitor timeout: 12000 Maximum PDU size: 1009 > ACL Data RX: Handle 11 flags 0x02 dlen 26 L2CAP: Configure Request (0x04) ident 15 len 18 Destination CID: 72 Flags: 0x0000 Option: Retransmission and Flow Control (0x04) [mandatory] Mode: Enhanced Retransmission (0x03) TX window size: 32 Max transmit: 255 Retransmission timeout: 0 Monitor timeout: 0 Maximum PDU size: 65527 Option: Frame Check Sequence (0x05) [mandatory] FCS: 16-bit FCS (0x01) < ACL Data TX: Handle 11 flags 0x00 dlen 29 L2CAP: Configure Response (0x05) ident 15 len 21 Source CID: 2832 Flags: 0x0000 Result: Success (0x0000) Option: Maximum Transmission Unit (0x01) [mandatory] MTU: 32767 Option: Retransmission and Flow Control (0x04) [mandatory] Mode: Enhanced Retransmission (0x03) TX window size: 32 Max transmit: 255 Retransmission timeout: 2000 Monitor timeout: 12000 Maximum PDU size: 1009 > ACL Data RX: Handle 11 flags 0x02 dlen 32 L2CAP: Configure Response (0x05) ident 24 len 24 Source CID: 72 Flags: 0x0000 Result: Success (0x0000) Option: Maximum Transmission Unit (0x01) [mandatory] MTU: 32767 Option: Retransmission and Flow Control (0x04) [mandatory] Mode: Enhanced Retransmission (0x03) TX window size: 63 Max transmit: 3 Retransmission timeout: 2000 Monitor timeout: 12000 Maximum PDU size: 1009 Option: Frame Check Sequence (0x05) [mandatory] FCS: 16-bit FCS (0x01) ... > ACL Data RX: Handle 11 flags 0x02 dlen 1009 Channel: 72 len 1005 ctrl 0x4202 [PSM 4103 mode Enhanced Retransmission (0x03)] {chan 8} I-frame: Start (len 21884) TxSeq 1 ReqSeq 2 > ACL Data RX: Handle 11 flags 0x02 dlen 1009 Channel: 72 len 1005 ctrl 0xc204 [PSM 4103 mode Enhanced Retransmission (0x03)] {chan 8} I-frame: Continuation TxSeq 2 ReqSeq 2 This has been tested with kernel 5.4 and BlueZ 5.77. Cc: stable@vger.kernel.org Signed-off-by: Frédéric Danis Signed-off-by: Luiz Augusto von Dentz commit 89a33de314945c866b155d369f224fa552af1722 Author: Kiran K Date: Tue Jun 10 19:30:37 2025 +0530 Bluetooth: btintel_pcie: Fix potential race condition in firmware download During firmware download, if an error occurs, interrupts must be disabled, synchronized, and re-enabled before retrying the download. This change ensures proper interrupt handling to prevent race conditions. Signed-off-by: Chandrashekar Devegowda Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz commit 417b8af2e30d7f131682a893ad79c506fd39c624 Author: Gao Xiang Date: Fri Jun 20 23:31:08 2025 +0800 erofs: remove a superfluous check for encoded extents It is possible when an inode is split into segments for multi-threaded compression, and the tail extent of a segment could also be small. Fixes: 1d191b4ca51d ("erofs: implement encoded extent metadata") Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20250620153108.1368029-1-hsiangkao@linux.alibaba.com commit 51a4598ad5d9eb6be4ec9ba65bbfdf0ac302eb2e Author: Jens Axboe Date: Fri Jun 20 07:41:21 2025 -0600 io_uring/net: always use current transfer count for buffer put A previous fix corrected the retry condition for when to continue a current bundle, but it missed that the current (not the total) transfer count also applies to the buffer put. If not, then for incrementally consumed buffer rings repeated completions on the same request may end up over consuming. Reported-by: Roy Tang (ErgoniaTrading) Cc: stable@vger.kernel.org Fixes: 3a08988123c8 ("io_uring/net: only retry recv bundle for a full transfer") Link: https://github.com/axboe/liburing/issues/1423 Signed-off-by: Jens Axboe commit f8b53cc9174c5980549f60c972faad82b660b62d Author: Vitaly Kuznetsov Date: Fri Jun 20 13:16:07 2025 +0200 efi: Fix .data section size calculations when .sbat is present Commit 0f9a1739dd0e ("efi: zboot specific mechanism for embedding SBAT section") neglected to adjust the sizes of the .data section when CONFIG_EFI_SBAT_FILE is set. As the result, the produced PE binary is incorrect and some tools complain about it. E.g. 'sbsign' reports: # sbsign --key my.key --cert my.crt arch/arm64/boot/vmlinuz.efi warning: file-aligned section .data extends beyond end of file warning: checksum areas are greater than image size. Invalid section table? Note, '__data_size' is also used in the PE optional header and it is not entirely clear whether .sbat needs to be accounted as part of SizeOfInitializedData or not. As the header seems to be unused by the real world firmware, keeping the field equal to __data_size. Fixes: 0f9a1739dd0e ("efi: zboot specific mechanism for embedding SBAT section") Reported-by: Heinrich Schuchardt Signed-off-by: Vitaly Kuznetsov Signed-off-by: Ard Biesheuvel commit 33bdee12822d240caaa01aeac231eac42182fd64 Author: Edson Juliano Drosdeck Date: Thu Jun 19 16:12:15 2025 -0300 ALSA: hda/realtek: Enable headset Mic on Positivo P15X Positivo P15X is equipped with ALC269VC, and needs a fix to make the headset mic to work. Also must to limits the internal microphone boost. Signed-off-by: Edson Juliano Drosdeck Link: https://patch.msgid.link/20250619191215.17203-1-edson.drosdeck@gmail.com Signed-off-by: Takashi Iwai commit 721385192415b6e9979454cdb08d67e2ded684d6 Merge: 60599e4f8a041d 16ea4666bbb7f5 Author: Takashi Iwai Date: Fri Jun 20 09:58:57 2025 +0200 Merge tag 'asoc-fix-v6.16-rc2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.16 A relatively large collection of fixes and updates that came in since the merge window. Of note are a couple of Cirrus ones which change the firmware naming for some newly added devices, and a fix from Laurentiu for issues booting firmwares on the DSPs on i.MX8 SoCs. commit a8905238c3bbe13db90065ed74682418f23830c3 Author: Akira Inoue Date: Thu Jun 12 13:34:38 2025 +0900 HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 Add "Thinkpad X1 Tablet Gen 2 Keyboard" PID to hid-lenovo driver to fix trackpoint not working issue. Signed-off-by: Akira Inoue Signed-off-by: Jiri Kosina commit 4540e41e753a7d69ecd3f5bad51fe620205c3a18 Author: Qasim Ijaz Date: Sun Jun 15 23:59:41 2025 +0100 HID: appletb-kbd: fix "appletb_backlight" backlight device reference counting During appletb_kbd_probe, probe attempts to get the backlight device by name. When this happens backlight_device_get_by_name looks for a device in the backlight class which has name "appletb_backlight" and upon finding a match it increments the reference count for the device and returns it to the caller. However this reference is never released leading to a reference leak. Fix this by decrementing the backlight device reference count on removal via put_device and on probe failure. Fixes: 93a0fc489481 ("HID: hid-appletb-kbd: add support for automatic brightness control while using the touchbar") Cc: stable@vger.kernel.org Signed-off-by: Qasim Ijaz Reviewed-by: Aditya Garg Signed-off-by: Jiri Kosina commit 75f5f23f8787c5e184fcb2fbcd02d8e9317dc5e7 Merge: 255da9b8d761c2 8c847285588435 Author: Linus Torvalds Date: Thu Jun 19 23:29:35 2025 -0700 Merge tag 'block-6.16-20250619' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: - Two fixes for aoe which fixes issues dating back to when this driver was converted to blk-mq - Fix for ublk, checking for valid queue depth and count values before setting up a device * tag 'block-6.16-20250619' of git://git.kernel.dk/linux: ublk: santizize the arguments from userspace when adding a device aoe: defer rexmit timer downdev work to workqueue aoe: clean device rq_list in aoedev_downdev() commit 255da9b8d761c20dbdca3ff2c96635d50a9f1fb8 Merge: 5f2b6c5f6b692c e1c75831f682ee Author: Linus Torvalds Date: Thu Jun 19 23:25:28 2025 -0700 Merge tag 'io_uring-6.16-20250619' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: - Two fixes for error injection failures. One fixes a task leak issue introduced in this merge window, the other an older issue with handling allocation of a mapped buffer. - Fix for a syzbot issue that triggers a kmalloc warning on attempting an allocation that's too large - Fix for an error injection failure causing a double put of a task, introduced in this merge window * tag 'io_uring-6.16-20250619' of git://git.kernel.dk/linux: io_uring: fix potential page leak in io_sqe_buffer_register() io_uring/sqpoll: don't put task_struct on tctx setup failure io_uring: remove duplicate io_uring_alloc_task_context() definition io_uring: fix task leak issue in io_wq_create() io_uring/rsrc: validate buffer count with offset for cloning commit 5f2b6c5f6b692c696a232d12c43b8e41c0d393b9 Merge: 0fa5248255a1f4 b8de9b21e8499a Author: Linus Torvalds Date: Thu Jun 19 23:18:59 2025 -0700 Merge tag 'drm-fixes-2025-06-20' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Bit of an uptick in fixes for rc3, msm and amdgpu leading the way, with i915/xe/nouveau with a few each and then some scattered misc bits, nothing looks too crazy: msm: - Display: - Fixed DP output on SDM845 - Fixed 10nm DSI PLL init - GPU: - SUBMIT ioctl error path leak fixes - drm half of stall-on-fault fixes - a7xx: Missing CP_RESET_CONTEXT_STATE - Skip GPU component bind if GPU is not in the device table i915: - Fix MIPI vtotal programming off by one on Broxton - Fix PMU code for GCOV and AutoFDO enabled build xe: - A workaround update - Fix memset on iomem - Fix early wedge on GuC Load failure amdgpu: - DP tunneling fix - LTTPR fix - DSC fix - DML2.x ABGR16161616 fix - RMCM fix - Backlight fixes - GFX11 kicker support - SDMA reset fixes - VCN 5.0.1 fix - Reset fix - Misc small fixes amdkfd: - SDMA reset fix - Fix race in GWS scheduling nouveau: - update docs reference - fix backlight name buffer size - fix UAF in r535 gsp rpc msg - fix undefined shift mgag200: - drop export header ast: - drop export header malidp: - drop informational error ssd130x: - fix clear columns etnaviv: - scheduler locking fix v3d: - null pointer crash fix" * tag 'drm-fixes-2025-06-20' of https://gitlab.freedesktop.org/drm/kernel: (50 commits) drm/xe: Fix early wedge on GuC load failure drm/xe: Fix memset on iomem drm/xe/bmg: Update Wa_16023588340 drm/amdgpu/sdma5.2: init engine reset mutex drm/amdkfd: Fix race in GWS queue scheduling drm/amdgpu/sdma5: init engine reset mutex drm/amdgpu: switch job hw_fence to amdgpu_fence drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences drm/amdgpu: Release reset locks during failures drm/amd/display: Check dce_hwseq before dereferencing it drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause drm/amdgpu: Use logical instance ID for SDMA v4_4_2 queue operations drm/amdgpu: Fix SDMA engine reset with logical instance ID drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 drm/amdgpu: Add kicker device detection drm/amd/display: Export full brightness range to userspace drm/amd/display: Only read ACPI backlight caps once drm/amd/display: Fix RMCM programming seq errors drm/amd/display: Fix mpv playback corruption on weston drm/amd/display: Add more checks for DSC / HUBP ONO guarantees ... commit 0fa5248255a1f4cc87f35610f2762d9cdd919246 Merge: 41687a5c6f8b07 df29f60369ccec Author: Linus Torvalds Date: Thu Jun 19 23:15:10 2025 -0700 Merge tag 'v6.16-p5' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: "This fixes a regression in ahash (broken fallback finup) and reinstates a Kconfig option to control the extra self-tests" * tag 'v6.16-p5' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: ahash - Fix infinite recursion in ahash_def_finup crypto: testmgr - reinstate kconfig control over full self-tests commit c742d127d2d831aa83ae2987a508bca2bf0c7736 Author: Lorenzo Stoakes Date: Tue Jun 17 15:41:30 2025 +0100 MAINTAINERS: add additional mmap-related files to mmap section msync and nommu are directly related to memory mapping, mincore is less so but all are roughly speaking operating on virtual memory mappings from the point of view of the user so this seems the most appropriate place for them. Link: https://lkml.kernel.org/r/20250617144130.147847-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Pedro Falcato Acked-by: Liam R. Howlett Acked-by: Vlastimil Babka Cc: David Hildenbrand Cc: Jann Horn Signed-off-by: Andrew Morton commit db5921ab8aa23142b277325192a7443601dc4534 Author: Lorenzo Stoakes Date: Tue Jun 17 17:13:59 2025 +0100 MAINTAINERS: add memfd, shmem quota files to shmem section These files seem best suited to shmem. Link: https://lkml.kernel.org/r/20250617161359.166955-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Cc: Baolin Wang Cc: Hugh Dickins Signed-off-by: Andrew Morton commit a1540dcbe0246c42ee271a3b7bba5ec7c933321a Author: Lorenzo Stoakes Date: Tue Jun 17 17:51:42 2025 +0100 MAINTAINERS: add stray rmap file to mm rmap section page_vma_mapped_walk() is used to traverse page tables from a VMA, used by rmap logic once the reverse mapping has been traversed to the VMA level. It is also used by other users (migration, damon, etc.) but is primarily used by the reverse mapping and is a key part of its logic, so it seems appropriate to place it here. Link: https://lkml.kernel.org/r/20250617165142.173716-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: Liam R. Howlett Acked-by: David Hildenbrand Acked-by: Vlastimil Babka Cc: Rik van Riel Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit d91b00b687abf6fef13be030abd848416f320149 Author: Lorenzo Stoakes Date: Tue Jun 17 18:15:38 2025 +0100 MAINTAINERS: add hugetlb_cgroup.c to hugetlb section This file is clearly specific to hugetlb so this seems the most appropriate place for it. Link: https://lkml.kernel.org/r/20250617171538.178042-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Cc: Muchun Song Cc: Oscar Salvador Signed-off-by: Andrew Morton commit b6d19f3742ff3429d8eb2cdf51a8ab598c197ee5 Author: Lorenzo Stoakes Date: Tue Jun 17 18:45:38 2025 +0100 MAINTAINERS: add further init files to mm init block These files comprise the bootmem info logic which is initialised on startup and also memory tests that are run on startup and as such this seems the most appropriate section for them. Link: https://lkml.kernel.org/r/20250617174538.188977-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Mike Rapoport (Microsoft) Signed-off-by: Andrew Morton commit 883cf5b0b8389610f17106c454180c7f54b8d486 Author: Oscar Salvador Date: Tue Jun 17 20:59:10 2025 +0200 MAINTAINERS: update maintainers for HugeTLB Change my role to Maintainer as I am quite involved in HugeTLB development, and will be more so with the upcoming HugetLB-pagewalk unification, so I would like to help Munchun take care of the code. Besides, having two people will help in offloading some pressure. Also add David as a Reviewer since he has quite some knowledge in the field and has already provided valuable feedback. Link: https://lkml.kernel.org/r/20250617185910.471406-1-osalvador@suse.de Signed-off-by: Oscar Salvador Acked-by: David Hildenbrand Acked-by: Vlastimil Babka Acked-by: Muchun Song Cc: Michal Hocko Cc: Peter Xu Signed-off-by: Andrew Morton commit fba46a5d83ca8decb338722fb4899026d8d9ead2 Author: Liam R. Howlett Date: Mon Jun 16 14:45:20 2025 -0400 maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() Temporarily clear the preallocation flag when explicitly requesting allocations. Pre-existing allocations are already counted against the request through mas_node_count_gfp(), but the allocations will not happen if the MA_STATE_PREALLOC flag is set. This flag is meant to avoid re-allocating in bulk allocation mode, and to detect issues with preallocation calculations. The MA_STATE_PREALLOC flag should also always be set on zero allocations so that detection of underflow allocations will print a WARN_ON() during consumption. User visible effect of this flaw is a WARN_ON() followed by a null pointer dereference when subsequent requests for larger number of nodes is ignored, such as the vma merge retry in mmap_region() caused by drivers altering the vma flags (which happens in v6.6, at least) Link: https://lkml.kernel.org/r/20250616184521.3382795-3-Liam.Howlett@oracle.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett Reported-by: Zhaoyang Huang Reported-by: Hailong Liu Link: https://lore.kernel.org/all/1652f7eb-a51b-4fee-8058-c73af63bacd1@oppo.com/ Link: https://lore.kernel.org/all/20250428184058.1416274-1-Liam.Howlett@oracle.com/ Link: https://lore.kernel.org/all/20250429014754.1479118-1-Liam.Howlett@oracle.com/ Cc: Lorenzo Stoakes Cc: Suren Baghdasaryan Cc: Hailong Liu Cc: zhangpeng.00@bytedance.com Cc: Steve Kang Cc: Matthew Wilcox Cc: Sidhartha Kumar Cc: Signed-off-by: Andrew Morton commit 40ffd2887635c492b758d8b02172c97f5d42f593 Author: Lorenzo Stoakes Date: Mon Jun 16 21:08:44 2025 +0100 MAINTAINERS: add missing test files to mm gup section We previously overlooked GUP test files that sensibly should belong to the GUP section, include them now. Link: https://lkml.kernel.org/r/20250616200844.560225-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: David Hildenbrand Reviewed-by: John Hubbard Cc: Jason Gunthorpe Cc: Peter Xu Signed-off-by: Andrew Morton commit 38103247777695ca2b09691b2247e66f157908c6 Author: Lorenzo Stoakes Date: Mon Jun 16 21:16:43 2025 +0100 MAINTAINERS: add missing mm/workingset.c file to mm reclaim section The working set logic belongs very much to the reclaim section and is otherwise not assigned to any other MAINTAINERS section so add it here. Link: https://lkml.kernel.org/r/20250616201643.561626-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: David Hildenbrand Acked-by: Shakeel Butt Acked-by: Qi Zheng Cc: Johannes Weiner Cc: Michal Hocko Signed-off-by: Andrew Morton commit 3333871296efd52ef6f6d5cce5a92dc7b06ba879 Author: Pedro Falcato Date: Tue Jun 10 13:22:09 2025 +0100 selftests/mm: skip uprobe vma merge test if uprobes are not enabled If uprobes are not enabled, the test currently fails with: 7151 12:46:54.627936 # # # RUN merge.handle_uprobe_upon_merged_vma ... 7152 12:46:54.639014 # # f /sys/bus/event_source/devices/uprobe/type 7153 12:46:54.639306 # # fopen: No such file or directory 7154 12:46:54.650451 # # # merge.c:473:handle_uprobe_upon_merged_vma:Expected read_sysfs("/sys/bus/event_source/devices/uprobe/type", &type) (1) == 0 (0) 7155 12:46:54.650730 # # # handle_uprobe_upon_merged_vma: Test terminated by assertion 7156 12:46:54.661750 # # # FAIL merge.handle_uprobe_upon_merged_vma 7157 12:46:54.662030 # # not ok 8 merge.handle_uprobe_upon_merged_vma Skipping is a more sane and friendly behavior here. Link: https://lkml.kernel.org/r/20250610122209.3177587-1-pfalcato@suse.de Fixes: efe99fabeb11 ("selftests/mm: add test about uprobe pte be orphan during vma merge") Signed-off-by: Pedro Falcato Reported-by: Aishwarya Closes: https://lore.kernel.org/linux-mm/20250610103729.72440-1-aishwarya.tcv@arm.com/ Reviewed-by: Lorenzo Stoakes Tested-by : Donet Tom Reviewed-by : Donet Tom Reviewed-by: Dev Jain Reviewed-by: Pu Lehui Cc: Jann Horn Cc: Liam Howlett Cc: Mark Brown Cc: Shuah Khan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 95b2e31e1752494d477c5da89d6789f769b0d67b Author: Kuan-Wei Chiu Date: Sun Jun 15 04:23:53 2025 +0800 bcache: remove unnecessary select MIN_HEAP After reverting the transition to the generic min heap library, bcache no longer depends on MIN_HEAP. The select entry can be removed to reduce code size and shrink the kernel's attack surface. This change effectively reverts the bcache-related part of commit 92a8b224b833 ("lib/min_heap: introduce non-inline versions of min heap API functions"). This is part of a series of changes to address a performance regression caused by the use of the generic min_heap implementation. As reported by Robert, bcache now suffers from latency spikes, with P100 (max) latency increasing from 600 ms to 2.4 seconds every 5 minutes. These regressions degrade bcache's effectiveness as a low-latency cache layer and lead to frequent timeouts and application stalls in production environments. Link: https://lore.kernel.org/lkml/CAJhEC05+0S69z+3+FB2Cd0hD+pCRyWTKLEOsc8BOmH73p1m+KQ@mail.gmail.com Link: https://lkml.kernel.org/r/20250614202353.1632957-4-visitorckw@gmail.com Fixes: 866898efbb25 ("bcache: remove heap-related macros and switch to generic min_heap") Fixes: 92a8b224b833 ("lib/min_heap: introduce non-inline versions of min heap API functions") Signed-off-by: Kuan-Wei Chiu Reported-by: Robert Pang Closes: https://lore.kernel.org/linux-bcache/CAJhEC06F_AtrPgw2-7CvCqZgeStgCtitbD-ryuPpXQA-JG5XXw@mail.gmail.com Acked-by: Coly Li Cc: Ching-Chun (Jim) Huang Cc: Kent Overstreet Cc: Signed-off-by: Andrew Morton commit 48fd7ebe00c1cdc782b42576548b25185902f64c Author: Kuan-Wei Chiu Date: Sun Jun 15 04:23:52 2025 +0800 Revert "bcache: remove heap-related macros and switch to generic min_heap" This reverts commit 866898efbb25bb44fd42848318e46db9e785973a. The generic bottom-up min_heap implementation causes performance regression in invalidate_buckets_lru(), a hot path in bcache. Before the cache is fully populated, new_bucket_prio() often returns zero, leading to many equal comparisons. In such cases, bottom-up sift_down performs up to 2 * log2(n) comparisons, while the original top-down approach completes with just O() comparisons, resulting in a measurable performance gap. The performance degradation is further worsened by the non-inlined min_heap API functions introduced in commit 92a8b224b833 ("lib/min_heap: introduce non-inline versions of min heap API functions"), adding function call overhead to this critical path. As reported by Robert, bcache now suffers from latency spikes, with P100 (max) latency increasing from 600 ms to 2.4 seconds every 5 minutes. These regressions degrade bcache's effectiveness as a low-latency cache layer and lead to frequent timeouts and application stalls in production environments. This revert aims to restore bcache's original low-latency behavior. Link: https://lore.kernel.org/lkml/CAJhEC05+0S69z+3+FB2Cd0hD+pCRyWTKLEOsc8BOmH73p1m+KQ@mail.gmail.com Link: https://lkml.kernel.org/r/20250614202353.1632957-3-visitorckw@gmail.com Fixes: 866898efbb25 ("bcache: remove heap-related macros and switch to generic min_heap") Fixes: 92a8b224b833 ("lib/min_heap: introduce non-inline versions of min heap API functions") Signed-off-by: Kuan-Wei Chiu Reported-by: Robert Pang Closes: https://lore.kernel.org/linux-bcache/CAJhEC06F_AtrPgw2-7CvCqZgeStgCtitbD-ryuPpXQA-JG5XXw@mail.gmail.com Acked-by: Coly Li Cc: Ching-Chun (Jim) Huang Cc: Kent Overstreet Cc: Signed-off-by: Andrew Morton commit 845f1f2d69f3f49b3d8c142265952c8257e3368c Author: Kuan-Wei Chiu Date: Sun Jun 15 04:23:51 2025 +0800 Revert "bcache: update min_heap_callbacks to use default builtin swap" Patch series "bcache: Revert min_heap migration due to performance regression". This patch series reverts the migration of bcache from its original heap implementation to the generic min_heap library. While the original change aimed to simplify the code and improve maintainability, it introduced a severe performance regression in real-world scenarios. As reported by Robert, systems using bcache now suffer from periodic latency spikes, with P100 (max) latency increasing from 600 ms to 2.4 seconds every 5 minutes. This degrades bcache's value as a low-latency caching layer, and leads to frequent timeouts and application stalls in production environments. The primary cause of this regression is the behavior of the generic min_heap implementation's bottom-up sift_down, which performs up to 2 * log2(n) comparisons when many elements are equal. The original top-down variant used by bcache only required O(1) comparisons in such cases. The issue was further exacerbated by commit 92a8b224b833 ("lib/min_heap: introduce non-inline versions of min heap API functions"), which introduced non-inlined versions of the min_heap API, adding function call overhead to a performance-critical hot path. This patch (of 3): This reverts commit 3d8a9a1c35227c3f1b0bd132c9f0a80dbda07b65. Although removing the custom swap function simplified the code, this change is part of a broader migration to the generic min_heap API that introduced significant performance regressions in bcache. As reported by Robert, bcache now suffers from latency spikes, with P100 (max) latency increasing from 600 ms to 2.4 seconds every 5 minutes. These regressions degrade bcache's effectiveness as a low-latency cache layer and lead to frequent timeouts and application stalls in production environments. This revert is part of a series of changes to restore previous performance by undoing the min_heap transition. Link: https://lkml.kernel.org/r/20250614202353.1632957-1-visitorckw@gmail.com Link: https://lore.kernel.org/lkml/CAJhEC05+0S69z+3+FB2Cd0hD+pCRyWTKLEOsc8BOmH73p1m+KQ@mail.gmail.com Link: https://lkml.kernel.org/r/20250614202353.1632957-2-visitorckw@gmail.com Fixes: 866898efbb25 ("bcache: remove heap-related macros and switch to generic min_heap") Fixes: 92a8b224b833 ("lib/min_heap: introduce non-inline versions of min heap API functions") Signed-off-by: Kuan-Wei Chiu Reported-by: Robert Pang Closes: https://lore.kernel.org/linux-bcache/CAJhEC06F_AtrPgw2-7CvCqZgeStgCtitbD-ryuPpXQA-JG5XXw@mail.gmail.com Acked-by: Coly Li Cc: Ching-Chun (Jim) Huang Cc: Kent Overstreet Cc: Signed-off-by: Andrew Morton commit 223731cd63004cb07edfc6257d53565995c00cbb Author: Dev Jain Date: Fri Jun 13 09:19:12 2025 +0530 selftests/mm: add configs to fix testcase failure If CONFIG_UPROBES is not set, a merge subtest fails: Failure log: 7151 12:46:54.627936 # # # RUN merge.handle_uprobe_upon_merged_vma ... 7152 12:46:54.639014 # # f /sys/bus/event_source/devices/uprobe/type 7153 12:46:54.639306 # # fopen: No such file or directory 7154 12:46:54.650451 # # # merge.c:473:handle_uprobe_upon_merged_vma:Expected read_sysfs("/sys/bus/event_source/devices/uprobe/type", &type) (1) == 0 (0) 7155 12:46:54.650730 # # # handle_uprobe_upon_merged_vma: Test terminated by assertion 7156 12:46:54.661750 # # # FAIL merge.handle_uprobe_upon_merged_vma 7157 12:46:54.662030 # # not ok 8 merge.handle_uprobe_upon_merged_vma CONFIG_UPROBES is enabled by CONFIG_UPROBE_EVENTS, which gets enabled by CONFIG_FTRACE. Therefore add these configs to selftests/mm/config so that CI systems can include this config in the kernel build. To be completely safe, add CONFIG_PROFILING too, to enable the dependency chain PROFILING -> PERF_EVENTS -> UPROBE_EVENTS -> UPROBES. Link: https://lkml.kernel.org/r/20250613034912.53791-1-dev.jain@arm.com Fixes: efe99fabeb11 ("selftests/mm: add test about uprobe pte be orphan during vma merge") Signed-off-by: Dev Jain Reported-by: Aishwarya Closes: https://lore.kernel.org/all/20250610103729.72440-1-aishwarya.tcv@arm.com/ Tested-by: Aishwarya TCV Tested-by : Donet Tom Reviewed-by: Lorenzo Stoakes Reviewed-by: Anshuman Khandual Reviewed-by: Mark Brown Reviewed-by: Donet Tom Reviewed-by: Pedro Falcato Cc: Jann Horn Cc: Liam Howlett Cc: Pu Lehui Cc: Ryan Roberts Cc: Shuah Khan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 12b9a2c05d1b474518b0f5fac4a50b7f93b16930 Author: Pratyush Yadav Date: Thu Jun 5 19:11:41 2025 +0200 kho: initialize tail pages for higher order folios properly Currently, when restoring higher order folios, kho_restore_folio() only calls prep_compound_page() on all the pages. That is not enough to properly initialize the folios. The managed page count does not get updated, the reserved flag does not get dropped, and page count does not get initialized properly. Restoring a higher order folio with it results in the following BUG with CONFIG_DEBUG_VM when attempting to free the folio: BUG: Bad page state in process test pfn:104e2b page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffffffffffffffff pfn:0x104e2b flags: 0x2fffff80000000(node=0|zone=2|lastcpupid=0x1fffff) raw: 002fffff80000000 0000000000000000 00000000ffffffff 0000000000000000 raw: ffffffffffffffff 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: nonzero _refcount [...] Call Trace: dump_stack_lvl+0x4b/0x70 bad_page.cold+0x97/0xb2 __free_frozen_pages+0x616/0x850 [...] Combine the path for 0-order and higher order folios, initialize the tail pages with a count of zero, and call adjust_managed_page_count() to account for all the pages instead of just missing them. In addition, since all the KHO-preserved pages get marked with MEMBLOCK_RSRV_NOINIT by deserialize_bitmap(), the reserved flag is not actually set (as can also be seen from the flags of the dumped page in the logs above). So drop the ClearPageReserved() calls. [ptyadav@amazon.de: declare i in the loop instead of at the top] Link: https://lkml.kernel.org/r/20250613125916.39272-1-pratyush@kernel.org Link: https://lkml.kernel.org/r/20250605171143.76963-1-pratyush@kernel.org Fixes: fc33e4b44b27 ("kexec: enable KHO support for memory preservation") Signed-off-by: Pratyush Yadav Reviewed-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: Baoquan He Cc: Changyuan Lyu Signed-off-by: Andrew Morton commit 417d145c2e71ad7362200ede6e8afdfc6e56c4fb Author: Pratyush Yadav Date: Fri Jun 13 15:19:14 2025 +0200 MAINTAINERS: add linux-mm@ list to Kexec Handover Along with kexec, KHO also has parts dealing with memory management, like page/folio initialization, memblock, and preserving/unpreserving memory for next kernel. Copy linux-mm@ to KHO patches so the right set of eyes can look at changes to those parts. Link: https://lkml.kernel.org/r/20250613131917.4488-1-pratyush@kernel.org Signed-off-by: Pratyush Yadav Reviewed-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Acked-by: SeongJae Park Cc: Alexander Graf Cc: Baoquan He Cc: Changyuan Lyu Signed-off-by: Andrew Morton commit 0ea148a799198518d8ebab63ddd0bb6114a103bc Author: Kairui Song Date: Wed Jun 4 23:10:38 2025 +0800 mm: userfaultfd: fix race of userfaultfd_move and swap cache This commit fixes two kinds of races, they may have different results: Barry reported a BUG_ON in commit c50f8e6053b0, we may see the same BUG_ON if the filemap lookup returned NULL and folio is added to swap cache after that. If another kind of race is triggered (folio changed after lookup) we may see RSS counter is corrupted: [ 406.893936] BUG: Bad rss-counter state mm:ffff0000c5a9ddc0 type:MM_ANONPAGES val:-1 [ 406.894071] BUG: Bad rss-counter state mm:ffff0000c5a9ddc0 type:MM_SHMEMPAGES val:1 Because the folio is being accounted to the wrong VMA. I'm not sure if there will be any data corruption though, seems no. The issues above are critical already. On seeing a swap entry PTE, userfaultfd_move does a lockless swap cache lookup, and tries to move the found folio to the faulting vma. Currently, it relies on checking the PTE value to ensure that the moved folio still belongs to the src swap entry and that no new folio has been added to the swap cache, which turns out to be unreliable. While working and reviewing the swap table series with Barry, following existing races are observed and reproduced [1]: In the example below, move_pages_pte is moving src_pte to dst_pte, where src_pte is a swap entry PTE holding swap entry S1, and S1 is not in the swap cache: CPU1 CPU2 userfaultfd_move move_pages_pte() entry = pte_to_swp_entry(orig_src_pte); // Here it got entry = S1 ... < interrupted> ... // folio A is a new allocated folio // and get installed into src_pte // src_pte now points to folio A, S1 // has swap count == 0, it can be freed // by folio_swap_swap or swap // allocator's reclaim. // folio B is a folio in another VMA. // S1 is freed, folio B can use it // for swap out with no problem. ... folio = filemap_get_folio(S1) // Got folio B here !!! ... < interrupted again> ... // Now S1 is free to be used again. // Now src_pte is a swap entry PTE // holding S1 again. folio_trylock(folio) move_swap_pte double_pt_lock is_pte_pages_stable // Check passed because src_pte == S1 folio_move_anon_rmap(...) // Moved invalid folio B here !!! The race window is very short and requires multiple collisions of multiple rare events, so it's very unlikely to happen, but with a deliberately constructed reproducer and increased time window, it can be reproduced easily. This can be fixed by checking if the folio returned by filemap is the valid swap cache folio after acquiring the folio lock. Another similar race is possible: filemap_get_folio may return NULL, but folio (A) could be swapped in and then swapped out again using the same swap entry after the lookup. In such a case, folio (A) may remain in the swap cache, so it must be moved too: CPU1 CPU2 userfaultfd_move move_pages_pte() entry = pte_to_swp_entry(orig_src_pte); // Here it got entry = S1, and S1 is not in swap cache folio = filemap_get_folio(S1) // Got NULL ... < interrupted again> ... move_swap_pte double_pt_lock is_pte_pages_stable // Check passed because src_pte == S1 folio_move_anon_rmap(...) // folio A is ignored !!! Fix this by checking the swap cache again after acquiring the src_pte lock. And to avoid the filemap overhead, we check swap_map directly [2]. The SWP_SYNCHRONOUS_IO path does make the problem more complex, but so far we don't need to worry about that, since folios can only be exposed to the swap cache in the swap out path, and this is covered in this patch by checking the swap cache again after acquiring the src_pte lock. Testing with a simple C program that allocates and moves several GB of memory did not show any observable performance change. Link: https://lkml.kernel.org/r/20250604151038.21968-1-ryncsn@gmail.com Fixes: adef440691ba ("userfaultfd: UFFDIO_MOVE uABI") Signed-off-by: Kairui Song Closes: https://lore.kernel.org/linux-mm/CAMgjq7B1K=6OOrK2OUZ0-tqCzi+EJt+2_K97TPGoSt=9+JwP7Q@mail.gmail.com/ [1] Link: https://lore.kernel.org/all/CAGsJ_4yJhJBo16XhiC-nUzSheyX-V3-nFE+tAi=8Y560K8eT=A@mail.gmail.com/ [2] Reviewed-by: Lokesh Gidra Acked-by: Peter Xu Reviewed-by: Suren Baghdasaryan Reviewed-by: Barry Song Reviewed-by: Chris Li Cc: Andrea Arcangeli Cc: David Hildenbrand Cc: Kairui Song Cc: Signed-off-by: Andrew Morton commit 517f496e1e61bd169d585dab4dd77e7147506322 Author: David Hildenbrand Date: Wed Jun 11 15:13:14 2025 +0200 mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" After commit 1aaf8c122918 ("mm: gup: fix infinite loop within __get_longterm_locked") we are able to longterm pin folios that are not supposed to get longterm pinned, simply because they temporarily have the LRU flag cleared (esp. temporarily isolated). For example, two __get_longterm_locked() callers can race, or __get_longterm_locked() can race with anything else that temporarily isolates folios. The introducing commit mentions the use case of a driver that uses vm_ops->fault to insert pages allocated through cma_alloc() into the page tables, assuming they can later get longterm pinned. These pages/ folios would never have the LRU flag set and consequently cannot get isolated. There is no known in-tree user making use of that so far, fortunately. To handle that in the future -- and avoid retrying forever to isolate/migrate them -- we will need a different mechanism for the CMA area *owner* to indicate that it actually already allocated the page and is fine with longterm pinning it. The LRU flag is not suitable for that. Probably we can lookup the relevant CMA area and query the bitmap; we only have have to care about some races, probably. If already allocated, we could just allow longterm pinning) Anyhow, let's fix the "must not be longterm pinned" problem first by reverting the original commit. Link: https://lkml.kernel.org/r/20250611131314.594529-1-david@redhat.com Fixes: 1aaf8c122918 ("mm: gup: fix infinite loop within __get_longterm_locked") Signed-off-by: David Hildenbrand Closes: https://lore.kernel.org/all/20250522092755.GA3277597@tiffany/ Reported-by: Hyesoo Yu Reviewed-by: John Hubbard Cc: Jason Gunthorpe Cc: Peter Xu Cc: Zhaoyang Huang Cc: Aijun Sun Cc: Alistair Popple Cc: Signed-off-by: Andrew Morton commit 965f87700adbcc6d72430f524d88135027f5bba3 Author: Shivank Garg Date: Mon Jun 9 12:06:07 2025 +0000 selftests/mm: increase timeout from 180 to 900 seconds The mm selftests are timing out with the current 180-second limit. Testing shows that run_vmtests.sh takes approximately 11 minutes (664 seconds) to complete. Increase the timeout to 900 seconds (15 minutes) to provide sufficient buffer for the tests to complete successfully. Link: https://lkml.kernel.org/r/20250609120606.73145-2-shivankg@amd.com Signed-off-by: Shivank Garg Cc: Shuah Khan Signed-off-by: Andrew Morton commit a05dd8ae5cbb1cb45f349922cfea4f548a5e5d6f Author: Kairui Song Date: Tue Jun 10 01:17:51 2025 +0800 mm/shmem, swap: fix softlockup with mTHP swapin Following softlockup can be easily reproduced on my test machine with: echo always > /sys/kernel/mm/transparent_hugepage/hugepages-64kB/enabled swapon /dev/zram0 # zram0 is a 48G swap device mkdir -p /sys/fs/cgroup/memory/test echo 1G > /sys/fs/cgroup/test/memory.max echo $BASHPID > /sys/fs/cgroup/test/cgroup.procs while true; do dd if=/dev/zero of=/tmp/test.img bs=1M count=5120 cat /tmp/test.img > /dev/null rm /tmp/test.img done Then after a while: watchdog: BUG: soft lockup - CPU#0 stuck for 763s! [cat:5787] Modules linked in: zram virtiofs CPU: 0 UID: 0 PID: 5787 Comm: cat Kdump: loaded Tainted: G L 6.15.0.orig-gf3021d9246bc-dirty #118 PREEMPT(voluntary)· Tainted: [L]=SOFTLOCKUP Hardware name: Red Hat KVM/RHEL-AV, BIOS 0.0.0 02/06/2015 RIP: 0010:mpol_shared_policy_lookup+0xd/0x70 Code: e9 b8 b4 ff ff 31 c0 c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 41 54 55 53 <48> 8b 1f 48 85 db 74 41 4c 8d 67 08 48 89 fb 48 89 f5 4c 89 e7 e8 RSP: 0018:ffffc90002b1fc28 EFLAGS: 00000202 RAX: 00000000001c20ca RBX: 0000000000724e1e RCX: 0000000000000001 RDX: ffff888118e214c8 RSI: 0000000000057d42 RDI: ffff888118e21518 RBP: 000000000002bec8 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000bf4 R11: 0000000000000000 R12: 0000000000000001 R13: 00000000001c20ca R14: 00000000001c20ca R15: 0000000000000000 FS: 00007f03f995c740(0000) GS:ffff88a07ad9a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f03f98f1000 CR3: 0000000144626004 CR4: 0000000000770eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: shmem_alloc_folio+0x31/0xc0 shmem_swapin_folio+0x309/0xcf0 ? filemap_get_entry+0x117/0x1e0 ? xas_load+0xd/0xb0 ? filemap_get_entry+0x101/0x1e0 shmem_get_folio_gfp+0x2ed/0x5b0 shmem_file_read_iter+0x7f/0x2e0 vfs_read+0x252/0x330 ksys_read+0x68/0xf0 do_syscall_64+0x4c/0x1c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f03f9a46991 Code: 00 48 8b 15 81 14 10 00 f7 d8 64 89 02 b8 ff ff ff ff eb bd e8 20 ad 01 00 f3 0f 1e fa 80 3d 35 97 10 00 00 74 13 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 4f c3 66 0f 1f 44 00 00 55 48 89 e5 48 83 ec RSP: 002b:00007fff3c52bd28 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 0000000000040000 RCX: 00007f03f9a46991 RDX: 0000000000040000 RSI: 00007f03f98ba000 RDI: 0000000000000003 RBP: 00007fff3c52bd50 R08: 0000000000000000 R09: 00007f03f9b9a380 R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000040000 R13: 00007f03f98ba000 R14: 0000000000000003 R15: 0000000000000000 The reason is simple, readahead brought some order 0 folio in swap cache, and the swapin mTHP folio being allocated is in conflict with it, so swapcache_prepare fails and causes shmem_swap_alloc_folio to return -EEXIST, and shmem simply retries again and again causing this loop. Fix it by applying a similar fix for anon mTHP swapin. The performance change is very slight, time of swapin 10g zero folios with shmem (test for 12 times): Before: 2.47s After: 2.48s [kasong@tencent.com: add comment] Link: https://lkml.kernel.org/r/20250610181645.45922-1-ryncsn@gmail.com Link: https://lkml.kernel.org/r/20250610181645.45922-1-ryncsn@gmail.com Link: https://lkml.kernel.org/r/20250609171751.36305-1-ryncsn@gmail.com Fixes: 1dd44c0af4fa ("mm: shmem: skip swapcache for swapin of synchronous swap device") Signed-off-by: Kairui Song Reviewed-by: Barry Song Acked-by: Nhat Pham Reviewed-by: Baolin Wang Cc: Baoquan He Cc: Chris Li Cc: Hugh Dickins Cc: Kemeng Shi Cc: Usama Arif Cc: Signed-off-by: Andrew Morton commit 85d6fbc47c3087c5d048e6734926b0c36af34fe9 Author: Thomas Fourier Date: Wed Jun 18 08:57:04 2025 +0200 scsi: fnic: Fix missing DMA mapping error in fnic_send_frame() dma_map_XXX() can fail and should be tested for errors with dma_mapping_error(). Fixes: a63e78eb2b0f ("scsi: fnic: Add support for fabric based solicited requests and responses") Signed-off-by: Thomas Fourier Link: https://lore.kernel.org/r/20250618065715.14740-2-fourier.thomas@gmail.com Reviewed-by: Karan Tilak Kumar Reviewed-by: John Menghini Signed-off-by: Martin K. Petersen commit 18b5cb6f1fdda4454f55a31f7c78d94da62be495 Author: Karan Tilak Kumar Date: Tue Jun 17 17:34:31 2025 -0700 scsi: fnic: Set appropriate logging level for log message Replace KERN_INFO with KERN_DEBUG for a log message. Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Signed-off-by: Karan Tilak Kumar Link: https://lore.kernel.org/stable/20250612002212.4144-1-kartilak%40cisco.com Link: https://lore.kernel.org/r/20250618003431.6314-4-kartilak@cisco.com Reviewed-by: John Meneghini Signed-off-by: Martin K. Petersen commit 9b9b8594654a79e3d4166356fd86cd5397477b24 Author: Karan Tilak Kumar Date: Tue Jun 17 17:34:30 2025 -0700 scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths Add logs in FDMI and FDMI ABTS paths. Modify log text in these paths. Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: John Meneghini Signed-off-by: Karan Tilak Kumar Link: https://lore.kernel.org/r/20250618003431.6314-3-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit 74f46a0524f8d2f01dc7ca95bb5fc463a8603e72 Author: Karan Tilak Kumar Date: Tue Jun 17 17:34:29 2025 -0700 scsi: fnic: Turn off FDMI ACTIVE flags on link down When the link goes down and comes up, FDMI requests are not sent out anymore. Fix bug by turning off FNIC_FDMI_ACTIVE when the link goes down. Fixes: 09c1e6ab4ab2 ("scsi: fnic: Add and integrate support for FDMI") Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Tested-by: Karan Tilak Kumar Cc: stable@vger.kernel.org Signed-off-by: Karan Tilak Kumar Link: https://lore.kernel.org/r/20250618003431.6314-2-kartilak@cisco.com Reviewed-by: John Meneghini Signed-off-by: Martin K. Petersen commit a35b29bdedb4d2ae3160d4d6684a6f1ecd9ca7c2 Author: Karan Tilak Kumar Date: Tue Jun 17 17:34:28 2025 -0700 scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out When both the RHBA and RPA FDMI requests time out, fnic reuses a frame to send ABTS for each of them. On send completion, this causes an attempt to free the same frame twice that leads to a crash. Fix crash by allocating separate frames for RHBA and RPA, and modify ABTS logic accordingly. Tested by checking MDS for FDMI information. Tested by using instrumented driver to: - Drop PLOGI response - Drop RHBA response - Drop RPA response - Drop RHBA and RPA response - Drop PLOGI response + ABTS response - Drop RHBA response + ABTS response - Drop RPA response + ABTS response - Drop RHBA and RPA response + ABTS response for both of them Fixes: 09c1e6ab4ab2 ("scsi: fnic: Add and integrate support for FDMI") Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Tested-by: Arun Easi Co-developed-by: Arun Easi Signed-off-by: Arun Easi Tested-by: Karan Tilak Kumar Cc: stable@vger.kernel.org Signed-off-by: Karan Tilak Kumar Link: https://lore.kernel.org/r/20250618003431.6314-1-kartilak@cisco.com Reviewed-by: John Meneghini Signed-off-by: Martin K. Petersen commit 2e083cd802294693a5414e4557a183dd7e442e71 Author: anvithdosapati Date: Mon Jun 16 08:57:34 2025 +0000 scsi: ufs: core: Fix clk scaling to be conditional in reset and restore In ufshcd_host_reset_and_restore(), scale up clocks only when clock scaling is supported. Without this change CPU latency is voted for 0 (ufshcd_pm_qos_update) during resume unconditionally. Signed-off-by: anvithdosapati Link: https://lore.kernel.org/r/20250616085734.2133581-1-anvithdosapati@google.com Fixes: a3cd5ec55f6c ("scsi: ufs: add load based scaling of UFS gear") Cc: stable@vger.kernel.org Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 752eb816b55adb0673727ba0ed96609a17895654 Author: Chen Yu Date: Wed Jun 4 12:25:56 2025 +0800 scsi: megaraid_sas: Fix invalid node index On a system with DRAM interleave enabled, out-of-bound access is detected: megaraid_sas 0000:3f:00.0: requested/available msix 128/128 poll_queue 0 ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in ./arch/x86/include/asm/topology.h:72:28 index -1 is out of range for type 'cpumask *[1024]' dump_stack_lvl+0x5d/0x80 ubsan_epilogue+0x5/0x2b __ubsan_handle_out_of_bounds.cold+0x46/0x4b megasas_alloc_irq_vectors+0x149/0x190 [megaraid_sas] megasas_probe_one.cold+0xa4d/0x189c [megaraid_sas] local_pci_probe+0x42/0x90 pci_device_probe+0xdc/0x290 really_probe+0xdb/0x340 __driver_probe_device+0x78/0x110 driver_probe_device+0x1f/0xa0 __driver_attach+0xba/0x1c0 bus_for_each_dev+0x8b/0xe0 bus_add_driver+0x142/0x220 driver_register+0x72/0xd0 megasas_init+0xdf/0xff0 [megaraid_sas] do_one_initcall+0x57/0x310 do_init_module+0x90/0x250 init_module_from_file+0x85/0xc0 idempotent_init_module+0x114/0x310 __x64_sys_finit_module+0x65/0xc0 do_syscall_64+0x82/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Fix it accordingly. Signed-off-by: Chen Yu Link: https://lore.kernel.org/r/20250604042556.3731059-1-yu.c.chen@intel.com Fixes: 8049da6f3943 ("scsi: megaraid_sas: Use irq_set_affinity_and_hint()") Cc: stable@vger.kernel.org Signed-off-by: Martin K. Petersen commit 41687a5c6f8b07ad0850d6c46452376d54fe9b65 Merge: e0990236bbdc96 d57e92dd660014 Author: Linus Torvalds Date: Thu Jun 19 17:46:08 2025 -0700 Merge tag 'spi-fix-v6.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fix from Mark Brown: "One fix here from Thierry, fixing crashes caused by attempting to do cache sync operations on uncached memory on Tegra platforms" * tag 'spi-fix-v6.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: tegra210-qspi: Remove cache operations commit e0990236bbdc96440bfc4a5b24b5dd811fd2210d Merge: 5c8013ae2e86ec 8acfb165a49225 Author: Linus Torvalds Date: Thu Jun 19 17:40:42 2025 -0700 Merge tag 'regulator-fix-v6.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "One patch here from Heiko which fixes stability issues on some Rockchip platforms by implementing soft start support and providing startup time information for their regulators" * tag 'regulator-fix-v6.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: fan53555: add enable_time support and soft-start times commit aacc875a448d363332b9df0621dde6d3a225ea9f Author: Xiaolei Wang Date: Thu Jun 19 14:21:08 2025 +0800 clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data When num_parents is 4, __clk_register() occurs an out-of-bounds when accessing parent_names member. Use ARRAY_SIZE() instead of hardcode number here. BUG: KASAN: global-out-of-bounds in __clk_register+0x1844/0x20d8 Read of size 8 at addr ffff800086988e78 by task kworker/u24:3/59 Hardware name: NXP i.MX95 19X19 board (DT) Workqueue: events_unbound deferred_probe_work_func Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x8c/0xcc print_report+0x398/0x5fc kasan_report+0xd4/0x114 __asan_report_load8_noabort+0x20/0x2c __clk_register+0x1844/0x20d8 clk_hw_register+0x44/0x110 __clk_hw_register_mux+0x284/0x3a8 imx95_bc_probe+0x4f4/0xa70 Fixes: 5224b189462f ("clk: imx: add i.MX95 BLK CTL clk driver") Cc: stable@vger.kernel.org Reviewed-by: Frank Li Signed-off-by: Xiaolei Wang Link: https://lore.kernel.org/r/20250619062108.2016511-1-xiaolei.wang@windriver.com Signed-off-by: Stephen Boyd commit 6306e0c5a0d28e9df2b5902f4a021204bee75173 Author: Sascha Hauer Date: Thu Jun 12 14:56:57 2025 +0200 clk: scmi: Handle case where child clocks are initialized before their parents The SCMI clock driver currently assumes that parent clocks are always initialized before their children. However, this assumption can fail if a child clock is encountered before its parent during probe. This leads to an issue during initialization of the parent_data array: sclk->parent_data[i].hw = hws[sclk->info->parents[i]]; If the parent clock's hardware structure has not been initialized yet, this assignment results in invalid data. To resolve this, allocate all struct scmi_clk instances as a contiguous array at the beginning of the probe and populate the hws[] array upfront. This ensures that any parent referenced later is already initialized, regardless of the order in which clocks are processed. Note that we can no longer free individual scmi_clk instances if scmi_clk_ops_init() fails which shouldn't be a problem if the SCMI platform has proper per-agent clock discovery. Fixes: 65a8a3dd3b95f ("clk: scmi: Add support for clock {set,get}_parent") Reviewed-by: peng.fan@nxp.com Reviewed-by: Cristian Marussi Reviewed-by: Sudeep Holla Signed-off-by: Sascha Hauer Link: https://lore.kernel.org/r/20250612-clk-scmi-children-parent-fix-v3-1-7de52a27593d@pengutronix.de Signed-off-by: Stephen Boyd commit b8de9b21e8499a09ef424e101a8703e8e1866bfd Merge: 97aadc161d623b a39d082c3553d3 Author: Dave Airlie Date: Fri Jun 20 09:01:21 2025 +1000 Merge tag 'drm-xe-fixes-2025-06-19' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Driver Changes: - A workaround update (Vinay) - Fix memset on iomem (Lucas) - Fix early wedge on GuC Load failure (Daniele) Signed-off-by: Dave Airlie From: Thomas Hellstrom Link: https://lore.kernel.org/r/aFQ03kNzhbiNK7gW@fedora commit 97aadc161d623b4b86ee5deaeb8e9165422ecb9e Merge: 453e6fd262904c 61ee19dedb8d75 Author: Dave Airlie Date: Fri Jun 20 08:57:10 2025 +1000 Merge tag 'drm-misc-fixes-2025-06-19' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes drm-misc-fixes for v6.16-rc3: - vivante scheduler fix. - v3d null pointer crash fix. - fix backlight, booting GSP-RM, and potential integer shift overflow in nouveau. - fix compiler warnings about unused linux/export.h - fix malidp unknown modifier spam. - fix for ssd130x. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://lore.kernel.org/r/d44bab7b-01f8-45a8-a7f4-5d3d563d2f9d@linux.intel.com commit e0fca6f2cebff539e9317a15a37dcf432e3b851a Author: Long Li Date: Tue Jun 17 18:36:46 2025 -0700 net: mana: Record doorbell physical address in PF mode MANA supports RDMA in PF mode. The driver should record the doorbell physical address when in PF mode. The doorbell physical address is used by the RDMA driver to map doorbell pages of the device to user-mode applications through RDMA verbs interface. In the past, they have been mapped to user-mode while the device is in VF mode. With the support for PF mode implemented, also expose those pages in PF mode. Support for PF mode is implemented in 290e5d3c49f6 ("net: mana: Add support for Multi Vports on Bare metal") Signed-off-by: Long Li Reviewed-by: Simon Horman Link: https://patch.msgid.link/1750210606-12167-1-git-send-email-longli@linuxonhyperv.com Signed-off-by: Jakub Kicinski commit c76bcc7d1f24e90a2d7b98d1e523d7524269fc56 Author: Alexey Charkov Date: Sat Jun 14 22:14:33 2025 +0400 arm64: dts: rockchip: list all CPU supplies on ArmSoM Sige5 List both CPU supply regulators which drive the little and big CPU clusters, respectively, so that cpufreq can pick them up. Without this patch the cpufreq governor attempts to raise the big CPU frequency under high load, while its supply voltage stays at 850000 uV. This causes system instability and, in my case, random reboots. With this patch, supply voltages are adjusted in step with frequency changes from 700000-737000 uV in idle to 950000 uV under full load, and the system appears to be stable. While at this, list all CPU supplies for completeness. Cc: stable@vger.kernel.org Fixes: 40f742b07ab2 ("arm64: dts: rockchip: Add rk3576-armsom-sige5 board") Reviewed-by: Nicolas Frattaroli Tested-by: Nicolas Frattaroli Signed-off-by: Alexey Charkov Link: https://lore.kernel.org/r/20250614-sige5-updates-v2-1-3bb31b02623c@gmail.com Signed-off-by: Heiko Stuebner commit fde46f60f6c5138ee422087addbc5bf5b4968bf1 Author: Stephen Smalley Date: Tue Jun 10 15:48:27 2025 -0400 selinux: change security_compute_sid to return the ssid or tsid on match If the end result of a security_compute_sid() computation matches the ssid or tsid, return that SID rather than looking it up again. This avoids the problem of multiple initial SIDs that map to the same context. Cc: stable@vger.kernel.org Reported-by: Guido Trentalancia Fixes: ae254858ce07 ("selinux: introduce an initial SID for early boot processes") Signed-off-by: Stephen Smalley Tested-by: Guido Trentalancia Signed-off-by: Paul Moore commit b2e2bed119809a5ca384241e0631f04c6142ae08 Author: Kent Overstreet Date: Thu Jun 19 14:32:57 2025 -0400 bcachefs: Add missing key type checks to check_snapshot_exists() For now we only have one key type in these btrees, but forward compatibility means we do have to check. Reported-by: syzbot+b4cb4a6988aced0cec4b@syzkaller.appspotmail.com Signed-off-by: Kent Overstreet commit 5c8013ae2e86ec36b07500ba4cacb14ab4d6f728 Merge: 24770983ccfec8 16ef63acb784bd Author: Linus Torvalds Date: Thu Jun 19 10:21:32 2025 -0700 Merge tag 'net-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from wireless. The ath12k fix to avoid FW crashes requires adding support for a number of new FW commands so it's quite large in terms of LoC. The rest is relatively small. Current release - fix to a fix: - ptp: fix breakage after ptp_vclock_in_use() rework Current release - regressions: - openvswitch: allocate struct ovs_pcpu_storage dynamically, static allocation may exhaust module loader limit on smaller systems Previous releases - regressions: - tcp: fix tcp_packet_delayed() for peers with no selective ACK support Previous releases - always broken: - wifi: ath12k: don't activate more links than firmware supports - tcp: make sure sockets open via passive TFO have valid NAPI ID - eth: bnxt_en: update MRU and RSS table of RSS contexts on queue reset, prevent Rx queues from silently hanging after queue reset - NFC: uart: set tty->disc_data only in success path" * tag 'net-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (59 commits) net: airoha: Differentiate hwfd buffer size for QDMA0 and QDMA1 net: airoha: Compute number of descriptors according to reserved memory size tools: ynl: fix mixing ops and notifications on one socket net: atm: fix /proc/net/atm/lec handling net: atm: add lec_mutex mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available net: airoha: Always check return value from airoha_ppe_foe_get_entry() NFC: nci: uart: Set tty->disc_data only in success path calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). MAINTAINERS: Remove Shannon Nelson from MAINTAINERS file net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() eth: fbnic: avoid double free when failing to DMA-map FW msg tcp: fix passive TFO socket having invalid NAPI ID selftests: net: add test for passive TFO socket NAPI ID selftests: net: add passive TFO test binary selftests: netdevsim: improve lib.sh include in peer.sh tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer Octeontx2-pf: Fix Backpresure configuration net: ftgmac100: select FIXED_PHY net: ethtool: remove duplicate defines for family info ... commit 6463cbe08b0cbf9bba8763306764f5fd643023e1 Author: Pablo Martin-Gomez Date: Wed Jun 18 13:35:16 2025 +0200 mtd: spinand: fix memory leak of ECC engine conf Memory allocated for the ECC engine conf is not released during spinand cleanup. Below kmemleak trace is seen for this memory leak: unreferenced object 0xffffff80064f00e0 (size 8): comm "swapper/0", pid 1, jiffies 4294937458 hex dump (first 8 bytes): 00 00 00 00 00 00 00 00 ........ backtrace (crc 0): kmemleak_alloc+0x30/0x40 __kmalloc_cache_noprof+0x208/0x3c0 spinand_ondie_ecc_init_ctx+0x114/0x200 nand_ecc_init_ctx+0x70/0xa8 nanddev_ecc_engine_init+0xec/0x27c spinand_probe+0xa2c/0x1620 spi_mem_probe+0x130/0x21c spi_probe+0xf0/0x170 really_probe+0x17c/0x6e8 __driver_probe_device+0x17c/0x21c driver_probe_device+0x58/0x180 __device_attach_driver+0x15c/0x1f8 bus_for_each_drv+0xec/0x150 __device_attach+0x188/0x24c device_initial_probe+0x10/0x20 bus_probe_device+0x11c/0x160 Fix the leak by calling nanddev_ecc_engine_cleanup() inside spinand_cleanup(). Signed-off-by: Pablo Martin-Gomez Signed-off-by: Miquel Raynal commit 32a01cd4334175a0ae42b3c3d7f37fd26468ecc3 Author: Kent Overstreet Date: Thu Jun 19 12:50:06 2025 -0400 bcachefs: Don't log fsck err in the journal if doing repair elsewhere This fixes exceeding the bump allocator limit when the allocator finds many buckets that need repair - they're repaired asynchronously, which means that every error logged a message in the bump allocator, without committing. Signed-off-by: Kent Overstreet commit b2348fe6c81cc92c7d0bd8a7d9241f8de0fa72b7 Author: Kent Overstreet Date: Thu Jun 19 12:25:41 2025 -0400 bcachefs: Fix *__bch2_trans_subbuf_alloc() error path Don't change buf->size on error - this would usually be a transaction restart, but it could also be -ENOMEM - when we've exceeded the bump allocator max). Fixes: 247abee6ae6d ("bcachefs: btree_trans_subbuf") Signed-off-by: Kent Overstreet commit 24770983ccfec854d89da9d87ca5f2c9efc695fc Merge: fb4d33ab452ea2 c25892b7a17443 Author: Linus Torvalds Date: Thu Jun 19 09:09:40 2025 -0700 Merge tag 'hwmon-for-v6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - ltc4282: Avoid repeated register write operation - occ: Fix unaligned accesses, and rework attribute registration to reduce stack usage - ftsteutates: Fix TOCTOU race * tag 'hwmon-for-v6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (ltc4282) avoid repeated register write hwmon: (occ) fix unaligned accesses hwmon: (occ) Rework attribute registration for stack usage hwmon: (ftsteutates) Fix TOCTOU race in fts_read() commit 16ef63acb784bd0951a08c6feb108d19d9488800 Merge: dccf87ea49b7b9 7b46bdaec00a67 Author: Jakub Kicinski Date: Thu Jun 19 08:42:27 2025 -0700 Merge branch 'net-airoha-improve-hwfd-buffer-descriptor-queues-setup' Lorenzo Bianconi says: ==================== net: airoha: Improve hwfd buffer/descriptor queues setup Compute the number of hwfd buffers/descriptors according to the reserved memory size if provided via DTS. Reduce the required hwfd buffers queue size for QDMA1. v3: https://lore.kernel.org/20250618-airoha-hw-num-desc-v3-0-18a6487cd75e@kernel.org v1: https://lore.kernel.org/20250615-airoha-hw-num-desc-v1-0-8f88daa4abd7@kernel.org ==================== Link: https://patch.msgid.link/20250619-airoha-hw-num-desc-v4-0-49600a9b319a@kernel.org Signed-off-by: Jakub Kicinski commit 7b46bdaec00a675f6fac9d0b01a2105b5746ebe9 Author: Lorenzo Bianconi Date: Thu Jun 19 09:07:25 2025 +0200 net: airoha: Differentiate hwfd buffer size for QDMA0 and QDMA1 EN7581 SoC allows configuring the size and the number of buffers in hwfd payload queue for both QDMA0 and QDMA1. In order to reduce the required DRAM used for hwfd buffers queues and decrease the memory footprint, differentiate hwfd buffer size for QDMA0 and QDMA1 and reduce hwfd buffer size to 1KB for QDMA1 (WAN) while maintaining 2KB for QDMA0 (LAN). Signed-off-by: Lorenzo Bianconi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250619-airoha-hw-num-desc-v4-2-49600a9b319a@kernel.org Signed-off-by: Jakub Kicinski commit edf8afeecfbb0b8c1a2edb8c8892d2f759d35321 Author: Lorenzo Bianconi Date: Thu Jun 19 09:07:24 2025 +0200 net: airoha: Compute number of descriptors according to reserved memory size In order to not exceed the reserved memory size for hwfd buffers, compute the number of hwfd buffers/descriptors according to the reserved memory size and the size of each hwfd buffer (2KB). Fixes: 3a1ce9e3d01b ("net: airoha: Add the capability to allocate hwfd buffers via reserved-memory") Reviewed-by: Simon Horman Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250619-airoha-hw-num-desc-v4-1-49600a9b319a@kernel.org Signed-off-by: Jakub Kicinski commit dccf87ea49b7b954f85ce4d13826dced250e855c Merge: 9738280aae592b 68dd8eeb7208f1 Author: Jakub Kicinski Date: Thu Jun 19 08:38:40 2025 -0700 Merge tag 'wireless-2025-06-18' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== More fixes: - ath12k - avoid busy-waiting - activate correct number of links - iwlwifi - iwldvm regression (lots of warnings) - iwlmld merge damage regression (crash) - fix build with some old gcc versions - carl9170: don't talk to device w/o FW [syzbot] - ath6kl: remove bad FW WARN [syzbot] - ieee80211: use variable-length arrays [syzbot] - mac80211 - remove WARN on delayed beacon update [syzbot] - drop OCB frames with invalid source [syzbot] * tag 'wireless-2025-06-18' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: iwlwifi: Fix incorrect logic on cmd_ver range checking wifi: iwlwifi: dvm: restore n_no_reclaim_cmds setting wifi: iwlwifi: cfg: Limit cb_size to valid range wifi: iwlwifi: restore missing initialization of async_handlers_list (again) wifi: ath6kl: remove WARN on bad firmware input wifi: carl9170: do not ping device which has failed to load firmware wifi: ath12k: don't wait when there is no vdev started wifi: ath12k: don't use static variables in ath12k_wmi_fw_stats_process() wifi: ath12k: avoid burning CPU while waiting for firmware stats wifi: ath12k: fix documentation on firmware stats wifi: ath12k: don't activate more links than firmware supports wifi: ath12k: update link active in case two links fall on the same MAC wifi: ath12k: support WMI_MLO_LINK_SET_ACTIVE_CMDID command wifi: ath12k: update freq range for each hardware mode wifi: ath12k: parse and save sbs_lower_band_end_freq from WMI_SERVICE_READY_EXT2_EVENTID event wifi: ath12k: parse and save hardware mode info from WMI_SERVICE_READY_EXT_EVENTID event for later use wifi: ath12k: Avoid CPU busy-wait by handling VDEV_STAT and BCN_STAT wifi: mac80211: don't WARN for late channel/color switch wifi: mac80211: drop invalid source address OCB frames wifi: remove zero-length arrays ==================== Link: https://patch.msgid.link/20250618210642.35805-6-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 9738280aae592b579a25b5b1b6584c894827d3c7 Author: Jakub Kicinski Date: Wed Jun 18 10:17:46 2025 -0700 tools: ynl: fix mixing ops and notifications on one socket The multi message support loosened the connection between the request and response handling, as we can now submit multiple requests before we start processing responses. Passing the attr set to NlMsgs decoding no longer makes sense (if it ever did), attr set may differ message by messsage. Isolate the part of decoding responsible for attr-set specific interpretation and call it once we identified the correct op. Without this fix performing SET operation on an ethtool socket, while being subscribed to notifications causes: # File "tools/net/ynl/pyynl/lib/ynl.py", line 1096, in _op # Exception| return self._ops(ops)[0] # Exception| ~~~~~~~~~^^^^^ # File "tools/net/ynl/pyynl/lib/ynl.py", line 1040, in _ops # Exception| nms = NlMsgs(reply, attr_space=op.attr_set) # Exception| ^^^^^^^^^^^ The value of op we use on line 1040 is stale, it comes form the previous loop. If a notification comes before a response we will update op to None and the next iteration thru the loop will break with the trace above. Fixes: 6fda63c45fe8 ("tools/net/ynl: fix cli.py --subscribe feature") Fixes: ba8be00f68f5 ("tools/net/ynl: Add multi message support to ynl") Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250618171746.1201403-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 664f1b854f63e0bedba96a8f5d896c7ce5fd167f Merge: e7ea5f5b1858dd d03b79f459c793 Author: Jakub Kicinski Date: Thu Jun 19 08:36:35 2025 -0700 Merge branch 'with-a-mutex' Eric Dumazet says: ==================== net: atm: protect dev_lec[] with a mutex Based on an initial syzbot report. First patch is adding lec_mutex to address the report. Second patch protects /proc/net/atm/lec operations. We probably should delete this driver, it seems quite broken. ==================== Link: https://patch.msgid.link/20250618140844.1686882-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit d03b79f459c7935cff830d98373474f440bd03ae Author: Eric Dumazet Date: Wed Jun 18 14:08:44 2025 +0000 net: atm: fix /proc/net/atm/lec handling /proc/net/atm/lec must ensure safety against dev_lec[] changes. It appears it had dev_put() calls without prior dev_hold(), leading to imbalance and UAF. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Acked-by: Francois Romieu # Minor atm contributor Link: https://patch.msgid.link/20250618140844.1686882-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit d13a3824bfd2b4774b671a75cf766a16637a0e67 Author: Eric Dumazet Date: Wed Jun 18 14:08:43 2025 +0000 net: atm: add lec_mutex syzbot found its way in net/atm/lec.c, and found an error path in lecd_attach() could leave a dangling pointer in dev_lec[]. Add a mutex to protect dev_lecp[] uses from lecd_attach(), lec_vcc_attach() and lec_mcast_attach(). Following patch will use this mutex for /proc/net/atm/lec. BUG: KASAN: slab-use-after-free in lecd_attach net/atm/lec.c:751 [inline] BUG: KASAN: slab-use-after-free in lane_ioctl+0x2224/0x23e0 net/atm/lec.c:1008 Read of size 8 at addr ffff88807c7b8e68 by task syz.1.17/6142 CPU: 1 UID: 0 PID: 6142 Comm: syz.1.17 Not tainted 6.16.0-rc1-syzkaller-00239-g08215f5486ec #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xcd/0x680 mm/kasan/report.c:521 kasan_report+0xe0/0x110 mm/kasan/report.c:634 lecd_attach net/atm/lec.c:751 [inline] lane_ioctl+0x2224/0x23e0 net/atm/lec.c:1008 do_vcc_ioctl+0x12c/0x930 net/atm/ioctl.c:159 sock_do_ioctl+0x118/0x280 net/socket.c:1190 sock_ioctl+0x227/0x6b0 net/socket.c:1311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Allocated by task 6132: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4328 [inline] __kvmalloc_node_noprof+0x27b/0x620 mm/slub.c:5015 alloc_netdev_mqs+0xd2/0x1570 net/core/dev.c:11711 lecd_attach net/atm/lec.c:737 [inline] lane_ioctl+0x17db/0x23e0 net/atm/lec.c:1008 do_vcc_ioctl+0x12c/0x930 net/atm/ioctl.c:159 sock_do_ioctl+0x118/0x280 net/socket.c:1190 sock_ioctl+0x227/0x6b0 net/socket.c:1311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 6132: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2381 [inline] slab_free mm/slub.c:4643 [inline] kfree+0x2b4/0x4d0 mm/slub.c:4842 free_netdev+0x6c5/0x910 net/core/dev.c:11892 lecd_attach net/atm/lec.c:744 [inline] lane_ioctl+0x1ce8/0x23e0 net/atm/lec.c:1008 do_vcc_ioctl+0x12c/0x930 net/atm/ioctl.c:159 sock_do_ioctl+0x118/0x280 net/socket.c:1190 sock_ioctl+0x227/0x6b0 net/socket.c:1311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+8b64dec3affaed7b3af5@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6852c6f6.050a0220.216029.0018.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250618140844.1686882-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit e7ea5f5b1858ddb96b152584d5fe06e6fc623e89 Author: David Thompson Date: Wed Jun 18 13:59:02 2025 +0000 mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available The message "Error getting PHY irq. Use polling instead" is emitted when the mlxbf_gige driver is loaded by the kernel before the associated gpio-mlxbf driver, and thus the call to get the PHY IRQ fails since it is not yet available. The driver probe() must return -EPROBE_DEFER if acpi_dev_gpio_irq_get_by() returns the same. Fixes: 6c2a6ddca763 ("net: mellanox: mlxbf_gige: Replace non-standard interrupt handling") Signed-off-by: David Thompson Reviewed-by: Asmaa Mnebhi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250618135902.346-1-davthompson@nvidia.com Signed-off-by: Jakub Kicinski commit 78bd03ee1f20a267d2c218884b66041b3508ac9c Author: Lorenzo Bianconi Date: Wed Jun 18 09:37:40 2025 +0200 net: airoha: Always check return value from airoha_ppe_foe_get_entry() airoha_ppe_foe_get_entry routine can return NULL, so check the returned pointer is not NULL in airoha_ppe_foe_flow_l2_entry_update() Fixes: b81e0f2b58be3 ("net: airoha: Add FLOW_CLS_STATS callback support") Reviewed-by: Simon Horman Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250618-check-ret-from-airoha_ppe_foe_get_entry-v2-1-068dcea3cc66@kernel.org Signed-off-by: Jakub Kicinski commit fc27ab48904ceb7e4792f0c400f1ef175edf16fe Author: Krzysztof Kozlowski Date: Wed Jun 18 09:36:50 2025 +0200 NFC: nci: uart: Set tty->disc_data only in success path Setting tty->disc_data before opening the NCI device means we need to clean it up on error paths. This also opens some short window if device starts sending data, even before NCIUARTSETDRIVER IOCTL succeeded (broken hardware?). Close the window by exposing tty->disc_data only on the success path, when opening of the NCI device and try_module_get() succeeds. The code differs in error path in one aspect: tty->disc_data won't be ever assigned thus NULL-ified. This however should not be relevant difference, because of "tty->disc_data=NULL" in nci_uart_tty_open(). Cc: Linus Torvalds Fixes: 9961127d4bce ("NFC: nci: add generic uart support") Cc: Signed-off-by: Krzysztof Kozlowski Reviewed-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20250618073649.25049-2-krzysztof.kozlowski@linaro.org Signed-off-by: Jakub Kicinski commit a55bc4ffc06d8c965a7d6f0a01ed0ed41380df28 Author: Nathan Chancellor Date: Mon Jun 9 14:13:14 2025 -0700 staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() After commit 6f110a5e4f99 ("Disable SLUB_TINY for build testing"), which causes CONFIG_KASAN to be enabled in allmodconfig again, arm64 allmodconfig builds with older versions of clang (15 through 17) show an instance of -Wframe-larger-than (which breaks the build with CONFIG_WERROR=y): drivers/staging/rtl8723bs/core/rtw_security.c:1287:5: error: stack frame size (2208) exceeds limit (2048) in 'rtw_aes_decrypt' [-Werror,-Wframe-larger-than] 1287 | u32 rtw_aes_decrypt(struct adapter *padapter, u8 *precvframe) | ^ This comes from aes_decipher() being inlined in rtw_aes_decrypt(). Running the same build with CONFIG_FRAME_WARN=128 shows aes_cipher() also uses a decent amount of stack, just under the limit of 2048: drivers/staging/rtl8723bs/core/rtw_security.c:864:19: warning: stack frame size (1952) exceeds limit (128) in 'aes_cipher' [-Wframe-larger-than] 864 | static signed int aes_cipher(u8 *key, uint hdrlen, | ^ -Rpass-analysis=stack-frame-layout only shows one large structure on the stack, which is the ctx variable inlined from aes128k128d(). A good number of the other variables come from the additional checks of fortified string routines, which are present in memset(), which both aes_cipher() and aes_decipher() use to initialize some temporary buffers. In this case, since the size is known at compile time, these additional checks should not result in any code generation changes but allmodconfig has several sanitizers enabled, which may make it harder for the compiler to eliminate the compile time checks and the variables that come about from them. The memset() calls are just initializing these buffers to zero, so use '= {}' instead, which is used all over the kernel and does the exact same thing as memset() without the fortify checks, which drops the stack usage of these functions by a few hundred kilobytes. drivers/staging/rtl8723bs/core/rtw_security.c:864:19: warning: stack frame size (1584) exceeds limit (128) in 'aes_cipher' [-Wframe-larger-than] 864 | static signed int aes_cipher(u8 *key, uint hdrlen, | ^ drivers/staging/rtl8723bs/core/rtw_security.c:1271:5: warning: stack frame size (1456) exceeds limit (128) in 'rtw_aes_decrypt' [-Wframe-larger-than] 1271 | u32 rtw_aes_decrypt(struct adapter *padapter, u8 *precvframe) | ^ Cc: stable@vger.kernel.org Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") Signed-off-by: Nathan Chancellor Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/20250609-rtl8723bs-fix-clang-arm64-wflt-v1-1-e2accba43def@kernel.org Signed-off-by: Greg Kroah-Hartman commit 10876da918fa1aec0227fb4c67647513447f53a9 Author: Kuniyuki Iwashima Date: Tue Jun 17 15:40:42 2025 -0700 calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). syzkaller reported a null-ptr-deref in sock_omalloc() while allocating a CALIPSO option. [0] The NULL is of struct sock, which was fetched by sk_to_full_sk() in calipso_req_setattr(). Since commit a1a5344ddbe8 ("tcp: avoid two atomic ops for syncookies"), reqsk->rsk_listener could be NULL when SYN Cookie is returned to its client, as hinted by the leading SYN Cookie log. Here are 3 options to fix the bug: 1) Return 0 in calipso_req_setattr() 2) Return an error in calipso_req_setattr() 3) Alaways set rsk_listener 1) is no go as it bypasses LSM, but 2) effectively disables SYN Cookie for CALIPSO. 3) is also no go as there have been many efforts to reduce atomic ops and make TCP robust against DDoS. See also commit 3b24d854cb35 ("tcp/dccp: do not touch listener sk_refcnt under synflood"). As of the blamed commit, SYN Cookie already did not need refcounting, and no one has stumbled on the bug for 9 years, so no CALIPSO user will care about SYN Cookie. Let's return an error in calipso_req_setattr() and calipso_req_delattr() in the SYN Cookie case. This can be reproduced by [1] on Fedora and now connect() of nc times out. [0]: TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] CPU: 3 UID: 0 PID: 12262 Comm: syz.1.2611 Not tainted 6.14.0 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:read_pnet include/net/net_namespace.h:406 [inline] RIP: 0010:sock_net include/net/sock.h:655 [inline] RIP: 0010:sock_kmalloc+0x35/0x170 net/core/sock.c:2806 Code: 89 d5 41 54 55 89 f5 53 48 89 fb e8 25 e3 c6 fd e8 f0 91 e3 00 48 8d 7b 30 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 26 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b RSP: 0018:ffff88811af89038 EFLAGS: 00010216 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffff888105266400 RDX: 0000000000000006 RSI: ffff88800c890000 RDI: 0000000000000030 RBP: 0000000000000050 R08: 0000000000000000 R09: ffff88810526640e R10: ffffed1020a4cc81 R11: ffff88810526640f R12: 0000000000000000 R13: 0000000000000820 R14: ffff888105266400 R15: 0000000000000050 FS: 00007f0653a07640(0000) GS:ffff88811af80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f863ba096f4 CR3: 00000000163c0005 CR4: 0000000000770ef0 PKRU: 80000000 Call Trace: ipv6_renew_options+0x279/0x950 net/ipv6/exthdrs.c:1288 calipso_req_setattr+0x181/0x340 net/ipv6/calipso.c:1204 calipso_req_setattr+0x56/0x80 net/netlabel/netlabel_calipso.c:597 netlbl_req_setattr+0x18a/0x440 net/netlabel/netlabel_kapi.c:1249 selinux_netlbl_inet_conn_request+0x1fb/0x320 security/selinux/netlabel.c:342 selinux_inet_conn_request+0x1eb/0x2c0 security/selinux/hooks.c:5551 security_inet_conn_request+0x50/0xa0 security/security.c:4945 tcp_v6_route_req+0x22c/0x550 net/ipv6/tcp_ipv6.c:825 tcp_conn_request+0xec8/0x2b70 net/ipv4/tcp_input.c:7275 tcp_v6_conn_request+0x1e3/0x440 net/ipv6/tcp_ipv6.c:1328 tcp_rcv_state_process+0xafa/0x52b0 net/ipv4/tcp_input.c:6781 tcp_v6_do_rcv+0x8a6/0x1a40 net/ipv6/tcp_ipv6.c:1667 tcp_v6_rcv+0x505e/0x5b50 net/ipv6/tcp_ipv6.c:1904 ip6_protocol_deliver_rcu+0x17c/0x1da0 net/ipv6/ip6_input.c:436 ip6_input_finish+0x103/0x180 net/ipv6/ip6_input.c:480 NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netfilter.h:308 [inline] ip6_input+0x13c/0x6b0 net/ipv6/ip6_input.c:491 dst_input include/net/dst.h:469 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:79 [inline] ip6_rcv_finish+0xb6/0x490 net/ipv6/ip6_input.c:69 NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netfilter.h:308 [inline] ipv6_rcv+0xf9/0x490 net/ipv6/ip6_input.c:309 __netif_receive_skb_one_core+0x12e/0x1f0 net/core/dev.c:5896 __netif_receive_skb+0x1d/0x170 net/core/dev.c:6009 process_backlog+0x41e/0x13b0 net/core/dev.c:6357 __napi_poll+0xbd/0x710 net/core/dev.c:7191 napi_poll net/core/dev.c:7260 [inline] net_rx_action+0x9de/0xde0 net/core/dev.c:7382 handle_softirqs+0x19a/0x770 kernel/softirq.c:561 do_softirq.part.0+0x36/0x70 kernel/softirq.c:462 do_softirq arch/x86/include/asm/preempt.h:26 [inline] __local_bh_enable_ip+0xf1/0x110 kernel/softirq.c:389 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:919 [inline] __dev_queue_xmit+0xc2a/0x3c40 net/core/dev.c:4679 dev_queue_xmit include/linux/netdevice.h:3313 [inline] neigh_hh_output include/net/neighbour.h:523 [inline] neigh_output include/net/neighbour.h:537 [inline] ip6_finish_output2+0xd69/0x1f80 net/ipv6/ip6_output.c:141 __ip6_finish_output net/ipv6/ip6_output.c:215 [inline] ip6_finish_output+0x5dc/0xd60 net/ipv6/ip6_output.c:226 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip6_output+0x24b/0x8d0 net/ipv6/ip6_output.c:247 dst_output include/net/dst.h:459 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netfilter.h:308 [inline] ip6_xmit+0xbbc/0x20d0 net/ipv6/ip6_output.c:366 inet6_csk_xmit+0x39a/0x720 net/ipv6/inet6_connection_sock.c:135 __tcp_transmit_skb+0x1a7b/0x3b40 net/ipv4/tcp_output.c:1471 tcp_transmit_skb net/ipv4/tcp_output.c:1489 [inline] tcp_send_syn_data net/ipv4/tcp_output.c:4059 [inline] tcp_connect+0x1c0c/0x4510 net/ipv4/tcp_output.c:4148 tcp_v6_connect+0x156c/0x2080 net/ipv6/tcp_ipv6.c:333 __inet_stream_connect+0x3a7/0xed0 net/ipv4/af_inet.c:677 tcp_sendmsg_fastopen+0x3e2/0x710 net/ipv4/tcp.c:1039 tcp_sendmsg_locked+0x1e82/0x3570 net/ipv4/tcp.c:1091 tcp_sendmsg+0x2f/0x50 net/ipv4/tcp.c:1358 inet6_sendmsg+0xb9/0x150 net/ipv6/af_inet6.c:659 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg+0xf4/0x2a0 net/socket.c:733 __sys_sendto+0x29a/0x390 net/socket.c:2187 __do_sys_sendto net/socket.c:2194 [inline] __se_sys_sendto net/socket.c:2190 [inline] __x64_sys_sendto+0xe1/0x1c0 net/socket.c:2190 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xc3/0x1d0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f06553c47ed Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f0653a06fc8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f0655605fa0 RCX: 00007f06553c47ed RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b RBP: 00007f065545db38 R08: 0000200000000140 R09: 000000000000001c R10: f7384d4ea84b01bd R11: 0000000000000246 R12: 0000000000000000 R13: 00007f0655605fac R14: 00007f0655606038 R15: 00007f06539e7000 Modules linked in: [1]: dnf install -y selinux-policy-targeted policycoreutils netlabel_tools procps-ng nmap-ncat mount -t selinuxfs none /sys/fs/selinux load_policy netlabelctl calipso add pass doi:1 netlabelctl map del default netlabelctl map add default address:::1 protocol:calipso,1 sysctl net.ipv4.tcp_syncookies=2 nc -l ::1 80 & nc ::1 80 Fixes: e1adea927080 ("calipso: Allow request sockets to be relabelled by the lsm.") Reported-by: syzkaller Reported-by: John Cheung Closes: https://lore.kernel.org/netdev/CAP=Rh=MvfhrGADy+-WJiftV2_WzMH4VEhEFmeT28qY+4yxNu4w@mail.gmail.com/ Signed-off-by: Kuniyuki Iwashima Acked-by: Paul Moore Link: https://patch.msgid.link/20250617224125.17299-1-kuni1840@gmail.com Signed-off-by: Jakub Kicinski commit a1113cefd7d62e20735edda79507dc9f6ce103ff Author: Shannon Nelson Date: Mon Jun 16 15:44:37 2025 -0700 MAINTAINERS: Remove Shannon Nelson from MAINTAINERS file Brett Creeley is taking ownership of AMD/Pensando drivers while I wander off into the sunset with my retirement this month. I'll still keep an eye out on a few topics for awhile, and maybe do some free-lance work in the future. Meanwhile, thank you all for the fun and support and the many learning opportunities :-). Special thanks go to DaveM for merging my first patch long ago, the big ionic patchset a few years ago, and my last patchset last week. Redirect things to a non-corporate account. Signed-off-by: Shannon Nelson Reviewed-by: Simon Horman Signed-off-by: Brett Creeley Link: https://patch.msgid.link/20250616224437.56581-1-shannon.nelson@amd.com [Jakub: squash in the .mailmap update] Signed-off-by: Shannon Nelson Link: https://patch.msgid.link/20250619010603.1173141-1-sln@onemain.com Signed-off-by: Jakub Kicinski commit a39d082c3553d35b4fe5585e1e2fb221c130cae8 Author: Daniele Ceraolo Spurio Date: Wed Jun 11 14:44:54 2025 -0700 drm/xe: Fix early wedge on GuC load failure When the GuC fails to load we declare the device wedged. However, the very first GuC load attempt on GT0 (from xe_gt_init_hwconfig) is done before the GT1 GuC objects are initialized, so things go bad when the wedge code attempts to cleanup GT1. To fix this, check the initialization status in the functions called during wedge. Fixes: 7dbe8af13c18 ("drm/xe: Wedge the entire device") Signed-off-by: Daniele Ceraolo Spurio Cc: Rodrigo Vivi Cc: Matthew Brost Cc: Jonathan Cavitt Cc: Lucas De Marchi Cc: Zhanjun Dong Cc: stable@vger.kernel.org # v6.12+: 1e1981b16bb1: drm/xe: Fix taking invalid lock on wedge Cc: stable@vger.kernel.org # v6.12+ Reviewed-by: Jonathan Cavitt Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250611214453.1159846-2-daniele.ceraolospurio@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 0b93b7dcd9eb888a6ac7546560877705d4ad61bf) Signed-off-by: Thomas Hellström commit 16ea4666bbb7f5bd1130fa2d75631ccf8b62362e Author: Peter Ujfalusi Date: Thu Jun 19 13:47:05 2025 +0300 ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count It is better to print out the non supported num_dmics than printing that it is not matching with 2 or 4. Fixes: 2fbeff33381c ("ASoC: Intel: add sof_sdw_get_tplg_files ops") Cc: stable@vger.kernel.org Signed-off-by: Peter Ujfalusi Reviewed-by: Bard Liao Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20250619104705.26057-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 87a15c89d8c7b00b0fc94e0d4f554f7ee2fe6961 Author: Lucas De Marchi Date: Thu Jun 12 15:14:12 2025 -0700 drm/xe: Fix memset on iomem It should rather use xe_map_memset() as the BO is created with XE_BO_FLAG_VRAM_IF_DGFX in xe_guc_pc_init(). Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: stable@vger.kernel.org Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250612-vmap-vaddr-v1-1-26238ed443eb@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 21cf47d89fba353b2d5915ba4718040c4cb955d3) Signed-off-by: Thomas Hellström commit 16c1241b08751a67cd7a0221ea9f82b0b02806f4 Author: Vinay Belgaumkar Date: Thu Jun 12 00:09:01 2025 -0700 drm/xe/bmg: Update Wa_16023588340 This allows for additional L2 caching modes. Fixes: 01570b446939 ("drm/xe/bmg: implement Wa_16023588340") Cc: Matthew Auld Reviewed-by: Matthew Auld Signed-off-by: Vinay Belgaumkar Link: https://lore.kernel.org/r/20250612-wa-14022085890-v4-2-94ba5dcc1e30@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 6ab42fa03d4c88a0ddf5e56e62794853b198e7bf) Signed-off-by: Thomas Hellström commit 8c8472855884355caf3d8e0c50adf825f83454b2 Author: Ronnie Sahlberg Date: Thu Jun 19 12:10:31 2025 +1000 ublk: santizize the arguments from userspace when adding a device Sanity check the values for queue depth and number of queues we get from userspace when adding a device. Signed-off-by: Ronnie Sahlberg Reviewed-by: Ming Lei Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver") Fixes: 62fe99cef94a ("ublk: add read()/write() support for ublk char device") Link: https://lore.kernel.org/r/20250619021031.181340-1-ronniesahlberg@gmail.com Signed-off-by: Jens Axboe commit 94d10a4dba0bc482f2b01e39f06d5513d0f75742 Author: Jeff Layton Date: Thu Jun 19 06:01:55 2025 -0400 sunrpc: handle SVC_GARBAGE during svc auth processing as auth error tianshuo han reported a remotely-triggerable crash if the client sends a kernel RPC server a specially crafted packet. If decoding the RPC reply fails in such a way that SVC_GARBAGE is returned without setting the rq_accept_statp pointer, then that pointer can be dereferenced and a value stored there. If it's the first time the thread has processed an RPC, then that pointer will be set to NULL and the kernel will crash. In other cases, it could create a memory scribble. The server sunrpc code treats a SVC_GARBAGE return from svc_authenticate or pg_authenticate as if it should send a GARBAGE_ARGS reply. RFC 5531 says that if authentication fails that the RPC should be rejected instead with a status of AUTH_ERR. Handle a SVC_GARBAGE return as an AUTH_ERROR, with a reason of AUTH_BADCRED instead of returning GARBAGE_ARGS in that case. This sidesteps the whole problem of touching the rpc_accept_statp pointer in this situation and avoids the crash. Cc: stable@kernel.org Fixes: 29cd2927fb91 ("SUNRPC: Fix encoding of accepted but unsuccessful RPC replies") Reported-by: tianshuo han Reviewed-by: Chuck Lever Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 8ea688a3372e8369dc04395b39b4e71a6d91d4d5 Author: Jeff Layton Date: Tue May 27 20:12:47 2025 -0400 nfsd: use threads array as-is in netlink interface The old nfsdfs interface for starting a server with multiple pools handles the special case of a single entry array passed down from userland by distributing the threads over every NUMA node. The netlink control interface however constructs an array of length nfsd_nrpools() and fills any unprovided slots with 0's. This behavior defeats the special casing that the old interface relies on. Change nfsd_nl_threads_set_doit() to pass down the array from userland as-is. Fixes: 7f5c330b2620 ("nfsd: allow passing in array of thread counts via netlink") Cc: stable@vger.kernel.org Reported-by: Mike Snitzer Closes: https://lore.kernel.org/linux-nfs/aDC-ftnzhJAlwqwh@kernel.org/ Signed-off-by: Jeff Layton Reviewed-by: Simon Horman Tested-by: Mike Snitzer Signed-off-by: Chuck Lever commit e353b0854d3a1a31cb061df8d022fbfea53a0f24 Author: Alexey Kodanev Date: Mon Jun 16 11:37:43 2025 +0000 net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() Before calling lan743x_ptp_io_event_clock_get(), the 'channel' value is checked against the maximum value of PCI11X1X_PTP_IO_MAX_CHANNELS(8). This seems correct and aligns with the PTP interrupt status register (PTP_INT_STS) specifications. However, lan743x_ptp_io_event_clock_get() writes to ptp->extts[] with only LAN743X_PTP_N_EXTTS(4) elements, using channel as an index: lan743x_ptp_io_event_clock_get(..., u8 channel,...) { ... /* Update Local timestamp */ extts = &ptp->extts[channel]; extts->ts.tv_sec = sec; ... } To avoid an out-of-bounds write and utilize all the supported GPIO inputs, set LAN743X_PTP_N_EXTTS to 8. Detected using the static analysis tool - Svace. Fixes: 60942c397af6 ("net: lan743x: Add support for PTP-IO Event Input External Timestamp (extts)") Signed-off-by: Alexey Kodanev Reviewed-by: Jacob Keller Acked-by: Rengarajan S Link: https://patch.msgid.link/20250616113743.36284-1-aleksei.kodanev@bell-sw.com Signed-off-by: Paolo Abeni commit c0d90a79e8e65b89037508276b2b31f41a1b3783 Author: Johannes Thumshirn Date: Fri Jun 6 09:17:41 2025 +0200 btrfs: zoned: fix alloc_offset calculation for partly conventional block groups When one of two zones composing a DUP block group is a conventional zone, we have the zone_info[i]->alloc_offset = WP_CONVENTIONAL. That will, of course, not match the write pointer of the other zone, and fails that block group. This commit solves that issue by properly recovering the emulated write pointer from the last allocated extent. The offset for the SINGLE, DUP, and RAID1 are straight-forward: it is same as the end of last allocated extent. The RAID0 and RAID10 are a bit tricky that we need to do the math of striping. This is the kernel equivalent of Naohiro's user-space commit: "btrfs-progs: zoned: fix alloc_offset calculation for partly conventional block groups". Reviewed-by: Naohiro Aota Signed-off-by: Johannes Thumshirn Signed-off-by: David Sterba commit 547e836661554dcfa15c212a3821664e85b4191a Author: Qu Wenruo Date: Sat Jun 7 09:18:43 2025 +0930 btrfs: handle csum tree error with rescue=ibadroots correctly [BUG] There is syzbot based reproducer that can crash the kernel, with the following call trace: (With some debug output added) DEBUG: rescue=ibadroots parsed BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop0 (7:0) scanned by repro (1010) BTRFS info (device loop0): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 BTRFS info (device loop0): using blake2b (blake2b-256-generic) checksum algorithm BTRFS info (device loop0): using free-space-tree BTRFS warning (device loop0): checksum verify failed on logical 5312512 mirror 1 wanted 0xb043382657aede36608fd3386d6b001692ff406164733d94e2d9a180412c6003 found 0x810ceb2bacb7f0f9eb2bf3b2b15c02af867cb35ad450898169f3b1f0bd818651 level 0 DEBUG: read tree root path failed for tree csum, ret=-5 BTRFS warning (device loop0): checksum verify failed on logical 5328896 mirror 1 wanted 0x51be4e8b303da58e6340226815b70e3a93592dac3f30dd510c7517454de8567a found 0x51be4e8b303da58e634022a315b70e3a93592dac3f30dd510c7517454de8567a level 0 BTRFS warning (device loop0): checksum verify failed on logical 5292032 mirror 1 wanted 0x1924ccd683be9efc2fa98582ef58760e3848e9043db8649ee382681e220cdee4 found 0x0cb6184f6e8799d9f8cb335dccd1d1832da1071d12290dab3b85b587ecacca6e level 0 process 'repro' launched './file2' with NULL argv: empty string added DEBUG: no csum root, idatacsums=0 ibadroots=134217728 Oops: general protection fault, probably for non-canonical address 0xdffffc0000000041: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000208-0x000000000000020f] CPU: 5 UID: 0 PID: 1010 Comm: repro Tainted: G OE 6.15.0-custom+ #249 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:btrfs_lookup_csum+0x93/0x3d0 [btrfs] Call Trace: btrfs_lookup_bio_sums+0x47a/0xdf0 [btrfs] btrfs_submit_bbio+0x43e/0x1a80 [btrfs] submit_one_bio+0xde/0x160 [btrfs] btrfs_readahead+0x498/0x6a0 [btrfs] read_pages+0x1c3/0xb20 page_cache_ra_order+0x4b5/0xc20 filemap_get_pages+0x2d3/0x19e0 filemap_read+0x314/0xde0 __kernel_read+0x35b/0x900 bprm_execve+0x62e/0x1140 do_execveat_common.isra.0+0x3fc/0x520 __x64_sys_execveat+0xdc/0x130 do_syscall_64+0x54/0x1d0 entry_SYSCALL_64_after_hwframe+0x76/0x7e ---[ end trace 0000000000000000 ]--- [CAUSE] Firstly the fs has a corrupted csum tree root, thus to mount the fs we have to go "ro,rescue=ibadroots" mount option. Normally with that mount option, a bad csum tree root should set BTRFS_FS_STATE_NO_DATA_CSUMS flag, so that any future data read will ignore csum search. But in this particular case, we have the following call trace that caused NULL csum root, but not setting BTRFS_FS_STATE_NO_DATA_CSUMS: load_global_roots_objectid(): ret = btrfs_search_slot(); /* Succeeded */ btrfs_item_key_to_cpu() found = true; /* We found the root item for csum tree. */ root = read_tree_root_path(); if (IS_ERR(root)) { if (!btrfs_test_opt(fs_info, IGNOREBADROOTS)) /* * Since we have rescue=ibadroots mount option, * @ret is still 0. */ break; if (!found || ret) { /* @found is true, @ret is 0, error handling for csum * tree is skipped. */ } This means we completely skipped to set BTRFS_FS_STATE_NO_DATA_CSUMS if the csum tree is corrupted, which results unexpected later csum lookup. [FIX] If read_tree_root_path() failed, always populate @ret to the error number. As at the end of the function, we need @ret to determine if we need to do the extra error handling for csum tree. Fixes: abed4aaae4f7 ("btrfs: track the csum, extent, and free space trees in a rb tree") Reported-by: Zhiyu Zhang Reported-by: Longxing Li Reviewed-by: David Sterba Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit a26bf338cdad3643a6e7c3d78a172baadba15c1a Author: Filipe Manana Date: Wed Jun 4 16:54:44 2025 +0100 btrfs: fix race between async reclaim worker and close_ctree() Syzbot reported an assertion failure due to an attempt to add a delayed iput after we have set BTRFS_FS_STATE_NO_DELAYED_IPUT in the fs_info state: WARNING: CPU: 0 PID: 65 at fs/btrfs/inode.c:3420 btrfs_add_delayed_iput+0x2f8/0x370 fs/btrfs/inode.c:3420 Modules linked in: CPU: 0 UID: 0 PID: 65 Comm: kworker/u8:4 Not tainted 6.15.0-next-20250530-syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Workqueue: btrfs-endio-write btrfs_work_helper RIP: 0010:btrfs_add_delayed_iput+0x2f8/0x370 fs/btrfs/inode.c:3420 Code: 4e ad 5d (...) RSP: 0018:ffffc9000213f780 EFLAGS: 00010293 RAX: ffffffff83c635b7 RBX: ffff888058920000 RCX: ffff88801c769e00 RDX: 0000000000000000 RSI: 0000000000000100 RDI: 0000000000000000 RBP: 0000000000000001 R08: ffff888058921b67 R09: 1ffff1100b12436c R10: dffffc0000000000 R11: ffffed100b12436d R12: 0000000000000001 R13: dffffc0000000000 R14: ffff88807d748000 R15: 0000000000000100 FS: 0000000000000000(0000) GS:ffff888125c53000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00002000000bd038 CR3: 000000006a142000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: btrfs_put_ordered_extent+0x19f/0x470 fs/btrfs/ordered-data.c:635 btrfs_finish_one_ordered+0x11d8/0x1b10 fs/btrfs/inode.c:3312 btrfs_work_helper+0x399/0xc20 fs/btrfs/async-thread.c:312 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402 kthread+0x70e/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 This can happen due to a race with the async reclaim worker like this: 1) The async metadata reclaim worker enters shrink_delalloc(), which calls btrfs_start_delalloc_roots() with an nr_pages argument that has a value less than LONG_MAX, and that in turn enters start_delalloc_inodes(), which sets the local variable 'full_flush' to false because wbc->nr_to_write is less than LONG_MAX; 2) There it finds inode X in a root's delalloc list, grabs a reference for inode X (with igrab()), and triggers writeback for it with filemap_fdatawrite_wbc(), which creates an ordered extent for inode X; 3) The unmount sequence starts from another task, we enter close_ctree() and we flush the workqueue fs_info->endio_write_workers, which waits for the ordered extent for inode X to complete and when dropping the last reference of the ordered extent, with btrfs_put_ordered_extent(), when we call btrfs_add_delayed_iput() we don't add the inode to the list of delayed iputs because it has a refcount of 2, so we decrement it to 1 and return; 4) Shortly after at close_ctree() we call btrfs_run_delayed_iputs() which runs all delayed iputs, and then we set BTRFS_FS_STATE_NO_DELAYED_IPUT in the fs_info state; 5) The async reclaim worker, after calling filemap_fdatawrite_wbc(), now calls btrfs_add_delayed_iput() for inode X and there we trigger an assertion failure since the fs_info state has the flag BTRFS_FS_STATE_NO_DELAYED_IPUT set. Fix this by setting BTRFS_FS_STATE_NO_DELAYED_IPUT only after we wait for the async reclaim workers to finish, after we call cancel_work_sync() for them at close_ctree(), and by running delayed iputs after wait for the reclaim workers to finish and before setting the bit. This race was recently introduced by commit 19e60b2a95f5 ("btrfs: add extra warning if delayed iput is added when it's not allowed"). Without the new validation at btrfs_add_delayed_iput(), this described scenario was safe because close_ctree() later calls btrfs_commit_super(). That will run any final delayed iputs added by reclaim workers in the window between the btrfs_run_delayed_iputs() and the the reclaim workers being shut down. Reported-by: syzbot+0ed30ad435bf6f5b7a42@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/6840481c.a00a0220.d4325.000c.GAE@google.com/T/#u Fixes: 19e60b2a95f5 ("btrfs: add extra warning if delayed iput is added when it's not allowed") Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 1961d20f6fa8903266ed9bd77c691924c22c8f02 Author: Filipe Manana Date: Thu Jun 5 20:51:03 2025 +0100 btrfs: fix assertion when building free space tree When building the free space tree with the block group tree feature enabled, we can hit an assertion failure like this: BTRFS info (device loop0 state M): rebuilding free space tree assertion failed: ret == 0, in fs/btrfs/free-space-tree.c:1102 ------------[ cut here ]------------ kernel BUG at fs/btrfs/free-space-tree.c:1102! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP Modules linked in: CPU: 1 UID: 0 PID: 6592 Comm: syz-executor322 Not tainted 6.15.0-rc7-syzkaller-gd7fa1af5b33e #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : populate_free_space_tree+0x514/0x518 fs/btrfs/free-space-tree.c:1102 lr : populate_free_space_tree+0x514/0x518 fs/btrfs/free-space-tree.c:1102 sp : ffff8000a4ce7600 x29: ffff8000a4ce76e0 x28: ffff0000c9bc6000 x27: ffff0000ddfff3d8 x26: ffff0000ddfff378 x25: dfff800000000000 x24: 0000000000000001 x23: ffff8000a4ce7660 x22: ffff70001499cecc x21: ffff0000e1d8c160 x20: ffff0000e1cb7800 x19: ffff0000e1d8c0b0 x18: 00000000ffffffff x17: ffff800092f39000 x16: ffff80008ad27e48 x15: ffff700011e740c0 x14: 1ffff00011e740c0 x13: 0000000000000004 x12: ffffffffffffffff x11: ffff700011e740c0 x10: 0000000000ff0100 x9 : 94ef24f55d2dbc00 x8 : 94ef24f55d2dbc00 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000a4ce6f98 x4 : ffff80008f415ba0 x3 : ffff800080548ef0 x2 : 0000000000000000 x1 : 0000000100000000 x0 : 000000000000003e Call trace: populate_free_space_tree+0x514/0x518 fs/btrfs/free-space-tree.c:1102 (P) btrfs_rebuild_free_space_tree+0x14c/0x54c fs/btrfs/free-space-tree.c:1337 btrfs_start_pre_rw_mount+0xa78/0xe10 fs/btrfs/disk-io.c:3074 btrfs_remount_rw fs/btrfs/super.c:1319 [inline] btrfs_reconfigure+0x828/0x2418 fs/btrfs/super.c:1543 reconfigure_super+0x1d4/0x6f0 fs/super.c:1083 do_remount fs/namespace.c:3365 [inline] path_mount+0xb34/0xde0 fs/namespace.c:4200 do_mount fs/namespace.c:4221 [inline] __do_sys_mount fs/namespace.c:4432 [inline] __se_sys_mount fs/namespace.c:4409 [inline] __arm64_sys_mount+0x3e8/0x468 fs/namespace.c:4409 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 Code: f0047182 91178042 528089c3 9771d47b (d4210000) ---[ end trace 0000000000000000 ]--- This happens because we are processing an empty block group, which has no extents allocated from it, there are no items for this block group, including the block group item since block group items are stored in a dedicated tree when using the block group tree feature. It also means this is the block group with the highest start offset, so there are no higher keys in the extent root, hence btrfs_search_slot_for_read() returns 1 (no higher key found). Fix this by asserting 'ret' is 0 only if the block group tree feature is not enabled, in which case we should find a block group item for the block group since it's stored in the extent root and block group item keys are greater than extent item keys (the value for BTRFS_BLOCK_GROUP_ITEM_KEY is 192 and for BTRFS_EXTENT_ITEM_KEY and BTRFS_METADATA_ITEM_KEY the values are 168 and 169 respectively). In case 'ret' is 1, we just need to add a record to the free space tree which spans the whole block group, and we can achieve this by making 'ret == 0' as the while loop's condition. Reported-by: syzbot+36fae25c35159a763a2a@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/6841dca8.a00a0220.d4325.0020.GAE@google.com/ Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 16edae52f60658caeaa0702e7cb6b738a09d4ad4 Author: Filipe Manana Date: Tue Jun 3 22:06:17 2025 +0100 btrfs: don't silently ignore unexpected extent type when replaying log If there's an unexpected (invalid) extent type, we just silently ignore it. This means a corruption or some bug somewhere, so instead return -EUCLEAN to the caller, making log replay fail, and print an error message with relevant information. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 2dcf838cf5c2f0f4501edaa1680fcad03618d760 Author: Filipe Manana Date: Tue Jun 3 19:29:01 2025 +0100 btrfs: fix invalid inode pointer dereferences during log replay In a few places where we call read_one_inode(), if we get a NULL pointer we end up jumping into an error path, or fallthrough in case of __add_inode_ref(), where we then do something like this: iput(&inode->vfs_inode); which results in an invalid inode pointer that triggers an invalid memory access, resulting in a crash. Fix this by making sure we don't do such dereferences. Fixes: b4c50cbb01a1 ("btrfs: return a btrfs_inode from read_one_inode()") CC: stable@vger.kernel.org # 6.15+ Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit e5b5596011773a38e035e9633ed928ef13c720b1 Author: Filipe Manana Date: Tue Jun 3 19:45:35 2025 +0100 btrfs: fix double unlock of buffer_tree xarray when releasing subpage eb If we break out of the loop because an extent buffer doesn't have the bit EXTENT_BUFFER_TREE_REF set, we end up unlocking the xarray twice, once before we tested for the bit and break out of the loop, and once again after the loop. Fix this by testing the bit and exiting before unlocking the xarray. The time spent testing the bit is negligible and it's not worth trying to do that outside the critical section delimited by the xarray lock due to the code complexity required to avoid it (like using a local boolean variable to track whether the xarray is locked or not). The xarray unlock only needs to be done before calling release_extent_buffer(), as that needs to lock the xarray (through xa_cmpxchg_irq()) and does a more significant amount of work. Fixes: 19d7f65f032f ("btrfs: convert the buffer_radix to an xarray") Reported-by: Dan Carpenter Link: https://lore.kernel.org/linux-btrfs/aDRNDU0GM1_D4Xnw@stanley.mountain/ Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit ae4477f937569d097ca5dbce92a89ba384b49bc6 Author: Mark Harmstone Date: Thu May 29 10:37:44 2025 +0100 btrfs: update superblock's device bytes_used when dropping chunk Each superblock contains a copy of the device item for that device. In a transaction which drops a chunk but doesn't create any new ones, we were correctly updating the device item in the chunk tree but not copying over the new bytes_used value to the superblock. This can be seen by doing the following: # dd if=/dev/zero of=test bs=4096 count=2621440 # mkfs.btrfs test # mount test /root/temp # cd /root/temp # for i in {00..10}; do dd if=/dev/zero of=$i bs=4096 count=32768; done # sync # rm * # sync # btrfs balance start -dusage=0 . # sync # cd # umount /root/temp # btrfs check test For btrfs-check to detect this, you will also need my patch at https://github.com/kdave/btrfs-progs/pull/991. Change btrfs_remove_dev_extents() so that it adds the devices to the fs_info->post_commit_list if they're not there already. This causes btrfs_commit_device_sizes() to be called, which updates the bytes_used value in the superblock. Fixes: bbbf7243d62d ("btrfs: combine device update operations during transaction commit") CC: stable@vger.kernel.org # 5.10+ Reviewed-by: Qu Wenruo Signed-off-by: Mark Harmstone Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3ca864de852bc91007b32d2a0d48993724f4abad Author: Filipe Manana Date: Wed May 28 12:28:27 2025 +0100 btrfs: fix a race between renames and directory logging We have a race between a rename and directory inode logging that if it happens and we crash/power fail before the rename completes, the next time the filesystem is mounted, the log replay code will end up deleting the file that was being renamed. This is best explained following a step by step analysis of an interleaving of steps that lead into this situation. Consider the initial conditions: 1) We are at transaction N; 2) We have directories A and B created in a past transaction (< N); 3) We have inode X corresponding to a file that has 2 hardlinks, one in directory A and the other in directory B, so we'll name them as "A/foo_link1" and "B/foo_link2". Both hard links were persisted in a past transaction (< N); 4) We have inode Y corresponding to a file that as a single hard link and is located in directory A, we'll name it as "A/bar". This file was also persisted in a past transaction (< N). The steps leading to a file loss are the following and for all of them we are under transaction N: 1) Link "A/foo_link1" is removed, so inode's X last_unlink_trans field is updated to N, through btrfs_unlink() -> btrfs_record_unlink_dir(); 2) Task A starts a rename for inode Y, with the goal of renaming from "A/bar" to "A/baz", so we enter btrfs_rename(); 3) Task A inserts the new BTRFS_INODE_REF_KEY for inode Y by calling btrfs_insert_inode_ref(); 4) Because the rename happens in the same directory, we don't set the last_unlink_trans field of directoty A's inode to the current transaction id, that is, we don't cal btrfs_record_unlink_dir(); 5) Task A then removes the entries from directory A (BTRFS_DIR_ITEM_KEY and BTRFS_DIR_INDEX_KEY items) when calling __btrfs_unlink_inode() (actually the dir index item is added as a delayed item, but the effect is the same); 6) Now before task A adds the new entry "A/baz" to directory A by calling btrfs_add_link(), another task, task B is logging inode X; 7) Task B starts a fsync of inode X and after logging inode X, at btrfs_log_inode_parent() it calls btrfs_log_all_parents(), since inode X has a last_unlink_trans value of N, set at in step 1; 8) At btrfs_log_all_parents() we search for all parent directories of inode X using the commit root, so we find directories A and B and log them. Bu when logging direct A, we don't have a dir index item for inode Y anymore, neither the old name "A/bar" nor for the new name "A/baz" since the rename has deleted the old name but has not yet inserted the new name - task A hasn't called yet btrfs_add_link() to do that. Note that logging directory A doesn't fallback to a transaction commit because its last_unlink_trans has a lower value than the current transaction's id (see step 4); 9) Task B finishes logging directories A and B and gets back to btrfs_sync_file() where it calls btrfs_sync_log() to persist the log tree; 10) Task B successfully persisted the log tree, btrfs_sync_log() completed with success, and a power failure happened. We have a log tree without any directory entry for inode Y, so the log replay code deletes the entry for inode Y, name "A/bar", from the subvolume tree since it doesn't exist in the log tree and the log tree is authorative for its index (we logged a BTRFS_DIR_LOG_INDEX_KEY item that covers the index range for the dentry that corresponds to "A/bar"). Since there's no other hard link for inode Y and the log replay code deletes the name "A/bar", the file is lost. The issue wouldn't happen if task B synced the log only after task A called btrfs_log_new_name(), which would update the log with the new name for inode Y ("A/bar"). Fix this by pinning the log root during renames before removing the old directory entry, and unpinning after btrfs_log_new_name() is called. Fixes: 259c4b96d78d ("btrfs: stop doing unnecessary log updates during a rename") CC: stable@vger.kernel.org # 5.18+ Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 65d5112b4d7cf019ccb62cf40077038aae66239b Author: Anand Jain Date: Tue May 20 19:42:23 2025 +0800 btrfs: scrub: add prefix for the error messages Add a "scrub: " prefix to all messages logged by scrub so that it's easy to filter them from dmesg for analysis. Reviewed-by: Filipe Manana Reviewed-by: Qu Wenruo Signed-off-by: Anand Jain Reviewed-by: David Sterba Signed-off-by: David Sterba commit 186b9dc3c302ad706b3f23c857eb128165f6b484 Author: Leo Martins Date: Tue May 27 17:04:22 2025 -0700 btrfs: warn if leaking delayed_nodes in btrfs_put_root() Add a warning for leaked delayed_nodes when putting a root. We currently do this for inodes, but not delayed_nodes. Signed-off-by: Leo Martins Reviewed-by: Filipe Manana Reviewed-by: Qu Wenruo [ Remove the changelog from the commit message. ] Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit dd276214e439db08f444fd3e07e9fe4c9e0ca210 Author: Leo Martins Date: Tue May 27 17:04:21 2025 -0700 btrfs: fix delayed ref refcount leak in debug assertion If the delayed_root is not empty we are increasing the number of references to a delayed_node without decreasing it, causing a leak. Fix by decrementing the delayed_node reference count. Reviewed-by: Filipe Manana Signed-off-by: Leo Martins Reviewed-by: Qu Wenruo [ Remove the changelog from the commit message. ] Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit c769be2d3dbb165a3d432f4fcca2c80fabb35877 Author: Filipe Manana Date: Thu May 22 16:10:00 2025 +0100 btrfs: include root in error message when unlinking inode To help debugging include the root number in the error message, and since this is a critical error that implies a metadata inconsistency and results in a transaction abort change the log message level from "info" to "critical", which is a much better fit. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 04c5355b2a94ff3191ce63ab035fb7f04d036869 Author: Mark Rutland Date: Tue Jun 17 14:37:18 2025 +0100 KVM: arm64: VHE: Centralize ISBs when returning to host The VHE hyp code has recently gained a few ISBs. Simplify this to one unconditional ISB in __kvm_vcpu_run_vhe(), and remove the unnecessary ISB from the kvm_call_hyp_ret() macro. While kvm_call_hyp_ret() is also used to invoke __vgic_v3_get_gic_config(), but no ISB is necessary in that case either. For the moment, an ISB is left in kvm_call_hyp(), as there are many more users, and removing the ISB would require a more thorough audit. Suggested-by: Marc Zyngier Signed-off-by: Mark Rutland Cc: Catalin Marinas Cc: Fuad Tabba Cc: Marc Zyngier Cc: Mark Brown Cc: Oliver Upton Cc: Will Deacon Link: https://lore.kernel.org/r/20250617133718.4014181-8-mark.rutland@arm.com Signed-off-by: Marc Zyngier commit 3a300a33e4063fb44c7887bec3aecd2fd6966df8 Author: Mark Rutland Date: Tue Jun 17 14:37:17 2025 +0100 KVM: arm64: Remove cpacr_clear_set() We no longer use cpacr_clear_set(). Remove cpacr_clear_set() and its helper functions. Signed-off-by: Mark Rutland Cc: Catalin Marinas Cc: Fuad Tabba Cc: Marc Zyngier Cc: Mark Brown Cc: Oliver Upton Cc: Will Deacon Link: https://lore.kernel.org/r/20250617133718.4014181-7-mark.rutland@arm.com Signed-off-by: Marc Zyngier commit 186b58bacd74d9b7892869f7c7d20cf865a3c237 Author: Mark Rutland Date: Tue Jun 17 14:37:16 2025 +0100 KVM: arm64: Remove ad-hoc CPTR manipulation from kvm_hyp_handle_fpsimd() The hyp code FPSIMD/SVE/SME trap handling logic has some rather messy open-coded manipulation of CPTR/CPACR. This is benign for non-nested guests, but broken for nested guests, as the guest hypervisor's CPTR configuration is not taken into account. Consider the case where L0 provides FPSIMD+SVE to an L1 guest hypervisor, and the L1 guest hypervisor only provides FPSIMD to an L2 guest (with L1 configuring CPTR/CPACR to trap SVE usage from L2). If the L2 guest triggers an FPSIMD trap to the L0 hypervisor, kvm_hyp_handle_fpsimd() will see that the vCPU supports FPSIMD+SVE, and will configure CPTR/CPACR to NOT trap FPSIMD+SVE before returning to the L2 guest. Consequently the L2 guest would be able to manipulate SVE state even though the L1 hypervisor had configured CPTR/CPACR to forbid this. Clean this up, and fix the nested virt issue by always using __deactivate_cptr_traps() and __activate_cptr_traps() to manage the CPTR traps. This removes the need for the ad-hoc fixup in kvm_hyp_save_fpsimd_host(), and ensures that any guest hypervisor configuration of CPTR/CPACR is taken into account. Signed-off-by: Mark Rutland Cc: Catalin Marinas Cc: Fuad Tabba Cc: Marc Zyngier Cc: Mark Brown Cc: Oliver Upton Cc: Will Deacon Link: https://lore.kernel.org/r/20250617133718.4014181-6-mark.rutland@arm.com Signed-off-by: Marc Zyngier commit 59e6e101a6fa542a365dd5858affd18ba3e84cb8 Author: Mark Rutland Date: Tue Jun 17 14:37:15 2025 +0100 KVM: arm64: Remove ad-hoc CPTR manipulation from fpsimd_sve_sync() There's no need for fpsimd_sve_sync() to write to CPTR/CPACR. All relevant traps are always disabled earlier within __kvm_vcpu_run(), when __deactivate_cptr_traps() configures CPTR/CPACR. With irrelevant details elided, the flow is: handle___kvm_vcpu_run(...) { flush_hyp_vcpu(...) { fpsimd_sve_flush(...); } __kvm_vcpu_run(...) { __activate_traps(...) { __activate_cptr_traps(...); } do { __guest_enter(...); } while (...); __deactivate_traps(....) { __deactivate_cptr_traps(...); } } sync_hyp_vcpu(...) { fpsimd_sve_sync(...); } } Remove the unnecessary write to CPTR/CPACR. An ISB is still necessary, so a comment is added to describe this requirement. Signed-off-by: Mark Rutland Cc: Catalin Marinas Cc: Fuad Tabba Cc: Marc Zyngier Cc: Mark Brown Cc: Oliver Upton Cc: Will Deacon Link: https://lore.kernel.org/r/20250617133718.4014181-5-mark.rutland@arm.com Signed-off-by: Marc Zyngier commit e62dd507844fa47f0fdc29f3be5a90a83f297820 Author: Mark Rutland Date: Tue Jun 17 14:37:14 2025 +0100 KVM: arm64: Reorganise CPTR trap manipulation The NVHE/HVHE and VHE modes have separate implementations of __activate_cptr_traps() and __deactivate_cptr_traps() in their respective switch.c files. There's some duplication of logic, and it's not currently possible to reuse this logic elsewhere. Move the logic into the common switch.h header so that it can be reused, and de-duplicate the common logic. This rework changes the way SVE traps are deactivated in VHE mode, aligning it with NVHE/HVHE modes: * Before this patch, VHE's __deactivate_cptr_traps() would unconditionally enable SVE for host EL2 (but not EL0), regardless of whether the ARM64_SVE cpucap was set. * After this patch, VHE's __deactivate_cptr_traps() will take the ARM64_SVE cpucap into account. When ARM64_SVE is not set, SVE will be trapped from EL2 and below. The old and new behaviour are both benign: * When ARM64_SVE is not set, the host will not touch SVE state, and will not reconfigure SVE traps. Host EL0 access to SVE will be trapped as expected. * When ARM64_SVE is set, the host will configure EL0 SVE traps before returning to EL0 as part of reloading the EL0 FPSIMD/SVE/SME state. Signed-off-by: Mark Rutland Cc: Catalin Marinas Cc: Fuad Tabba Cc: Marc Zyngier Cc: Mark Brown Cc: Oliver Upton Cc: Will Deacon Link: https://lore.kernel.org/r/20250617133718.4014181-4-mark.rutland@arm.com Signed-off-by: Marc Zyngier commit 257d0aa8e2502754bc758faceceb6ff59318af60 Author: Mark Rutland Date: Tue Jun 17 14:37:13 2025 +0100 KVM: arm64: VHE: Synchronize CPTR trap deactivation Currently there is no ISB between __deactivate_cptr_traps() disabling traps that affect EL2 and fpsimd_lazy_switch_to_host() manipulating registers potentially affected by CPTR traps. When NV is not in use, this is safe because the relevant registers are only accessed when guest_owns_fp_regs() && vcpu_has_sve(vcpu), and this also implies that SVE traps affecting EL2 have been deactivated prior to __guest_entry(). When NV is in use, a guest hypervisor may have configured SVE traps for a nested context, and so it is necessary to have an ISB between __deactivate_cptr_traps() and fpsimd_lazy_switch_to_host(). Due to the current lack of an ISB, when a guest hypervisor enables SVE traps in CPTR, the host can take an unexpected SVE trap from within fpsimd_lazy_switch_to_host(), e.g. | Unhandled 64-bit el1h sync exception on CPU1, ESR 0x0000000066000000 -- SVE | CPU: 1 UID: 0 PID: 164 Comm: kvm-vcpu-0 Not tainted 6.15.0-rc4-00138-ga05e0f012c05 #3 PREEMPT | Hardware name: FVP Base RevC (DT) | pstate: 604023c9 (nZCv DAIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : __kvm_vcpu_run+0x6f4/0x844 | lr : __kvm_vcpu_run+0x150/0x844 | sp : ffff800083903a60 | x29: ffff800083903a90 x28: ffff000801f4a300 x27: 0000000000000000 | x26: 0000000000000000 x25: ffff000801f90000 x24: ffff000801f900f0 | x23: ffff800081ff7720 x22: 0002433c807d623f x21: ffff000801f90000 | x20: ffff00087f730730 x19: 0000000000000000 x18: 0000000000000000 | x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 | x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 | x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 | x8 : 0000000000000000 x7 : 0000000000000000 x6 : ffff000801f90d70 | x5 : 0000000000001000 x4 : ffff8007fd739000 x3 : ffff000801f90000 | x2 : 0000000000000000 x1 : 00000000000003cc x0 : ffff800082f9d000 | Kernel panic - not syncing: Unhandled exception | CPU: 1 UID: 0 PID: 164 Comm: kvm-vcpu-0 Not tainted 6.15.0-rc4-00138-ga05e0f012c05 #3 PREEMPT | Hardware name: FVP Base RevC (DT) | Call trace: | show_stack+0x18/0x24 (C) | dump_stack_lvl+0x60/0x80 | dump_stack+0x18/0x24 | panic+0x168/0x360 | __panic_unhandled+0x68/0x74 | el1h_64_irq_handler+0x0/0x24 | el1h_64_sync+0x6c/0x70 | __kvm_vcpu_run+0x6f4/0x844 (P) | kvm_arm_vcpu_enter_exit+0x64/0xa0 | kvm_arch_vcpu_ioctl_run+0x21c/0x870 | kvm_vcpu_ioctl+0x1a8/0x9d0 | __arm64_sys_ioctl+0xb4/0xf4 | invoke_syscall+0x48/0x104 | el0_svc_common.constprop.0+0x40/0xe0 | do_el0_svc+0x1c/0x28 | el0_svc+0x30/0xcc | el0t_64_sync_handler+0x10c/0x138 | el0t_64_sync+0x198/0x19c | SMP: stopping secondary CPUs | Kernel Offset: disabled | CPU features: 0x0000,000002c0,02df4fb9,97ee773f | Memory Limit: none | ---[ end Kernel panic - not syncing: Unhandled exception ]--- Fix this by adding an ISB between __deactivate_traps() and fpsimd_lazy_switch_to_host(). Signed-off-by: Mark Rutland Cc: Catalin Marinas Cc: Fuad Tabba Cc: Marc Zyngier Cc: Mark Brown Cc: Oliver Upton Cc: Will Deacon Link: https://lore.kernel.org/r/20250617133718.4014181-3-mark.rutland@arm.com Signed-off-by: Marc Zyngier commit cade3d57e456e69f67aa9894bf89dc8678796bb7 Author: Mark Rutland Date: Tue Jun 17 14:37:12 2025 +0100 KVM: arm64: VHE: Synchronize restore of host debug registers When KVM runs in non-protected VHE mode, there's no context synchronization event between __debug_switch_to_host() restoring the host debug registers and __kvm_vcpu_run() unmasking debug exceptions. Due to this, it's theoretically possible for the host to take an unexpected debug exception due to the stale guest configuration. This cannot happen in NVHE/HVHE mode as debug exceptions are masked in the hyp code, and the exception return to the host will provide the necessary context synchronization before debug exceptions can be taken. For now, avoid the problem by adding an ISB after VHE hyp code restores the host debug registers. Signed-off-by: Mark Rutland Cc: Catalin Marinas Cc: Fuad Tabba Cc: Marc Zyngier Cc: Mark Brown Cc: Oliver Upton Cc: Will Deacon Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250617133718.4014181-2-mark.rutland@arm.com Signed-off-by: Marc Zyngier commit d36f0e9a0002f04f4d6dd9be908d58fe5bd3a279 Author: Aidan Stewart Date: Tue Jun 17 10:48:19 2025 -0600 serial: core: restore of_node information in sysfs Since in v6.8-rc1, the of_node symlink under tty devices is missing. This breaks any udev rules relying on this information. Link the of_node information in the serial controller device with the parent defined in the device tree. This will also apply to the serial device which takes the serial controller as a parent device. Fixes: b286f4e87e32 ("serial: core: Move tty and serdev to be children of serial core port device") Cc: stable@vger.kernel.org Signed-off-by: Aidan Stewart Link: https://lore.kernel.org/r/20250617164819.13912-1-astewart@tektelic.com Signed-off-by: Greg Kroah-Hartman commit 747b52413effe958ed57cf6d7bef80c34e1185f3 Author: Randy Dunlap Date: Tue Jun 10 19:02:29 2025 -0700 vt: fix kernel-doc warnings in ucs_get_fallback() Use the correct function parameter name in ucs_get_fallback() to prevent kernel-doc warnings: Warning: drivers/tty/vt/ucs.c:218 function parameter 'cp' not described in 'ucs_get_fallback' Warning: drivers/tty/vt/ucs.c:218 Excess function parameter 'base' description in 'ucs_get_fallback' Fixes: fe26933cf1e1 ("vt: add ucs_get_fallback()") Signed-off-by: Randy Dunlap Cc: Nicolas Pitre Cc: Greg Kroah-Hartman Cc: Jiri Slaby Cc: linux-serial@vger.kernel.org Reviewed-by: Nicolas Pitre . Link: https://lore.kernel.org/r/20250611020229.2650595-1-rdunlap@infradead.org Signed-off-by: Greg Kroah-Hartman commit ff78538e07fa284ce08cbbcb0730daa91ed16722 Author: Nicolas Pitre Date: Tue Jun 10 21:41:44 2025 -0400 vt: add missing notification when switching back to text mode Programs using poll() on /dev/vcsa to be notified when VT changes occur were missing one case: the switch from gfx to text mode. Signed-off-by: Nicolas Pitre Link: https://lore.kernel.org/r/9o5ro928-0pp4-05rq-70p4-ro385n21n723@onlyvoer.pbz Signed-off-by: Greg Kroah-Hartman commit f5de469990f19569627ea0dd56536ff5a13beaa3 Author: Masami Hiramatsu (Google) Date: Thu Jun 12 20:26:10 2025 +0900 mtk-sd: Prevent memory corruption from DMA map failure If msdc_prepare_data() fails to map the DMA region, the request is not prepared for data receiving, but msdc_start_data() proceeds the DMA with previous setting. Since this will lead a memory corruption, we have to stop the request operation soon after the msdc_prepare_data() fails to prepare it. Signed-off-by: Masami Hiramatsu (Google) Fixes: 208489032bdd ("mmc: mediatek: Add Mediatek MMC driver") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/174972756982.3337526.6755001617701603082.stgit@mhiramat.tok.corp.google.com Signed-off-by: Ulf Hansson commit 7aed15379db9c6ec67999cdaf5c443b7be06ea73 Author: Roy Luo Date: Thu May 22 19:09:12 2025 +0000 Revert "usb: xhci: Implement xhci_handshake_check_state() helper" This reverts commit 6ccb83d6c4972ebe6ae49de5eba051de3638362c. Commit 6ccb83d6c497 ("usb: xhci: Implement xhci_handshake_check_state() helper") was introduced to workaround watchdog timeout issues on some platforms, allowing xhci_reset() to bail out early without waiting for the reset to complete. Skipping the xhci handshake during a reset is a dangerous move. The xhci specification explicitly states that certain registers cannot be accessed during reset in section 5.4.1 USB Command Register (USBCMD), Host Controller Reset (HCRST) field: "This bit is cleared to '0' by the Host Controller when the reset process is complete. Software cannot terminate the reset process early by writinga '0' to this bit and shall not write any xHC Operational or Runtime registers until while HCRST is '1'." This behavior causes a regression on SNPS DWC3 USB controller with dual-role capability. When the DWC3 controller exits host mode and removes xhci while a reset is still in progress, and then tries to configure its hardware for device mode, the ongoing reset leads to register access issues; specifically, all register reads returns 0. These issues extend beyond the xhci register space (which is expected during a reset) and affect the entire DWC3 IP block, causing the DWC3 device mode to malfunction. Cc: stable Fixes: 6ccb83d6c497 ("usb: xhci: Implement xhci_handshake_check_state() helper") Signed-off-by: Roy Luo Link: https://lore.kernel.org/r/20250522190912.457583-3-royluo@google.com Signed-off-by: Greg Kroah-Hartman commit 3eff494f6e17abf932699483f133a708ac0355dc Author: Roy Luo Date: Thu May 22 19:09:11 2025 +0000 usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed xhci_reset() currently returns -ENODEV if XHCI_STATE_REMOVING is set, without completing the xhci handshake, unless the reset completes exceptionally quickly. This behavior causes a regression on Synopsys DWC3 USB controllers with dual-role capabilities. Specifically, when a DWC3 controller exits host mode and removes xhci while a reset is still in progress, and then attempts to configure its hardware for device mode, the ongoing, incomplete reset leads to critical register access issues. All register reads return zero, not just within the xHCI register space (which might be expected during a reset), but across the entire DWC3 IP block. This patch addresses the issue by preventing xhci_reset() from being called in xhci_resume() and bailing out early in the reinit flow when XHCI_STATE_REMOVING is set. Cc: stable Fixes: 6ccb83d6c497 ("usb: xhci: Implement xhci_handshake_check_state() helper") Suggested-by: Mathias Nyman Signed-off-by: Roy Luo Link: https://lore.kernel.org/r/20250522190912.457583-2-royluo@google.com Signed-off-by: Greg Kroah-Hartman commit c529c3730bd09115684644e26bf01ecbd7e2c2c9 Author: Kuen-Han Tsai Date: Tue Jun 17 13:07:12 2025 +0800 usb: gadget: u_serial: Fix race condition in TTY wakeup A race condition occurs when gs_start_io() calls either gs_start_rx() or gs_start_tx(), as those functions briefly drop the port_lock for usb_ep_queue(). This allows gs_close() and gserial_disconnect() to clear port.tty and port_usb, respectively. Use the null-safe TTY Port helper function to wake up TTY. Example CPU1: CPU2: gserial_connect() // lock gs_close() // await lock gs_start_rx() // unlock usb_ep_queue() gs_close() // lock, reset port.tty and unlock gs_start_rx() // lock tty_wakeup() // NPE Fixes: 35f95fd7f234 ("TTY: usb/u_serial, use tty from tty_port") Cc: stable Signed-off-by: Kuen-Han Tsai Reviewed-by: Prashanth K Link: https://lore.kernel.org/linux-usb/20240116141801.396398-1-khtsai@google.com/ Link: https://lore.kernel.org/r/20250617050844.1848232-2-khtsai@google.com Signed-off-by: Greg Kroah-Hartman commit f6c7bc4a6823a0a959f40866a1efe99bd03c2c5b Author: Kuen-Han Tsai Date: Tue Jun 17 13:07:11 2025 +0800 Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" This reverts commit ffd603f214237e250271162a5b325c6199a65382. Commit ffd603f21423 ("usb: gadget: u_serial: Add null pointer check in gs_start_io") adds null pointer checks at the beginning of the gs_start_io() function to prevent a null pointer dereference. However, these checks are redundant because the function's comment already requires callers to hold the port_lock and ensure port.tty and port_usb are not null. All existing callers already follow these rules. The true cause of the null pointer dereference is a race condition. When gs_start_io() calls either gs_start_rx() or gs_start_tx(), the port_lock is temporarily released for usb_ep_queue(). This allows port.tty and port_usb to be cleared. Fixes: ffd603f21423 ("usb: gadget: u_serial: Add null pointer check in gs_start_io") Cc: stable Signed-off-by: Kuen-Han Tsai Reviewed-by: Prashanth K Link: https://lore.kernel.org/r/20250617050844.1848232-1-khtsai@google.com Signed-off-by: Greg Kroah-Hartman commit 31a6afbe86e8e9deba9ab53876ec49eafc7fd901 Author: Xu Yang Date: Sat Jun 14 20:49:14 2025 +0800 usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume Shawn and John reported a hang issue during system suspend as below: - USB gadget is enabled as Ethernet - There is data transfer over USB Ethernet (scp a big file between host and device) - Device is going in/out suspend (echo mem > /sys/power/state) The root cause is the USB device controller is suspended but the USB bus is still active which caused the USB host continues to transfer data with device and the device continues to queue USB requests (in this case, a delayed TCP ACK packet trigger the issue) after controller is suspended, however the USB controller clock is already gated off. Then if udc driver access registers after that point, the system will hang. The correct way to avoid such issue is to disconnect device from host when the USB bus is not at suspend state. Then the host will receive disconnect event and stop data transfer in time. To continue make USB gadget device work after system resume, this will reconnect device automatically. To make usb wakeup work if USB bus is already at suspend state, this will keep connection for it only when USB device controller has enabled wakeup capability. Reported-by: Shawn Guo Reported-by: John Ernberg Closes: https://lore.kernel.org/linux-usb/aEZxmlHmjeWcXiF3@dragon/ Tested-by: John Ernberg # iMX8QXP Fixes: 235ffc17d014 ("usb: chipidea: udc: add suspend/resume support for device controller") Cc: stable Reviewed-by: Jun Li Signed-off-by: Xu Yang Acked-by: Peter Chen Link: https://lore.kernel.org/r/20250614124914.207540-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit 3b18405763c1ebb1efc15feef5563c9cdb2cc3a7 Author: Heikki Krogerus Date: Wed Jun 11 14:14:15 2025 +0300 usb: acpi: fix device link removal The device link to the USB4 host interface has to be removed manually since it's no longer auto removed. Fixes: 623dae3e7084 ("usb: acpi: fix boot hang due to early incorrect 'tunneled' USB3 device links") Cc: stable Signed-off-by: Heikki Krogerus Reviewed-by: Mika Westerberg Link: https://lore.kernel.org/r/20250611111415.2707865-1-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 8f5b7e2bec1c36578fdaa74a6951833541103e27 Author: Mathias Nyman Date: Wed Jun 11 14:24:41 2025 +0300 usb: hub: fix detection of high tier USB3 devices behind suspended hubs USB3 devices connected behind several external suspended hubs may not be detected when plugged in due to aggressive hub runtime pm suspend. The hub driver immediately runtime-suspends hubs if there are no active children or port activity. There is a delay between the wake signal causing hub resume, and driver visible port activity on the hub downstream facing ports. Most of the LFPS handshake, resume signaling and link training done on the downstream ports is not visible to the hub driver until completed, when device then will appear fully enabled and running on the port. This delay between wake signal and detectable port change is even more significant with chained suspended hubs where the wake signal will propagate upstream first. Suspended hubs will only start resuming downstream ports after upstream facing port resumes. The hub driver may resume a USB3 hub, read status of all ports, not yet see any activity, and runtime suspend back the hub before any port activity is visible. This exact case was seen when conncting USB3 devices to a suspended Thunderbolt dock. USB3 specification defines a 100ms tU3WakeupRetryDelay, indicating USB3 devices expect to be resumed within 100ms after signaling wake. if not then device will resend the wake signal. Give the USB3 hubs twice this time (200ms) to detect any port changes after resume, before allowing hub to runtime suspend again. Cc: stable Fixes: 2839f5bcfcfc ("USB: Turn on auto-suspend for USB 3.0 hubs.") Acked-by: Alan Stern Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20250611112441.2267883-1-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit cee4392a57e14a799fbdee193bc4c0de65b29521 Author: Oliver Neukum Date: Thu Jun 5 14:28:45 2025 +0200 Logitech C-270 even more broken Some varieties of this device don't work with RESET_RESUME alone. Signed-off-by: Oliver Neukum Cc: stable Link: https://lore.kernel.org/r/20250605122852.1440382-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit 630a1dec3b0eba2a695b9063f1c205d585cbfec9 Author: Kuen-Han Tsai Date: Wed May 28 18:03:11 2025 +0800 usb: dwc3: Abort suspend on soft disconnect failure When dwc3_gadget_soft_disconnect() fails, dwc3_suspend_common() keeps going with the suspend, resulting in a period where the power domain is off, but the gadget driver remains connected. Within this time frame, invoking vbus_event_work() will cause an error as it attempts to access DWC3 registers for endpoint disabling after the power domain has been completely shut down. Abort the suspend sequence when dwc3_gadget_suspend() cannot halt the controller and proceeds with a soft connect. Fixes: 9f8a67b65a49 ("usb: dwc3: gadget: fix gadget suspend/resume") Cc: stable Acked-by: Thinh Nguyen Signed-off-by: Kuen-Han Tsai Link: https://lore.kernel.org/r/20250528100315.2162699-1-khtsai@google.com Signed-off-by: Greg Kroah-Hartman commit 7e2c421ef88e9da9c39e01496b7f5b0b354b42bc Author: Peter Chen Date: Thu Jun 19 09:34:13 2025 +0800 usb: cdnsp: do not disable slot for disabled slot It doesn't need to do it, and the related command event returns 'Slot Not Enabled Error' status. Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver") Cc: stable Suggested-by: Hongliang Yang Reviewed-by: Fugang Duan Signed-off-by: Peter Chen Link: https://lore.kernel.org/r/20250619013413.35817-1-peter.chen@cixtech.com Signed-off-by: Greg Kroah-Hartman commit 5bd1bafd4474ee26f504b41aba11f3e2a1175b88 Author: Jakub Kicinski Date: Mon Jun 16 12:55:10 2025 -0700 eth: fbnic: avoid double free when failing to DMA-map FW msg The semantics are that caller of fbnic_mbx_map_msg() retains the ownership of the message on error. All existing callers dutifully free the page. Fixes: da3cde08209e ("eth: fbnic: Add FW communication mechanism") Reviewed-by: Alexander Duyck Signed-off-by: Jakub Kicinski Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250616195510.225819-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit d9d79e4f7dc935fea96dbf3de524404c08d08b03 Author: Arnd Bergmann Date: Tue May 20 17:40:43 2025 +0200 mfd: Fix building without CONFIG_OF Using the of_fwnode_handle() means that local 'node' variables are unused whenever CONFIG_OF is disabled for compile testing: drivers/mfd/88pm860x-core.c: In function 'device_irq_init': drivers/mfd/88pm860x-core.c:576:29: error: unused variable 'node' [-Werror=unused-variable] 576 | struct device_node *node = i2c->dev.of_node; | ^~~~ drivers/mfd/max8925-core.c: In function 'max8925_irq_init': drivers/mfd/max8925-core.c:659:29: error: unused variable 'node' [-Werror=unused-variable] 659 | struct device_node *node = chip->dev->of_node; | ^~~~ drivers/mfd/twl4030-irq.c: In function 'twl4030_init_irq': drivers/mfd/twl4030-irq.c:679:46: error: unused variable 'node' [-Werror=unused-variable] 679 | struct device_node *node = dev->of_node; | ^~~~ Replace these with the corresponding dev_fwnode() lookups that keep the code simpler in addition to avoiding the warnings. Fixes: e3d44f11da04 ("mfd: Switch to irq_domain_create_*()") Signed-off-by: Arnd Bergmann Reviewed-by: Jiri Slaby Link: https://lore.kernel.org/r/20250520154106.2019525-1-arnd@kernel.org Signed-off-by: Lee Jones commit 56a14984505b11674df5e01407748236bc4bc8f8 Author: Zenghui Yu Date: Sun Jun 8 17:54:02 2025 +0800 KVM: arm64: selftests: Close the GIC FD in arch_timer_edge_cases Close the GIC FD to free the reference it holds to the VM so that we can correctly clean up the VM. This also gets rid of the "KVM: debugfs: duplicate directory 395722-4" warning when running arch_timer_edge_cases. Signed-off-by: Zenghui Yu Reviewed-by: Miguel Luis Reviewed-by: Sebastian Ott Link: https://lore.kernel.org/r/20250608095402.1131-1-yuzenghui@huawei.com Signed-off-by: Marc Zyngier commit 1fbe6861a6d9a942fb8ab8677ddf1ecb86b1af60 Author: Sean Christopherson Date: Wed Jun 11 15:45:04 2025 -0700 KVM: arm64: Explicitly treat routing entry type changes as changes Explicitly treat type differences as GSI routing changes, as comparing MSI data between two entries could get a false negative, e.g. if userspace changed the type but left the type-specific data as- Note, the same bug was fixed in x86 by commit bcda70c56f3e ("KVM: x86: Explicitly treat routing entry type changes as changes"). Fixes: 4bf3693d36af ("KVM: arm64: Unmap vLPIs affected by changes to GSI routing information") Signed-off-by: Sean Christopherson Reviewed-by: Oliver Upton Link: https://lore.kernel.org/r/20250611224604.313496-3-seanjc@google.com Signed-off-by: Marc Zyngier commit 8a8ff069c7ad9a359c54683329883e2432cff191 Author: Marc Zyngier Date: Sun Jun 15 16:11:38 2025 +0100 KVM: arm64: nv: Fix tracking of shadow list registers Wei-Lin reports that the tracking of shadow list registers is majorly broken when resync'ing the L2 state after a run, as we confuse the guest's LR index with the host's, potentially losing the interrupt state. While this could be fixed by adding yet another side index to track it (Wei-Lin's fix), it may be better to refactor this code to avoid having a side index altogether, limiting the risk to introduce this class of bugs. A key observation is that the shadow index is always the number of bits in the lr_map bitmap. With that, the parallel indexing scheme can be completely dropped. While doing this, introduce a couple of helpers that abstract the index conversion and some of the LR repainting, making the whole exercise much simpler. Reported-by: Wei-Lin Chang Reviewed-by: Wei-Lin Chang Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20250614145721.2504524-1-r09922117@csie.ntu.edu.tw Link: https://lore.kernel.org/r/86qzzkc5xa.wl-maz@kernel.org commit 0bdaca0922175478ddeadf8e515faa5269f6fae6 Author: Tim Harvey Date: Wed Jun 4 15:56:30 2025 -0700 arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency The IMX8MPDS Table 37 [1] shows that the max SPI master read frequency depends on the pins the interface is muxed behind with ECSPI2 muxed behind ECSPI2 supporting up to 25MHz. Adjust the spi-max-frequency based on these findings. [1] https://www.nxp.com/webapp/Download?colCode=IMX8MPIEC Fixes: 531936b218d8 ("arm64: dts: imx8mp-venice-gw74xx: update to revB PCB") Cc: stable@vger.kernel.org Signed-off-by: Tim Harvey Signed-off-by: Shawn Guo commit 1fc02c2086003c5fdaa99cde49a987992ff1aae4 Author: Tim Harvey Date: Wed Jun 4 15:56:29 2025 -0700 arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency The IMX8MPDS Table 37 [1] shows that the max SPI master read frequency depends on the pins the interface is muxed behind with ECSPI2 muxed behind ECSPI2 supporting up to 25MHz. Adjust the spi-max-frequency based on these findings. [1] https://www.nxp.com/webapp/Download?colCode=IMX8MPIEC Fixes: 2b3ab9d81ab4 ("arm64: dts: imx8mp-venice-gw73xx: add TPM device") Cc: stable@vger.kernel.org Signed-off-by: Tim Harvey Signed-off-by: Shawn Guo commit b25344753c53a5524ba80280ce68f2046e559ce0 Author: Tim Harvey Date: Wed Jun 4 15:56:28 2025 -0700 arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency The IMX8MPDS Table 37 [1] shows that the max SPI master read frequency depends on the pins the interface is muxed behind with ECSPI2 muxed behind ECSPI2 supporting up to 25MHz. Adjust the spi-max-frequency based on these findings. [1] https://www.nxp.com/webapp/Download?colCode=IMX8MPIEC Fixes: 5016f22028e4 ("arm64: dts: imx8mp-venice-gw72xx: add TPM device") Cc: stable@vger.kernel.org Signed-off-by: Tim Harvey Signed-off-by: Shawn Guo commit 528e2d3125ad8d783e922033a0a8e2adb17b400e Author: Tim Harvey Date: Wed Jun 4 15:56:27 2025 -0700 arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency The IMX8MPDS Table 37 [1] shows that the max SPI master read frequency depends on the pins the interface is muxed behind with ECSPI2 muxed behind ECSPI2 supporting up to 25MHz. Adjust the spi-max-frequency based on these findings. [1] https://www.nxp.com/webapp/Download?colCode=IMX8MPIEC Fixes: 1a8f6ff6a291 ("arm64: dts: imx8mp-venice-gw71xx: add TPM device") Cc: stable@vger.kernel.org Signed-off-by: Tim Harvey Link: https://lore.kernel.org/stable/20250523173723.4167474-1-tharvey%40gateworks.com Signed-off-by: Shawn Guo commit 453e6fd262904cb736afdf08130bd84855ecac93 Merge: bec8ff17ff6528 fe79ef3530d3c6 Author: Dave Airlie Date: Thu Jun 19 17:29:09 2025 +1000 Merge tag 'amd-drm-fixes-6.16-2025-06-18' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.16-2025-06-18: amdgpu: - DP tunneling fix - LTTPR fix - DSC fix - DML2.x ABGR16161616 fix - RMCM fix - Backlight fixes - GFX11 kicker support - SDMA reset fixes - VCN 5.0.1 fix - Reset fix - Misc small fixes amdkfd: - SDMA reset fix - Fix race in GWS scheduling Signed-off-by: Dave Airlie From: Alex Deucher Link: https://lore.kernel.org/r/20250618203115.1533451-1-alexander.deucher@amd.com commit 7869738b6908eec7755818aaf6f3aa068b2f0e1b Author: Gao Xiang Date: Thu Jun 19 11:28:39 2025 +0800 erofs: refuse crafted out-of-file-range encoded extents Crafted encoded extents could record out-of-range `lstart`, which should not happen in normal cases. It caused an iomap_iter_done() complaint [1] reported by syzbot. [1] https://lore.kernel.org/r/684cb499.a00a0220.c6bd7.0010.GAE@google.com Fixes: 1d191b4ca51d ("erofs: implement encoded extent metadata") Reported-and-tested-by: syzbot+d8f000c609f05f52d9b5@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d8f000c609f05f52d9b5 Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20250619032839.2642193-1-hsiangkao@linux.alibaba.com commit bec8ff17ff6528bec9f2089dcef9e41a63b71dea Merge: 49a5fdc06ccfec c464ce6af332e7 Author: Dave Airlie Date: Thu Jun 19 14:18:54 2025 +1000 Merge tag 'drm-intel-fixes-2025-06-18' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Fix MIPI vtotal programming off by one on Broxton - Fix PMU code for GCOV and AutoFDO enabled build Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://lore.kernel.org/r/aFJfykDpUwtmpilE@jlahtine-mobl commit d4adf1c9ee7722545450608bcb095fb31512f0c6 Author: Willem de Bruijn Date: Wed Jun 18 17:57:40 2025 -0400 bpf: Adjust free target to avoid global starvation of LRU map BPF_MAP_TYPE_LRU_HASH can recycle most recent elements well before the map is full, due to percpu reservations and force shrink before neighbor stealing. Once a CPU is unable to borrow from the global map, it will once steal one elem from a neighbor and after that each time flush this one element to the global list and immediately recycle it. Batch value LOCAL_FREE_TARGET (128) will exhaust a 10K element map with 79 CPUs. CPU 79 will observe this behavior even while its neighbors hold 78 * 127 + 1 * 15 == 9921 free elements (99%). CPUs need not be active concurrently. The issue can appear with affinity migration, e.g., irqbalance. Each CPU can reserve and then hold onto its 128 elements indefinitely. Avoid global list exhaustion by limiting aggregate percpu caches to half of map size, by adjusting LOCAL_FREE_TARGET based on cpu count. This change has no effect on sufficiently large tables. Similar to LOCAL_NR_SCANS and lru->nr_scans, introduce a map variable lru->free_target. The extra field fits in a hole in struct bpf_lru. The cacheline is already warm where read in the hot path. The field is only accessed with the lru lock held. Tested-by: Anton Protopopov Signed-off-by: Willem de Bruijn Acked-by: Stanislav Fomichev Link: https://lore.kernel.org/r/20250618215803.3587312-1-willemdebruijn.kernel@gmail.com Signed-off-by: Alexei Starovoitov commit 9b70c362a9d4ab93e0b582dad73acb2a953ef797 Merge: f82727adcf2992 dbe0ca8da1f62b Author: Jakub Kicinski Date: Wed Jun 18 18:30:55 2025 -0700 Merge branch 'net-fix-passive-tfo-socket-having-invalid-napi-id' David Wei says: ==================== net: fix passive TFO socket having invalid NAPI ID Found a bug where an accepted passive TFO socket returns an invalid NAPI ID (i.e. 0) from SO_INCOMING_NAPI_ID. Add a selftest for this using netdevsim and fix the bug. Patch 1 is a drive-by fix for the lib.sh include in an existing drivers/net/netdevsim/peer.sh selftest. Patch 2 adds a test binary for a simple TFO server/client. Patch 3 adds a selftest for checking that the NAPI ID of a passive TFO socket is valid. This will currently fail. Patch 4 adds a fix for the bug. ==================== Link: https://patch.msgid.link/20250617212102.175711-1-dw@davidwei.uk Signed-off-by: Jakub Kicinski commit dbe0ca8da1f62b6252e7be6337209f4d86d4a914 Author: David Wei Date: Tue Jun 17 14:21:02 2025 -0700 tcp: fix passive TFO socket having invalid NAPI ID There is a bug with passive TFO sockets returning an invalid NAPI ID 0 from SO_INCOMING_NAPI_ID. Normally this is not an issue, but zero copy receive relies on a correct NAPI ID to process sockets on the right queue. Fix by adding a sk_mark_napi_id_set(). Fixes: e5907459ce7e ("tcp: Record Rx hash and NAPI ID in tcp_child_process") Signed-off-by: David Wei Reviewed-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250617212102.175711-5-dw@davidwei.uk Signed-off-by: Jakub Kicinski commit 137e7b5cceda2fd634ff47fde6c4226092d09442 Author: David Wei Date: Tue Jun 17 14:21:01 2025 -0700 selftests: net: add test for passive TFO socket NAPI ID Add a test that checks that the NAPI ID of a passive TFO socket is valid i.e. not zero. Signed-off-by: David Wei Link: https://patch.msgid.link/20250617212102.175711-4-dw@davidwei.uk Signed-off-by: Jakub Kicinski commit c65b5bb2329e36340eba76f05752f8f1eb15bee0 Author: David Wei Date: Tue Jun 17 14:21:00 2025 -0700 selftests: net: add passive TFO test binary Add a simple passive TFO server and client test binary. This will be used to test the SO_INCOMING_NAPI_ID of passive TFO accepted sockets. Signed-off-by: David Wei Link: https://patch.msgid.link/20250617212102.175711-3-dw@davidwei.uk Signed-off-by: Jakub Kicinski commit 3168276591210d147ed9e6dc267f8a04007593c7 Author: David Wei Date: Tue Jun 17 14:20:59 2025 -0700 selftests: netdevsim: improve lib.sh include in peer.sh Fix the peer.sh test to run from INSTALL_PATH. Signed-off-by: David Wei Link: https://patch.msgid.link/20250617212102.175711-2-dw@davidwei.uk Signed-off-by: Jakub Kicinski commit fb4d33ab452ea254e2c319bac5703d1b56d895bf Merge: 229f135e0680da 4ea0bb8aaedfad Author: Linus Torvalds Date: Wed Jun 18 17:47:27 2025 -0700 Merge tag '6.16-rc2-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - Fix alternate data streams bug - Important fix for null pointer deref with Kerberos authentication - Fix oops in smbdirect (RDMA) in free_transport * tag '6.16-rc2-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: handle set/get info file for streamed file ksmbd: fix null pointer dereference in destroy_previous_session ksmbd: add free_transport ops in ksmbd connection commit ba8dac350faf16afc129ce6303ca4feaf083ccb1 Author: Chao Yu Date: Thu Jun 5 11:26:33 2025 +0800 f2fs: fix to zero post-eof page fstest reports a f2fs bug: generic/363 42s ... [failed, exit status 1]- output mismatch (see /share/git/fstests/results//generic/363.out.bad) --- tests/generic/363.out 2025-01-12 21:57:40.271440542 +0800 +++ /share/git/fstests/results//generic/363.out.bad 2025-05-19 19:55:58.000000000 +0800 @@ -1,2 +1,78 @@ QA output created by 363 fsx -q -S 0 -e 1 -N 100000 +READ BAD DATA: offset = 0xd6fb, size = 0xf044, fname = /mnt/f2fs/junk +OFFSET GOOD BAD RANGE +0x1540d 0x0000 0x2a25 0x0 +operation# (mod 256) for the bad data may be 37 +0x1540e 0x0000 0x2527 0x1 ... (Run 'diff -u /share/git/fstests/tests/generic/363.out /share/git/fstests/results//generic/363.out.bad' to see the entire diff) Ran: generic/363 Failures: generic/363 Failed 1 of 1 tests The root cause is user can update post-eof page via mmap [1], however, f2fs missed to zero post-eof page in below operations, so, once it expands i_size, then it will include dummy data locates previous post-eof page, so during below operations, we need to zero post-eof page. Operations which can include dummy data after previous i_size after expanding i_size: - write - mapwrite [1] - truncate - fallocate * preallocate * zero_range * insert_range * collapse_range - clone_range (doesn’t support in f2fs) - copy_range (doesn’t support in f2fs) [1] https://man7.org/linux/man-pages/man2/mmap.2.html 'BUG section' Cc: stable@kernel.org Signed-off-by: Chao Yu Reviewed-by: Zhiguo Niu Signed-off-by: Jaegeuk Kim commit 229f135e0680da3dd0bcce515c07be87858f1d12 Merge: 74b4cc9b8780bf eab9dcb76b9fca Author: Linus Torvalds Date: Wed Jun 18 14:31:16 2025 -0700 Merge tag 'driver-core-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core fixes from Danilo Krummrich: - Fix a race condition in Devres::drop(). This depends on two other patches: - (Minimal) Rust abstractions for struct completion - Let Revocable indicate whether its data is already being revoked - Fix Devres to avoid exposing the internal Revocable - Add .mailmap entry for Danilo Krummrich - Add Madhavan Srinivasan to embargoed-hardware-issues.rst * tag 'driver-core-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: Documentation: embargoed-hardware-issues.rst: Add myself for Power mailmap: add entry for Danilo Krummrich rust: devres: do not dereference to the internal Revocable rust: devres: fix race in Devres::drop() rust: revocable: indicate whether `data` has been revoked already rust: completion: implement initial abstraction commit 74b4cc9b8780bfe8a3992c9ac0033bf22ac01f19 Merge: 0564e6a8c2c315 37fb58a7273726 Author: Linus Torvalds Date: Wed Jun 18 14:25:50 2025 -0700 Merge tag 'cgroup-for-6.16-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fix from Tejun Heo: - In cgroup1 freezer, a task migrating into a frozen cgroup might not get frozen immediately due to the wrong operation order. Fix it. * tag 'cgroup-for-6.16-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup,freezer: fix incomplete freezing when attaching tasks commit 0564e6a8c2c3152783906534d5767cabe1b05930 Merge: 4f24bfcc398eb7 261dce3d64021e Author: Linus Torvalds Date: Wed Jun 18 14:22:31 2025 -0700 Merge tag 'wq-for-6.16-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue fix from Tejun Heo: - Fix missed early init of wq_isolated_cpumask * tag 'wq-for-6.16-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() commit f82727adcf2992822e12198792af450a76ebd5ef Author: Haixia Qu Date: Tue Jun 17 05:56:24 2025 +0000 tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer The reproduction steps: 1. create a tun interface 2. enable l2 bearer 3. TIPC_NL_UDP_GET_REMOTEIP with media name set to tun tipc: Started in network mode tipc: Node identity 8af312d38a21, cluster identity 4711 tipc: Enabled bearer , priority 1 Oops: general protection fault KASAN: null-ptr-deref in range CPU: 1 UID: 1000 PID: 559 Comm: poc Not tainted 6.16.0-rc1+ #117 PREEMPT Hardware name: QEMU Ubuntu 24.04 PC RIP: 0010:tipc_udp_nl_dump_remoteip+0x4a4/0x8f0 the ub was in fact a struct dev. when bid != 0 && skip_cnt != 0, bearer_list[bid] may be NULL or other media when other thread changes it. fix this by checking media_id. Fixes: 832629ca5c313 ("tipc: add UDP remoteip dump to netlink API") Signed-off-by: Haixia Qu Reviewed-by: Tung Nguyen Link: https://patch.msgid.link/20250617055624.2680-1-hxqu@hillstonenet.com Signed-off-by: Jakub Kicinski commit 9ac8d0c640a161486eaf71d1999ee990fad62947 Author: Hariprasad Kelam Date: Tue Jun 17 12:04:02 2025 +0530 Octeontx2-pf: Fix Backpresure configuration NIX block can receive packets from multiple links such as MAC (RPM), LBK and CPT. ----------------- RPM --| NIX | ----------------- | | LBK Each link supports multiple channels for example RPM link supports 16 channels. In case of link oversubsribe, NIX will assert backpressure on receive channels. The previous patch considered a single channel per link, resulting in backpressure not being enabled on the remaining channels Fixes: a7ef63dbd588 ("octeontx2-af: Disable backpressure between CPT and NIX") Signed-off-by: Hariprasad Kelam Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250617063403.3582210-1-hkelam@marvell.com Signed-off-by: Jakub Kicinski commit 4f24bfcc398eb77aa41fe1bb1621d8c2cca5368d Merge: 61f4769affffc3 33796b91871ad4 Author: Linus Torvalds Date: Wed Jun 18 14:17:15 2025 -0700 Merge tag 'sched_ext-for-6.16-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fixes from Tejun Heo: - Fix a couple bugs in cgroup cpu.weight support - Add the new sched-ext@lists.linux.dev to MAINTAINERS * tag 'sched_ext-for-6.16-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() sched_ext: Make scx_group_set_weight() always update tg->scx.weight sched_ext: Update mailing list entry in MAINTAINERS commit 28c0d7756fd9b69971073c946076e35851a7133b Merge: ae409629e022fb 688a0d61b2d742 Author: Jakub Kicinski Date: Wed Jun 18 14:15:15 2025 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2025-06-17 (ice, e1000e) For ice: Krishna Kumar modifies aRFS match criteria to correctly identify matching filters. Grzegorz fixes a memory leak in eswitch legacy mode. For e1000e: Vitaly sets clock frequency on some Nahum systems which may misreport their value. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13 ice: fix eswitch code memory leak in reset scenario net: ice: Perform accurate aRFS flow match ==================== Link: https://patch.msgid.link/20250617172444.1419560-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit ae409629e022fbebbc6d31a1bfeccdbbeee20fd6 Author: Heiner Kallweit Date: Tue Jun 17 20:20:17 2025 +0200 net: ftgmac100: select FIXED_PHY Depending on e.g. DT configuration this driver uses a fixed link. So we shouldn't rely on the user to enable FIXED_PHY, select it in Kconfig instead. We may end up with a non-functional driver otherwise. Fixes: 38561ded50d0 ("net: ftgmac100: support fixed link") Cc: stable@vger.kernel.org Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/476bb33b-5584-40f0-826a-7294980f2895@gmail.com Signed-off-by: Jakub Kicinski commit c6d732c38f93c4aebd204a5656583142289c3a2e Author: Jakub Kicinski Date: Tue Jun 17 13:22:40 2025 -0700 net: ethtool: remove duplicate defines for family info Commit under fixes switched to uAPI generation from the YAML spec. A number of custom defines were left behind, mostly for commands very hard to express in YAML spec. Among what was left behind was the name and version of the generic netlink family. Problem is that the codegen always outputs those values so we ended up with a duplicated, differently named set of defines. Provide naming info in YAML and remove the incorrect defines. Fixes: 8d0580c6ebdd ("ethtool: regenerate uapi header from the spec") Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250617202240.811179-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 61f4769affffc398499250ccacf0b86d5b654399 Merge: 5adb635077d1b4 9d4204a8106fe7 Author: Linus Torvalds Date: Wed Jun 18 14:09:22 2025 -0700 Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library fixes from Eric Biggers: - Fix a regression in the arm64 Poly1305 code - Fix a couple compiler warnings * tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: lib/crypto/poly1305: Fix arm64's poly1305_blocks_arch() lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older lib/crypto: Annotate crypto strings with nonstring commit 37fb58a7273726e59f9429c89ade5116083a213d Author: Chen Ridong Date: Wed Jun 18 07:32:17 2025 +0000 cgroup,freezer: fix incomplete freezing when attaching tasks An issue was found: # cd /sys/fs/cgroup/freezer/ # mkdir test # echo FROZEN > test/freezer.state # cat test/freezer.state FROZEN # sleep 1000 & [1] 863 # echo 863 > test/cgroup.procs # cat test/freezer.state FREEZING When tasks are migrated to a frozen cgroup, the freezer fails to immediately freeze the tasks, causing the cgroup to remain in the "FREEZING". The freeze_task() function is called before clearing the CGROUP_FROZEN flag. This causes the freezing() check to incorrectly return false, preventing __freeze_task() from being invoked for the migrated task. To fix this issue, clear the CGROUP_FROZEN state before calling freeze_task(). Fixes: f5d39b020809 ("freezer,sched: Rewrite core freezer logic") Cc: stable@vger.kernel.org # v6.1+ Reported-by: Zhong Jiawei Signed-off-by: Chen Ridong Acked-by: Michal Koutný Signed-off-by: Tejun Heo commit 6fcab2791543924d438e7fa49276d0998b0a069f Author: Rafael J. Wysocki Date: Wed Jun 18 14:17:45 2025 +0200 ACPICA: Refuse to evaluate a method if arguments are missing As reported in [1], a platform firmware update that increased the number of method parameters and forgot to update a least one of its callers, caused ACPICA to crash due to use-after-free. Since this a result of a clear AML issue that arguably cannot be fixed up by the interpreter (it cannot produce missing data out of thin air), address it by making ACPICA refuse to evaluate a method if the caller attempts to pass fewer arguments than expected to it. Closes: https://github.com/acpica/acpica/issues/1027 [1] Reported-by: Peter Williams Signed-off-by: Rafael J. Wysocki Reviewed-by: Hans de Goede Tested-by: Hans de Goede # Dell XPS 9640 with BIOS 1.12.0 Link: https://patch.msgid.link/5909446.DvuYhMxLoT@rjwysocki.net Signed-off-by: Rafael J. Wysocki commit 840738eae94864993a735ab677b9795bb8f3b961 Author: Pali Rohár Date: Sun Jun 8 16:10:33 2025 +0200 cifs: Remove duplicate fattr->cf_dtype assignment from wsl_to_fattr() function Commit 8bd25b61c5a5 ("smb: client: set correct d_type for reparse DFS/DFSR and mount point") deduplicated assignment of fattr->cf_dtype member from all places to end of the function cifs_reparse_point_to_fattr(). The only one missing place which was not deduplicated is wsl_to_fattr(). Fix it. Fixes: 8bd25b61c5a5 ("smb: client: set correct d_type for reparse DFS/DFSR and mount point") Signed-off-by: Pali Rohár Signed-off-by: Steve French commit 306cb65bb0cb243389fcbd0a66907d5bdea07d1e Author: Bharath SM Date: Mon Mar 17 15:57:27 2025 +0530 smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels When mounting a share with kerberos authentication with multichannel support, share mounts correctly, but fails to create secondary channels. This occurs because the hostname is not populated when adding the channels. The hostname is necessary for the userspace cifs.upcall program to retrieve the required credentials and pass it back to kernel, without hostname secondary channels fails establish. Cc: stable@vger.kernel.org Reviewed-by: Shyam Prasad N Signed-off-by: Bharath SM Reported-by: xfuren Link: https://bugzilla.samba.org/show_bug.cgi?id=15824 Signed-off-by: Steve French commit 88efa0de3285be66969b71ec137d9dab1ee19e52 Author: Qiuxu Zhuo Date: Thu Jun 19 00:23:06 2025 +0800 EDAC/igen6: Fix NULL pointer dereference A kernel panic was reported with the following kernel log: EDAC igen6: Expected 2 mcs, but only 1 detected. BUG: unable to handle page fault for address: 000000000000d570 ... Hardware name: Notebook V54x_6x_TU/V54x_6x_TU, BIOS Dasharo (coreboot+UEFI) v0.9.0 07/17/2024 RIP: e030:ecclog_handler+0x7e/0xf0 [igen6_edac] ... igen6_probe+0x2a0/0x343 [igen6_edac] ... igen6_init+0xc5/0xff0 [igen6_edac] ... This issue occurred because one memory controller was disabled by the BIOS but the igen6_edac driver still checked all the memory controllers, including this absent one, to identify the source of the error. Accessing the null MMIO for the absent memory controller resulted in the oops above. Fix this issue by reverting the configuration structure to non-const and updating the field 'res_cfg->num_imc' to reflect the number of detected memory controllers. Fixes: 20e190b1c1fd ("EDAC/igen6: Skip absent memory controllers") Reported-by: Marek Marczykowski-Górecki Closes: https://lore.kernel.org/all/aFFN7RlXkaK_loQb@mail-itl/ Suggested-by: Borislav Petkov Signed-off-by: Qiuxu Zhuo Signed-off-by: Tony Luck Signed-off-by: Borislav Petkov (AMD) Tested-by: Marek Marczykowski-Górecki Link: https://lore.kernel.org/r/20250618162307.1523736-1-qiuxu.zhuo@intel.com commit 5adb635077d1b4bd65b183022775a59a378a9c00 Merge: 5da3ff1fd0fdce 86c8db86af43f5 Author: Linus Torvalds Date: Wed Jun 18 10:32:01 2025 -0700 Merge tag 'selinux-pr-20250618' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux fix from Paul Moore: "A small SELinux patch to resolve a UBSAN warning in the xfrm/labeled-IPsec code" * tag 'selinux-pr-20250618' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len commit 5da3ff1fd0fdce7b5d9508c62403c04a8c96a1e5 Merge: 5a3b583f205087 327e28664307d4 Author: Linus Torvalds Date: Wed Jun 18 10:24:50 2025 -0700 Merge tag 'ftrace-v6.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull ftrace fix from Steven Rostedt: - Do not blindly enable function_graph tracer when updating funcgraph-args When the option to trace function arguments in the function graph trace is updated, it requires the function graph tracer to switch its callback routine. It disables function graph tracing, updates the callback and then re-enables function graph tracing. The issue is that it doesn't check if function graph tracing is currently enabled or not. If it is not enabled, it will try to disable it and re-enable it (which will actually enable it even though it is not the current tracer). This causes an issue in the accounting and will trigger a WARN_ON() if the function tracer is enabled after that. * tag 'ftrace-v6.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: fgraph: Do not enable function_graph tracer when setting funcgraph-args commit 5a3b583f2050870e0403ffed650f06c94d7968a4 Merge: 52da431bf03b55 a7b3b77fd111d4 Author: Linus Torvalds Date: Wed Jun 18 10:21:39 2025 -0700 Merge tag 'ata-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata fixes from Niklas Cassel: - Force PIO for ATAPI devices on VT6415/VT6330 as the controller locks up on ATAPI DMA (Tasos) - Fix ACPI PATA cable type detection such that the controller is not forced down to a slow transfer mode (Tasos) - Fix build error on 32-bit UML (Johannes) - Fix a PCI region leak in the pata_macio driver so that the driver no longer fails to load after rmmod (Philipp) - Use correct DMI BIOS build date for ThinkPad W541 quirk (me) - Disallow LPM for ASUSPRO-D840SA motherboard as this board interestingly enough gets graphical corruptions on the iGPU when LPM is enabled (me) - Disallow LPM for Asus B550-F motherboard as this board will get command timeouts on ports 5 and 6, yet LPM with the same drive works fine on all other ports (Mikko) * tag 'ata-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: ahci: Disallow LPM for Asus B550-F motherboard ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard ata: ahci: Use correct BIOS build date for ThinkPad W541 quirk ata: pata_macio: Fix PCI region leak ata: pata_cs5536: fix build on 32-bit UML ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 commit fe79ef3530d3c681ef2d5644a9d1d1a67b21426a Author: Alex Deucher Date: Mon Jun 16 15:47:13 2025 -0400 drm/amdgpu/sdma5.2: init engine reset mutex Missing the mutex init. Fixes: 47454f2dc0bf ("drm/amdgpu: Register the new sdma function pointers for sdma_v5_2") Reviewed-by: Jesse Zhang Signed-off-by: Alex Deucher (cherry picked from commit ea685ff30a51a25dd9be90786933ada49a088f65) commit cfb05257ae168a0496c7637e1d9e3ab8a25cbffe Author: Jay Cornwall Date: Wed Jun 11 09:52:14 2025 -0500 drm/amdkfd: Fix race in GWS queue scheduling q->gws is not updated atomically with qpd->mapped_gws_queue. If a runlist is created between pqm_set_gws and update_queue it will contain a queue which uses GWS in a process with no GWS allocated. This will result in a scheduler hang. Use q->properties.is_gws which is changed while holding the DQM lock. Signed-off-by: Jay Cornwall Reviewed-by: Harish Kasiviswanathan Signed-off-by: Alex Deucher (cherry picked from commit b98370220eb3110e82248e3354e16a489a492cfb) Cc: stable@vger.kernel.org commit 49cc5beeabd5b9b6a6660be8ea2e95de30ec0a07 Author: Alex Deucher Date: Mon Jun 16 15:43:55 2025 -0400 drm/amdgpu/sdma5: init engine reset mutex Missing the mutex init. Fixes: e56d4bf57fab ("drm/amdgpu/: drm/amdgpu: Register the new sdma function pointers for sdma_v5_0") Reviewed-by: Jesse Zhang Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 3f4caf092f02f0de169c6122639af481c7edc8f9) commit ebe43542702c3d15d1a1d95e8e13b1b54076f05a Author: Alex Deucher Date: Mon Jun 2 11:31:52 2025 -0400 drm/amdgpu: switch job hw_fence to amdgpu_fence Use the amdgpu fence container so we can store additional data in the fence. This also fixes the start_time handling for MCBP since we were casting the fence to an amdgpu_fence and it wasn't. Fixes: 3f4c175d62d8 ("drm/amdgpu: MCBP based on DRM scheduler (v9)") Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit bf1cd14f9e2e1fdf981eed273ddd595863f5288c) Cc: stable@vger.kernel.org commit 7f3b16f3f229e37cc3e02e9e4e7106c523b119e9 Author: Jesse Zhang Date: Mon Jun 16 19:21:41 2025 +0800 drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences This commit makes two key fixes to SDMA v4.4.2 handling: 1. disable UTC_L1 in sdma_cntl register when stopping SDMA engines by reading the current value before modifying UTC_L1_ENABLE bit. 2. Ensure UTC_L1_ENABLE is consistently managed by: - Adding the missing register write when enabling UTC_L1 during start - Keeping UTC_L1 enabled by default as per hardware requirements v2: Correct SDMA_CNTL setting (Philip) Suggested-by: Jonathan Kim Signed-off-by: Jesse Zhang Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 375bf564654e85a7b1b0657b191645b3edca1bda) Cc: stable@vger.kernel.org commit 785c536c31c0bb057252fddedb30d79ae4979f4b Author: Lijo Lazar Date: Fri Jun 6 10:29:28 2025 +0530 drm/amdgpu: Release reset locks during failures Make sure to release reset domain lock in case of failures. Signed-off-by: Lijo Lazar Signed-off-by: Ce Sun Reviewed-by: Hawking Zhang Fixes: 11bb33766f66 ("drm/amdgpu: refactor amdgpu_device_gpu_recover") Signed-off-by: Alex Deucher (cherry picked from commit 1ab11a82681eb33a66f423216cb063e7f40c6f85) commit b669507b637eb6b1aaecf347f193efccc65d756e Author: Alex Hung Date: Tue Jun 3 18:30:55 2025 -0600 drm/amd/display: Check dce_hwseq before dereferencing it [WHAT] hws was checked for null earlier in dce110_blank_stream, indicating hws can be null, and should be checked whenever it is used. Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Aurabindo Pillai Signed-off-by: Alex Hung Signed-off-by: Aurabindo Pillai Signed-off-by: Alex Deucher (cherry picked from commit 79db43611ff61280b6de58ce1305e0b2ecf675ad) Cc: stable@vger.kernel.org commit 46e15197b513e60786a44107759d6ca293d6288c Author: Sonny Jiang Date: Thu Jun 12 11:01:08 2025 -0400 drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause Add a protection to ensure programming are all complete prior VCPU starting. This is a WA for an unintended VCPU running. Signed-off-by: Sonny Jiang Acked-by: Leo Liu Reviewed-by: Ruijing Dong Signed-off-by: Alex Deucher (cherry picked from commit c29521b529fa5e225feaf709d863a636ca0cbbfa) Cc: stable@vger.kernel.org commit caade9d69f2e2b76d2e2d47089736a99135b8772 Author: Jesse Zhang Date: Wed Jun 11 15:07:11 2025 +0800 drm/amdgpu: Use logical instance ID for SDMA v4_4_2 queue operations Simplify SDMA v4_4_2 queue reset and stop operations by: 1. Removing GET_INST(SDMA0) conversion for ring->me 2. Using the logical instance ID (ring->me) directly 3. Maintaining consistent behavior with other SDMA queue operations This change aligns with the existing queue handling logic where ring->me already represents the correct instance identifier. Signed-off-by: Lijo Lazar Signed-off-by: Jesse Zhang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 3bab282dfe25dff7a55add432f56898505a6cc6c) Cc: stable@vger.kernel.org commit 09b585592fa481384597c81388733aed4a04dd05 Author: Jesse Zhang Date: Wed Jun 11 15:02:09 2025 +0800 drm/amdgpu: Fix SDMA engine reset with logical instance ID This commit makes the following improvements to SDMA engine reset handling: 1. Clarifies in the function documentation that instance_id refers to a logical ID 2. Adds conversion from logical to physical instance ID before performing reset using GET_INST(SDMA0, instance_id) macro 3. Improves error messaging to indicate when a logical instance reset fails 4. Adds better code organization with blank lines for readability The change ensures proper SDMA engine reset by using the correct physical instance ID while maintaining the logical ID interface for callers. V2: Remove harvest_config check and convert directly to physical instance (Lijo) Suggested-by: Jonathan Kim Signed-off-by: Jesse Zhang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 5efa6217c239ed1ceec0f0414f9b6f6927387dfc) Cc: stable@vger.kernel.org commit 854171405e7f093532b33d8ed0875b9e34fc55b4 Author: Frank Min Date: Wed Jun 4 21:17:05 2025 +0800 drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 1. Add kicker firmwares loading for gfx11/smu13/psp13 2. Register additional MODULE_FIRMWARE entries for kicker fws - gc_11_0_0_rlc_kicker.bin - gc_11_0_0_imu_kicker.bin - psp_13_0_0_sos_kicker.bin - psp_13_0_0_ta_kicker.bin - smu_13_0_0_kicker.bin Signed-off-by: Frank Min Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher (cherry picked from commit fb5ec2174d70a8989bc207d257db90ffeca3b163) Cc: stable@vger.kernel.org commit 0bbf5fd86c585d437b75003f11365b324360a5d6 Author: Frank Min Date: Wed Jun 4 21:00:44 2025 +0800 drm/amdgpu: Add kicker device detection 1. add kicker device list 2. add kicker device checking helper function Signed-off-by: Frank Min Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher (cherry picked from commit 09aa2b408f4ab689c3541d22b0968de0392ee406) Cc: stable@vger.kernel.org commit 16dc8bc27c2aa3c93905d3e885e27f1e3535f09a Author: Mario Limonciello Date: Thu May 29 09:46:32 2025 -0500 drm/amd/display: Export full brightness range to userspace [WHY] Userspace currently is offered a range from 0-0xFF but the PWM is programmed from 0-0xFFFF. This can be limiting to some software that wants to apply greater granularity. [HOW] Convert internally to firmware values only when mapping custom brightness curves because these are in 0-0xFF range. Advertise full PWM range to userspace. Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Roman Li Signed-off-by: Mario Limonciello Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 8dbd72cb790058ce52279af38a43c2b302fdd3e5) Cc: stable@vger.kernel.org commit ffcaed1d7ecef31198000dfbbea791f30f7ca437 Author: Mario Limonciello Date: Thu May 29 11:33:44 2025 -0500 drm/amd/display: Only read ACPI backlight caps once [WHY] Backlight caps are read already in amdgpu_dm_update_backlight_caps(). They may be updated by update_connector_ext_caps(). Reading again when registering backlight device may cause wrong values to be used. [HOW] Use backlight caps already registered to the dm. Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Roman Li Signed-off-by: Mario Limonciello Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 148144f6d2f14b02eaaa39b86bbe023cbff350bd) Cc: stable@vger.kernel.org commit 158f9944ac05dafd2d3a23d0688e6cf40ef68b90 Author: Yihan Zhu Date: Tue May 27 16:47:40 2025 -0400 drm/amd/display: Fix RMCM programming seq errors [WHY & HOW] Fix RMCM programming sequence errors and mapping issues to pass the RMCM test. Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Dmytro Laktyushkin Signed-off-by: Yihan Zhu Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 11baa4975025033547f45f5894087a0dda6efbb8) Cc: stable@vger.kernel.org commit 8724a5380c4390eed81e271d22f34ff06453ded9 Author: Alex Hung Date: Thu May 29 10:59:19 2025 -0600 drm/amd/display: Fix mpv playback corruption on weston [WHAT] Severe video playback corruption is observed in the following setup: weston 14.0.90 (built from source) + mpv v0.40.0 with command: mpv bbb_sunflower_1080p_60fps_normal.mp4 --vo=gpu [HOW] ABGR16161616 needs to be included in dml2/2.1 translation. Cc: Mario Limonciello Cc: Alex Deucher Acked-by: Aurabindo Pillai Reviewed-by: Harry Wentland Reviewed-by: Austin Zheng Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit d023de809f85307ca819a9dbbceee6ae1f50e2ad) Cc: stable@vger.kernel.org commit 0d57dd1765d311111d9885346108c4deeae1deb4 Author: Nicholas Kazlauskas Date: Wed May 21 16:40:25 2025 -0400 drm/amd/display: Add more checks for DSC / HUBP ONO guarantees [WHY] For non-zero DSC instances it's possible that the HUBP domain required to drive it for sequential ONO ASICs isn't met, potentially causing the logic to the tile to enter an undefined state leading to a system hang. [HOW] Add more checks to ensure that the HUBP domain matching the DSC instance is appropriately powered. Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Duncan Ma Signed-off-by: Nicholas Kazlauskas Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit da63df07112e5a9857a8d2aaa04255c4206754ec) Cc: stable@vger.kernel.org commit d358a51444c88bcc995e471dc8cc840f19e4b374 Author: Michael Strauss Date: Wed Feb 26 10:03:48 2025 -0500 drm/amd/display: Get LTTPR IEEE OUI/Device ID From Closest LTTPR To Host [WHY] These fields are read for the explicit purpose of detecting embedded LTTPRs (i.e. between host ASIC and the user-facing port), and thus need to calculate the correct DPCD address offset based on LTTPR count to target the appropriate LTTPR's DPCD register space with these queries. [HOW] Cascaded LTTPRs in a link each snoop and increment LTTPR count when queried via DPCD read, so an LTTPR embedded in a source device (e.g. USB4 port on a laptop) will always be addressible using the max LTTPR count seen by the host. Therefore we simply need to use a recently added helper function to calculate the correct DPCD address to target potentially embedded LTTPRs based on the received LTTPR count. Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Wenjing Liu Signed-off-by: Michael Strauss Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 791897f5c77a2a65d0e500be4743af2ddf6eb061) Cc: stable@vger.kernel.org commit 3251b69b7efb82eba24c9e168a6142a3078de72f Author: Peichen Huang Date: Mon May 26 16:04:10 2025 +0800 drm/amd/display: Add dc cap for dp tunneling [WHAT] 1. add dc cap for dp tunneling 2. add function to get index of host router Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Cruise Hung Signed-off-by: Peichen Huang Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 29e178d13979cf6fdb42c5fe2dfec2da2306c4ad) Cc: stable@vger.kernel.org commit a55737dab6ba63eb4241e9c6547629058af31e12 Author: Jesse.Zhang Date: Thu May 29 11:27:37 2025 +0800 drm/amdkfd: move SDMA queue reset capability check to node_show Relocate the per-SDMA queue reset capability check from kfd_topology_set_capabilities() to node_show() to ensure we read the latest value of sdma.supported_reset after all IP blocks are initialized. Fixes: ceb7114c961b ("drm/amdkfd: flag per-sdma queue reset supported to user space") Reviewed-by: Jonathan Kim Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher (cherry picked from commit e17df7b086cf908cedd919f448da9e00028419bb) commit 6c5b8895c8cab4fdb496b38513ec417588b58596 Author: Richard Fitzgerald Date: Wed Jun 18 15:55:47 2025 +0100 ASoC: doc: cs35l56: Add CS35L63 to the list of supported devices Add CS35L63 to the list of parts supported by the cs35l56 driver and mention the CS35L63 where the text refers to the supported part numbers. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20250618145547.152814-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit bbf10cd686835d5a4b8566dc73a3b00b4cd7932a Author: Lukas Wunner Date: Wed Jun 18 16:38:25 2025 +0200 PCI: pciehp: Ignore belated Presence Detect Changed caused by DPC Commit c3be50f7547c ("PCI: pciehp: Ignore Presence Detect Changed caused by DPC") sought to ignore Presence Detect Changed events occurring as a side effect of Downstream Port Containment. The commit awaits recovery from DPC and then clears events which occurred in the meantime. However if the first event seen after DPC is Data Link Layer State Changed, only that event is cleared and not Presence Detect Changed. The object of the commit is thus defeated. That's because pciehp_ist() computes the events to clear based on the local "events" variable instead of "ctrl->pending_events". The former contains the events that had occurred when pciehp_ist() was entered, whereas the latter also contains events that have accumulated while awaiting DPC recovery. In practice, the order of PDC and DLLSC events is arbitrary and the delay in-between can be several milliseconds. So change the logic to always clear PDC events, even if they come after an initial DLLSC event. Fixes: c3be50f7547c ("PCI: pciehp: Ignore Presence Detect Changed caused by DPC") Reported-by: Lương Việt Hoàng Reported-by: Joel Mathew Thomas Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219765#c165 Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Tested-by: Lương Việt Hoàng Tested-by: Joel Mathew Thomas Link: https://patch.msgid.link/d9c4286a16253af7e93eaf12e076e3ef3546367a.1750257164.git.lukas@wunner.de commit eab9dcb76b9fca47402c9e93afca243e745a0f02 Author: Madhavan Srinivasan Date: Sat Jun 14 20:59:24 2025 +0530 Documentation: embargoed-hardware-issues.rst: Add myself for Power Adding myself as the contact for Power Signed-off-by: Madhavan Srinivasan Link: https://lore.kernel.org/r/20250614152925.82831-1-maddy@linux.ibm.com Signed-off-by: Greg Kroah-Hartman commit 46147490b4098e200b7d7d3ac4637a3e4f7b806a Author: Miquel Raynal Date: Fri Jun 13 20:13:12 2025 +0200 pinctrl: nuvoton: Fix boot on ma35dx platforms As part of a wider cleanup trying to get rid of OF specific APIs, an incorrect (and partially unrelated) cleanup was introduced. The goal was to replace a device_for_each_chil_node() loop including an additional condition inside by a macro doing both the loop and the check on a single line. The snippet: device_for_each_child_node(dev, child) if (fwnode_property_present(child, "gpio-controller")) continue; was replaced by: for_each_gpiochip_node(dev, child) which expands into: device_for_each_child_node(dev, child) for_each_if(fwnode_property_present(child, "gpio-controller")) This change is actually doing the opposite of what was initially expected, breaking the probe of this driver, breaking at the same time the whole boot of Nuvoton platforms (no more console, the kernel WARN()). Revert these two changes to roll back to the correct behavior. Fixes: 693c9ecd8326 ("pinctrl: nuvoton: Reduce use of OF-specific APIs") Cc: stable@vger.kernel.org Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/20250613181312.1269794-1-miquel.raynal@bootlin.com Signed-off-by: Linus Walleij commit 7d502192431e2d863f4b2595182d61c7fa8e656f Author: Bartosz Golaszewski Date: Thu Jun 12 15:19:27 2025 +0200 MAINTAINERS: drop bouncing Lakshmi Sowjanya D The address for Lakshmi Sowjanya D: lakshmi.sowjanya.d@intel.com is bouncing. Drop it and mark the driver as orphaned. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/20250612131927.127733-1-brgl@bgdev.pl Signed-off-by: Linus Walleij commit 2aebf5ee43bf0ed225a09a30cf515d9f2813b759 Author: Masami Hiramatsu (Google) Date: Wed Jun 18 09:05:23 2025 +0900 x86/alternatives: Fix int3 handling failure from broken text_poke array Since smp_text_poke_single() does not expect there is another text_poke request is queued, it can make text_poke_array not sorted or cause a buffer overflow on the text_poke_array.vec[]. This will cause an Oops in int3 because of bsearch failing; CPU 0 CPU 1 CPU 2 ----- ----- ----- smp_text_poke_batch_add() smp_text_poke_single() <<-- Adds out of order [Fails o find address in text_poke_array ] OOPS! Or unhandled page fault because of a buffer overflow; CPU 0 CPU 1 ----- ----- smp_text_poke_batch_add() <<+ ... | smp_text_poke_batch_add() <<-- Adds TEXT_POKE_ARRAY_MAX times. smp_text_poke_single() { __smp_text_poke_batch_add() <<-- Adds entry at TEXT_POKE_ARRAY_MAX + 1 smp_text_poke_batch_finish() [Unhandled page fault because text_poke_array.nr_entries is overwritten] BUG! } Use smp_text_poke_batch_add() instead of __smp_text_poke_batch_add() so that it correctly flush the queue if needed. Closes: https://lore.kernel.org/all/CA+G9fYsLu0roY3DV=tKyqP7FEKbOEETRvTDhnpPxJGbA=Cg+4w@mail.gmail.com/ Fixes: c8976ade0c1b ("x86/alternatives: Simplify smp_text_poke_single() by using tp_vec and existing APIs") Reported-by: Linux Kernel Functional Testing Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Steven Rostedt (Google) Tested-by: Linux Kernel Functional Testing Link: https://lkml.kernel.org/r/\ 175020512308.3582717.13631440385506146631.stgit@mhiramat.tok.corp.google.com commit 93712205ce2f1fb047739494c0399a26ea4f0890 Author: Bartosz Golaszewski Date: Thu Jun 12 11:14:48 2025 +0200 pinctrl: qcom: msm: mark certain pins as invalid for interrupts On some platforms, the UFS-reset pin has no interrupt logic in TLMM but is nevertheless registered as a GPIO in the kernel. This enables the user-space to trigger a BUG() in the pinctrl-msm driver by running, for example: `gpiomon -c 0 113` on RB2. The exact culprit is requesting pins whose intr_detection_width setting is not 1 or 2 for interrupts. This hits a BUG() in msm_gpio_irq_set_type(). Potentially crashing the kernel due to an invalid request from user-space is not optimal, so let's go through the pins and mark those that would fail the check as invalid for the irq chip as we should not even register them as available irqs. This function can be extended if we determine that there are more corner-cases like this. Fixes: f365be092572 ("pinctrl: Add Qualcomm TLMM driver") Cc: stable@vger.kernel.org Reviewed-by: Bjorn Andersson Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/20250612091448.41546-1-brgl@bgdev.pl Signed-off-by: Linus Walleij commit 327e28664307d49ce3fa71ba30dcc0007c270974 Author: Steven Rostedt Date: Wed Jun 18 07:38:01 2025 -0400 fgraph: Do not enable function_graph tracer when setting funcgraph-args When setting the funcgraph-args option when function graph tracer is net enabled, it incorrectly enables it. Worse, it unregisters itself when it was never registered. Then when it gets enabled again, it will register itself a second time causing a WARNing. ~# echo 1 > /sys/kernel/tracing/options/funcgraph-args ~# head -20 /sys/kernel/tracing/trace # tracer: nop # # entries-in-buffer/entries-written: 813/26317372 #P:8 # # _-----=> irqs-off/BH-disabled # / _----=> need-resched # | / _---=> hardirq/softirq # || / _--=> preempt-depth # ||| / _-=> migrate-disable # |||| / delay # TASK-PID CPU# ||||| TIMESTAMP FUNCTION # | | | ||||| | | -0 [007] d..4. 358.966010: 7) 1.692 us | fetch_next_timer_interrupt(basej=4294981640, basem=357956000000, base_local=0xffff88823c3ae040, base_global=0xffff88823c3af300, tevt=0xffff888100e47cb8); -0 [007] d..4. 358.966012: 7) | tmigr_cpu_deactivate(nextexp=357988000000) { -0 [007] d..4. 358.966013: 7) | _raw_spin_lock(lock=0xffff88823c3b2320) { -0 [007] d..4. 358.966014: 7) 0.981 us | preempt_count_add(val=1); -0 [007] d..5. 358.966017: 7) 1.058 us | do_raw_spin_lock(lock=0xffff88823c3b2320); -0 [007] d..4. 358.966019: 7) 5.824 us | } -0 [007] d..5. 358.966021: 7) | tmigr_inactive_up(group=0xffff888100cb9000, child=0x0, data=0xffff888100e47bc0) { -0 [007] d..5. 358.966022: 7) | tmigr_update_events(group=0xffff888100cb9000, child=0x0, data=0xffff888100e47bc0) { Notice the "tracer: nop" at the top there. The current tracer is the "nop" tracer, but the content is obviously the function graph tracer. Enabling function graph tracing will cause it to register again and trigger a warning in the accounting: ~# echo function_graph > /sys/kernel/tracing/current_tracer -bash: echo: write error: Device or resource busy With the dmesg of: ------------[ cut here ]------------ WARNING: CPU: 7 PID: 1095 at kernel/trace/ftrace.c:3509 ftrace_startup_subops+0xc1e/0x1000 Modules linked in: kvm_intel kvm irqbypass CPU: 7 UID: 0 PID: 1095 Comm: bash Not tainted 6.16.0-rc2-test-00006-gea03de4105d3 #24 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:ftrace_startup_subops+0xc1e/0x1000 Code: 48 b8 22 01 00 00 00 00 ad de 49 89 84 24 88 01 00 00 8b 44 24 08 89 04 24 e9 c3 f7 ff ff c7 04 24 ed ff ff ff e9 b7 f7 ff ff <0f> 0b c7 04 24 f0 ff ff ff e9 a9 f7 ff ff c7 04 24 f4 ff ff ff e9 RSP: 0018:ffff888133cff948 EFLAGS: 00010202 RAX: 0000000000000001 RBX: 1ffff1102679ff31 RCX: 0000000000000000 RDX: 1ffffffff0b27a60 RSI: ffffffff8593d2f0 RDI: ffffffff85941140 RBP: 00000000000c2041 R08: ffffffffffffffff R09: ffffed1020240221 R10: ffff88810120110f R11: ffffed1020240214 R12: ffffffff8593d2f0 R13: ffffffff8593d300 R14: ffffffff85941140 R15: ffffffff85631100 FS: 00007f7ec6f28740(0000) GS:ffff8882b5251000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7ec6f181c0 CR3: 000000012f1d0005 CR4: 0000000000172ef0 Call Trace: ? __pfx_ftrace_startup_subops+0x10/0x10 ? find_held_lock+0x2b/0x80 ? ftrace_stub_direct_tramp+0x10/0x10 ? ftrace_stub_direct_tramp+0x10/0x10 ? trace_preempt_on+0xd0/0x110 ? __pfx_trace_graph_entry_args+0x10/0x10 register_ftrace_graph+0x4d2/0x1020 ? tracing_reset_online_cpus+0x14b/0x1e0 ? __pfx_register_ftrace_graph+0x10/0x10 ? ring_buffer_record_enable+0x16/0x20 ? tracing_reset_online_cpus+0x153/0x1e0 ? __pfx_tracing_reset_online_cpus+0x10/0x10 ? __pfx_trace_graph_return+0x10/0x10 graph_trace_init+0xfd/0x160 tracing_set_tracer+0x500/0xa80 ? __pfx_tracing_set_tracer+0x10/0x10 ? lock_release+0x181/0x2d0 ? _copy_from_user+0x26/0xa0 tracing_set_trace_write+0x132/0x1e0 ? __pfx_tracing_set_trace_write+0x10/0x10 ? ftrace_graph_func+0xcc/0x140 ? ftrace_stub_direct_tramp+0x10/0x10 ? ftrace_stub_direct_tramp+0x10/0x10 ? ftrace_stub_direct_tramp+0x10/0x10 vfs_write+0x1d0/0xe90 ? __pfx_vfs_write+0x10/0x10 Have the setting of the funcgraph-args check if function_graph tracer is the current tracer of the instance, and if not, do nothing, as there's nothing to do (the option is checked when function_graph tracing starts). Cc: stable@vger.kernel.org Cc: Mathieu Desnoyers Cc: Mark Rutland Link: https://lore.kernel.org/20250618073801.057ea636@gandalf.local.home Fixes: c7a60a733c373 ("ftrace: Have funcgraph-args take affect during tracing") Closes: https://lore.kernel.org/all/4ab1a7bdd0174ab09c7b0d68cdbff9a4@huawei.com/ Reported-by: Changbin Du Tested-by: Changbin Du Reviewed-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit e1c75831f682eef0f68b35723437146ed86070b1 Author: Penglei Jiang Date: Tue Jun 17 09:56:44 2025 -0700 io_uring: fix potential page leak in io_sqe_buffer_register() If allocation of the 'imu' fails, then the existing pages aren't unpinned in the error path. This is mostly a theoretical issue, requiring fault injection to hit. Move unpin_user_pages() to unified error handling to fix the page leak issue. Fixes: d8c2237d0aa9 ("io_uring: add io_pin_pages() helper") Signed-off-by: Penglei Jiang Link: https://lore.kernel.org/r/20250617165644.79165-1-superman.xpt@gmail.com Signed-off-by: Jens Axboe commit 10af0273a35ab4513ca1546644b8c853044da134 Author: David Thompson Date: Fri Jun 13 16:34:43 2025 +0000 gpio: mlxbf3: only get IRQ for device instance 0 The gpio-mlxbf3 driver interfaces with two GPIO controllers, device instance 0 and 1. There is a single IRQ resource shared between the two controllers, and it is found in the ACPI table for device instance 0. The driver should not attempt to get an IRQ resource when probing device instance 1, otherwise the following error is logged: mlxbf3_gpio MLNXBF33:01: error -ENXIO: IRQ index 0 not found Signed-off-by: David Thompson Reviewed-by: Shravan Kumar Ramani Fixes: cd33f216d241 ("gpio: mlxbf3: Add gpio driver support") Link: https://lore.kernel.org/r/20250613163443.1065217-1-davthompson@nvidia.com Signed-off-by: Bartosz Golaszewski commit dba90f5a79c13936de4273a19e67908a0c296afe Author: Miquel Raynal Date: Wed Jun 18 10:48:00 2025 +0200 mtd: spinand: winbond: Prevent unsupported frequencies on dual/quad I/O variants Dual and quad capable chips natively support dual and quad I/O variants at up to 104MHz (1-2-2 and 1-4-4 operations). Reaching the maximum speed of 166MHz is theoretically possible (while still unsupported in the field) by adding a few more dummy cycles. Let's be accurate and clearly state this limit. Setting a maximum frequency implies adding the frequency parameter to the macro, which is done using a variadic argument to avoid impacting all the other drivers which already make use of this macro. Fixes: 1ea808b4d15b ("mtd: spinand: winbond: Update the *JW chip definitions") Signed-off-by: Miquel Raynal commit 29384bbb1a2a5926f97b8cbe469081e7a1770dea Author: Miquel Raynal Date: Wed Jun 18 10:47:59 2025 +0200 mtd: spinand: winbond: Increase maximum frequency on an octal operation The default number of dummy cycles is 16 in octal I/O mode (1S-8S-8S), and with this default configuration the maximum frequency is higher than what is being advertised. There are higher and lower frequency possibilities, which involve making changes in the number of dummy cycles through the VCR register. At this stage, let's just describe the default configuration correctly. There should be no functional change. Fixes: 1ac5ff2f2ad6 ("mtd: spinand: winbond: Add octal support") Signed-off-by: Miquel Raynal commit 60dffe96fab00cee7ef7f1b151da485d42ccb33a Author: Miquel Raynal Date: Wed Jun 18 10:47:58 2025 +0200 mtd: spinand: winbond: Fix W35N number of planes/LUN There's been a mistake when extracting the geometry of the W35N02 and W35N04 chips from the datasheet. There is a single plane, however there are respectively 2 and 4 LUNs. They are actually referred in the datasheet as dies (equivalent of target), but as there is no die select operation and the chips only feature a single configuration register for the entire chip (instead of one per die), we can reasonably assume we are talking about LUNs and not dies. Reported-by: Andreas Dannenberg Suggested-by: Vignesh Raghavendra Fixes: 25e08bf66660 ("mtd: spinand: winbond: Add support for W35N02JW and W35N04JW chips") Cc: stable@vger.kernel.org Signed-off-by: Miquel Raynal commit 635e118317ffa773f6d25ec6a71b7927d7e8886a Author: Miquel Raynal Date: Wed Jun 18 10:54:44 2025 +0200 Revert "mtd: core: always create master device" The idea behind this patch was to always let a "master" mtd device available to anchor runtime PM. Historically, there was no mtd device representing the whole storage as soon as partitions were coming into play. The introduction of CONFIG_MTD_PARTITIONED_MASTER allowed to keep this "master" device, but was not enabled by default to avoid breaking existing users (otherwise the mtd device numbering would be totally messed up with an off by 1, at least). The approach of adding an mtd_master class on top of partitioned mtd devices is breaking the mtd core in many creative ways, so better think again this approach and revert the faulty changes for now. This reverts commit 0aa7b390fc40a871267a2328bbbefca8b37ad307. Fixes: 0aa7b390fc40 ("mtd: core: always create master device") Tested-by: Guenter Roeck Acked-by: Guenter Roeck Signed-off-by: Miquel Raynal commit df29f60369ccec0aa17d7eed7e2ae1fcdc9be6d4 Author: Herbert Xu Date: Mon Jun 16 12:09:17 2025 +0800 crypto: ahash - Fix infinite recursion in ahash_def_finup Invoke the final function directly in the default finup implementation since crypto_ahash_final is now just a wrapper around finup. Reported-by: Eric Biggers Fixes: 9d7a0ab1c753 ("crypto: ahash - Handle partial blocks in API") Signed-off-by: Herbert Xu commit 68dd8eeb7208f16a0592da3896dd59379d95d553 Merge: 05ced11a508af9 83f3ac2848b46e Author: Johannes Berg Date: Wed Jun 18 10:31:21 2025 +0200 Merge tag 'iwlwifi-fixes-2025-06-18' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next Miri Korenblit says: ==================== fixes for 6.16-rc3 ==================== Signed-off-by: Johannes Berg commit d0fa59897e049e84432600e86df82aab3dce7aa5 Author: Neal Cardwell Date: Fri Jun 13 15:30:56 2025 -0400 tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior After the following commit from 2024: commit e37ab7373696 ("tcp: fix to allow timestamp undo if no retransmits were sent") ...there was buggy behavior where TCP connections without SACK support could easily see erroneous undo events at the end of fast recovery or RTO recovery episodes. The erroneous undo events could cause those connections to suffer repeated loss recovery episodes and high retransmit rates. The problem was an interaction between the non-SACK behavior on these connections and the undo logic. The problem is that, for non-SACK connections at the end of a loss recovery episode, if snd_una == high_seq, then tcp_is_non_sack_preventing_reopen() holds steady in CA_Recovery or CA_Loss, but clears tp->retrans_stamp to 0. Then upon the next ACK the "tcp: fix to allow timestamp undo if no retransmits were sent" logic saw the tp->retrans_stamp at 0 and erroneously concluded that no data was retransmitted, and erroneously performed an undo of the cwnd reduction, restoring cwnd immediately to the value it had before loss recovery. This caused an immediate burst of traffic and build-up of queues and likely another immediate loss recovery episode. This commit fixes tcp_packet_delayed() to ignore zero retrans_stamp values for non-SACK connections when snd_una is at or above high_seq, because tcp_is_non_sack_preventing_reopen() clears retrans_stamp in this case, so it's not a valid signal that we can undo. Note that the commit named in the Fixes footer restored long-present behavior from roughly 2005-2019, so apparently this bug was present for a while during that era, and this was simply not caught. Fixes: e37ab7373696 ("tcp: fix to allow timestamp undo if no retransmits were sent") Reported-by: Eric Wheeler Closes: https://lore.kernel.org/netdev/64ea9333-e7f9-0df-b0f2-8d566143acab@ewheeler.net/ Signed-off-by: Neal Cardwell Co-developed-by: Yuchung Cheng Signed-off-by: Yuchung Cheng Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller commit 83f3ac2848b46e3e5af5d06b5f176c17e35733a3 Author: Colin Ian King Date: Thu May 22 13:17:03 2025 +0100 wifi: iwlwifi: Fix incorrect logic on cmd_ver range checking The current cmd_ver range checking on cmd_ver < 1 && cmd_ver > 3 can never be true because the logical operator && is being used, cmd_ver can never be less than 1 and also greater than 3. Fix this by using the logical || operator. Fixes: df6146a0296e ("wifi: iwlwifi: Add a new version for mac config command") Signed-off-by: Colin Ian King Link: https://patch.msgid.link/20250522121703.2766764-1-colin.i.king@gmail.com Signed-off-by: Miri Korenblit commit 432a41232ca932ecb2330f46105e68e296ba8c7f Author: Johannes Berg Date: Mon Jun 16 13:48:36 2025 +0200 wifi: iwlwifi: dvm: restore n_no_reclaim_cmds setting Apparently I accidentally removed this setting in my transport configuration rework, leading to an endless stream of warnings from the PCIe code when relevant notifications are received by the driver from firmware. Restore it. Reported-by: Woody Suwalski Closes: https://lore.kernel.org/r/e8c45d32-6129-8a5e-af80-ccc42aaf200b@gmail.com/ Fixes: 08e77d5edf70 ("wifi: iwlwifi: rework transport configuration") Signed-off-by: Johannes Berg Link: https://patch.msgid.link/20250616134902.222342908ca4.I47a551c86cbc0e9de4f980ca2fd0d67bf4052e50@changeid Signed-off-by: Miri Korenblit commit d5352b491a3a2628f1a798952a4ae76bde5d42e4 Author: Pei Xiao Date: Tue May 27 16:03:55 2025 +0800 wifi: iwlwifi: cfg: Limit cb_size to valid range on arm64 defconfig build failed with gcc-8: drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c:208:3: include/linux/bitfield.h:195:3: error: call to '__field_overflow' declared with attribute error: value doesn't fit into mask __field_overflow(); \ ^~~~~~~~~~~~~~~~~~ include/linux/bitfield.h:215:2: note: in expansion of macro '____MAKE_OP' ____MAKE_OP(u##size,u##size,,) ^~~~~~~~~~~ include/linux/bitfield.h:218:1: note: in expansion of macro '__MAKE_OP' __MAKE_OP(32) Limit cb_size to valid range to fix it. Signed-off-by: Pei Xiao Link: https://patch.msgid.link/7b373a4426070d50b5afb3269fd116c18ce3aea8.1748332709.git.xiaopei01@kylinos.cn Signed-off-by: Miri Korenblit commit db5957ab85204a02093ac5ab2d0bbfe253955b71 Author: Miri Korenblit Date: Tue Jun 17 15:00:06 2025 +0300 wifi: iwlwifi: restore missing initialization of async_handlers_list (again) The initialization of async_handlers_list was accidentally removed in a previous change. Then it was restoted by commit 175e69e33c66 ("wifi: iwlwifi: restore missing initialization of async_handlers_list"). Somehow, the initialization disappeared again. Restote it. Signed-off-by: Miri Korenblit commit 05ced11a508af932c15bf549add04584cb989dc9 Merge: e7417421d89358 15d25307692312 Author: Johannes Berg Date: Wed Jun 18 09:05:26 2025 +0200 Merge tag 'ath-current-20250617' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git updates for v6.16-rc3 Fix the following 3 issues: wifi: ath12k: avoid burning CPU while waiting for firmware stats wifi: ath12k: don't activate more links than firmware supports wifi: carl9170: do not ping device which has failed to load firmware ================== Signed-off-by: Johannes Berg commit e7417421d89358da071fd2930f91e67c7128fbff Author: Johannes Berg Date: Tue Jun 17 11:45:29 2025 +0200 wifi: ath6kl: remove WARN on bad firmware input If the firmware gives bad input, that's nothing to do with the driver's stack at this point etc., so the WARN_ON() doesn't add any value. Additionally, this is one of the top syzbot reports now. Just print a message, and as an added bonus, print the sizes too. Reported-by: syzbot+92c6dd14aaa230be6855@syzkaller.appspotmail.com Tested-by: syzbot+92c6dd14aaa230be6855@syzkaller.appspotmail.com Acked-by: Jeff Johnson Link: https://patch.msgid.link/20250617114529.031a677a348e.I58bf1eb4ac16a82c546725ff010f3f0d2b0cca49@changeid Signed-off-by: Johannes Berg commit 30b58444807c93bffeaba7d776110f2a909d2f9a Author: Gao Xiang Date: Tue Jun 17 13:40:56 2025 +0800 erofs: remove unused trace event erofs_destroy_inode The trace event `erofs_destroy_inode` was added but remains unused. This unused event contributes approximately 5KB to the kernel module size. Reported-by: Steven Rostedt Closes: https://lore.kernel.org/r/20250612224906.15000244@batman.local.home Fixes: 13f06f48f7bf ("staging: erofs: support tracepoint") Cc: stable@vger.kernel.org Reviewed-by: Hongbo Li Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20250617054056.3232365-1-hsiangkao@linux.alibaba.com commit 905eeb2b7c33adda23a966aeb811ab4cb9e62031 Author: Tatsuyuki Ishi Date: Thu Jun 12 19:18:25 2025 +0900 erofs: impersonate the opener's credentials when accessing backing file Previously, file operations on a file-backed mount used the current process' credentials to access the backing FD. Attempting to do so on Android lead to SELinux denials, as ACL rules on the backing file (e.g. /system/apex/foo.apex) is restricted to a small set of process. Arguably, this error is redundant and leaking implementation details, as access to files on a mount is already ACL'ed by path. Instead, override to use the opener's cred when accessing the backing file. This makes the behavior similar to a loop-backed mount, which uses kworker cred when accessing the backing file and does not cause SELinux denials. Signed-off-by: Tatsuyuki Ishi Reviewed-by: Gao Xiang Reviewed-by: Hongbo Li Link: https://lore.kernel.org/r/20250612-b4-erofs-impersonate-v1-1-8ea7d6f65171@google.com Signed-off-by: Gao Xiang commit 0aff00432cc755ad7713f8a2f305395d443cdd4c Merge: 6dbb0d97c50960 7851263998d426 Author: Jakub Kicinski Date: Tue Jun 17 18:42:48 2025 -0700 Merge branch 'atm-fix-uninit-and-mem-accounting-leak-in-vcc_sendmsg' Kuniyuki Iwashima says: ==================== atm: Fix uninit and mem accounting leak in vcc_sendmsg(). Patch 1 fixes uninit issue reported by KMSAN, and patch 2 fixes another issue found by Simon Horman during review for v1 patch. v1: https://lore.kernel.org/20250613055700.415596-1-kuni1840@gmail.com ==================== Link: https://patch.msgid.link/20250616182147.963333-1-kuni1840@gmail.com Signed-off-by: Jakub Kicinski commit 7851263998d4269125fd6cb3fdbfc7c6db853859 Author: Kuniyuki Iwashima Date: Mon Jun 16 11:21:15 2025 -0700 atm: Revert atm_account_tx() if copy_from_iter_full() fails. In vcc_sendmsg(), we account skb->truesize to sk->sk_wmem_alloc by atm_account_tx(). It is expected to be reverted by atm_pop_raw() later called by vcc->dev->ops->send(vcc, skb). However, vcc_sendmsg() misses the same revert when copy_from_iter_full() fails, and then we will leak a socket. Let's factorise the revert part as atm_return_tx() and call it in the failure path. Note that the corresponding sk_wmem_alloc operation can be found in alloc_tx() as of the blamed commit. $ git blame -L:alloc_tx net/atm/common.c c55fa3cccbc2c~ Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Simon Horman Closes: https://lore.kernel.org/netdev/20250614161959.GR414686@horms.kernel.org/ Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250616182147.963333-3-kuni1840@gmail.com Signed-off-by: Jakub Kicinski commit 2f370ae1fb6317985f3497b1bb80d457508ca2f7 Author: Kuniyuki Iwashima Date: Mon Jun 16 11:21:14 2025 -0700 atm: atmtcp: Free invalid length skb in atmtcp_c_send(). syzbot reported the splat below. [0] vcc_sendmsg() copies data passed from userspace to skb and passes it to vcc->dev->ops->send(). atmtcp_c_send() accesses skb->data as struct atmtcp_hdr after checking if skb->len is 0, but it's not enough. Also, when skb->len == 0, skb and sk (vcc) were leaked because dev_kfree_skb() is not called and sk_wmem_alloc adjustment is missing to revert atm_account_tx() in vcc_sendmsg(), which is expected to be done in atm_pop_raw(). Let's properly free skb with an invalid length in atmtcp_c_send(). [0]: BUG: KMSAN: uninit-value in atmtcp_c_send+0x255/0xed0 drivers/atm/atmtcp.c:294 atmtcp_c_send+0x255/0xed0 drivers/atm/atmtcp.c:294 vcc_sendmsg+0xd7c/0xff0 net/atm/common.c:644 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x330/0x3d0 net/socket.c:727 ____sys_sendmsg+0x7e0/0xd80 net/socket.c:2566 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2620 __sys_sendmsg net/socket.c:2652 [inline] __do_sys_sendmsg net/socket.c:2657 [inline] __se_sys_sendmsg net/socket.c:2655 [inline] __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2655 x64_sys_call+0x32fb/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:4154 [inline] slab_alloc_node mm/slub.c:4197 [inline] kmem_cache_alloc_node_noprof+0x818/0xf00 mm/slub.c:4249 kmalloc_reserve+0x13c/0x4b0 net/core/skbuff.c:579 __alloc_skb+0x347/0x7d0 net/core/skbuff.c:670 alloc_skb include/linux/skbuff.h:1336 [inline] vcc_sendmsg+0xb40/0xff0 net/atm/common.c:628 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x330/0x3d0 net/socket.c:727 ____sys_sendmsg+0x7e0/0xd80 net/socket.c:2566 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2620 __sys_sendmsg net/socket.c:2652 [inline] __do_sys_sendmsg net/socket.c:2657 [inline] __se_sys_sendmsg net/socket.c:2655 [inline] __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2655 x64_sys_call+0x32fb/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 1 UID: 0 PID: 5798 Comm: syz-executor192 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(undef) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+1d3c235276f62963e93a@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=1d3c235276f62963e93a Tested-by: syzbot+1d3c235276f62963e93a@syzkaller.appspotmail.com Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250616182147.963333-2-kuni1840@gmail.com Signed-off-by: Jakub Kicinski commit 49a5fdc06ccfece8fc935aef1d15f4400d47602b Merge: e04c78d86a9699 d3deabe4c61987 Author: Dave Airlie Date: Wed Jun 18 11:37:14 2025 +1000 Merge tag 'drm-msm-fixes-2025-06-16' of https://gitlab.freedesktop.org/drm/msm into drm-fixes Fixes for v6.16-rc3 Display: - Fixed DP output on SDM845 - Fixed 10nm DSI PLL init GPU: - SUBMIT ioctl error path leak fixes - drm half of stall-on-fault fixes. Note there is a soft dependency, to get correct mmu fault devcoredumps, on arm-smmu changes which are not in this branch, but have already been merged by Linus. So by the time Linus merges this, everything should be peachy. - a7xx: Missing CP_RESET_CONTEXT_STATE - Skip GPU component bind if GPU is not in the device table. Signed-off-by: Dave Airlie From: Rob Clark Link: https://lore.kernel.org/r/CACSVV03=OH74ip8O1xqb8RJWGyM4HFuUnWuR=p3zJR+-ko_AJA@mail.gmail.com commit 6dbb0d97c5096072c78a6abffe393584e57ae945 Author: Kuniyuki Iwashima Date: Mon Jun 16 13:15:12 2025 -0700 mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). As syzbot reported [0], mpls_route_input_rcu() can be called from mpls_getroute(), where is under RTNL. net->mpls.platform_label is only updated under RTNL. Let's use rcu_dereference_rtnl() in mpls_route_input_rcu() to silence the splat. [0]: WARNING: suspicious RCU usage 6.15.0-rc7-syzkaller-00082-g5cdb2c77c4c3 #0 Not tainted ---------------------------- net/mpls/af_mpls.c:84 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by syz.2.4451/17730: #0: ffffffff9012a3e8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff9012a3e8 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x371/0xe90 net/core/rtnetlink.c:6961 stack backtrace: CPU: 1 UID: 0 PID: 17730 Comm: syz.2.4451 Not tainted 6.15.0-rc7-syzkaller-00082-g5cdb2c77c4c3 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 lockdep_rcu_suspicious+0x166/0x260 kernel/locking/lockdep.c:6865 mpls_route_input_rcu+0x1d4/0x200 net/mpls/af_mpls.c:84 mpls_getroute+0x621/0x1ea0 net/mpls/af_mpls.c:2381 rtnetlink_rcv_msg+0x3c9/0xe90 net/core/rtnetlink.c:6964 netlink_rcv_skb+0x16d/0x440 net/netlink/af_netlink.c:2534 netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] netlink_unicast+0x53a/0x7f0 net/netlink/af_netlink.c:1339 netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1883 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg net/socket.c:727 [inline] ____sys_sendmsg+0xa98/0xc70 net/socket.c:2566 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2620 __sys_sendmmsg+0x200/0x420 net/socket.c:2709 __do_sys_sendmmsg net/socket.c:2736 [inline] __se_sys_sendmmsg net/socket.c:2733 [inline] __x64_sys_sendmmsg+0x9c/0x100 net/socket.c:2733 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x230 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f0a2818e969 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f0a28f52038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 00007f0a283b5fa0 RCX: 00007f0a2818e969 RDX: 0000000000000003 RSI: 0000200000000080 RDI: 0000000000000003 RBP: 00007f0a28210ab1 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f0a283b5fa0 R15: 00007ffce5e9f268 Fixes: 0189197f4416 ("mpls: Basic routing support") Reported-by: syzbot+8a583bdd1a5cc0b0e068@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68507981.a70a0220.395abc.01ef.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250616201532.1036568-1-kuni1840@gmail.com Signed-off-by: Jakub Kicinski commit 434635987fb7d544dd134f25c922413e19b02112 Author: Kent Overstreet Date: Tue Jun 17 20:22:32 2025 -0400 bcachefs: Fix missing newlines before ero Signed-off-by: Kent Overstreet commit 88bd771191f7f20d6295700d1746f576419e3d1f Author: Kent Overstreet Date: Tue Jun 17 20:24:12 2025 -0400 bcachefs: fix spurious error in read_btree_roots() Signed-off-by: Kent Overstreet commit 1df310860aa5b4d97b3cc83a1a8dee599071b72d Author: Kent Overstreet Date: Tue Jun 17 16:49:40 2025 -0400 bcachefs: fsck: Fix oops in key_visible_in_snapshot() The normal fsck code doesn't call key_visible_in_snapshot() with an empty list of snapshot IDs seen (the current snapshot ID will always be on the list), but str_hash_repair_key() -> bch2_get_snapshot_overwrites() can, and that's totally fine as long as we check for it. Signed-off-by: Kent Overstreet commit 3f890768dab1f97ff9bd7ebb76f4c52309401501 Author: Kent Overstreet Date: Tue Jun 17 16:41:43 2025 -0400 bcachefs: fsck: fix unhandled restart in topology repair Signed-off-by: Kent Overstreet commit cb6075bc62dc6a9cd7ab3572758685fdf78e3e20 Author: Rik van Riel Date: Fri Jun 6 13:10:34 2025 -0400 x86/mm: Fix early boot use of INVPLGB The INVLPGB instruction has limits on how many pages it can invalidate at once. That limit is enumerated in CPUID, read by the kernel, and stored in 'invpgb_count_max'. Ranged invalidation, like invlpgb_kernel_range_flush() break up their invalidations so that they do not exceed the limit. However, early boot code currently attempts to do ranged invalidation before populating 'invlpgb_count_max'. There is a for loop which is basically: for (...; addr < end; addr += invlpgb_count_max*PAGE_SIZE) If invlpgb_kernel_range_flush is called before the kernel has read the value of invlpgb_count_max from the hardware, the normally bounded loop can become an infinite loop if invlpgb_count_max is initialized to zero. Fix that issue by initializing invlpgb_count_max to 1. This way INVPLGB at early boot time will be a little bit slower than normal (with initialized invplgb_count_max), and not an instant hang at bootup time. Fixes: b7aa05cbdc52 ("x86/mm: Add INVLPGB support code") Signed-off-by: Rik van Riel Signed-off-by: Dave Hansen Link: https://lore.kernel.org/all/20250606171112.4013261-3-riel%40surriel.com commit 15d25307692312cec4b57052da73387f91a2e870 Author: Dmitry Antipov Date: Mon Jun 16 21:12:05 2025 +0300 wifi: carl9170: do not ping device which has failed to load firmware Syzkaller reports [1, 2] crashes caused by an attempts to ping the device which has failed to load firmware. Since such a device doesn't pass 'ieee80211_register_hw()', an internal workqueue managed by 'ieee80211_queue_work()' is not yet created and an attempt to queue work on it causes null-ptr-deref. [1] https://syzkaller.appspot.com/bug?extid=9a4aec827829942045ff [2] https://syzkaller.appspot.com/bug?extid=0d8afba53e8fb2633217 Fixes: e4a668c59080 ("carl9170: fix spurious restart due to high latency") Signed-off-by: Dmitry Antipov Acked-by: Christian Lamparter Link: https://patch.msgid.link/20250616181205.38883-1-dmantipov@yandex.ru Signed-off-by: Jeff Johnson commit ad5e9178cec589bf3af589dc43e638e5a5bf56fa Author: Baochen Qiang Date: Thu Jun 12 09:31:52 2025 +0800 wifi: ath12k: don't wait when there is no vdev started For WMI_REQUEST_VDEV_STAT request, firmware might split response into multiple events dut to buffer limit, hence currently in ath12k_wmi_fw_stats_process() host waits until all events received. In case there is no vdev started, this results in that below condition would never get satisfied ((++ar->fw_stats.num_vdev_recvd) == total_vdevs_started) consequently the requestor would be blocked until time out. The same applies to WMI_REQUEST_BCN_STAT request as well due to: ((++ar->fw_stats.num_bcn_recvd) == ar->num_started_vdevs) Change to check the number of started vdev first: if it is zero, finish directly; if not, follow the old way. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Tested-on: QCN9274 hw2.0 WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 Fixes: e367c924768b ("wifi: ath12k: Request vdev stats from firmware") Signed-off-by: Baochen Qiang Link: https://patch.msgid.link/20250612-ath12k-fw-fixes-v1-4-12f594f3b857@quicinc.com Signed-off-by: Jeff Johnson commit ac7b8ff7839ded757806317ab8979be844766770 Author: Baochen Qiang Date: Thu Jun 12 09:31:51 2025 +0800 wifi: ath12k: don't use static variables in ath12k_wmi_fw_stats_process() Currently ath12k_wmi_fw_stats_process() is using static variables to count firmware stat events. Taking num_vdev as an example, if for whatever reason (say ar->num_started_vdevs is 0 or firmware bug etc.) the following condition (++num_vdev) == total_vdevs_started is not met, is_end is not set thus num_vdev won't be cleared. Next time when firmware stats is requested again, even if everything is working fine, failure is expected due to the condition above will never be satisfied. The same applies to num_bcn as well. Change to use non-static counters and reset them each time before firmware stats is requested. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Tested-on: QCN9274 hw2.0 WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 Fixes: e367c924768b ("wifi: ath12k: Request vdev stats from firmware") Signed-off-by: Baochen Qiang Link: https://patch.msgid.link/20250612-ath12k-fw-fixes-v1-3-12f594f3b857@quicinc.com Signed-off-by: Jeff Johnson commit 9a353a4a11a475578be3c02dd17e70afe3a4a7f6 Author: Baochen Qiang Date: Thu Jun 12 09:31:50 2025 +0800 wifi: ath12k: avoid burning CPU while waiting for firmware stats ath12k_mac_get_fw_stats() is busy polling fw_stats_done flag while waiting firmware finishing sending all events. This is not good as CPU is monopolized and kept burning during the wait. Change to the completion mechanism to fix it. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Tested-on: QCN9274 hw2.0 WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 Fixes: e367c924768b ("wifi: ath12k: Request vdev stats from firmware") Reported-by: Grégoire Stein Closes: https://lore.kernel.org/ath12k/AS8P190MB120575BBB25FCE697CD7D4988763A@AS8P190MB1205.EURP190.PROD.OUTLOOK.COM/ Signed-off-by: Baochen Qiang Tested-by: Grégoire Stein Link: https://patch.msgid.link/20250612-ath12k-fw-fixes-v1-2-12f594f3b857@quicinc.com Signed-off-by: Jeff Johnson commit a48a931a32f88157db2baa31c10738a7fe660e93 Author: Baochen Qiang Date: Thu Jun 12 09:31:49 2025 +0800 wifi: ath12k: fix documentation on firmware stats Regarding the firmware stats events handling, the comment in ath12k_mac_get_fw_stats() says host determines whether all events have been received based on 'end' tag in TLV. This is wrong as there is no such tag at all, actually host makes the decision totally by itself based on the stats type and active pdev/vdev counts etc. Fix it to correctly reflect the logic. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Tested-on: QCN9274 hw2.0 WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 Signed-off-by: Baochen Qiang Link: https://patch.msgid.link/20250612-ath12k-fw-fixes-v1-1-12f594f3b857@quicinc.com Signed-off-by: Jeff Johnson commit d9dbc6b8b94ab41fb8b9dbb5a7be024029d46309 Author: Baochen Qiang Date: Thu May 22 16:54:15 2025 +0800 wifi: ath12k: don't activate more links than firmware supports In case of ML connection, currently all useful links are activated at ASSOC stage: ieee80211_set_active_links(vif, ieee80211_vif_usable_links(vif)) this results in firmware crash when the number of links activated on the same device is more than supported. Since firmware supports activating at most 2 links for a ML connection, to avoid firmware crash, host needs to select 2 links out of the useful links. As the assoc link has already been chosen, the question becomes how to determine partner links. A straightforward principle applied here is that the resulted combination should achieve the best throughput. For that purpose, ideally various factors like bandwidth, RSSI etc should be considered. But that would be too complicate. To make it easy, the choice is to only take hardware modes into consideration. The SBS (single band simultaneously) mode frequency range covers 5 GHz and 6 GHz bands. In this mode, the two individual MACs are both active, with one working on 5g-high band and the other on 5g-low band (from hardware perspective 5 GHz and 6 GHz bands are referred to as a 'large' single 5 GHz band). The DBS (dual band simultaneously) mode covers 2 GHz band and the 'large' 5 GHz band, with one MAC working on 2 GHz band and the other working on 5 GHz band or 6 GHz band. Since 5,6 GHz bands could provide higher bandwidth than 2 GHz band, the preference is given to SBS mode. Other hardware modes results in only one working MAC at any given time, so it is chosen only when both SBS are DBS are not possible. For each hardware mode, if there are more than one partner candidate, just choose the first one. For now only single device MLO case is handled as it is easy. Other cases could be addressed in the future. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Signed-off-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250522-ath12k-sbs-dbs-v1-6-54a29e7a3a88@quicinc.com Signed-off-by: Jeff Johnson commit 2296038fd35a6e57af77496affe9044293ed2947 Author: Baochen Qiang Date: Thu May 22 16:54:14 2025 +0800 wifi: ath12k: update link active in case two links fall on the same MAC In case of two links established on the same device in an ML connection, depending on device's hardware mode capability, it is possible that both links fall on the same MAC. Currently, no specific action is taken to address this but just keep both links active. However this would result in lower throughput compared to even one link, because switching between these two links on the resulted MAC significantly impacts throughput. Check if both links fall in the frequency range of a single MAC. If so, send WMI_MLO_LINK_SET_ACTIVE_CMDID command to firmware such that firmware can deactivate one of them. Note the decision of which link getting deactivated is made by firmware, host only sends the vdev lists. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Signed-off-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250522-ath12k-sbs-dbs-v1-5-54a29e7a3a88@quicinc.com Signed-off-by: Jeff Johnson commit c36f2cd628f9df6ffb19c23eedaa666440b8f5c5 Author: Baochen Qiang Date: Thu May 22 16:54:13 2025 +0800 wifi: ath12k: support WMI_MLO_LINK_SET_ACTIVE_CMDID command Add WMI_MLO_LINK_SET_ACTIVE_CMDID command. This command allows host to send required link information to firmware such that firmware can make decision on activating/deactivating links in various scenarios. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Signed-off-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250522-ath12k-sbs-dbs-v1-4-54a29e7a3a88@quicinc.com Signed-off-by: Jeff Johnson commit e47b11e3bd34177af6669ef0945eb23dd4da3bcb Author: Baochen Qiang Date: Thu May 22 16:54:12 2025 +0800 wifi: ath12k: update freq range for each hardware mode Previous patches parse and save hardware MAC frequency range information in ath12k_svc_ext_info structure. Such range represents hardware capability hence needs to be updated based on host information, e.g. guard the range based on host's low/high boundary. So update frequency range. The updated range is saved in ath12k_hw_mode_info structure and would be used when doing vdev activation and link selection in following patches. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Signed-off-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250522-ath12k-sbs-dbs-v1-3-54a29e7a3a88@quicinc.com Signed-off-by: Jeff Johnson commit 241d130f1419fd99923d99aff6e40490a4c34d93 Author: Baochen Qiang Date: Thu May 22 16:54:11 2025 +0800 wifi: ath12k: parse and save sbs_lower_band_end_freq from WMI_SERVICE_READY_EXT2_EVENTID event Firmware sends the boundary between lower and higher bands in ath12k_wmi_dbs_or_sbs_cap_params structure embedded in WMI_SERVICE_READY_EXT2_EVENTID event. The boundary is needed when updating frequency range in the following patch. So parse and save it for later use. Note ath12k_wmi_dbs_or_sbs_cap_params is placed after some other structures, so placeholders for them are added as well. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Signed-off-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250522-ath12k-sbs-dbs-v1-2-54a29e7a3a88@quicinc.com Signed-off-by: Jeff Johnson commit 062ade23991e556a14bbb27c1cf873c34dbd9d28 Author: Baochen Qiang Date: Thu May 22 16:54:10 2025 +0800 wifi: ath12k: parse and save hardware mode info from WMI_SERVICE_READY_EXT_EVENTID event for later use WLAN hardware might support various hardware modes such as DBS (dual band simultaneously), SBS (single band simultaneously) and DBS_OR_SBS etc, see enum wmi_host_hw_mode_config_type. Firmware advertises actual supported modes in WMI_SERVICE_READY_EXT_EVENTID event. For each mode, firmware advertises frequency range each hardware MAC can operate on. In MLO case such information is necessary during vdev activation and link selection (which is done in following patches), so add a new structure ath12k_svc_ext_info to ath12k_wmi_base, then parse and save those information to it for later use. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Signed-off-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250522-ath12k-sbs-dbs-v1-1-54a29e7a3a88@quicinc.com Signed-off-by: Jeff Johnson commit 18ae7d0cdd76420e80f6ab15ada063708f14ba40 Author: Bjorn Andersson Date: Mon Jun 9 22:06:22 2025 -0500 wifi: ath12k: Avoid CPU busy-wait by handling VDEV_STAT and BCN_STAT When the ath12k driver is built without CONFIG_ATH12K_DEBUG, the recently refactored stats code can cause any user space application (such at NetworkManager) to consume 100% CPU for 3 seconds, every time stats are read. Commit 'b8a0d83fe4c7 ("wifi: ath12k: move firmware stats out of debugfs")' moved ath12k_debugfs_fw_stats_request() out of debugfs, by merging the additional logic into ath12k_mac_get_fw_stats(). Among the added responsibility of ath12k_mac_get_fw_stats() was the busy-wait for `fw_stats_done`. Signalling of `fw_stats_done` happens when one of the WMI_REQUEST_PDEV_STAT, WMI_REQUEST_VDEV_STAT, and WMI_REQUEST_BCN_STAT messages are received, but the handling of the latter two commands remained in the debugfs code. As `fw_stats_done` isn't signalled, the calling processes will spin until the timeout (3 seconds) is reached. Moving the handling of these two additional responses out of debugfs resolves the issue. Fixes: b8a0d83fe4c7 ("wifi: ath12k: move firmware stats out of debugfs") Signed-off-by: Bjorn Andersson Tested-by: Abel Vesa Link: https://patch.msgid.link/20250609-ath12k-fw-stats-done-v1-1-2b3624656697@oss.qualcomm.com Signed-off-by: Jeff Johnson commit b160766e26d4e2e2d6fe2294e0b02f92baefcec5 Author: Hyunwoo Kim Date: Fri Jun 13 20:54:57 2025 -0400 net/sched: fix use-after-free in taprio_dev_notifier Since taprio’s taprio_dev_notifier() isn’t protected by an RCU read-side critical section, a race with advance_sched() can lead to a use-after-free. Adding rcu_read_lock() inside taprio_dev_notifier() prevents this. Fixes: fed87cc6718a ("net/sched: taprio: automatically calculate queueMaxSDU based on TC gate durations") Cc: stable@vger.kernel.org Signed-off-by: Hyunwoo Kim Reviewed-by: Simon Horman Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/aEzIYYxt0is9upYG@v4bel-B760M-AORUS-ELITE-AX Signed-off-by: Jakub Kicinski commit 4300fd62daf219e712687fff82098490517d6b20 Merge: 13c90202ddbb5f aa112cbc5f0ac6 Author: Jakub Kicinski Date: Tue Jun 17 16:13:12 2025 -0700 Merge branch 'ptp_vclock-fixes' Vladimir Oltean says: ==================== ptp_vclock fixes While I was intending to test something else related to PTP in net-next I noticed any time I would run ptp4l on an interface, the kernel would print "ptp: physical clock is free running" and ptp4l would exit with an error code. I then found Jeongjun Park's patch and subsequent explanation provided to Jakub's question, specifically related to the code which introduced the breakage I am seeing. https://lore.kernel.org/netdev/CAO9qdTEjQ5414un7Yw604paECF=6etVKSDSnYmZzZ6Pg3LurXw@mail.gmail.com/ I had to look at the original issue that prompted Jeongjun Park's patch, and provide an alternative fix for it. Patch 1/2 in this set contains a logical revert plus the alternative fix, squashed into one. Patch 2/2 fixes another issue which was confusing during debugging/ characterization, namely: "ok, the kernel clearly thinks that any physical clock is free-running after this change (despite there being no vclocks), but why would ptp4l fail to create the clock altogether? Why not just fail to adjust it?" By reverting (locally) Jeongjun Park's commit, I could reproduce the reported lockdep splat using the commands from patch 1/2's commit message, and this goes away with the reworked implementation. ==================== Link: https://patch.msgid.link/20250613174749.406826-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit aa112cbc5f0ac6f3b44d829005bf34005d9fe9bb Author: Vladimir Oltean Date: Fri Jun 13 20:47:49 2025 +0300 ptp: allow reading of currently dialed frequency to succeed on free-running clocks There is a bug in ptp_clock_adjtime() which makes it refuse the operation even if we just want to read the current clock dialed frequency, not modify anything (tx->modes == 0). That should be possible even if the clock is free-running. For context, the kernel UAPI is the same for getting and setting the frequency of a POSIX clock. For example, ptp4l errors out at clock_create() -> clockadj_get_freq() -> clock_adjtime() time, when it should logically only have failed on actual adjustments to the clock, aka if the clock was configured as slave. But in master mode it should work. This was discovered when examining the issue described in the previous commit, where ptp_clock_freerun() returned true despite n_vclocks being zero. Fixes: 73f37068d540 ("ptp: support ptp physical/virtual clocks conversion") Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20250613174749.406826-3-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 5ab73b010cad294851e558f1d4714a85c6f206c7 Author: Vladimir Oltean Date: Fri Jun 13 20:47:48 2025 +0300 ptp: fix breakage after ptp_vclock_in_use() rework What is broken -------------- ptp4l, and any other application which calls clock_adjtime() on a physical clock, is greeted with error -EBUSY after commit 87f7ce260a3c ("ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use()"). Explanation for the breakage ---------------------------- The blamed commit was based on the false assumption that ptp_vclock_in_use() callers already test for n_vclocks prior to calling this function. This is notably incorrect for the code path below, in which there is, in fact, no n_vclocks test: ptp_clock_adjtime() -> ptp_clock_freerun() -> ptp_vclock_in_use() The result is that any clock adjustment on any physical clock is now impossible. This is _despite_ there not being any vclock over this physical clock. $ ptp4l -i eno0 -2 -P -m ptp4l[58.425]: selected /dev/ptp0 as PTP clock [ 58.429749] ptp: physical clock is free running ptp4l[58.431]: Failed to open /dev/ptp0: Device or resource busy failed to create a clock $ cat /sys/class/ptp/ptp0/n_vclocks 0 The patch makes the ptp_vclock_in_use() function say "if it's not a virtual clock, then this physical clock does have virtual clocks on top". Then ptp_clock_freerun() uses this information to say "this physical clock has virtual clocks on top, so it must stay free-running". Then ptp_clock_adjtime() uses this information to say "well, if this physical clock has to be free-running, I can't do it, return -EBUSY". Simply put, ptp_vclock_in_use() cannot be simplified so as to remove the test whether vclocks are in use. What did the blamed commit intend to fix ---------------------------------------- The blamed commit presents a lockdep warning stating "possible recursive locking detected", with the n_vclocks_store() and ptp_clock_unregister() functions involved. The recursive locking seems this: n_vclocks_store() -> mutex_lock_interruptible(&ptp->n_vclocks_mux) // 1 -> device_for_each_child_reverse(..., unregister_vclock) -> unregister_vclock() -> ptp_vclock_unregister() -> ptp_clock_unregister() -> ptp_vclock_in_use() -> mutex_lock_interruptible(&ptp->n_vclocks_mux) // 2 The issue can be triggered by creating and then deleting vclocks: $ echo 2 > /sys/class/ptp/ptp0/n_vclocks $ echo 0 > /sys/class/ptp/ptp0/n_vclocks But note that in the original stack trace, the address of the first lock is different from the address of the second lock. This is because at step 1 marked above, &ptp->n_vclocks_mux is the lock of the parent (physical) PTP clock, and at step 2, the lock is of the child (virtual) PTP clock. They are different locks of different devices. In this situation there is no real deadlock, the lockdep warning is caused by the fact that the mutexes have the same lock class on both the parent and the child. Functionally it is fine. Proposed alternative solution ----------------------------- We must reintroduce the body of ptp_vclock_in_use() mostly as it was structured prior to the blamed commit, but avoid the lockdep warning. Based on the fact that vclocks cannot be nested on top of one another (ptp_is_attribute_visible() hides n_vclocks for virtual clocks), we already know that ptp->n_vclocks is zero for a virtual clock. And ptp->is_virtual_clock is a runtime invariant, established at ptp_clock_register() time and never changed. There is no need to serialize on any mutex in order to read ptp->is_virtual_clock, and we take advantage of that by moving it outside the lock. Thus, virtual clocks do not need to acquire &ptp->n_vclocks_mux at all, and step 2 in the code walkthrough above can simply go away. We can simply return false to the question "ptp_vclock_in_use(a virtual clock)". Other notes ----------- Releasing &ptp->n_vclocks_mux before ptp_vclock_in_use() returns execution seems racy, because the returned value can become stale as soon as the function returns and before the return value is used (i.e. n_vclocks_store() can run any time). The locking requirement should somehow be transferred to the caller, to ensure a longer life time for the returned value, but this seems out of scope for this severe bug fix. Because we are also fixing up the logic from the original commit, there is another Fixes: tag for that. Fixes: 87f7ce260a3c ("ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use()") Fixes: 73f37068d540 ("ptp: support ptp physical/virtual clocks conversion") Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20250613174749.406826-2-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 3c902383f2da91cba3821b73aa6edd49f4db6023 Author: Lukas Bulwahn Date: Mon Jun 16 12:04:32 2025 +0200 x86/its: Fix an ifdef typo in its_alloc() Commit a82b26451de1 ("x86/its: explicitly manage permissions for ITS pages") reworks its_alloc() and introduces a typo in an ifdef conditional, referring to CONFIG_MODULE instead of CONFIG_MODULES. Fix this typo in its_alloc(). Fixes: a82b26451de1 ("x86/its: explicitly manage permissions for ITS pages") Signed-off-by: Lukas Bulwahn Signed-off-by: Dave Hansen Link: https://lore.kernel.org/all/20250616100432.22941-1-lukas.bulwahn%40redhat.com commit 13c90202ddbb5f6e8457dadc797ca88b2d1b0742 Merge: 68a4abb1ef7970 5dacc94c6fe61c Author: Jakub Kicinski Date: Tue Jun 17 15:56:33 2025 -0700 Merge branch 'bnxt_en-bug-fixes' Michael Chan says: ==================== bnxt_en: Bug fixes Thie first patch fixes a crash during PCIe AER when the bnxt_re RoCE driver is loaded. The second patch is a refactor patch needed by patch 3. Patch 3 fixes a packet drop issue if queue restart is done on a ring belonging to a non-default RSS context. Patch 2 and 3 are version 2 that has addressed the v1 issue by reducing the scope of the traffic disruptions: https://lore.kernel.org/netdev/CACKFLi=P9xYHVF4h2Ovjd-8DaoyzFAHnY6Y6H+1b7eGq+BQZzA@mail.gmail.com/ ==================== Link: https://patch.msgid.link/20250613231841.377988-1-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 5dacc94c6fe61cde6f700e95cf35af9944b022c4 Author: Pavan Chebbi Date: Fri Jun 13 16:18:41 2025 -0700 bnxt_en: Update MRU and RSS table of RSS contexts on queue reset The commit under the Fixes tag below which updates the VNICs' RSS and MRU during .ndo_queue_start(), needs to be extended to cover any non-default RSS contexts which have their own VNICs. Without this step, packets that are destined to a non-default RSS context may be dropped after .ndo_queue_start(). We further optimize this scheme by updating the VNIC only if the RX ring being restarted is in the RSS table of the VNIC. Updating the VNIC (in particular setting the MRU to 0) will momentarily stop all traffic to all rings in the RSS table. Any VNIC that has the RX ring excluded from the RSS table can skip this step and avoid the traffic disruption. Note that this scheme is just an improvement. A VNIC with multiple rings in the RSS table will still see traffic disruptions to all rings in the RSS table when one of the rings is being restarted. We are working on a FW scheme that will improve upon this further. Fixes: 5ac066b7b062 ("bnxt_en: Fix queue start to update vnic RSS table") Reported-by: David Wei Signed-off-by: Pavan Chebbi Signed-off-by: Michael Chan Link: https://patch.msgid.link/20250613231841.377988-4-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit e11baaea94e2923739a98abeee85eb0667c04fd3 Author: Pavan Chebbi Date: Fri Jun 13 16:18:40 2025 -0700 bnxt_en: Add a helper function to configure MRU and RSS Add a new helper function that will configure MRU and RSS table of a VNIC. This will be useful when we configure both on a VNIC when resetting an RX ring. This function will be used again in the next bug fix patch where we have to reconfigure VNICs for RSS contexts. Suggested-by: Michael Chan Reviewed-by: Simon Horman Reviewed-by: David Wei Signed-off-by: Pavan Chebbi Signed-off-by: Michael Chan Link: https://patch.msgid.link/20250613231841.377988-3-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 1e9ac33fa271be0d2480fd732f9642d81542500b Author: Kalesh AP Date: Fri Jun 13 16:18:39 2025 -0700 bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() Before the commit under the Fixes tag below, bnxt_ulp_stop() and bnxt_ulp_start() were always invoked in pairs. After that commit, the new bnxt_ulp_restart() can be invoked after bnxt_ulp_stop() has been called. This may result in the RoCE driver's aux driver .suspend() method being invoked twice. The 2nd bnxt_re_suspend() call will crash when it dereferences a NULL pointer: (NULL ib_device): Handle device suspend call BUG: kernel NULL pointer dereference, address: 0000000000000b78 PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 20 UID: 0 PID: 181 Comm: kworker/u96:5 Tainted: G S 6.15.0-rc1 #4 PREEMPT(voluntary) Tainted: [S]=CPU_OUT_OF_SPEC Hardware name: Dell Inc. PowerEdge R730/072T6D, BIOS 2.4.3 01/17/2017 Workqueue: bnxt_pf_wq bnxt_sp_task [bnxt_en] RIP: 0010:bnxt_re_suspend+0x45/0x1f0 [bnxt_re] Code: 8b 05 a7 3c 5b f5 48 89 44 24 18 31 c0 49 8b 5c 24 08 4d 8b 2c 24 e8 ea 06 0a f4 48 c7 c6 04 60 52 c0 48 89 df e8 1b ce f9 ff <48> 8b 83 78 0b 00 00 48 8b 80 38 03 00 00 a8 40 0f 85 b5 00 00 00 RSP: 0018:ffffa2e84084fd88 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffffffffb4b6b934 RDI: 00000000ffffffff RBP: ffffa1760954c9c0 R08: 0000000000000000 R09: c0000000ffffdfff R10: 0000000000000001 R11: ffffa2e84084fb50 R12: ffffa176031ef070 R13: ffffa17609775000 R14: ffffa17603adc180 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffffa17daa397000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000b78 CR3: 00000004aaa30003 CR4: 00000000003706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: bnxt_ulp_stop+0x69/0x90 [bnxt_en] bnxt_sp_task+0x678/0x920 [bnxt_en] ? __schedule+0x514/0xf50 process_scheduled_works+0x9d/0x400 worker_thread+0x11c/0x260 ? __pfx_worker_thread+0x10/0x10 kthread+0xfe/0x1e0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2b/0x40 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 Check the BNXT_EN_FLAG_ULP_STOPPED flag and do not proceed if the flag is already set. This will preserve the original symmetrical bnxt_ulp_stop() and bnxt_ulp_start(). Also, inside bnxt_ulp_start(), clear the BNXT_EN_FLAG_ULP_STOPPED flag after taking the mutex to avoid any race condition. And for symmetry, only proceed in bnxt_ulp_start() if the BNXT_EN_FLAG_ULP_STOPPED is set. Fixes: 3c163f35bd50 ("bnxt_en: Optimize recovery path ULP locking in the driver") Signed-off-by: Kalesh AP Co-developed-by: Michael Chan Signed-off-by: Michael Chan Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250613231841.377988-2-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 68a4abb1ef797095799e91d21f5d428c5bd09342 Merge: 6f793a1d053775 db22720545207f Author: Jakub Kicinski Date: Tue Jun 17 15:48:38 2025 -0700 Merge tag 'linux-can-fixes-for-6.16-20250617' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2025-06-17 The patch is by Brett Werling, and fixes the power regulator retrieval during probe of the tcan4x5x glue code for the m_can driver. * tag 'linux-can-fixes-for-6.16-20250617' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: tcan4x5x: fix power regulator retrieval during probe openvswitch: Allocate struct ovs_pcpu_storage dynamically ==================== Link: https://patch.msgid.link/20250617155123.2141584-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit 6f793a1d053775f8324b8dba1e7ed224f8b0166f Author: Mina Almasry Date: Sun Jun 15 20:07:33 2025 +0000 net: netmem: fix skb_ensure_writable with unreadable skbs skb_ensure_writable should succeed when it's trying to write to the header of the unreadable skbs, so it doesn't need an unconditional skb_frags_readable check. The preceding pskb_may_pull() call will succeed if write_len is within the head and fail if we're trying to write to the unreadable payload, so we don't need an additional check. Removing this check restores DSCP functionality with unreadable skbs as it's called from dscp_tg. Cc: willemb@google.com Cc: asml.silence@gmail.com Fixes: 65249feb6b3d ("net: add support for skbs with unreadable frags") Signed-off-by: Mina Almasry Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250615200733.520113-1-almasrymina@google.com Signed-off-by: Jakub Kicinski commit 94a17f2dc90bc7eae36c0f478515d4bd1c23e877 Author: Dave Hansen Date: Tue Jun 10 15:24:20 2025 -0700 x86/mm: Disable INVLPGB when PTI is enabled PTI uses separate ASIDs (aka. PCIDs) for kernel and user address spaces. When the kernel needs to flush the user address space, it just sets a bit in a bitmap and then flushes the entire PCID on the next switch to userspace. This bitmap is a single 'unsigned long' which is plenty for all 6 dynamic ASIDs. But, unfortunately, the INVLPGB support brings along a bunch more user ASIDs, as many as ~2k more. The bitmap can't address that many. Fortunately, the bitmap is only needed for PTI and all the CPUs with INVLPGB are AMD CPUs that aren't vulnerable to Meltdown and don't need PTI. The only way someone can run into an issue in practice is by booting with pti=on on a newer AMD CPU. Disable INVLPGB if PTI is enabled. Avoid overrunning the small bitmap. Note: this will be fixed up properly by making the bitmap bigger. For now, just avoid the mostly theoretical bug. Fixes: 4afeb0ed1753 ("x86/mm: Enable broadcast TLB invalidation for multi-threaded processes") Signed-off-by: Dave Hansen Acked-by: Rik van Riel Cc:stable@vger.kernel.org Link: https://lore.kernel.org/all/20250610222420.E8CBF472%40davehans-spike.ostc.intel.com commit 60524f1d2bdf222db6dc3f680e0272441f697fe4 Author: Meghana Malladi Date: Mon Jun 16 12:03:19 2025 +0530 net: ti: icssg-prueth: Fix packet handling for XDP_TX While transmitting XDP frames for XDP_TX, page_pool is used to get the DMA buffers (already mapped to the pages) and need to be freed/reycled once the transmission is complete. This need not be explicitly done by the driver as this is handled more gracefully by the xdp driver while returning the xdp frame. __xdp_return() frees the XDP memory based on its memory type, under which page_pool memory is also handled. This change fixes the transmit queue timeout while running XDP_TX. logs: [ 309.069682] icssg-prueth icssg1-eth eth2: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 45860 ms [ 313.933780] icssg-prueth icssg1-eth eth2: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 50724 ms [ 319.053656] icssg-prueth icssg1-eth eth2: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 55844 ms ... Fixes: 62aa3246f462 ("net: ti: icssg-prueth: Add XDP support") Signed-off-by: Meghana Malladi Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250616063319.3347541-1-m-malladi@ti.com Signed-off-by: Jakub Kicinski commit f4b048a6a34af9ad14a3a4a82902748f6cea6872 Author: Sven Peter Date: Thu Jun 12 21:11:32 2025 +0000 Input: apple_z2 - drop default ARCH_APPLE in Kconfig When the first driver for Apple Silicon was upstreamed we accidentally included `default ARCH_APPLE` in its Kconfig which then spread to almost every subsequent driver. As soon as ARCH_APPLE is set to y this will pull in many drivers as built-ins which is not what we want. Thus, drop `default ARCH_APPLE` from Kconfig. Signed-off-by: Sven Peter Link: https://lore.kernel.org/r/20250612-apple-kconfig-defconfig-v1-8-0e6f9cb512c1@kernel.org Signed-off-by: Dmitry Torokhov commit 52da431bf03b5506203bca27fe14a97895c80faf Merge: 4663747812d1a2 62a65b32bddb0f Author: Linus Torvalds Date: Tue Jun 17 14:58:52 2025 -0700 Merge tag 'libnvdimm-fixes-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm fix from Ira Weiny: "This converts the pmem-region device tree bindings to YAML to fix errors and bring it up to date" * tag 'libnvdimm-fixes-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: dt-bindings: pmem: Convert binding to YAML commit d222b6e6fb31e320eca506e665694d8ddf459157 Author: Arnaldo Carvalho de Melo Date: Mon Jun 16 14:18:55 2025 -0300 tools headers x86 cpufeatures: Sync with the kernel sources To pick the changes from: faad6645e1128ec2 ("x86/cpufeatures: Add CPUID feature bit for the Bus Lock Threshold") 159013a7ca18c271 ("x86/its: Enumerate Indirect Target Selection (ITS) bug") f9f27c4a377a8b45 ("x86/cpufeatures: Add "Allowed SEV Features" Feature") b02dc185ee86836c ("x86/cpufeatures: Add X86_FEATURE_APX") d88bb2ded2efdc38 ("KVM: x86: Advertise support for AMD's PREFETCHI") This causes these perf files to be rebuilt and brings some X86_FEATURE that may be used by: CC /tmp/build/perf/bench/mem-memcpy-x86-64-asm.o CC /tmp/build/perf/bench/mem-memset-x86-64-asm.o And addresses this perf build warning: Warning: Kernel ABI header differences: diff -u tools/arch/x86/include/asm/cpufeatures.h arch/x86/include/asm/cpufeatures.h Please see tools/include/uapi/README for further details. Cc: Adrian Hunter Cc: Babu Moger Cc: Chang S. Bae Cc: Dave Hansen Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Kishon Vijay Abraham I Cc: Manali Shukla Cc: Namhyung Kim Cc: Pawan Gupta Cc: Sean Christopherson Link: https://lore.kernel.org/r/aFBWAI3kHYX5aL9G@x1 Signed-off-by: Arnaldo Carvalho de Melo commit 1c85c94b3767895d70b7a5a49b111f974f5660ec Author: Arnaldo Carvalho de Melo Date: Mon Jun 16 14:33:17 2025 -0300 perf bench futex: Fix prctl include in musl libc Namhyung Kim reported: I've updated the perf-tools-next to v6.16-rc1 and found a build error like below on alpine linux 3.18. In file included from bench/futex.c:6: /usr/include/sys/prctl.h:88:8: error: redefinition of 'struct prctl_mm_map' 88 | struct prctl_mm_map { | ^~~~~~~~~~~~ In file included from bench/futex.c:5: /linux/tools/include/uapi/linux/prctl.h:134:8: note: originally defined here 134 | struct prctl_mm_map { | ^~~~~~~~~~~~ make[4]: *** [/linux/tools/build/Makefile.build:86: /build/bench/futex.o] Error 1 git bisect says it's the first commit introduced the failure. So both /usr/include/sys/prctl.h and /linux/tools/include/uapi/linux/prctl.h provide struct prctl_mm_map but their include guard must be different. /usr/include/sys/prctl.h provided by glibc contains the prctl() declaration. It includes also linux/prctl.h. The /usr/include/sys/prctl.h on alpine linux is different. This is probably coming from musl. It contains the PR_* definition and the prctl() declaration. So it clashes here because now the one struct is available twice. The man page for prctl(2) says: | #include /* Definition of PR_* constants */ | #include so musl doesn't follow this. So don't include linux/prctl.h explicitely and add some new defines needed if they aren't available. Acked-by: Sebastian Andrzej Siewior Reported-by: Namhyung Kim Closes: https://lore.kernel.org/r/20250611092542.F4ooE2FL@linutronix.de Link: https://www.openwall.com/lists/musl/2025/06/12/11 Signed-off-by: Arnaldo Carvalho de Melo commit 19f4422d485b2d0a935117a1a16015328f99be25 Author: Ian Rogers Date: Fri Jun 13 17:41:04 2025 -0700 perf test: Directory file descriptor leak Add missed close when iterating over the script directories. Fixes: f3295f5b067d3c26 ("perf tests: Use scandirat for shell script finding") Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: Jiapeng Chong Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Michael Petlan Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Tiezhu Yang Link: https://lore.kernel.org/r/20250614004108.1650988-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 4ea0bb8aaedfad8e695429cda6bd1c8b0dad0844 Author: Namjae Jeon Date: Fri Jun 13 11:51:29 2025 +0900 ksmbd: handle set/get info file for streamed file The bug only appears when: - windows 11 copies a file that has an alternate data stream - streams_xattr is enabled on the share configuration. Microsoft Edge adds a ZoneIdentifier data stream containing the URL for files it downloads. Another way to create a test file: - open cmd.exe - echo "hello from default data stream" > hello.txt - echo "hello again from ads" > hello.txt:ads.txt If you open the file using notepad, we'll see the first message. If you run "notepad hello.txt:ads.txt" in cmd.exe, we should see the second message. dir /s /r should least all streams for the file. The truncation happens because the windows 11 client sends a SetInfo/EndOfFile message on the ADS, but it is instead applied on the main file, because we don't check fp->stream. When receiving set/get info file for a stream file, Change to process requests using stream position and size. Truncate is unnecessary for stream files, so we skip set_file_allocation_info and set_end_of_file_info operations. Reported-by: Marios Makassikis Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 7ac5b66acafcc9292fb935d7e03790f2b8b2dc0e Author: Namjae Jeon Date: Fri Jun 13 10:12:43 2025 +0900 ksmbd: fix null pointer dereference in destroy_previous_session If client set ->PreviousSessionId on kerberos session setup stage, NULL pointer dereference error will happen. Since sess->user is not set yet, It can pass the user argument as NULL to destroy_previous_session. sess->user will be set in ksmbd_krb5_authenticate(). So this patch move calling destroy_previous_session() after ksmbd_krb5_authenticate(). Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-27391 Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit a89f5fae998bdc4d0505306f93844c9ae059d50c Author: Namjae Jeon Date: Tue Jun 10 18:52:56 2025 +0900 ksmbd: add free_transport ops in ksmbd connection free_transport function for tcp connection can be called from smbdirect. It will cause kernel oops. This patch add free_transport ops in ksmbd connection, and add each free_transports for tcp and smbdirect. Fixes: 21a4e47578d4 ("ksmbd: fix use-after-free in __smb2_lease_break_noti()") Reviewed-by: Stefan Metzmacher Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 155c1e5a92bebff36cc033c9eb9bb3f76712af44 Author: Krzysztof Kozlowski Date: Fri Jun 13 09:16:54 2025 +0200 Input: Fully open-code compatible for grepping It is very useful to find driver implementing compatibles with `git grep compatible`, so driver should not use defines for that string, even if this means string will be effectively duplicated. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250613071653.46809-2-krzysztof.kozlowski@linaro.org Signed-off-by: Dmitry Torokhov commit c44f79cbd305e7a8c2548b4fa3b42b865611bada Author: Chen-Yu Tsai Date: Tue Jun 17 16:19:58 2025 +0800 dt-bindings: HID: i2c-hid: elan: Introduce Elan eKTH8D18 The Elan eKTH8D18 touchscreen controller is an I2C HID device with a longer boot-up time. Power sequence timing wise it is compatible with the eKTH6A12NAY, with a power-on delay of at least 5ms, 20ms out-of-reset for I2C ack response, and 150ms out-of-reset for I2C HID enumeration, both shorter than what the eKTH6A12NAY requires. Enumeration and subsequent operation follows the I2C HID standard. Add a compatible string for it with the ekth6a12nay one as a fallback. No enum was used as it is rare to actually add new entries. These chips are commonly completely backward compatible, and unless the power sequencing delays change, there is no real effort being made to keep track of new parts, which come out constantly. Also drop the constraints on the I2C address since it's not really part of the binding. Reviewed-by: Douglas Anderson Reviewed-by: Rob Herring (Arm) Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20250617082004.1653492-2-wenst@chromium.org Signed-off-by: Dmitry Torokhov commit ebec62bc7ec435b475722a5467d67c720a1ad79f Author: Ian Rogers Date: Fri Jun 13 17:41:05 2025 -0700 perf evsel: Missed close() when probing hybrid core PMUs Add missing close() to avoid leaking perf events. In past perfs this mattered little as the function was just used by 'perf list'. As the function is now used to detect hybrid PMUs leaking the perf event is somewhat more painful. Fixes: b41f1cec91c37eee ("perf list: Skip unsupported events") Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: Jiapeng Chong Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Michael Petlan Cc: Namhyung Kim Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Tiezhu Yang Link: https://lore.kernel.org/r/20250614004108.1650988-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit fc92099902fbf21000554678a47654b029c15a4d Author: Arnaldo Carvalho de Melo Date: Thu Jun 12 12:36:06 2025 -0300 tools headers: Synchronize linux/bits.h with the kernel sources To pick up the changes in this cset: 1e7933a575ed8af4 ("uapi: Revert "bitops: avoid integer overflow in GENMASK(_ULL)"") 5b572e8a9f3dcd6e ("bits: introduce fixed-type BIT_U*()") 19408200c094858d ("bits: introduce fixed-type GENMASK_U*()") 31299a5e02112411 ("bits: add comments and newlines to #if, #else and #endif directives") This addresses these perf build warnings: Warning: Kernel ABI header differences: diff -u tools/include/linux/bits.h include/linux/bits.h Please see tools/include/uapi/README for further details. Acked-by: Vincent Mailhol Cc: I Hsin Cheng Cc: Yury Norov Cc: Adrian Hunter Cc: Ian Rogers Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Lucas De Marchi Cc: Namhyung Kim Cc: Yury Norov Link: https://lore.kernel.org/r/aEr0ZJ60EbshEy6p@x1 Signed-off-by: Arnaldo Carvalho de Melo commit bb6b4143503750318a3f85975186db899a3caaf2 Author: Arnaldo Carvalho de Melo Date: Thu Jun 12 18:08:40 2025 -0300 tools arch amd ibs: Sync ibs.h with the kernel sources To pick up the changes from: 861c6b1185fbb2e3 ("x86/platform/amd: Add standard header guards to ") A small change to tools/perf/check-headers.sh was made to cope with the move of this header done in: 3846389c03a85188 ("x86/platform/amd: Move the header to ") That don't result in any changes in the tools, just address this perf build warning: Warning: Kernel ABI header differences: diff -u tools/arch/x86/include/asm/amd/ibs.h arch/x86/include/asm/amd/ibs.h Cc: Adrian Hunter Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Link: https://lore.kernel.org/r/aEtCi0pup5FEwnzn@x1 Signed-off-by: Arnaldo Carvalho de Melo commit 261dce3d64021e7ec828a17b4975ce9182e54ceb Author: Chuyi Zhou Date: Tue Jun 17 12:42:16 2025 +0800 workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() Now when isolcpus is enabled via the cmdline, wq_isolated_cpumask does not include these isolated CPUs, even wq_unbound_cpumask has already excluded them. It is only when we successfully configure an isolate cpuset partition that wq_isolated_cpumask gets overwritten by workqueue_unbound_exclude_cpumask(), including both the cmdline-specified isolated CPUs and the isolated CPUs within the cpuset partitions. Fix this issue by initializing wq_isolated_cpumask properly in workqueue_init_early(). Fixes: fe28f631fa94 ("workqueue: Add workqueue_unbound_exclude_cpumask() to exclude CPUs from wq_unbound_cpumask") Signed-off-by: Chuyi Zhou Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit 4663747812d1a272312d1b95cbd128f0cdb329f2 Merge: 9afe652958c3ee e2468dc7007436 Author: Linus Torvalds Date: Tue Jun 17 11:31:53 2025 -0700 Merge tag 'platform-drivers-x86-v6.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Ilpo Järvinen: - amd/hsmp: Timeout handling fixes - amd/pmc: - Clear metrics table at start of cycle - Add PCSpecialist Lafite Pro V 14M to 8042 quirks list - amd/pmf: Fix error handling corner cases (nth attempt) - alienware-wmi-wmax: Revert G-Mode support as it lowers performance - dell_rbu: - Fix sparse lock context warning - Fix list head usage - Don't overwrite data buffer past the size of the last packet - ideapad-laptop: Ensure EC is not polled too frequently - intel-uncore-freq: - Fail module load when plat_info is NULL - Avoid a non-literal format string as it triggers a compiler warning - intel/pmc: Add Lunar Lake and Panther Lake support to SSRAM Telemetry - intel/power-domains: Fix error code in tpmi_init() - samsung-galaxybook: Add support for Notebook 9 Pro and others (SAM0426) * tag 'platform-drivers-x86-v6.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: Revert "platform/x86: alienware-wmi-wmax: Add G-Mode support to Alienware m16 R1" platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list platform/x86/intel-uncore-freq: avoid non-literal format string platform/x86/intel/pmc: Add Panther Lake support to Intel PMC SSRAM Telemetry platform/x86/intel/pmc: Add Lunar Lake support to Intel PMC SSRAM Telemetry MAINTAINERS: .mailmap: Update Hans de Goede's email address platform/x86: dell_rbu: Bump version platform/x86: dell_rbu: Stop overwriting data buffer platform/x86: dell_rbu: Fix list usage platform/x86: dell_rbu: Fix lock context warning platform/x86/amd: pmf: Simplify error flow in amd_pmf_init_smart_pc() platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice platform/x86/amd: pmf: Use device managed allocations x86/platform/amd: replace down_timeout() with down_interruptible() x86/platform/amd: move final timeout check to after final sleep platform/x86/amd: pmc: Clear metrics table at start of cycle platform/x86/intel: power-domains: Fix error code in tpmi_init() platform/x86: samsung-galaxybook: Add SAM0426 platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL platform/x86: ideapad-laptop: use usleep_range() for EC polling commit 33796b91871ad4010c8188372dd1faf97cf0f1c0 Author: Tejun Heo Date: Mon Jun 16 10:13:25 2025 -1000 sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() During task_group creation, sched_create_group() calls scx_group_set_weight() with CGROUP_WEIGHT_DFL to initialize the sched_ext portion. This is premature and ends up calling ops.cgroup_set_weight() with an incorrect @cgrp before ops.cgroup_init() is called. sched_create_group() should just initialize SCX related fields in the new task_group. Fix it by factoring out scx_tg_init() from sched_init() and making sched_create_group() call that function instead of scx_group_set_weight(). v2: Retain CONFIG_EXT_GROUP_SCHED ifdef in sched_init() as removing it leads to build failures on !CONFIG_GROUP_SCHED configs. Signed-off-by: Tejun Heo Fixes: 819513666966 ("sched_ext: Add cgroup support") Cc: stable@vger.kernel.org # v6.12+ commit c50784e99f0e7199cdb12dbddf02229b102744ef Author: Tejun Heo Date: Fri Jun 13 13:23:07 2025 -1000 sched_ext: Make scx_group_set_weight() always update tg->scx.weight Otherwise, tg->scx.weight can go out of sync while scx_cgroup is not enabled and ops.cgroup_init() may be called with a stale weight value. Signed-off-by: Tejun Heo Fixes: 819513666966 ("sched_ext: Add cgroup support") Cc: stable@vger.kernel.org # v6.12+ commit bbc3a0b17a890aa19bddd0f9b08e8af488f1ec94 Author: Kent Overstreet Date: Tue Jun 17 13:08:35 2025 -0400 bcachefs: fsck: Fix check_directory_structure when no check_dirents check_directory_structure runs after check_dirents, so it expects that it won't see any inodes with missing backpointers - normally. But online fsck can't run check_dirents yet, or the user might only be running a specific pass, so we need to be careful that this isn't an error. If an inode is unreachable, that's handled by a separate pass. Also, add a new 'bch2_inode_has_backpointer()' helper, since we were doing this inconsistently. Signed-off-by: Kent Overstreet commit 8edab8a72d67742f87e9dc2e2b0cdfddda5dc29a Author: Mark Zhang Date: Tue Jun 17 11:13:55 2025 +0300 RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert The obj_event may be loaded immediately after inserted, then if the list_head is not initialized then we may get a poisonous pointer. This fixes the crash below: mlx5_core 0000:03:00.0: MLX5E: StrdRq(1) RqSz(8) StrdSz(2048) RxCqeCmprss(0 enhanced) mlx5_core.sf mlx5_core.sf.4: firmware version: 32.38.3056 mlx5_core 0000:03:00.0 en3f0pf0sf2002: renamed from eth0 mlx5_core.sf mlx5_core.sf.4: Rate limit: 127 rates are supported, range: 0Mbps to 195312Mbps IPv6: ADDRCONF(NETDEV_CHANGE): en3f0pf0sf2002: link becomes ready Unable to handle kernel NULL pointer dereference at virtual address 0000000000000060 Mem abort info: ESR = 0x96000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=00000007760fb000 [0000000000000060] pgd=000000076f6d7003, p4d=000000076f6d7003, pud=0000000777841003, pmd=0000000000000000 Internal error: Oops: 96000006 [#1] SMP Modules linked in: ipmb_host(OE) act_mirred(E) cls_flower(E) sch_ingress(E) mptcp_diag(E) udp_diag(E) raw_diag(E) unix_diag(E) tcp_diag(E) inet_diag(E) binfmt_misc(E) bonding(OE) rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) isofs(E) cdrom(E) mst_pciconf(OE) ib_umad(OE) mlx5_ib(OE) ipmb_dev_int(OE) mlx5_core(OE) kpatch_15237886(OEK) mlxdevm(OE) auxiliary(OE) ib_uverbs(OE) ib_core(OE) psample(E) mlxfw(OE) tls(E) sunrpc(E) vfat(E) fat(E) crct10dif_ce(E) ghash_ce(E) sha1_ce(E) sbsa_gwdt(E) virtio_console(E) ext4(E) mbcache(E) jbd2(E) xfs(E) libcrc32c(E) mmc_block(E) virtio_net(E) net_failover(E) failover(E) sha2_ce(E) sha256_arm64(E) nvme(OE) nvme_core(OE) gpio_mlxbf3(OE) mlx_compat(OE) mlxbf_pmc(OE) i2c_mlxbf(OE) sdhci_of_dwcmshc(OE) pinctrl_mlxbf3(OE) mlxbf_pka(OE) gpio_generic(E) i2c_core(E) mmc_core(E) mlxbf_gige(OE) vitesse(E) pwr_mlxbf(OE) mlxbf_tmfifo(OE) micrel(E) mlxbf_bootctl(OE) virtio_ring(E) virtio(E) ipmi_devintf(E) ipmi_msghandler(E) [last unloaded: mst_pci] CPU: 11 PID: 20913 Comm: rte-worker-11 Kdump: loaded Tainted: G OE K 5.10.134-13.1.an8.aarch64 #1 Hardware name: https://www.mellanox.com BlueField-3 SmartNIC Main Card/BlueField-3 SmartNIC Main Card, BIOS 4.2.2.12968 Oct 26 2023 pstate: a0400089 (NzCv daIf +PAN -UAO -TCO BTYPE=--) pc : dispatch_event_fd+0x68/0x300 [mlx5_ib] lr : devx_event_notifier+0xcc/0x228 [mlx5_ib] sp : ffff80001005bcf0 x29: ffff80001005bcf0 x28: 0000000000000001 x27: ffff244e0740a1d8 x26: ffff244e0740a1d0 x25: ffffda56beff5ae0 x24: ffffda56bf911618 x23: ffff244e0596a480 x22: ffff244e0596a480 x21: ffff244d8312ad90 x20: ffff244e0596a480 x19: fffffffffffffff0 x18: 0000000000000000 x17: 0000000000000000 x16: ffffda56be66d620 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000040 x10: ffffda56bfcafb50 x9 : ffffda5655c25f2c x8 : 0000000000000010 x7 : 0000000000000000 x6 : ffff24545a2e24b8 x5 : 0000000000000003 x4 : ffff80001005bd28 x3 : 0000000000000000 x2 : 0000000000000000 x1 : ffff244e0596a480 x0 : ffff244d8312ad90 Call trace: dispatch_event_fd+0x68/0x300 [mlx5_ib] devx_event_notifier+0xcc/0x228 [mlx5_ib] atomic_notifier_call_chain+0x58/0x80 mlx5_eq_async_int+0x148/0x2b0 [mlx5_core] atomic_notifier_call_chain+0x58/0x80 irq_int_handler+0x20/0x30 [mlx5_core] __handle_irq_event_percpu+0x60/0x220 handle_irq_event_percpu+0x3c/0x90 handle_irq_event+0x58/0x158 handle_fasteoi_irq+0xfc/0x188 generic_handle_irq+0x34/0x48 ... Fixes: 759738537142 ("IB/mlx5: Enable subscription for device events over DEVX") Link: https://patch.msgid.link/r/3ce7f20e0d1a03dc7de6e57494ec4b8eaf1f05c2.1750147949.git.leon@kernel.org Signed-off-by: Mark Zhang Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 333e4d79316c9ed5877d7aac8b8ed22efc74e96d Author: Maor Gottlieb Date: Mon Jun 16 11:26:21 2025 +0300 RDMA/core: Rate limit GID cache warning messages The GID cache warning messages can flood the kernel log when there are multiple failed attempts to add GIDs. This can happen when creating many virtual interfaces without having enough space for their GIDs in the GID table. Change pr_warn to pr_warn_ratelimited to prevent log flooding while still maintaining visibility of the issue. Link: https://patch.msgid.link/r/fd45ed4a1078e743f498b234c3ae816610ba1b18.1750062357.git.leon@kernel.org Signed-off-by: Maor Gottlieb Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 2c6b640ea08bff1a192bf87fa45246ff1e40767c Author: Or Har-Toov Date: Mon Jun 16 11:17:01 2025 +0300 RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling __xa_store() and __xa_erase() were used without holding the proper lock, which led to a lockdep warning due to unsafe RCU usage. This patch replaces them with xa_store() and xa_erase(), which perform the necessary locking internally. ============================= WARNING: suspicious RCPU usage 6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1 Not tainted ----------------------------- ./include/linux/xarray.h:1211 suspicious rcu_dereference_protected() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 3 locks held by kworker/u136:0/219: at: process_one_work+0xbe4/0x15f0 process_one_work+0x75c/0x15f0 pagefault_mr+0x9a5/0x1390 [mlx5_ib] stack backtrace: CPU: 14 UID: 0 PID: 219 Comm: kworker/u136:0 Not tainted 6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Workqueue: mlx5_ib_page_fault mlx5_ib_eqe_pf_action [mlx5_ib] Call Trace: dump_stack_lvl+0xa8/0xc0 lockdep_rcu_suspicious+0x1e6/0x260 xas_create+0xb8a/0xee0 xas_store+0x73/0x14c0 __xa_store+0x13c/0x220 ? xa_store_range+0x390/0x390 ? spin_bug+0x1d0/0x1d0 pagefault_mr+0xcb5/0x1390 [mlx5_ib] ? _raw_spin_unlock+0x1f/0x30 mlx5_ib_eqe_pf_action+0x3be/0x2620 [mlx5_ib] ? lockdep_hardirqs_on_prepare+0x400/0x400 ? mlx5_ib_invalidate_range+0xcb0/0xcb0 [mlx5_ib] process_one_work+0x7db/0x15f0 ? pwq_dec_nr_in_flight+0xda0/0xda0 ? assign_work+0x168/0x240 worker_thread+0x57d/0xcd0 ? rescuer_thread+0xc40/0xc40 kthread+0x3b3/0x800 ? kthread_is_per_cpu+0xb0/0xb0 ? lock_downgrade+0x680/0x680 ? do_raw_spin_lock+0x12d/0x270 ? spin_bug+0x1d0/0x1d0 ? finish_task_switch.isra.0+0x284/0x9e0 ? lockdep_hardirqs_on_prepare+0x284/0x400 ? kthread_is_per_cpu+0xb0/0xb0 ret_from_fork+0x2d/0x70 ? kthread_is_per_cpu+0xb0/0xb0 ret_from_fork_asm+0x11/0x20 Fixes: d3d930411ce3 ("RDMA/mlx5: Fix implicit ODP use after free") Link: https://patch.msgid.link/r/a85ddd16f45c8cb2bc0a188c2b0fcedfce975eb8.1750061791.git.leon@kernel.org Signed-off-by: Or Har-Toov Reviewed-by: Patrisious Haddad Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 688a0d61b2d7427189c4eb036ce485d8fc957cbb Author: Vitaly Lifshits Date: Sun May 25 11:38:43 2025 +0300 e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13 On some systems with Nahum 11 and Nahum 13 the value of the XTAL clock in the software STRAP is incorrect. This causes the PTP timer to run at the wrong rate and can lead to synchronization issues. The STRAP value is configured by the system firmware, and a firmware update is not always possible. Since the XTAL clock on these systems always runs at 38.4MHz, the driver may ignore the STRAP and just set the correct value. Fixes: cc23f4f0b6b9 ("e1000e: Add support for Meteor Lake") Signed-off-by: Vitaly Lifshits Tested-by: Mor Bar-Gabay Reviewed-by: Gil Fine Signed-off-by: Tony Nguyen commit 48c8b214974dc55283bd5f12e3a483b27c403bbc Author: Grzegorz Nitka Date: Fri May 16 15:09:07 2025 +0200 ice: fix eswitch code memory leak in reset scenario Add simple eswitch mode checker in attaching VF procedure and allocate required port representor memory structures only in switchdev mode. The reset flows triggers VF (if present) detach/attach procedure. It might involve VF port representor(s) re-creation if the device is configured is switchdev mode (not legacy one). The memory was blindly allocated in current implementation, regardless of the mode and not freed if in legacy mode. Kmemeleak trace: unreferenced object (percpu) 0x7e3bce5b888458 (size 40): comm "bash", pid 1784, jiffies 4295743894 hex dump (first 32 bytes on cpu 45): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 0): pcpu_alloc_noprof+0x4c4/0x7c0 ice_repr_create+0x66/0x130 [ice] ice_repr_create_vf+0x22/0x70 [ice] ice_eswitch_attach_vf+0x1b/0xa0 [ice] ice_reset_all_vfs+0x1dd/0x2f0 [ice] ice_pci_err_resume+0x3b/0xb0 [ice] pci_reset_function+0x8f/0x120 reset_store+0x56/0xa0 kernfs_fop_write_iter+0x120/0x1b0 vfs_write+0x31c/0x430 ksys_write+0x61/0xd0 do_syscall_64+0x5b/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e Testing hints (ethX is PF netdev): - create at least one VF echo 1 > /sys/class/net/ethX/device/sriov_numvfs - trigger the reset echo 1 > /sys/class/net/ethX/device/reset Fixes: 415db8399d06 ("ice: make representor code generic") Signed-off-by: Grzegorz Nitka Reviewed-by: Przemek Kitszel Reviewed-by: Simon Horman Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 5d3bc9e5e725aa36cca9b794e340057feb6880b4 Author: Krishna Kumar Date: Tue May 20 22:36:56 2025 +0530 net: ice: Perform accurate aRFS flow match This patch fixes an issue seen in a large-scale deployment under heavy incoming pkts where the aRFS flow wrongly matches a flow and reprograms the NIC with wrong settings. That mis-steering causes RX-path latency spikes and noisy neighbor effects when many connections collide on the same hash (some of our production servers have 20-30K connections). set_rps_cpu() calls ndo_rx_flow_steer() with flow_id that is calculated by hashing the skb sized by the per rx-queue table size. This results in multiple connections (even across different rx-queues) getting the same hash value. The driver steer function modifies the wrong flow to use this rx-queue, e.g.: Flow#1 is first added: Flow#1: , Hash 'h', q#10 Later when a new flow needs to be added: Flow#2: , Hash 'h', q#20 The driver finds the hash 'h' from Flow#1 and updates it to use q#20. This results in both flows getting un-optimized - packets for Flow#1 goes to q#20, and then reprogrammed back to q#10 later and so on; and Flow #2 programming is never done as Flow#1 is matched first for all misses. Many flows may wrongly share the same hash and reprogram rules of the original flow each with their own q#. Tested on two 144-core servers with 16K netperf sessions for 180s. Netperf clients are pinned to cores 0-71 sequentially (so that wrong packets on q#s 72-143 can be measured). IRQs are set 1:1 for queues -> CPUs, enable XPS, enable aRFS (global value is 144 * rps_flow_cnt). Test notes about results from ice_rx_flow_steer(): --------------------------------------------------- 1. "Skip:" counter increments here: if (fltr_info->q_index == rxq_idx || arfs_entry->fltr_state != ICE_ARFS_ACTIVE) goto out; 2. "Add:" counter increments here: ret = arfs_entry->fltr_info.fltr_id; INIT_HLIST_NODE(&arfs_entry->list_entry); 3. "Update:" counter increments here: /* update the queue to forward to on an already existing flow */ Runtime comparison: original code vs with the patch for different rps_flow_cnt values. +-------------------------------+--------------+--------------+ | rps_flow_cnt | 512 | 2048 | +-------------------------------+--------------+--------------+ | Ratio of Pkts on Good:Bad q's | 214 vs 822K | 1.1M vs 980K | | Avoid wrong aRFS programming | 0 vs 310K | 0 vs 30K | | CPU User | 216 vs 183 | 216 vs 206 | | CPU System | 1441 vs 1171 | 1447 vs 1320 | | CPU Softirq | 1245 vs 920 | 1238 vs 961 | | CPU Total | 29 vs 22.7 | 29 vs 24.9 | | aRFS Update | 533K vs 59 | 521K vs 32 | | aRFS Skip | 82M vs 77M | 7.2M vs 4.5M | +-------------------------------+--------------+--------------+ A separate TCP_STREAM and TCP_RR with 1,4,8,16,64,128,256,512 connections showed no performance degradation. Some points on the patch/aRFS behavior: 1. Enabling full tuple matching ensures flows are always correctly matched, even with smaller hash sizes. 2. 5-6% drop in CPU utilization as the packets arrive at the correct CPUs and fewer calls to driver for programming on misses. 3. Larger hash tables reduces mis-steering due to more unique flow hashes, but still has clashes. However, with larger per-device rps_flow_cnt, old flows take more time to expire and new aRFS flows cannot be added if h/w limits are reached (rps_may_expire_flow() succeeds when 10*rps_flow_cnt pkts have been processed by this cpu that are not part of the flow). Fixes: 28bf26724fdb0 ("ice: Implement aRFS") Signed-off-by: Krishna Kumar Reviewed-by: Simon Horman Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 7f8073cfb04a97842fe891ca50dad60afd1e3121 Author: Heiko Carstens Date: Fri Jun 13 17:53:04 2025 +0200 s390/ptrace: Fix pointer dereferencing in regs_get_kernel_stack_nth() The recent change which added READ_ONCE_NOCHECK() to read the nth entry from the kernel stack incorrectly dropped dereferencing of the stack pointer in order to read the requested entry. In result the address of the entry is returned instead of its content. Dereference the pointer again to fix this. Reported-by: Will Deacon Closes: https://lore.kernel.org/r/20250612163331.GA13384@willie-the-truck Fixes: d93a855c31b7 ("s390/ptrace: Avoid KASAN false positives in regs_get_kernel_stack_nth()") Cc: stable@vger.kernel.org Reviewed-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit db22720545207f734aaa9d9f71637bfc8b0155e0 Author: Brett Werling Date: Thu Jun 12 14:18:25 2025 -0500 can: tcan4x5x: fix power regulator retrieval during probe Fixes the power regulator retrieval in tcan4x5x_can_probe() by ensuring the regulator pointer is not set to NULL in the successful return from devm_regulator_get_optional(). Fixes: 3814ca3a10be ("can: tcan4x5x: tcan4x5x_can_probe(): turn on the power before parsing the config") Signed-off-by: Brett Werling Link: https://patch.msgid.link/20250612191825.3646364-1-brett.werling@garmin.com Cc: stable@vger.kernel.org Signed-off-by: Marc Kleine-Budde commit e1f0e1a45a40f45ed615abf938cbdfeb7793a9ee Author: Kent Overstreet Date: Tue Jun 17 10:23:53 2025 -0400 bcachefs: Fix restart handling in btree_node_scrub_work() btree node scrub was sometimes failing to rewrite nodes with errors; bch2_btree_node_rewrite() can return a transaction restart and we weren't checking - the lockrestart_do() needs to wrap the entire operation. And there's a better helper it should've been using, bch2_btree_node_rewrite_key(), which makes all this more convenient. Signed-off-by: Kent Overstreet commit a766cfbbeb3a74397965a8fa2e9a402026d3e1d8 Author: Song Liu Date: Thu Jun 12 22:28:56 2025 -0700 bpf: Mark dentry->d_inode as trusted_or_null LSM hooks such as security_path_mknod() and security_inode_rename() have access to newly allocated negative dentry, which has NULL d_inode. Therefore, it is necessary to do the NULL pointer check for d_inode. Also add selftests that checks the verifier enforces the NULL pointer check. Signed-off-by: Song Liu Reviewed-by: Matt Bobrowski Link: https://lore.kernel.org/r/20250613052857.1992233-1-song@kernel.org Signed-off-by: Alexei Starovoitov commit 8e786a85c0a3c0fffae6244733fb576eeabd9dec Author: Borislav Petkov (AMD) Date: Mon Apr 14 15:33:19 2025 +0200 x86/process: Move the buffer clearing before MONITOR Move the VERW clearing before the MONITOR so that VERW doesn't disarm it and the machine never enters C1. Original idea by Kim Phillips . Suggested-by: Andrew Cooper Signed-off-by: Borislav Petkov (AMD) commit 2329f250e04d3b8e78b36a68b9880ca7750a07ef Author: Borislav Petkov (AMD) Date: Thu Mar 27 12:23:55 2025 +0100 x86/microcode/AMD: Add TSA microcode SHAs Signed-off-by: Borislav Petkov (AMD) commit 31272abd5974b38ba312e9cf2ec2f09f9dd7dcba Author: Borislav Petkov (AMD) Date: Wed Sep 11 11:00:50 2024 +0200 KVM: SVM: Advertise TSA CPUID bits to guests Synthesize the TSA CPUID feature bits for guests. Set TSA_{SQ,L1}_NO on unaffected machines. Signed-off-by: Borislav Petkov (AMD) commit d8010d4ba43e9f790925375a7de100604a5e2dba Author: Borislav Petkov (AMD) Date: Wed Sep 11 10:53:08 2024 +0200 x86/bugs: Add a Transient Scheduler Attacks mitigation Add the required features detection glue to bugs.c et all in order to support the TSA mitigation. Co-developed-by: Kim Phillips Signed-off-by: Kim Phillips Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Pawan Gupta commit 7b4ac12cc929e281cf7edc22203e0533790ebc2b Author: Sebastian Andrzej Siewior Date: Fri Jun 13 14:36:29 2025 +0200 openvswitch: Allocate struct ovs_pcpu_storage dynamically PERCPU_MODULE_RESERVE defines the maximum size that can by used for the per-CPU data size used by modules. This is 8KiB. Commit 035fcdc4d240c ("openvswitch: Merge three per-CPU structures into one") restructured the per-CPU memory allocation for the module and moved the separate alloc_percpu() invocations at module init time to a static per-CPU variable which is allocated by the module loader. The size of the per-CPU data section for openvswitch is 6488 bytes which is ~80% of the available per-CPU memory. Together with a few other modules it is easy to exhaust the available 8KiB of memory. Allocate ovs_pcpu_storage dynamically at module init time. Reported-by: Gal Pressman Closes: https://lore.kernel.org/all/c401e017-f8db-4f57-a1cd-89beb979a277@nvidia.com Fixes: 035fcdc4d240c ("openvswitch: Merge three per-CPU structures into one") Signed-off-by: Sebastian Andrzej Siewior Reviewed-by: Aaron Conole Link: https://patch.msgid.link/20250613123629.-XSoQTCu@linutronix.de Signed-off-by: Paolo Abeni commit f2320f1dd6f6f82cb2c7aff23a12bab537bdea89 Author: Jens Axboe Date: Tue Jun 17 06:43:18 2025 -0600 io_uring/sqpoll: don't put task_struct on tctx setup failure A recent commit moved the error handling of sqpoll thread and tctx failures into the thread itself, as part of fixing an issue. However, it missed that tctx allocation may also fail, and that io_sq_offload_create() does its own error handling for the task_struct in that case. Remove the manual task putting in io_sq_offload_create(), as io_sq_thread() will notice that the tctx did not get setup and hence it should put itself and exit. Reported-by: syzbot+763e12bbf004fb1062e4@syzkaller.appspotmail.com Fixes: ac0b8b327a56 ("io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo()") Signed-off-by: Jens Axboe commit 91a7703a036b146481b8a0bd6efa6200d296ca5d Author: Jens Axboe Date: Tue Jun 17 06:41:48 2025 -0600 io_uring: remove duplicate io_uring_alloc_task_context() definition This function exists in both tctx.h (where it belongs) and in io_uring.h as a remnant of before the tctx handling code got split out. Remove the io_uring.h definition and ensure that sqpoll.c includes the tctx.h header to get the definition. Signed-off-by: Jens Axboe commit 109f4d29dade8ae5b4ac6325af9d1bc24b4230f8 Author: David Thompson Date: Fri Jun 13 21:46:08 2025 +0000 platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment Fix warnings reported by sparse, related to incorrect type: drivers/platform/mellanox/mlxbf-tmfifo.c:284:38: warning: incorrect type in assignment (different base types) drivers/platform/mellanox/mlxbf-tmfifo.c:284:38: expected restricted __virtio32 [usertype] len drivers/platform/mellanox/mlxbf-tmfifo.c:284:38: got unsigned long Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202404040339.S7CUIgf3-lkp@intel.com/ Fixes: 78034cbece79 ("platform/mellanox: mlxbf-tmfifo: Drop the Rx packet if no more descriptors") Signed-off-by: David Thompson Link: https://lore.kernel.org/r/20250613214608.2250130-1-davthompson@nvidia.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit c8892c2a5b27d4026cda60409c393ba0d6c88df9 Author: Ivan Hu Date: Mon Jun 16 15:48:19 2025 +0800 platform/x86: portwell-ec: Move watchdog device under correct platform hierarchy Without explicitly setting a parent for the watchdog device, the device is registered with a NULL parent. This causes device_add() (called internally by devm_watchdog_register_device()) to register the device under /sys/devices/virtual, since no parent is provided. The result is: DEVPATH=/devices/virtual/watchdog/watchdog0 To fix this, assign &pdev->dev as the parent of the watchdog device before calling devm_watchdog_register_device(). This ensures the device is associated with the Portwell EC platform device and placed correctly in sysfs as: DEVPATH=/devices/platform/portwell-ec/watchdog/watchdog0 This aligns the device hierarchy with expectations and avoids misplacement under the virtual class. Fixes: 835796753310 ("platform/x86: portwell-ec: Add GPIO and WDT driver for Portwell EC") Signed-off-by: Ivan Hu Link: https://lore.kernel.org/r/20250616074819.63547-1-ivan.hu@canonical.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d19bac3d4edc4ab92e90d1c6bf68620192254b4b Author: Johannes Berg Date: Tue Jun 17 10:49:01 2025 +0200 wifi: mac80211: don't WARN for late channel/color switch There's really no value in the WARN stack trace etc., the reason for this happening isn't directly related to the calling function anyway. Also, syzbot has been observing it constantly, and there's no way we can resolve it there - those systems are just slow. Instead print an error message (once) and add a comment about what really causes this message. Reported-by: syzbot+468656785707b0e995df@syzkaller.appspotmail.com Reported-by: syzbot+18c783c5cf6a781e3e2c@syzkaller.appspotmail.com Reported-by: syzbot+d5924d5cffddfccab68e@syzkaller.appspotmail.com Reported-by: syzbot+7d73d99525d1ff7752ef@syzkaller.appspotmail.com Reported-by: syzbot+8e6e002c74d1927edaf5@syzkaller.appspotmail.com Reported-by: syzbot+97254a3b10c541879a65@syzkaller.appspotmail.com Reported-by: syzbot+dfd1fd46a1960ad9c6ec@syzkaller.appspotmail.com Reported-by: syzbot+85e0b8d12d9ca877d806@syzkaller.appspotmail.com Link: https://patch.msgid.link/20250617104902.146e10919be1.I85f352ca4a2dce6f556e5ff45ceaa5f3769cb5ce@changeid Signed-off-by: Johannes Berg commit d1b1a5eb27c4948e8811cf4dbb05aaf3eb10700c Author: Johannes Berg Date: Mon Jun 16 17:18:38 2025 +0200 wifi: mac80211: drop invalid source address OCB frames In OCB, don't accept frames from invalid source addresses (and in particular don't try to create stations for them), drop the frames instead. Reported-by: syzbot+8b512026a7ec10dcbdd9@syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/6788d2d9.050a0220.20d369.0028.GAE@google.com/ Signed-off-by: Johannes Berg Tested-by: syzbot+8b512026a7ec10dcbdd9@syzkaller.appspotmail.com Link: https://patch.msgid.link/20250616171838.7433379cab5d.I47444d63c72a0bd58d2e2b67bb99e1fea37eec6f@changeid Signed-off-by: Johannes Berg commit a85b8544d46390469b6ca72d6bfd3ecb7be985ff Author: Johannes Berg Date: Sat Jun 14 00:30:37 2025 +0200 wifi: remove zero-length arrays All of these are really meant to be variable-length, and in the case of s1g_beacon it's actually accessed. Make that one in particular, and a couple of others (that aren't used as arrays now), actually variable. Reported-by: syzbot+fd222bb38e916df26fa4@syzkaller.appspotmail.com Fixes: 1e1f706fc2ce ("wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements") Link: https://patch.msgid.link/20250614003037.a3e82e882251.I2e8b58e56ff2a9f8b06c66f036578b7c1d4e4685@changeid Signed-off-by: Johannes Berg commit cffc873d68ab09a0432b8212008c5613f8a70a2c Author: Justin Sanders Date: Tue Jun 10 17:06:00 2025 +0000 aoe: defer rexmit timer downdev work to workqueue When aoe's rexmit_timer() notices that an aoe target fails to respond to commands for more than aoe_deadsecs, it calls aoedev_downdev() which cleans the outstanding aoe and block queues. This can involve sleeping, such as in blk_mq_freeze_queue(), which should not occur in irq context. This patch defers that aoedev_downdev() call to the aoe device's workqueue. Link: https://bugzilla.kernel.org/show_bug.cgi?id=212665 Signed-off-by: Justin Sanders Link: https://lore.kernel.org/r/20250610170600.869-2-jsanders.devel@gmail.com Tested-By: Valentin Kleibel Signed-off-by: Jens Axboe commit 7f90d45e57cb2ef1f0adcaf925ddffdfc5e680ca Author: Justin Sanders Date: Tue Jun 10 17:05:59 2025 +0000 aoe: clean device rq_list in aoedev_downdev() An aoe device's rq_list contains accepted block requests that are waiting to be transmitted to the aoe target. This queue was added as part of the conversion to blk_mq. However, the queue was not cleaned out when an aoe device is downed which caused blk_mq_freeze_queue() to sleep indefinitely waiting for those requests to complete, causing a hang. This fix cleans out the queue before calling blk_mq_freeze_queue(). Link: https://bugzilla.kernel.org/show_bug.cgi?id=212665 Fixes: 3582dd291788 ("aoe: convert aoeblk to blk-mq") Signed-off-by: Justin Sanders Link: https://lore.kernel.org/r/20250610170600.869-1-jsanders.devel@gmail.com Tested-By: Valentin Kleibel Signed-off-by: Jens Axboe commit 9a816ebeb573eddc2ed079dd4ea57a8d831c176c Merge: 614b1c3cbfb0ec 903cc7096db22f Author: Wolfram Sang Date: Tue Jun 17 12:32:54 2025 +0200 Merge tag 'i2c-host-fixes-6.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current i2c-host-fixes for v6.16-rc2 tegra: fix YAML conversion of device tree bindings commit a7b3b77fd111d49f8e25624e4ea1046322a57baf Author: Mikko Korhonen Date: Tue Jun 17 09:18:41 2025 +0300 ata: ahci: Disallow LPM for Asus B550-F motherboard Asus ROG STRIX B550-F GAMING (WI-FI) motherboard has problems on some SATA ports with at least one hard drive model (WDC WD20EFAX-68FB5N0) when LPM is enabled. Disabling LPM solves the issue. Cc: stable@vger.kernel.org Fixes: 7627a0edef54 ("ata: ahci: Drop low power policy board type") Signed-off-by: Mikko Korhonen Link: https://lore.kernel.org/r/20250617062055.784827-1-mjkorhon@gmail.com [cassel: more detailed comment, make single line comments consistent] Signed-off-by: Niklas Cassel commit 0a1db19f66c0960eb00e1f2ccd40708b6747f5b1 Author: Sascha Hauer Date: Mon Jun 16 15:45:03 2025 +0200 gpio: pca953x: fix wrong error probe return value The second argument to dev_err_probe() is the error value. Pass the return value of devm_request_threaded_irq() there instead of the irq number. Signed-off-by: Sascha Hauer Fixes: c47f7ff0fe61 ("gpio: pca953x: Utilise dev_err_probe() where it makes sense") Link: https://lore.kernel.org/r/20250616134503.1201138-1-s.hauer@pengutronix.de Signed-off-by: Bartosz Golaszewski commit 2e7be162996640bbe3b6da694cc064c511b8a5d9 Author: Anup Patel Date: Thu Jun 5 11:44:47 2025 +0530 RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs The SBI specification clearly states that SBI HFENCE calls should return SBI_ERR_NOT_SUPPORTED when one of the target hart doesn’t support hypervisor extension (aka nested virtualization in-case of KVM RISC-V). Fixes: c7fa3c48de86 ("RISC-V: KVM: Treat SBI HFENCE calls as NOPs") Reviewed-by: Atish Patra Signed-off-by: Anup Patel Link: https://lore.kernel.org/r/20250605061458.196003-3-apatel@ventanamicro.com Signed-off-by: Anup Patel commit 6aba0cb5bba6141158d5449f2cf53187b7f755f9 Author: Anup Patel Date: Thu Jun 5 11:44:46 2025 +0530 RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls As-per the SBI specification, an SBI remote fence operation applies to the entire address space if either: 1) start_addr and size are both 0 2) size is equal to 2^XLEN-1 >From the above, only #1 is checked by SBI SFENCE calls so fix the size parameter check in SBI SFENCE calls to cover #2 as well. Fixes: 13acfec2dbcc ("RISC-V: KVM: Add remote HFENCE functions based on VCPU requests") Reviewed-by: Atish Patra Signed-off-by: Anup Patel Link: https://lore.kernel.org/r/20250605061458.196003-2-apatel@ventanamicro.com Signed-off-by: Anup Patel commit 6c4897caefc8e4c6f2bf08f8317b955672667909 Author: Kent Overstreet Date: Mon Jun 16 20:08:23 2025 -0400 bcachefs: Fix bch2_read_bio_to_text() We can only pass negative error codes to bch2_err_str(); if it's a positive integer it's not an error and we trip an assert. Signed-off-by: Kent Overstreet commit 61ee19dedb8d753249e20308782bf4e9e2fb7344 Author: Maíra Canal Date: Mon Jun 2 10:22:16 2025 -0300 drm/etnaviv: Protect the scheduler's pending list with its lock Commit 704d3d60fec4 ("drm/etnaviv: don't block scheduler when GPU is still active") ensured that active jobs are returned to the pending list when extending the timeout. However, it didn't use the pending list's lock to manipulate the list, which causes a race condition as the scheduler's workqueues are running. Hold the lock while manipulating the scheduler's pending list to prevent a race. Cc: stable@vger.kernel.org Fixes: 704d3d60fec4 ("drm/etnaviv: don't block scheduler when GPU is still active") Reported-by: Philipp Stanner Closes: https://lore.kernel.org/dri-devel/964e59ba1539083ef29b06d3c78f5e2e9b138ab8.camel@mailbox.org/ Reviewed-by: Lucas Stach Reviewed-by: Philipp Stanner Link: https://lore.kernel.org/r/20250602132240.93314-1-mcanal@igalia.com Signed-off-by: Maíra Canal commit 495ba899d5a163d4cd50627ab48e3edd80dfa3a4 Author: Kent Overstreet Date: Mon Jun 16 16:16:38 2025 -0400 bcachefs: fsck: Fix check_path_loop() + snapshots A path exists in a particular snapshot: we should do the pathwalk in the snapshot ID of the inode we started from, _not_ change snapshot ID as we walk inodes and dirents. Signed-off-by: Kent Overstreet commit 583ba52a40dd1f9328e2626056f0797d273817e7 Author: Kent Overstreet Date: Mon Jun 16 16:15:41 2025 -0400 bcachefs: fsck: check_subdir_count logs path We can easily go from inode number -> path now, which makes for more useful log messages. Signed-off-by: Kent Overstreet commit 8d6ac82361df55d223186d8cd2ce884310ee5e6b Author: Kent Overstreet Date: Mon Jun 16 16:14:59 2025 -0400 bcachefs: fsck: additional diagnostics for reattach_inode() Log the inode's new path. Signed-off-by: Kent Overstreet commit 3e5ceaa5bfd71ae94d736426f8a27391023182ff Author: Kent Overstreet Date: Mon Jun 16 16:13:02 2025 -0400 bcachefs: fsck: check_directory_structure runs in reverse order When we find a directory connectivity problem, we should do the repair in the oldest snapshot that has the issue - so that we don't end up duplicating work or making a real mess of things. Oldest snapshot IDs have the highest integer value, so - just walk inodes in reverse order. Signed-off-by: Kent Overstreet commit 9fb09ace59b2beab312ec225630ce87ddbec6d79 Author: Kent Overstreet Date: Mon Jun 16 14:41:27 2025 -0400 bcachefs: fsck: Fix reattach_inode() for subvol roots bch_subvolume.fs_path_parent needs to be updated as well, it should match inode.bi_parent_subvol. Signed-off-by: Kent Overstreet commit c1ca07a4dd1a1ab17ed651729c37b04af9f75ee8 Author: Kent Overstreet Date: Mon Jun 16 14:15:28 2025 -0400 bcachefs: fsck: Fix remove_backpointer() for subvol roots The dirent will be in a different snapshot if the inode is a subvolume root. Signed-off-by: Kent Overstreet commit 7029cc4d13453499a88f512720d26c1a0c4e957b Author: Kent Overstreet Date: Sat Jun 7 19:33:59 2025 -0400 bcachefs: fsck: Print path when we find a subvol loop Signed-off-by: Kent Overstreet commit 9ba6930ef8e0e00102716f4627896e0be6358d7b Author: Kent Overstreet Date: Mon Jun 16 14:00:40 2025 -0400 bcachefs: Fix __bch2_inum_to_path() when crossing subvol boundaries The bch2_subvolume_get_snapshot() call needs to happen before the dirent lookup - the dirent is in the parent subvolume. Also, check for loops. Signed-off-by: Kent Overstreet commit 1cddad0fcbccc7056036f2a83184a3ca5c62f7d3 Author: Kent Overstreet Date: Sun Jun 15 16:43:34 2025 -0400 bcachefs: Call bch2_fs_init_rw() early if we'll be going rw kthread creation checks for pending signals, which is _very_ annoying if we have to do a long recovery and don't go rw until we've done significant work. Check if we'll be going rw and pre-allocate kthreads/workqueues. Signed-off-by: Kent Overstreet commit f2a701fd94f161bdca7537284ba218c20181451e Author: Kent Overstreet Date: Sun Jun 15 12:09:24 2025 -0400 bcachefs: fsck: Improve check_key_has_inode() Print out more info when we find a key (extent, dirent, xattr) for a missing inode - was there a good inode in an older snapshot, full(ish) list of keys for that missing inode, so we can make better decisions on how to repair. If it looks like it should've been deleted, autofix it. If we ever hit the non-autofix cases, we'll want to write more repair code (possibly reconstituting the inode). Signed-off-by: Kent Overstreet commit 03208bd06a61bc2ebc423b6485cbcffecd37af36 Author: Bharadwaj Raju Date: Sun Jun 15 22:15:38 2025 +0530 bcachefs: don't return fsck_fix for unfixable node errors in __btree_err After cd3cdb1ef706 ("Single err message for btree node reads"), all errors caused __btree_err to return -BCH_ERR_fsck_fix no matter what the actual error type was if the recovery pass was scanning for btree nodes. This lead to the code continuing despite things like bad node formats when they earlier would have caused a jump to fsck_err, because btree_err only jumps when the return from __btree_err does not match fsck_fix. Ultimately this lead to undefined behavior by attempting to unpack a key based on an invalid format. Make only errors of type -BCH_ERR_btree_node_read_err_fixable cause __btree_err to return -BCH_ERR_fsck_fix when scanning for btree nodes. Reported-by: syzbot+cfd994b9cdf00446fd54@syzkaller.appspotmail.com Fixes: cd3cdb1ef706 ("bcachefs: Single err message for btree node reads") Signed-off-by: Bharadwaj Raju Signed-off-by: Kent Overstreet commit 56be92c63f02e0f6fd855075acb1471ea1c68539 Author: Alan Huang Date: Sun Jun 15 13:41:22 2025 +0800 bcachefs: Fix pool->alloc NULL pointer dereference btree_interior_update_pool has not been initialized before the filesystem becomes read-write, thus mempool_alloc in bch2_btree_update_start will trigger pool->alloc NULL pointer dereference in mempool_alloc_noprof Reported-by: syzbot+2f3859bd28f20fa682e6@syzkaller.appspotmail.com Signed-off-by: Alan Huang Signed-off-by: Kent Overstreet commit d89a34b14df5c205de698c23c3950b2b947cdb97 Author: Alan Huang Date: Sat Jun 14 17:18:07 2025 +0800 bcachefs: Move bset size check before csum check In syzbot's crash, the bset's u64s is larger than the btree node. Reported-by: syzbot+bfaeaa8e26281970158d@syzkaller.appspotmail.com Signed-off-by: Alan Huang Signed-off-by: Kent Overstreet commit 7c9cef5f8bf10a803fd0937ea071a93778f1108a Author: Kent Overstreet Date: Fri Jun 13 18:01:25 2025 -0400 bcachefs: mark more errors autofix Signed-off-by: Kent Overstreet commit 10dfe4926de30b550913409d107005278ab47911 Author: Kent Overstreet Date: Fri Jun 13 20:06:33 2025 -0400 bcachefs: Kill unused tracepoints Dead code cleanup. Link: https://lore.kernel.org/linux-bcachefs/20250612224059.39fddd07@batman.local.home/ Signed-off-by: Kent Overstreet commit 17c3395e25f7db23fa5758c257a372d410d16cfd Author: Kent Overstreet Date: Sat Jun 7 19:16:12 2025 -0400 bcachefs: opts.journal_rewind Add a mount option for rewinding the journal, bringing the entire filesystem to where it was at a previous point in time. This is for extreme disaster recovery scenarios - it's not intended as an undelete operation. The option takes a journal sequence number; the desired sequence number can be determined with 'bcachefs list_journal' Caveats: - The 'journal_transaction_names' option must have been enabled (it's on by default). The option controls emitting of extra debug info in the journal, so we can see what individual transactions were doing; It also enables journalling of keys being overwritten, which is what we rely on here. - A full fsck run will be automatically triggered since alloc info will be inconsistent. Only leaf node updates to non-alloc btrees are rewound, since rewinding interior btree updates isn't possible or desirable. - We can't do anything about data that was deleted and overwritten. Lots of metadata updates after the point in time we're rewinding to shouldn't cause a problem, since we segragate data and metadata allocations (this is in order to make repair by btree node scan practical on larger filesystems; there's a small 64-bit per device bitmap in the superblock of device ranges with btree nodes, and we try to keep this small). However, having discards enabled will cause problems, since buckets are discarded as soon as they become empty (this is why we don't implement fstrim: we don't need it). Hopefully, this feature will be a one-off thing that's never used again: this was implemented for recovering from the "vfs i_nlink 0 -> subvol deletion" bug, and that bug was unusually disastrous and additional safeguards have since been implemented. But if it does turn out that we need this more in the future, I'll have to implement an option so that empty buckets aren't discarded immediately - lagging by perhaps 1% of device capacity. Signed-off-by: Kent Overstreet commit 86c8db86af43f52f682e53a0f2f0828683be1e52 Author: Stephen Smalley Date: Fri Jun 13 15:37:05 2025 -0400 selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len We should count the terminating NUL byte as part of the ctx_len. Otherwise, UBSAN logs a warning: UBSAN: array-index-out-of-bounds in security/selinux/xfrm.c:99:14 index 60 is out of range for type 'char [*]' The allocation itself is correct so there is no actual out of bounds indexing, just a warning. Cc: stable@vger.kernel.org Suggested-by: Christian Göttsche Link: https://lore.kernel.org/selinux/CAEjxPJ6tA5+LxsGfOJokzdPeRomBHjKLBVR6zbrg+_w3ZZbM3A@mail.gmail.com/ Signed-off-by: Stephen Smalley Signed-off-by: Paul Moore commit e1bc3a13bd775791cca0bb144d977b00f3598042 Author: Maíra Canal Date: Mon Jun 2 12:14:02 2025 -0300 drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` The following kernel Oops was recently reported by Mesa CI: [ 800.139824] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000588 [ 800.148619] Mem abort info: [ 800.151402] ESR = 0x0000000096000005 [ 800.155141] EC = 0x25: DABT (current EL), IL = 32 bits [ 800.160444] SET = 0, FnV = 0 [ 800.163488] EA = 0, S1PTW = 0 [ 800.166619] FSC = 0x05: level 1 translation fault [ 800.171487] Data abort info: [ 800.174357] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 800.179832] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 800.184873] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 800.190176] user pgtable: 4k pages, 39-bit VAs, pgdp=00000001014c2000 [ 800.196607] [0000000000000588] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [ 800.205305] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP [ 800.211564] Modules linked in: vc4 snd_soc_hdmi_codec drm_display_helper v3d cec gpu_sched drm_dma_helper drm_shmem_helper drm_kms_helper drm drm_panel_orientation_quirks snd_soc_core snd_compress snd_pcm_dmaengine snd_pcm i2c_brcmstb snd_timer snd backlight [ 800.234448] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.25+rpt-rpi-v8 #1 Debian 1:6.12.25-1+rpt1 [ 800.244182] Hardware name: Raspberry Pi 4 Model B Rev 1.4 (DT) [ 800.250005] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 800.256959] pc : v3d_job_update_stats+0x60/0x130 [v3d] [ 800.262112] lr : v3d_job_update_stats+0x48/0x130 [v3d] [ 800.267251] sp : ffffffc080003e60 [ 800.270555] x29: ffffffc080003e60 x28: ffffffd842784980 x27: 0224012000000000 [ 800.277687] x26: ffffffd84277f630 x25: ffffff81012fd800 x24: 0000000000000020 [ 800.284818] x23: ffffff8040238b08 x22: 0000000000000570 x21: 0000000000000158 [ 800.291948] x20: 0000000000000000 x19: ffffff8040238000 x18: 0000000000000000 [ 800.299078] x17: ffffffa8c1bd2000 x16: ffffffc080000000 x15: 0000000000000000 [ 800.306208] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 [ 800.313338] x11: 0000000000000040 x10: 0000000000001a40 x9 : ffffffd83b39757c [ 800.320468] x8 : ffffffd842786420 x7 : 7fffffffffffffff x6 : 0000000000ef32b0 [ 800.327598] x5 : 00ffffffffffffff x4 : 0000000000000015 x3 : ffffffd842784980 [ 800.334728] x2 : 0000000000000004 x1 : 0000000000010002 x0 : 000000ba4c0ca382 [ 800.341859] Call trace: [ 800.344294] v3d_job_update_stats+0x60/0x130 [v3d] [ 800.349086] v3d_irq+0x124/0x2e0 [v3d] [ 800.352835] __handle_irq_event_percpu+0x58/0x218 [ 800.357539] handle_irq_event+0x54/0xb8 [ 800.361369] handle_fasteoi_irq+0xac/0x240 [ 800.365458] handle_irq_desc+0x48/0x68 [ 800.369200] generic_handle_domain_irq+0x24/0x38 [ 800.373810] gic_handle_irq+0x48/0xd8 [ 800.377464] call_on_irq_stack+0x24/0x58 [ 800.381379] do_interrupt_handler+0x88/0x98 [ 800.385554] el1_interrupt+0x34/0x68 [ 800.389123] el1h_64_irq_handler+0x18/0x28 [ 800.393211] el1h_64_irq+0x64/0x68 [ 800.396603] default_idle_call+0x3c/0x168 [ 800.400606] do_idle+0x1fc/0x230 [ 800.403827] cpu_startup_entry+0x40/0x50 [ 800.407742] rest_init+0xe4/0xf0 [ 800.410962] start_kernel+0x5e8/0x790 [ 800.414616] __primary_switched+0x80/0x90 [ 800.418622] Code: 8b170277 8b160296 11000421 b9000861 (b9401ac1) [ 800.424707] ---[ end trace 0000000000000000 ]--- [ 800.457313] ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]--- This issue happens when the file descriptor is closed before the jobs submitted by it are completed. When the job completes, we update the global GPU stats and the per-fd GPU stats, which are exposed through fdinfo. If the file descriptor was closed, then the struct `v3d_file_priv` and its stats were already freed and we can't update the per-fd stats. Therefore, if the file descriptor was already closed, don't update the per-fd GPU stats, only update the global ones. Cc: stable@vger.kernel.org # v6.12+ Reviewed-by: Jose Maria Casanova Crespo Link: https://lore.kernel.org/r/20250602151451.10161-1-mcanal@igalia.com Signed-off-by: Maíra Canal commit 2a8a5a5dd06eef580f9818567773fd75057cb875 Author: Vitaliy Shevtsov Date: Thu Jun 12 21:35:18 2025 +0500 scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() strsep() modifies the address of the pointer passed to it so that it no longer points to the original address. This means kfree() gets the wrong pointer. Fix this by passing unmodified pointer returned from kstrdup() to kfree(). Found by Linux Verification Center (linuxtesting.org) with Svace. Fixes: 4df84e846624 ("scsi: elx: efct: Driver initialization routines") Signed-off-by: Vitaliy Shevtsov Link: https://lore.kernel.org/r/20250612163616.24298-1-v.shevtsov@mt-integration.ru Reviewed-by: Daniel Wagner Signed-off-by: Martin K. Petersen commit 1224b218a4b9203656ecc932152f4c81a97b4fcc Author: Simon Horman Date: Fri Jun 13 17:46:20 2025 +0100 pldmfw: Select CRC32 when PLDMFW is selected pldmfw calls crc32 code and depends on it being enabled, else there is a link error as follows. So PLDMFW should select CRC32. lib/pldmfw/pldmfw.o: In function `pldmfw_flash_image': pldmfw.c:(.text+0x70f): undefined reference to `crc32_le_base' This problem was introduced by commit b8265621f488 ("Add pldmfw library for PLDM firmware update"). It manifests as of commit d69ea414c9b4 ("ice: implement device flash update via devlink"). And is more likely to occur as of commit 9ad19171b6d6 ("lib/crc: remove unnecessary prompt for CONFIG_CRC32 and drop 'default y'"). Found by chance while exercising builds based on tinyconfig. Fixes: b8265621f488 ("Add pldmfw library for PLDM firmware update") Signed-off-by: Simon Horman Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250613-pldmfw-crc32-v1-1-f3fad109eee6@kernel.org Signed-off-by: Jakub Kicinski commit b2e673ae53ef4b943f68585207a5f21cfc9a0714 Author: Avadhut Naik Date: Fri Jun 13 00:51:35 2025 +0000 EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh AMD's Family 19h-based Models 70h-7fh support 4 unified memory controllers (UMC) per processor die. The amd64_edac driver, however, assumes only 2 UMCs are supported since max_mcs variable for the models has not been explicitly set to 4. The same results in incomplete or incorrect memory information being logged to dmesg by the module during initialization in some instances. Fixes: 6c79e42169fe ("EDAC/amd64: Add support for ECC on family 19h model 60h-7Fh") Closes: https://lore.kernel.org/all/27dc093f-ce27-4c71-9e81-786150a040b6@reox.at/ Reported-by: reox Signed-off-by: Avadhut Naik Signed-off-by: Borislav Petkov (AMD) Cc: stable@kernel.org Link: https://lore.kernel.org/20250613005233.2330627-1-avadhut.naik@amd.com commit 9d4204a8106fe7dc80e3f2e440c8f2ba1ba47319 Author: Eric Biggers Date: Sun Jun 15 18:06:54 2025 -0700 lib/crypto/poly1305: Fix arm64's poly1305_blocks_arch() For some reason arm64's Poly1305 code got changed to ignore the padbit argument. As a result, the output is incorrect when the message length is not a multiple of 16 (which is not reached with the standard ChaCha20Poly1305, but bcachefs could reach this). Fix this. Fixes: a59e5468a921 ("crypto: arm64/poly1305 - Add block-only interface") Reported-by: Kent Overstreet Tested-by: Kent Overstreet Link: https://lore.kernel.org/r/20250616010654.367302-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 594902c986e269660302f09df9ec4bf1cf017b77 Author: Qinyun Tan Date: Sat May 31 02:20:53 2025 +0800 x86,fs/resctrl: Remove inappropriate references to cacheinfo in the resctrl subsystem In the resctrl subsystem's Sub-NUMA Cluster (SNC) mode, the rdt_mon_domain structure representing a NUMA node relies on the cacheinfo interface (rdt_mon_domain::ci) to store L3 cache information (e.g., shared_cpu_map) for monitoring. The L3 cache information of a SNC NUMA node determines which domains are summed for the "top level" L3-scoped events. rdt_mon_domain::ci is initialized using the first online CPU of a NUMA node. When this CPU goes offline, its shared_cpu_map is cleared to contain only the offline CPU itself. Subsequently, attempting to read counters via smp_call_on_cpu(offline_cpu) fails (and error ignored), returning zero values for "top-level events" without any error indication. Replace the cacheinfo references in struct rdt_mon_domain and struct rmid_read with the cacheinfo ID (a unique identifier for the L3 cache). rdt_domain_hdr::cpu_mask contains the online CPUs associated with that domain. When reading "top-level events", select a CPU from rdt_domain_hdr::cpu_mask and utilize its L3 shared_cpu_map to determine valid CPUs for reading RMID counter via the MSR interface. Considering all CPUs associated with the L3 cache improves the chances of picking a housekeeping CPU on which the counter reading work can be queued, avoiding an unnecessary IPI. Fixes: 328ea68874642 ("x86/resctrl: Prepare for new Sub-NUMA Cluster (SNC) monitor files") Signed-off-by: Qinyun Tan Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Tested-by: Tony Luck Link: https://lore.kernel.org/20250530182053.37502-2-qinyuntan@linux.alibaba.com commit 9afe652958c3ee88f24df1e4a97f298afce89407 Merge: 44a5ab7a7958fb 7cd9a11dd0c3d1 Author: Linus Torvalds Date: Mon Jun 16 11:36:21 2025 -0700 Merge tag 'x86_urgent_for_6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Dave Hansen: "This is a pretty scattered set of fixes. The majority of them are further fixups around the recent ITS mitigations. The rest don't really have a coherent story: - Some flavors of Xen PV guests don't support large pages, but the set_memory.c code assumes all CPUs support them. Avoid problems with a quick CPU feature check. - The TDX code has some wrappers to help retry calls to the TDX module. They use function pointers to assembly functions and the compiler usually generates direct CALLs. But some new compilers, plus -Os turned them in to indirect CALLs and the assembly code was not annotated for indirect calls. Force inlining of the helper to fix it up. - Last, a FRED issue showed up when single-stepping. It's fine when using an external debugger, but was getting stuck returning from a SIGTRAP handler otherwise. Clear the FRED 'swevent' bit to ensure that forward progress is made" * tag 'x86_urgent_for_6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: Revert "mm/execmem: Unify early execmem_cache behaviour" x86/its: explicitly manage permissions for ITS pages x86/its: move its_pages array to struct mod_arch_specific x86/Kconfig: only enable ROX cache in execmem when STRICT_MODULE_RWX is set x86/mm/pat: don't collapse pages without PSE set x86/virt/tdx: Avoid indirect calls to TDX assembly functions selftests/x86: Add a test to detect infinite SIGTRAP handler loop x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler commit d8ab68bdb294b09a761e967dad374f2965e1913f Author: Maurizio Lombardi Date: Thu Jun 12 12:15:56 2025 +0200 scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() The function core_scsi3_decode_spec_i_port(), in its error code path, unconditionally calls core_scsi3_lunacl_undepend_item() passing the dest_se_deve pointer, which may be NULL. This can lead to a NULL pointer dereference if dest_se_deve remains unset. SPC-3 PR SPEC_I_PT: Unable to locate dest_tpg Unable to handle kernel paging request at virtual address dfff800000000012 Call trace: core_scsi3_lunacl_undepend_item+0x2c/0xf0 [target_core_mod] (P) core_scsi3_decode_spec_i_port+0x120c/0x1c30 [target_core_mod] core_scsi3_emulate_pro_register+0x6b8/0xcd8 [target_core_mod] target_scsi3_emulate_pr_out+0x56c/0x840 [target_core_mod] Fix this by adding a NULL check before calling core_scsi3_lunacl_undepend_item() Signed-off-by: Maurizio Lombardi Link: https://lore.kernel.org/r/20250612101556.24829-1-mlombard@redhat.com Reviewed-by: Mike Christie Reviewed-by: John Meneghini Signed-off-by: Martin K. Petersen commit 6143374c6dc874d301dc16612aed144bf4544bae Author: Arnaldo Carvalho de Melo Date: Thu Jun 12 17:58:05 2025 -0300 tools arch x86: Sync the msr-index.h copy with the kernel sources To pick up the changes from these csets: 159013a7ca18c271 ("x86/its: Enumerate Indirect Target Selection (ITS) bug") f4138de5e41fae1a ("x86/msr: Standardize on u64 in ") ec980e4facef8110 ("perf/x86/intel: Support auto counter reload") That cause no changes to tooling as it doesn't include a new MSR to be captured by the tools/perf/trace/beauty/tracepoints/x86_msr.sh script. Just silences this perf build warning: Warning: Kernel ABI header differences: diff -u tools/arch/x86/include/asm/msr-index.h arch/x86/include/asm/msr-index.h Cc: Adrian Hunter Cc: Dave Hansen Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Cc: Pawan Gupta Cc: Peter Zijlstra Link: https://lore.kernel.org/r/aEtAUg83OQGx8Kay@x1 Signed-off-by: Arnaldo Carvalho de Melo commit 3417404c6f83c5d72d69ae81ded914bdc3841a49 Author: Arnaldo Carvalho de Melo Date: Thu Jun 12 12:53:37 2025 -0300 tools headers: Syncronize linux/build_bug.h with the kernel sources To pick up the changes in: 243c90e917f5cfc9 ("build_bug.h: more user friendly error messages in BUILD_BUG_ON_ZERO()") This also needed to pick the __BUILD_BUG_ON_ZERO_MSG() in linux/compiler.h, that needed to be polished to avoid hitting old clang problems with _Static_assert on arrays of structs: Debian clang version 11.0.1-2~deb10u1 Debian clang version 11.0.1-2~deb10u1 $ make NO_LIBTRACEEVENT=1 ARCH= CROSS_COMPILE= EXTRA_CFLAGS= -C tools/perf O=/tmp/build/perf CC=clang btf_dump.c:895:18: error: type name does not allow storage class to be specified for (i = 0; i < ARRAY_SIZE(pads); i++) { ^ /git/perf-6.16.0-rc1/tools/include/linux/kernel.h:91:59: note: expanded from macro 'ARRAY_SIZE' #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr)) ^ /git/perf-6.16.0-rc1/tools/include/linux/compiler-gcc.h:26:28: note: expanded from macro '__must_be_array' #define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0])) ^ /git/perf-6.16.0-rc1/tools/include/linux/build_bug.h:17:2: note: expanded from macro 'BUILD_BUG_ON_ZERO' __BUILD_BUG_ON_ZERO_MSG(e, ##__VA_ARGS__, #e " is true") ^ /git/perf-6.16.0-rc1/tools/include/linux/compiler.h:248:67: note: expanded from macro '__BUILD_BUG_ON_ZERO_MSG' #define __BUILD_BUG_ON_ZERO_MSG(e, msg, ...) ((int)sizeof(struct {_Static_assert(!(e), msg);})) ^ /usr/include/x86_64-linux-gnu/sys/cdefs.h:438:5: note: expanded from macro '_Static_assert' extern int (*__Static_assert_function (void)) \ ^ These also failed: toolsbuilder@five:~$ grep FAIL dm.log/summary | grep clang 1 72.87 almalinux:8 : FAIL clang version 19.1.7 ( 19.1.7-2.module_el8.10.0+3990+33d0d926) 15 73.39 centos:stream : FAIL clang version 17.0.6 (Red Hat 17.0.6-1.module_el8+767+9fa966b8) 36 87.14 opensuse:15.4 : FAIL clang version 15.0.7 37 80.08 opensuse:15.5 : FAIL clang version 15.0.7 40 72.12 oraclelinux:8 : FAIL clang version 16.0.6 (Red Hat 16.0.6-2.0.1.module+el8.9.0+90129+d3ee8717) 42 74.12 rockylinux:8 : FAIL clang version 16.0.6 (Red Hat 16.0.6-2.module+el8.9.0+1651+e10a8f6d) toolsbuilder@five:~$ This addresses this perf build warning: Warning: Kernel ABI header differences: diff -u tools/include/linux/build_bug.h include/linux/build_bug.h Cc: Adrian Hunter Cc: Ian Rogers Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Cc: Vincent Mailhol Cc: Yury Norov Link: https://lore.kernel.org/r/aEszb7SSIJB6Lp6f@x1 Signed-off-by: Arnaldo Carvalho de Melo commit 00c8fde72fe2cdbd3892fbdc338c2d3a66ec8db3 Author: Arnaldo Carvalho de Melo Date: Thu Jun 12 12:29:23 2025 -0300 tools headers: Update the copy of x86's mem{cpy,set}_64.S used in 'perf bench' Also add SYM_PIC_ALIAS() to tools/perf/util/include/linux/linkage.h. This is to get the changes from: 419cbaf6a56a6e4b ("x86/boot: Add a bunch of PIC aliases") That addresses these perf tools build warning: Warning: Kernel ABI header differences: diff -u tools/arch/x86/lib/memcpy_64.S arch/x86/lib/memcpy_64.S diff -u tools/arch/x86/lib/memset_64.S arch/x86/lib/memset_64.S Cc: Adrian Hunter Cc: Ard Biesheuvel Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Link: https://lore.kernel.org/r/aEry7L3fibwIG5au@x1 Signed-off-by: Arnaldo Carvalho de Melo commit aa69783a5920d5924d95a198917fa3dd9c2c84a3 Author: Arnaldo Carvalho de Melo Date: Thu Jun 12 12:08:45 2025 -0300 tools headers UAPI: Sync linux/kvm.h with the kernel sources To pick the changes in: 5b9db9c16f428ada ("RISC-V: KVM: add KVM_CAP_RISCV_MP_STATE_RESET") a7484c80e5ca1ae0 ("KVM: arm64: Allow userspace to request KVM_ARM_VCPU_EL2*") 79462faa2b2aa89d ("KVM: TDX: Handle TDG.VP.VMCALL") That just rebuilds perf, as these patches don't add any new KVM ioctl to be harvested for the the 'perf trace' ioctl syscall argument beautifiers. This addresses this perf build warning: Warning: Kernel ABI header differences: diff -u tools/include/uapi/linux/kvm.h include/uapi/linux/kvm.h Cc: Adrian Hunter Cc: Anup Patel Cc: Binbin Wu Cc: Ian Rogers Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Marc Zyngier Cc: Namhyung Kim Cc: Paolo Bonzini Cc: Radim Krčmář Link: https://lore.kernel.org/r/aEruUUJvR0bfCg7_@x1 Signed-off-by: Arnaldo Carvalho de Melo commit c71bc5995409395d5c9094144534912886fd09a7 Author: Arnaldo Carvalho de Melo Date: Thu Jun 12 12:03:28 2025 -0300 tools headers UAPI: Sync the drm/drm.h with the kernel sources Picking the changes from: c2d3a730069545f2 ("drm/syncobj: Extend EXPORT_SYNC_FILE for timeline syncobjs") Silencing these perf build warnings: Warning: Kernel ABI header differences: diff -u tools/include/uapi/drm/drm.h include/uapi/drm/drm.h No changes in tooling as these are just C comment documentation changes: $ tools/perf/trace/beauty/drm_ioctl.sh > before $ cp include/uapi/drm/drm.h tools/include/uapi/drm/drm.h $ tools/perf/trace/beauty/drm_ioctl.sh > after $ diff -u before after $ Cc: Adrian Hunter Cc: Christian König Cc: Ian Rogers Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Cc: Rob Clark Link: https://lore.kernel.org/r/aErtHs3T2hdPjjHx@x1 Signed-off-by: Arnaldo Carvalho de Melo commit 47684bfb7c3405aa8f7bfb31f2aa642ffd2b640f Author: Arnaldo Carvalho de Melo Date: Thu Jun 12 11:55:54 2025 -0300 perf beauty: Update copy of linux/socket.h with the kernel sources To pick the changes in: b1e904999542ad67 ("net: pass const to msg_data_left()") That don't result in any changes in the tables generated from that header. This silences this perf build warning: Warning: Kernel ABI header differences: diff -u tools/perf/trace/beauty/include/linux/socket.h include/linux/socket.h Please see tools/include/uapi/README for details. Cc: Adrian Hunter Cc: Breno Leitao Cc: Ian Rogers Cc: Jakub Kicinski Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Link: https://lore.kernel.org/r/aErrK24XLUILFH_P@x1 Signed-off-by: Arnaldo Carvalho de Melo commit 8fc50bec411e9cc7bba441dc6f7de9af30ea9cbb Author: Arnaldo Carvalho de Melo Date: Thu Jun 12 11:31:41 2025 -0300 tools headers UAPI: Sync kvm header with the kernel sources To pick the changes in: c9c1e20b4c7d60fa ("KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT") 012426d6f59cab21 ("KVM: TDX: Finalize VM initialization") c846b451d3c5d4ba ("KVM: TDX: Add an ioctl to create initial guest memory") 488808e682e72bdb ("KVM: x86: Introduce KVM_TDX_GET_CPUID") a50f673f25e0ba2b ("KVM: TDX: Do TDX specific vcpu initialization") 0186dd29a251866d ("KVM: TDX: add ioctl to initialize VM with TDX specific parameters") 61bb28279623b636 ("KVM: TDX: Get system-wide info about TDX module on initialization") b2aaf38ced6905b8 ("KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl") This addresses these perf build warnings: Warning: Kernel ABI header differences: diff -u tools/arch/x86/include/uapi/asm/kvm.h arch/x86/include/uapi/asm/kvm.h Please see tools/include/uapi/README for further details. Cc: Adrian Hunter Cc: Ian Rogers Cc: Isaku Yamahata Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Cc: Paolo Bonzini Cc: Xiaoyao Li Cc: Yan Zhao Link: https://lore.kernel.org/r/aErqLPktXIzGyS-m@x1 Signed-off-by: Arnaldo Carvalho de Melo commit da845e4bf4587cf4a212b607b6d508b00eab5217 Author: Arnaldo Carvalho de Melo Date: Thu Jun 12 10:49:47 2025 -0300 tools headers x86 svm: Sync svm headers with the kernel sources To pick the changes in: 827547bc3a2a2af6 ("KVM: SVM: Add architectural definitions/assets for Bus Lock Threshold") That triggers: CC /tmp/build/perf-tools/arch/x86/util/kvm-stat.o LD /tmp/build/perf-tools/arch/x86/util/perf-util-in.o LD /tmp/build/perf-tools/arch/x86/perf-util-in.o LD /tmp/build/perf-tools/arch/perf-util-in.o LD /tmp/build/perf-tools/perf-util-in.o AR /tmp/build/perf-tools/libperf-util.a LINK /tmp/build/perf-tools/perf The SVM_EXIT_BUS_LOCK exit reason was added to SVM_EXIT_REASONS, used in kvm-stat.c. This addresses this perf build warning: Warning: Kernel ABI header differences: diff -u tools/arch/x86/include/uapi/asm/svm.h arch/x86/include/uapi/asm/svm.h Cc: Adrian Hunter Cc: Ian Rogers Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Cc: Nikunj A Dadhania Cc: Sean Christopherson Link: https://lore.kernel.org/r/aErcjuTTCVEZ-8Nb@x1 Signed-off-by: Arnaldo Carvalho de Melo commit c30c18709587bba7753f8ee2419bacc9100d6b40 Author: Arnaldo Carvalho de Melo Date: Thu Jun 12 10:44:07 2025 -0300 tools headers UAPI: Sync KVM's vmx.h header with the kernel sources To pick the changes in: 6c441e4d6e729616 ("KVM: TDX: Handle EXIT_REASON_OTHER_SMI") c42856af8f70d983 ("KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL)") That makes 'perf kvm-stat' aware of this new TDCALL exit reason, thus addressing the following perf build warning: Warning: Kernel ABI header differences: diff -u tools/arch/x86/include/uapi/asm/vmx.h arch/x86/include/uapi/asm/vmx.h Cc: Adrian Hunter Cc: Ian Rogers Cc: Isaku Yamahata Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Cc: Paolo Bonzini Link: https://lore.kernel.org/r/aErcVn_4plQyODR1@x1 Signed-off-by: Arnaldo Carvalho de Melo commit f1e30a4269f9636ffe6b0556f336633fac524ba7 Author: Arnaldo Carvalho de Melo Date: Tue Jun 10 17:46:03 2025 -0300 tools kvm headers arm64: Update KVM header from the kernel sources To pick the changes from: b7628c7973765c85 ("KVM: arm64: Allow userspace to limit the number of PMU counters for EL2 VMs") That doesn't result in any changes in tooling (built on a Raspberry PI 5 running Debian GNU/Linux 12 (bookworm)), only addresses this perf build warning: Warning: Kernel ABI header differences: diff -u tools/arch/arm64/include/uapi/asm/kvm.h arch/arm64/include/uapi/asm/kvm.h Cc: Adrian Hunter Cc: Ian Rogers Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Marc Zyngier Cc: Namhyung Kim Link: https://lore.kernel.org/r/ Signed-off-by: Arnaldo Carvalho de Melo commit 3ce66a48a685f27a931e5bdffb637751c58df7d9 Author: Arnaldo Carvalho de Melo Date: Mon Jun 9 15:02:17 2025 -0300 tools headers UAPI: Sync linux/prctl.h with the kernel sources to pick FUTEX knob To pick the changes in: 63e8595c060a1fef ("futex: Allow to make the private hash immutable") 80367ad01d93ac78 ("futex: Add basic infrastructure for local task local hash") That adds a FUTEX knob: $ tools/perf/trace/beauty/prctl_option.sh > before $ cp include/uapi/linux/prctl.h tools/perf/trace/beauty/include/uapi/linux/prctl.h $ tools/perf/trace/beauty/prctl_option.sh > after $ diff -u before after --- before 2025-06-09 14:50:45.162579336 -0300 +++ after 2025-06-09 14:50:52.797660024 -0300 @@ -72,6 +72,7 @@ [75] = "SET_SHADOW_STACK_STATUS", [76] = "LOCK_SHADOW_STACK_STATUS", [77] = "TIMER_CREATE_RESTORE_IDS", + [78] = "FUTEX_HASH", }; static const char *prctl_set_mm_options[] = { [1] = "START_CODE", $ That now will be used to decode the syscall option and also to compose filters, for instance: [root@five ~]# perf trace -e syscalls:sys_enter_prctl --filter option==SET_NAME 0.000 Isolated Servi/3474327 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23f13b7aee) 0.032 DOM Worker/3474327 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23deb25670) 7.920 :3474328/3474328 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23e24fbb10) 7.935 StreamT~s #374/3474328 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23e24fb970) 8.400 Isolated Servi/3474329 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23e24bab10) 8.418 StreamT~s #374/3474329 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23e24ba970) ^C[root@five ~]# This addresses this perf build warning: Warning: Kernel ABI header differences: diff -u tools/perf/trace/beauty/include/uapi/linux/prctl.h include/uapi/linux/prctl.h Acked-by: Sebastian Andrzej Siewior Cc: Adrian Hunter Cc: Ian Rogers Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/aEiYOtKkrVDT03hZ@x1 Signed-off-by: Arnaldo Carvalho de Melo commit bbeb1088a40b0da8b832d72e05e1c1cb71535712 Author: Namhyung Kim Date: Mon Jun 9 17:57:42 2025 -0700 perf mem: Document new output fields (op, cache, mem, dtlb, snoop) Update the documentation of the new fields with examples and caveats. Also update the related documentation for AMD IBS. Reviewed-by: Ravi Bangoria Signed-off-by: Namhyung Kim Cc: Adrian Hunter Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250610005742.2173050-1-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 11cfaf37d6a79447bde8192e2e3bb2877932b82b Author: Arnaldo Carvalho de Melo Date: Mon Jun 9 12:32:06 2025 -0300 tools headers: Update the fs headers with the kernel sources To pick up changes from: 5d894321c49e6137 ("fs: add atomic write unit max opt to statx") a516403787e08119 ("fs/proc: extend the PAGEMAP_SCAN ioctl to report guard regions") c07d3aede2b26830 ("fscrypt: add support for hardware-wrapped keys") These are used to beautify fs syscall arguments, albeit the changes in this update are not affecting those beautifiers. This addresses these tools/ build warnings: Warning: Kernel ABI header differences: diff -u tools/include/uapi/linux/fscrypt.h include/uapi/linux/fscrypt.h diff -u tools/include/uapi/linux/stat.h include/uapi/linux/stat.h diff -u tools/perf/trace/beauty/include/uapi/linux/fs.h include/uapi/linux/fs.h diff -u tools/perf/trace/beauty/include/uapi/linux/stat.h include/uapi/linux/stat.h Please see tools/include/uapi/README for details (it's in the first patch of this series). Cc: Adrian Hunter Cc: Andrei Vagin Cc: Andrew Morton Cc: Andrii Nakryiko Cc: Darrick J. Wong Cc: Eric Biggers Cc: Ian Rogers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Liam R. Howlett Cc: Namhyung Kim Link: https://lore.kernel.org/r/aEce1keWdO-vGeqe@x1 Signed-off-by: Arnaldo Carvalho de Melo commit 070b315333ee942f2cc69d02a864945c9bc27ef2 Author: Chun-Tse Shao Date: Wed May 21 15:44:44 2025 -0700 perf test: Restrict uniquifying test to machines with 'uncore_imc' The test would fail if target machine does not have 'uncore_imc' devices. Since event uniquifying behavior is similar among different architectures, we are restricting the test to only run on machines with `uncore_imc` devices. Suggested-by: Ian Rogers Signed-off-by: Chun-Tse Shao Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250521224513.1104129-1-ctshao@google.com [ Skip the test, i.e. return 2, instead of returning 0 as if the test had succeed ] Signed-off-by: Arnaldo Carvalho de Melo commit f9af88a3d384c8b55beb5dc5483e5da0135fadbd Author: Borislav Petkov (AMD) Date: Wed Sep 11 05:13:46 2024 +0200 x86/bugs: Rename MDS machinery to something more generic It will be used by other x86 mitigations. No functional changes. Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Pawan Gupta commit 44a5ab7a7958fbf190ae384b8ef252f23b840c1b Merge: fe78e02600f83d ab107276607af9 Author: Linus Torvalds Date: Mon Jun 16 08:49:58 2025 -0700 Merge tag 'powerpc-6.16-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Madhavan Srinivasan: - Fix to handle VDSO32 with pcrel - Couple of dts fixes in microwatt and mpc8315erdb - Fix to handle PE bridge reconfiguration in VFIO EEH recovery path - Fix ioctl macros related to struct termio Thanks to Christophe Leroy, Ganesh Goudar, J. Neuschäfer, Justin M. Forbes, Michael Ellerman, Narayana Murty N, Tulio Magno, and Vaibhav Jain * tag 'powerpc-6.16-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc: Fix struct termio related ioctl macros powerpc: dts: mpc8315erdb: Add GPIO controller node powerpc/microwatt: Fix model property in device tree powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery powerpc/vdso: Fix build of VDSO32 with pcrel commit fe78e02600f83d81e55f6fc352d82c4f264a2901 Merge: e04c78d86a9699 dd2d6b7f6f519d Author: Linus Torvalds Date: Mon Jun 16 08:18:43 2025 -0700 Merge tag 'vfs-6.16-rc3.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - Fix a regression in overlayfs caused by reworking the lookup_one*() set of helpers - Make sure that the name of the dentry is printed in overlayfs' mkdir() helper - Add missing iocb values to TRACE_IOCB_STRINGS define - Unlock the superblock during iterate_supers_type(). This was an accidental internal api change - Drop a misleading assert in file_seek_cur_needs_f_lock() helper - Never refuse to return PIDFD_GET_INGO when parent pid is zero That can trivially happen in container scenarios where the parent process might be located in an ancestor pid namespace - Don't revalidate in try_lookup_noperm() as that causes regression for filesystems such as cifs - Fix simple_xattr_list() and reset the err variable after security_inode_listsecurity() got called so as not to confuse userspace about the length of the xattr * tag 'vfs-6.16-rc3.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fs: drop assert in file_seek_cur_needs_f_lock fs: unlock the superblock during iterate_supers_type ovl: fix debug print in case of mkdir error VFS: change try_lookup_noperm() to skip revalidation fs: add missing values to TRACE_IOCB_STRINGS fs/xattr.c: fix simple_xattr_list() ovl: fix regression caused by lookup helpers API changes pidfs: never refuse ppid == 0 in PIDFD_GET_INFO commit 7360ee47599af91a1d5f4e74d635d9408a54e489 Author: Fedor Pchelkin Date: Wed Jun 11 22:20:10 2025 +0300 s390/pkey: Prevent overflow in size calculation for memdup_user() Number of apqn target list entries contained in 'nr_apqns' variable is determined by userspace via an ioctl call so the result of the product in calculation of size passed to memdup_user() may overflow. In this case the actual size of the allocated area and the value describing it won't be in sync leading to various types of unpredictable behaviour later. Use a proper memdup_array_user() helper which returns an error if an overflow is detected. Note that it is different from when nr_apqns is initially zero - that case is considered valid and should be handled in subsequent pkey_handler implementations. Found by Linux Verification Center (linuxtesting.org). Fixes: f2bbc96e7cfa ("s390/pkey: add CCA AES cipher key support") Cc: stable@vger.kernel.org Signed-off-by: Fedor Pchelkin Reviewed-by: Holger Dengler Reviewed-by: Heiko Carstens Link: https://lore.kernel.org/r/20250611192011.206057-1-pchelkin@ispras.ru Signed-off-by: Alexander Gordeev commit c25892b7a1744355e16281cd24a9b59ec15ec974 Author: Nuno Sá Date: Wed Jun 11 17:26:12 2025 +0100 hwmon: (ltc4282) avoid repeated register write The fault enabled bits were being mistankenly enabled twice in case the FW property is present. Remove one of the writes. Fixes: cbc29538dbf7 ("hwmon: Add driver for LTC4282") Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20250611-fix-ltc4282-repetead-write-v1-1-fe46edd08cf1@analog.com Signed-off-by: Guenter Roeck commit 2c021b45c154958566aad0cae9f74ab26a2d5732 Author: Arnd Bergmann Date: Tue Jun 10 11:25:49 2025 +0200 hwmon: (occ) fix unaligned accesses Passing a pointer to an unaligned integer as a function argument is undefined behavior: drivers/hwmon/occ/common.c:492:27: warning: taking address of packed member 'accumulator' of class or structure 'power_sensor_2' may result in an unaligned pointer value [-Waddress-of-packed-member] 492 | val = occ_get_powr_avg(&power->accumulator, | ^~~~~~~~~~~~~~~~~~ drivers/hwmon/occ/common.c:493:13: warning: taking address of packed member 'update_tag' of class or structure 'power_sensor_2' may result in an unaligned pointer value [-Waddress-of-packed-member] 493 | &power->update_tag); | ^~~~~~~~~~~~~~~~~ Move the get_unaligned() calls out of the function and pass these through argument registers instead. Fixes: c10e753d43eb ("hwmon (occ): Add sensor types and versions") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250610092553.2641094-1-arnd@kernel.org Signed-off-by: Guenter Roeck commit 744c2fe950e936c4d62430de899d6253424200ed Author: Arnd Bergmann Date: Tue Jun 10 11:23:06 2025 +0200 hwmon: (occ) Rework attribute registration for stack usage clang produces an output with excessive stack usage when building the occ_setup_sensor_attrs() function, apparently the result of having a lot of struct literals and building with the -fno-strict-overflow option that leads clang to skip some optimization in case the 'attr' pointer overruns: drivers/hwmon/occ/common.c:775:12: error: stack frame size (1392) exceeds limit (1280) in 'occ_setup_sensor_attrs' [-Werror,-Wframe-larger-than] Replace the custom macros for initializing the attributes with a simpler function call that does not run into this corner case. Link: https://godbolt.org/z/Wf1Yx76a5 Fixes: 54076cb3b5ff ("hwmon (occ): Add sensor attributes and register hwmon device") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250610092315.2640039-1-arnd@kernel.org Signed-off-by: Guenter Roeck commit 14c9ede9ca4cd078ad76a6ab9617b81074eb58bf Author: Gui-Dong Han Date: Fri Jun 6 07:16:40 2025 +0000 hwmon: (ftsteutates) Fix TOCTOU race in fts_read() In the fts_read() function, when handling hwmon_pwm_auto_channels_temp, the code accesses the shared variable data->fan_source[channel] twice without holding any locks. It is first checked against FTS_FAN_SOURCE_INVALID, and if the check passes, it is read again when used as an argument to the BIT() macro. This creates a Time-of-Check to Time-of-Use (TOCTOU) race condition. Another thread executing fts_update_device() can modify the value of data->fan_source[channel] between the check and its use. If the value is changed to FTS_FAN_SOURCE_INVALID (0xff) during this window, the BIT() macro will be called with a large shift value (BIT(255)). A bit shift by a value greater than or equal to the type width is undefined behavior and can lead to a crash or incorrect values being returned to userspace. Fix this by reading data->fan_source[channel] into a local variable once, eliminating the race condition. Additionally, add a bounds check to ensure the value is less than BITS_PER_LONG before passing it to the BIT() macro, making the code more robust against undefined behavior. This possible bug was found by an experimental static analysis tool developed by our team. Fixes: 1c5759d8ce05 ("hwmon: (ftsteutates) Replace fanX_source with pwmX_auto_channels_temp") Cc: stable@vger.kernel.org Signed-off-by: Gui-Dong Han Link: https://lore.kernel.org/r/20250606071640.501262-1-hanguidong02@gmail.com Signed-off-by: Guenter Roeck commit 8acfb165a492251a08a22a4fa6497a131e8c2609 Author: Heiko Stuebner Date: Fri Jun 6 21:04:18 2025 +0200 regulator: fan53555: add enable_time support and soft-start times The datasheets for all the fan53555 variants (and clones using the same interface) define so called soft start times, from enabling the regulator until at least some percentage of the output (i.e. 92% for the rk860x types) are available. The regulator framework supports this with the enable_time property but currently the fan53555 driver does not define enable_times for any variant. I ran into a problem with this while testing the new driver for the Rockchip NPUs (rocket), which does runtime-pm including disabling and enabling a rk8602 as needed. When reenabling the regulator while running a load, fatal hangs could be observed while enabling the associated power-domain, which the regulator supplies. Experimentally setting the regulator to always-on, made the issue disappear, leading to the missing delay to let power stabilize. And as expected, setting the enable-time to a non-zero value according to the datasheet also resolved the regulator-issue. The datasheets in nearly all cases only specify "typical" values, except for the fan53555 type 08. There both a typical and maximum value are listed - 40uS apart. For all typical values I've added 100uS to be on the safe side. Individual details for the relevant regulators below: - fan53526: The datasheet for all variants lists a typical value of 150uS, so make that 250uS with safety margin. - fan53555: types 08 and 18 (unsupported) are given a typical enable time of 135uS but also a maximum of 175uS so use that value. All the other types only have a typical time in the datasheet of 300uS, so give a bit margin by setting it to 400uS. - rk8600 + rk8602: Datasheet reports a typical value of 260us, so use 360uS to be safe. - syr82x + syr83x: All datasheets report typical soft-start values of 300uS for these regulators, so use 400uS. - tcs452x: Datasheet sadly does not report a soft-start time, so I've not set an enable-time Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20250606190418.478633-1-heiko@sntech.de Signed-off-by: Mark Brown commit b081d8564e4a396843a78788476fdcbf70efed06 Author: Laurentiu Mihalcea Date: Fri Jun 13 15:43:10 2025 -0400 ASoC: SOF: imx8: add core shutdown operation for imx8/imx8x Currently, the DSP core from i.MX8QM/i.MX8QXP is able to operate while the firmware image is being loaded. Because of this, the DSP may change the content of the firmware data just after it was loaded, thus leading to the data having unexpected values when the DSP is reset (via run()). Fix this by implementing the core_shutdown() operation that will put the DSP in stall during suspend(). The stall will be removed during the run() opertion, thus guaranteeing that the DSP core will not be able to run while the firmware image is being loaded. Signed-off-by: Laurentiu Mihalcea Reviewed-by: Daniel Baluta Link: https://patch.msgid.link/20250613194310.1128733-1-laurentiumihalcea111@gmail.com Signed-off-by: Mark Brown commit b8b8663ac82a2595a0922d30014f60c5547084de Author: Danilo Krummrich Date: Sat Jun 14 11:20:23 2025 +0200 mailmap: add entry for Danilo Krummrich Add an entry to remap my Red Hat address. Link: https://lore.kernel.org/r/20250614092054.161658-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit db44d088a5ab030b741a3adf2e7b181a8a6dcfbe Author: Darrick J. Wong Date: Thu Jun 12 10:51:12 2025 -0700 xfs: actually use the xfs_growfs_check_rtgeom tracepoint We created a new tracepoint but forgot to put it in. Fix that. Cc: rostedt@goodmis.org Cc: stable@vger.kernel.org # v6.14 Fixes: 59a57acbce282d ("xfs: check that the rtrmapbt maxlevels doesn't increase when growing fs") Signed-off-by: Darrick J. Wong Reviewed-by: Carlos Maiolino Reported-by: Steven Rostedt Closes: https://lore.kernel.org/all/20250612131021.114e6ec8@batman.local.home/ Signed-off-by: Carlos Maiolino commit 19fa6e493a933c095f164230d3393d504216e052 Author: Markus Elfring Date: Tue Jun 10 14:50:07 2025 +0200 xfs: Improve error handling in xfs_mru_cache_create() Simplify error handling in this function implementation. * Delete unnecessary pointer checks and variable assignments. * Omit a redundant function call. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 0989dfa61f438150c4f1110604ba0787856fe8b0 Author: Christoph Hellwig Date: Thu Jun 5 08:16:30 2025 +0200 xfs: move xfs_submit_zoned_bio a bit Commit f3e2e53823b9 ("xfs: add inode to zone caching for data placement") add the new code right between xfs_submit_zoned_bio and xfs_zone_alloc_and_submit which implement the main zoned write path. Move xfs_submit_zoned_bio down to keep it together again. Signed-off-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Reviewed-by: Hans Holmberg Signed-off-by: Carlos Maiolino commit df3b7e2b56d271f93e2d1f395c13235a1a277639 Author: Christoph Hellwig Date: Thu Jun 5 08:16:29 2025 +0200 xfs: use xfs_readonly_buftarg in xfs_remount_rw Use xfs_readonly_buftarg instead of open coding it. Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Reviewed-by: John Garry Signed-off-by: Carlos Maiolino commit a593c89ac5a417605b165cbc9768b3663ab4d8ad Author: Christoph Hellwig Date: Thu Jun 5 08:16:28 2025 +0200 xfs: remove NULL pointer checks in xfs_mru_cache_insert Remove the check for a NULL mru or mru->list in xfs_mru_cache_insert as this API misused lead to a direct NULL pointer dereference on first use and is not user triggerable. As a smatch run by Dan points out with the recent cleanup it would otherwise try to free the object we just determined to be NULL for this impossible to reach case. Fixes: 70b95cb86513 ("xfs: free the item in xfs_mru_cache_insert on failure") Reported-by: Dan Carpenter Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Signed-off-by: Carlos Maiolino commit b0f77d301eb2b4e1fc816f33ade8519ae7f894f4 Author: Christoph Hellwig Date: Thu Jun 5 08:16:27 2025 +0200 xfs: check for shutdown before going to sleep in xfs_select_zone Ensure the file system hasn't been shut down before waiting for a free zone to become available, because that won't happen on a shut down file system. Without this processes can occasionally get stuck in the allocator wait loop when racing with a file system shutdown. This sporadically happens when running generic/388 or generic/475. Fixes: 4e4d52075577 ("xfs: add the zoned space allocator") Reported-by: Shinichiro Kawasaki Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Tested-by: Shin'ichiro Kawasaki Signed-off-by: Carlos Maiolino commit dd2d6b7f6f519d078a866a36a625b0297d81c5bc Author: Luis Henriques Date: Fri Jun 13 11:11:11 2025 +0100 fs: drop assert in file_seek_cur_needs_f_lock The assert in function file_seek_cur_needs_f_lock() can be triggered very easily because there are many users of vfs_llseek() (such as overlayfs) that do their custom locking around llseek instead of relying on fdget_pos(). Just drop the overzealous assertion. Fixes: da06e3c51794 ("fs: don't needlessly acquire f_lock") Suggested-by: Jan Kara Suggested-by: Mateusz Guzik Signed-off-by: Luis Henriques Link: https://lore.kernel.org/20250613101111.17716-1-luis@igalia.com Signed-off-by: Christian Brauner commit e6382fcf989074566bb9a54bbd3c514d7bb99397 Author: Vivian Wang Date: Fri Jun 13 17:25:33 2025 +0800 gpio: spacemit: Add missing MODULE_DEVICE_TABLE The gpio-spacemit-k1 driver can be compiled as a module. Add missing MODULE_DEVICE_TABLE so it can be matched by modalias and automatically loaded by udev. Fixes: d00553240ef8 ("gpio: spacemit: add support for K1 SoC") Signed-off-by: Vivian Wang Reviewed-by: Yixun Lan Link: https://lore.kernel.org/r/20250613-k1-gpio-of-table-v1-1-9015da8fdfdb@iscas.ac.cn Signed-off-by: Bartosz Golaszewski commit c464ce6af332e7c802c36cd337cacf81db05400c Author: Ville Syrjälä Date: Fri Mar 14 17:01:34 2025 +0200 drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL BXT_MIPI_TRANS_VTOTAL must be programmed with vtotal-1 instead of vtotal. Make it so. Cc: stable@vger.kernel.org Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250314150136.22564-1-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula (cherry picked from commit 7b3685c9b38c3097f465efec8b24dbed63258cf6) Signed-off-by: Joonas Lahtinen commit a7137b1825b535eb7258b25beeb0d5425e0037d2 Author: Tzung-Bi Shih Date: Thu Jun 12 08:30:23 2025 +0000 drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled i915_pmu.c may fail to build with GCOV and AutoFDO enabled. ../drivers/gpu/drm/i915/i915_pmu.c:116:3: error: call to '__compiletime_assert_487' declared with 'error' attribute: BUILD_BUG_ON failed: bit > BITS_PER_TYPE(typeof_member(struct i915_pmu, enable)) - 1 116 | BUILD_BUG_ON(bit > | ^ Here is a way to reproduce the issue: $ git checkout v6.15 $ mkdir build $ ./scripts/kconfig/merge_config.sh -O build -n -m <(cat < Signed-off-by: Tzung-Bi Shih Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20250612083023.562585-1-tzungbi@kernel.org (cherry picked from commit 686d773186bf72b739bab7e12eb8665d914676ee) Signed-off-by: Joonas Lahtinen commit 191334400d8031df367eb74b6ab49bc163f6f821 Author: Kent Overstreet Date: Fri Jun 13 18:58:57 2025 -0400 bcachefs: fsck: fix extent past end of inode repair Fix the case where we're deleting in a different snapshot and need to emit a whiteout - that requires a regular BTREE_ITER_filter_snapshots iterator. Also, only delete the part of the extent that extents past i_size. Signed-off-by: Kent Overstreet commit b17d7bdb128c50025fc3eb7a9e57b3c7caa4a5ac Author: Kent Overstreet Date: Fri Jun 13 18:49:54 2025 -0400 bcachefs: fsck: fix add_inode() the inode btree uses the offset field for the inum, not the inode field. Signed-off-by: Kent Overstreet commit c27e5782d957c7242e9cb6405a395b89e8e1d573 Author: Kent Overstreet Date: Fri Jun 13 18:27:33 2025 -0400 bcachefs: Fix snapshot_key_missing_inode_snapshot repair When the inode was a whiteout, we were inserting a new whiteout at the wrong (old) snapshot. Signed-off-by: Kent Overstreet commit c1ccd43b357e157d78c899e61764fc83b4d1dbaa Author: Kent Overstreet Date: Fri Jun 13 17:47:07 2025 -0400 bcachefs: Fix "now allowing incompatible features" message Check against version_incompat_allowed, not version_incompat. Signed-off-by: Kent Overstreet commit 2ba562cc04dc22d01750e80d0638cc1d91fdd95c Author: Kent Overstreet Date: Fri Jun 13 15:15:09 2025 -0400 bcachefs: pass last_seq into fs_journal_start() Prep work for journal rewind, where the seq we're replaying from may be different than the last journal entry's last_seq. Signed-off-by: Kent Overstreet commit f2ed0892732d470abde7a1af360bd670dc8a68c6 Author: Kent Overstreet Date: Fri Jun 13 15:17:37 2025 -0400 bcachefs: better __bch2_snapshot_is_ancestor() assert Previously, we weren't checking the result of the skiplist walk, just the is_ancestor bitmap. Signed-off-by: Kent Overstreet commit 425da82c63e3ac06b2f8780879e83463e88cbf9f Author: Kent Overstreet Date: Fri Jun 13 14:57:34 2025 -0400 bcachefs: btree_iter: fix updates, journal overlay We need to start searching from search_key - _not_ path->pos, which will point to the key we found in the btree Signed-off-by: Kent Overstreet commit 0e62fca2a6dbfcedaab4919d7ad2044f20fdf889 Author: Kent Overstreet Date: Fri Jun 13 14:53:42 2025 -0400 bcachefs: Fix bch2_journal_keys_peek_prev_min() this code is rarely invoked, so - we had a few bugs left from basing it off of bch2_journal_keys_peek_max()... Signed-off-by: Kent Overstreet commit 0dc8eaebed99ea323ab3be7cf1438277f990189d Author: Alan Huang Date: Fri Jun 13 03:01:59 2025 +0800 bcachefs: Delay calculation of trans->journal_u64s When there is commit error that need split btree leaf, fsck might change the value of trans->journal_entries.u64s, when retry commit, the value of trans->journal_u64s would be incorrect, which will lead to trans->journal_res.u64s underflow, and then out of bounds write will occur: [ 464.496970][T11969] Call trace: [ 464.496973][T11969] show_stack+0x3c/0x88 (C) [ 464.496995][T11969] dump_stack_lvl+0xf8/0x178 [ 464.497014][T11969] dump_stack+0x20/0x30 [ 464.497031][T11969] __bch2_trans_log_str+0x344/0x350 [ 464.497048][T11969] bch2_trans_log_str+0x3c/0x60 [ 464.497065][T11969] __bch2_fsck_err+0x11bc/0x1390 [ 464.497083][T11969] bch2_check_discard_freespace_key+0xad4/0x10d0 [ 464.497100][T11969] bch2_bucket_alloc_freelist+0x99c/0x1130 [ 464.497117][T11969] bch2_bucket_alloc_trans+0x79c/0xcb8 [ 464.497133][T11969] bch2_bucket_alloc_set_trans+0x378/0xc20 [ 464.497151][T11969] __open_bucket_add_buckets+0x7fc/0x1c00 [ 464.497168][T11969] open_bucket_add_buckets+0x184/0x3a8 [ 464.497185][T11969] bch2_alloc_sectors_start_trans+0xa04/0x1da0 [ 464.497203][T11969] bch2_btree_reserve_get+0x6e0/0xef0 [ 464.497220][T11969] bch2_btree_update_start+0x1618/0x2600 [ 464.497239][T11969] bch2_btree_split_leaf+0xcc/0x730 [ 464.497258][T11969] bch2_trans_commit_error+0x22c/0xc30 [ 464.497276][T11969] __bch2_trans_commit+0x207c/0x4e30 [ 464.497292][T11969] bch2_journal_replay+0x9e0/0x1420 [ 464.497305][T11969] __bch2_run_recovery_passes+0x458/0xf98 [ 464.497318][T11969] bch2_run_recovery_passes+0x280/0x478 [ 464.497331][T11969] bch2_fs_recovery+0x24f0/0x3a28 [ 464.497344][T11969] bch2_fs_start+0xb80/0x1248 [ 464.497358][T11969] bch2_fs_get_tree+0xe94/0x1708 [ 464.497377][T11969] vfs_get_tree+0x84/0x2d0 Signed-off-by: Alan Huang Signed-off-by: Kent Overstreet commit e31144f8cbe041a572ca64d9261ceeb647ccf557 Author: Alan Huang Date: Fri Jun 13 03:01:58 2025 +0800 bcachefs: Add missing EBUG_ON Just like the EBUG_ON in bch2_journal_add_entry(). Signed-off-by: Alan Huang Signed-off-by: Kent Overstreet commit 9b54efe66c9b44e7446e8a81a058c014cd43661d Author: Alan Huang Date: Fri Jun 13 22:54:59 2025 +0800 bcachefs: Fix alloc_req use after free Now the alloc_req is allocated from the bump allocator, if there is reallocation, the memory of alloc_req would be frees, fix by delaying the reallocation to transaction restart, it has to restart anyway. Reported-by: syzbot+2887a13a5c387e616a68@syzkaller.appspotmail.com Signed-off-by: Alan Huang Signed-off-by: Kent Overstreet commit 9b9a3270092bf8030dbe21ce90b2d0c8d98d33c7 Author: Alan Huang Date: Fri Jun 13 21:19:50 2025 +0800 bcachefs: Don't allocate new memory when mempool is exhausted Allocating new memory when mempool is exhausted is too complicated, just return ENOMEM is fine. memcpy is not needed, since there might be pointers point to the old memory, that's the bug. Signed-off-by: Alan Huang Signed-off-by: Kent Overstreet commit 3bd6f8aeae3d3f8121cbae5a8650a46622aa4e07 Author: Kent Overstreet Date: Thu Jun 12 18:27:37 2025 -0400 bcachefs: btree iter tracepoints We've been seeing some livelock-ish behavior in the index update part of the main write path, and while we've got low level btree path tracepoints, we've been lacking high level btree iterator tracepoints. Signed-off-by: Kent Overstreet commit 0f4dd2ce352d38c7ecf1b3821c908816eb6376a7 Author: Kent Overstreet Date: Thu Jun 12 18:26:48 2025 -0400 bcachefs: trace_extent_trim_atomic Add a tracepoint for when we insert only part of an extent, due to too many overwrites. Signed-off-by: Kent Overstreet commit 2f13daee2a72bb962f5fd356c3a263a6f16da965 Author: Nathan Chancellor Date: Mon Jun 9 15:45:20 2025 -0700 lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older After commit 6f110a5e4f99 ("Disable SLUB_TINY for build testing"), which causes CONFIG_KASAN to be enabled in allmodconfig again, arm64 allmodconfig builds with clang-17 and older show an instance of -Wframe-larger-than (which breaks the build with CONFIG_WERROR=y): lib/crypto/curve25519-hacl64.c:757:6: error: stack frame size (2336) exceeds limit (2048) in 'curve25519_generic' [-Werror,-Wframe-larger-than] 757 | void curve25519_generic(u8 mypublic[CURVE25519_KEY_SIZE], | ^ When KASAN is disabled, the stack usage is roughly quartered: lib/crypto/curve25519-hacl64.c:757:6: error: stack frame size (608) exceeds limit (128) in 'curve25519_generic' [-Werror,-Wframe-larger-than] 757 | void curve25519_generic(u8 mypublic[CURVE25519_KEY_SIZE], | ^ Using '-Rpass-analysis=stack-frame-layout' shows the following variables and many, many 8-byte spills when KASAN is enabled: Offset: [SP-144], Type: Variable, Align: 8, Size: 40 Offset: [SP-464], Type: Variable, Align: 8, Size: 320 Offset: [SP-784], Type: Variable, Align: 8, Size: 320 Offset: [SP-864], Type: Variable, Align: 32, Size: 80 Offset: [SP-896], Type: Variable, Align: 32, Size: 32 Offset: [SP-1016], Type: Variable, Align: 8, Size: 120 When KASAN is disabled, there are still spills but not at many and the variables list is smaller: Offset: [SP-192], Type: Variable, Align: 32, Size: 80 Offset: [SP-224], Type: Variable, Align: 32, Size: 32 Offset: [SP-344], Type: Variable, Align: 8, Size: 120 Disable KASAN for this file when using clang-17 or older to avoid blowing out the stack, clearing up the warning. Signed-off-by: Nathan Chancellor Acked-by: "Jason A. Donenfeld" Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250609-curve25519-hacl64-disable-kasan-clang-v1-1-08ea0ac5ccff@kernel.org Signed-off-by: Eric Biggers commit e202196b8aa249d78ab87eae56bbe0e71e3dc39c Author: Kees Cook Date: Thu May 29 10:31:17 2025 -0700 lib/crypto: Annotate crypto strings with nonstring Annotate various keys, ivs, and other byte arrays with __nonstring so that static initializers will not complain about truncating the trailing NUL byte under GCC 15 with -Wunterminated-string-initialization enabled. Silences many warnings like: ../lib/crypto/aesgcm.c:642:27: warning: initializer-string for array of 'unsigned char' truncates NUL terminator but destination lacks 'nonstring' attribute (13 chars into 12 available) [-Wunterminated-string-initialization] 642 | .iv = "\xca\xfe\xba\xbe\xfa\xce\xdb\xad" | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20250529173113.work.760-kees@kernel.org Signed-off-by: Eric Biggers commit e04c78d86a9699d136910cfc0bdcf01087e3267e Author: Linus Torvalds Date: Sun Jun 15 13:49:41 2025 -0700 Linux 6.16-rc2 commit 89465d923bda180299e69ee2800aab84ad0ba689 Author: Penglei Jiang Date: Sun Jun 15 09:39:06 2025 -0700 io_uring: fix task leak issue in io_wq_create() Add missing put_task_struct() in the error path Cc: stable@vger.kernel.org Fixes: 0f8baa3c9802 ("io-wq: fully initialize wqe before calling cpuhp_state_add_instance_nocalls()") Signed-off-by: Penglei Jiang Link: https://lore.kernel.org/r/20250615163906.2367-1-superman.xpt@gmail.com Signed-off-by: Jens Axboe commit 08215f5486ec4d7c39cf14987ffb133e1e1f6c10 Merge: 8c6bc74c7f8910 2f6b47b295518c Author: Linus Torvalds Date: Sun Jun 15 09:14:27 2025 -0700 Merge tag 'kbuild-fixes-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - Move warnings about linux/export.h from W=1 to W=2 - Fix structure type overrides in gendwarfksyms * tag 'kbuild-fixes-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: gendwarfksyms: Fix structure type overrides kbuild: move warnings about linux/export.h from W=1 to W=2 commit 2f6b47b295518c3ba16fabb1dddbe6a319899acb Author: Sami Tolvanen Date: Sat Jun 14 00:55:33 2025 +0000 gendwarfksyms: Fix structure type overrides As we always iterate through the entire die_map when expanding type strings, recursively processing referenced types in type_expand_child() is not actually necessary. Furthermore, the type_string kABI rule added in commit c9083467f7b9 ("gendwarfksyms: Add a kABI rule to override type strings") can fail to override type strings for structures due to a missing kabi_get_type_string() check in this function. Fix the issue by dropping the unnecessary recursion and moving the override check to type_expand(). Note that symbol versions are otherwise unchanged with this patch. Fixes: c9083467f7b9 ("gendwarfksyms: Add a kABI rule to override type strings") Reported-by: Giuliano Procida Signed-off-by: Sami Tolvanen Reviewed-by: Petr Pavlu Signed-off-by: Masahiro Yamada commit cf0233491b3a15933234a26efd9ecbc1c0764674 Author: Dmitry Baryshkov Date: Thu Jun 5 14:25:49 2025 +0300 phy: use per-PHY lockdep keys If the PHY driver uses another PHY internally (e.g. in case of eUSB2, repeaters are represented as PHYs), then it would trigger the following lockdep splat because all PHYs use a single static lockdep key and thus lockdep can not identify whether there is a dependency or not and reports a false positive. Make PHY subsystem use dynamic lockdep keys, assigning each driver a separate key. This way lockdep can correctly identify dependency graph between mutexes. ============================================ WARNING: possible recursive locking detected 6.15.0-rc7-next-20250522-12896-g3932f283970c #3455 Not tainted -------------------------------------------- kworker/u51:0/78 is trying to acquire lock: ffff0008116554f0 (&phy->mutex){+.+.}-{4:4}, at: phy_init+0x4c/0x12c but task is already holding lock: ffff000813c10cf0 (&phy->mutex){+.+.}-{4:4}, at: phy_init+0x4c/0x12c other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&phy->mutex); lock(&phy->mutex); *** DEADLOCK *** May be due to missing lock nesting notation 4 locks held by kworker/u51:0/78: #0: ffff000800010948 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x18c/0x5ec #1: ffff80008036bdb0 (deferred_probe_work){+.+.}-{0:0}, at: process_one_work+0x1b4/0x5ec #2: ffff0008094ac8f8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x38/0x188 #3: ffff000813c10cf0 (&phy->mutex){+.+.}-{4:4}, at: phy_init+0x4c/0x12c stack backtrace: CPU: 0 UID: 0 PID: 78 Comm: kworker/u51:0 Not tainted 6.15.0-rc7-next-20250522-12896-g3932f283970c #3455 PREEMPT Hardware name: Qualcomm CRD, BIOS 6.0.240904.BOOT.MXF.2.4-00528.1-HAMOA-1 09/ 4/2024 Workqueue: events_unbound deferred_probe_work_func Call trace: show_stack+0x18/0x24 (C) dump_stack_lvl+0x90/0xd0 dump_stack+0x18/0x24 print_deadlock_bug+0x258/0x348 __lock_acquire+0x10fc/0x1f84 lock_acquire+0x1c8/0x338 __mutex_lock+0xb8/0x59c mutex_lock_nested+0x24/0x30 phy_init+0x4c/0x12c snps_eusb2_hsphy_init+0x54/0x1a0 phy_init+0xe0/0x12c dwc3_core_init+0x450/0x10b4 dwc3_core_probe+0xce4/0x15fc dwc3_probe+0x64/0xb0 platform_probe+0x68/0xc4 really_probe+0xbc/0x298 __driver_probe_device+0x78/0x12c driver_probe_device+0x3c/0x160 __device_attach_driver+0xb8/0x138 bus_for_each_drv+0x84/0xe0 __device_attach+0x9c/0x188 device_initial_probe+0x14/0x20 bus_probe_device+0xac/0xb0 deferred_probe_work_func+0x8c/0xc8 process_one_work+0x208/0x5ec worker_thread+0x1c0/0x368 kthread+0x14c/0x20c ret_from_fork+0x10/0x20 Fixes: 3584f6392f09 ("phy: qcom: phy-qcom-snps-eusb2: Add support for eUSB2 repeater") Fixes: e2463559ff1d ("phy: amlogic: Add Amlogic AXG PCIE PHY Driver") Reviewed-by: Neil Armstrong Reviewed-by: Abel Vesa Reported-by: Johan Hovold Link: https://lore.kernel.org/lkml/ZnpoAVGJMG4Zu-Jw@hovoldconsulting.com/ Reviewed-by: Johan Hovold Tested-by: Johan Hovold Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250605-phy-subinit-v3-1-1e1e849e10cd@oss.qualcomm.com Signed-off-by: Vinod Koul commit a6a7946bd691940cfe7289ae6dfb1f077516df72 Author: Masahiro Yamada Date: Fri Jun 13 01:08:48 2025 +0900 kbuild: move warnings about linux/export.h from W=1 to W=2 This hides excessive warnings, as nobody builds with W=2. Fixes: a934a57a42f6 ("scripts/misc-check: check missing #include when W=1") Fixes: 7d95680d64ac ("scripts/misc-check: check unnecessary #include when W=1") Signed-off-by: Masahiro Yamada Acked-by: Arnd Bergmann Reviewed-by: Nathan Chancellor Acked-by: Heiko Carstens commit cefc1caee9dd06c69e2d807edc5949b329f52b22 Author: Wayne Chang Date: Fri May 2 17:26:06 2025 +0800 phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode When transitioning from USB_ROLE_DEVICE to USB_ROLE_NONE, the code assumed that the regulator should be disabled. However, if the regulator is marked as always-on, regulator_is_enabled() continues to return true, leading to an incorrect attempt to disable a regulator which is not enabled. This can result in warnings such as: [ 250.155624] WARNING: CPU: 1 PID: 7326 at drivers/regulator/core.c:3004 _regulator_disable+0xe4/0x1a0 [ 250.155652] unbalanced disables for VIN_SYS_5V0 To fix this, we move the regulator control logic into tegra186_xusb_padctl_id_override() function since it's directly related to the ID override state. The regulator is now only disabled when the role transitions from USB_ROLE_HOST to USB_ROLE_NONE, by checking the VBUS_ID register. This ensures that regulator enable/disable operations are properly balanced and only occur when actually transitioning to/from host mode. Fixes: 49d46e3c7e59 ("phy: tegra: xusb: Add set_mode support for UTMI phy on Tegra186") Cc: stable@vger.kernel.org Signed-off-by: Wayne Chang Reviewed-by: Jon Hunter Tested-by: Jon Hunter Link: https://lore.kernel.org/r/20250502092606.2275682-1-waynec@nvidia.com Signed-off-by: Vinod Koul commit 7be54870e9bf5ed0b4fe2a23b41a630527882de5 Author: Haotien Hsu Date: Mon May 19 17:09:29 2025 +0800 phy: tegra: xusb: Disable periodic tracking on Tegra234 Periodic calibration updates (~10µs) may overlap with transfers when PCIe NVMe SSD, LPDDR, and USB2 devices operate simultaneously, causing crosstalk on Tegra234 devices. Hence disable periodic calibration updates and make this a one-time calibration. Fixes: d8163a32ca95 ("phy: tegra: xusb: Add Tegra234 support") Cc: stable@vger.kernel.org Signed-off-by: Haotien Hsu Signed-off-by: Wayne Chang Reviewed-by: Jon Hunter Tested-by: Jon Hunter Link: https://lore.kernel.org/r/20250519090929.3132456-3-waynec@nvidia.com Signed-off-by: Vinod Koul commit 24c63c590adca310e0df95c77cf7aa5552bc3fc5 Author: Wayne Chang Date: Mon May 19 17:09:28 2025 +0800 phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode The logic that drives the pad calibration values resides in the controller reset domain and so the calibration values are only being captured when the controller is out of reset. However, by clearing the CYA_TRK_CODE_UPDATE_ON_IDLE bit, the calibration values can be set while the controller is in reset. The CYA_TRK_CODE_UPDATE_ON_IDLE bit was previously cleared based on the trk_hw_mode flag, but this dependency is not necessary. Instead, introduce a new flag, trk_update_on_idle, to independently control this bit. Fixes: d8163a32ca95 ("phy: tegra: xusb: Add Tegra234 support") Cc: stable@vger.kernel.org Signed-off-by: Wayne Chang Reviewed-by: Jon Hunter Tested-by: Jon Hunter Link: https://lore.kernel.org/r/20250519090929.3132456-2-waynec@nvidia.com Signed-off-by: Vinod Koul commit 1d27f11bf02b38c431e49a17dee5c10a2b4c2e28 Author: Jens Axboe Date: Sun Jun 15 08:09:14 2025 -0600 io_uring/rsrc: validate buffer count with offset for cloning syzbot reports that it can trigger a WARN_ON() for kmalloc() attempt that's too big: WARNING: CPU: 0 PID: 6488 at mm/slub.c:5024 __kvmalloc_node_noprof+0x520/0x640 mm/slub.c:5024 Modules linked in: CPU: 0 UID: 0 PID: 6488 Comm: syz-executor312 Not tainted 6.15.0-rc7-syzkaller-gd7fa1af5b33e #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __kvmalloc_node_noprof+0x520/0x640 mm/slub.c:5024 lr : __do_kmalloc_node mm/slub.c:-1 [inline] lr : __kvmalloc_node_noprof+0x3b4/0x640 mm/slub.c:5012 sp : ffff80009cfd7a90 x29: ffff80009cfd7ac0 x28: ffff0000dd52a120 x27: 0000000000412dc0 x26: 0000000000000178 x25: ffff7000139faf70 x24: 0000000000000000 x23: ffff800082f4cea8 x22: 00000000ffffffff x21: 000000010cd004a8 x20: ffff0000d75816c0 x19: ffff0000dd52a000 x18: 00000000ffffffff x17: ffff800092f39000 x16: ffff80008adbe9e4 x15: 0000000000000005 x14: 1ffff000139faf1c x13: 0000000000000000 x12: 0000000000000000 x11: ffff7000139faf21 x10: 0000000000000003 x9 : ffff80008f27b938 x8 : 0000000000000002 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 00000000ffffffff x4 : 0000000000400dc0 x3 : 0000000200000000 x2 : 000000010cd004a8 x1 : ffff80008b3ebc40 x0 : 0000000000000001 Call trace: __kvmalloc_node_noprof+0x520/0x640 mm/slub.c:5024 (P) kvmalloc_array_node_noprof include/linux/slab.h:1065 [inline] io_rsrc_data_alloc io_uring/rsrc.c:206 [inline] io_clone_buffers io_uring/rsrc.c:1178 [inline] io_register_clone_buffers+0x484/0xa14 io_uring/rsrc.c:1287 __io_uring_register io_uring/register.c:815 [inline] __do_sys_io_uring_register io_uring/register.c:926 [inline] __se_sys_io_uring_register io_uring/register.c:903 [inline] __arm64_sys_io_uring_register+0x42c/0xea8 io_uring/register.c:903 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 which is due to offset + buffer_count being too large. The registration code checks only the total count of buffers, but given that the indexing is an array, it should also check offset + count. That can't exceed IORING_MAX_REG_BUFFERS either, as there's no way to reach buffers beyond that limit. There's no issue with registrering a table this large, outside of the fact that it's pointless to register buffers that cannot be reached, and that it can trigger this kmalloc() warning for attempting an allocation that is too large. Cc: stable@vger.kernel.org Fixes: b16e920a1909 ("io_uring/rsrc: allow cloning at an offset") Reported-by: syzbot+cb4bf3cb653be0d25de8@syzkaller.appspotmail.com Link: https://lore.kernel.org/io-uring/684e77bd.a00a0220.279073.0029.GAE@google.com/ Signed-off-by: Jens Axboe commit 8c6bc74c7f8910ed4c969ccec52e98716f98700a Merge: ac91b4de4492bf 72dd7961a4bb4f Author: Linus Torvalds Date: Sat Jun 14 10:13:32 2025 -0700 Merge tag 'v6.16-rc1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - SMB3.1.1 POSIX extensions fix for char remapping - Fix for repeated directory listings when directory leases enabled - deferred close handle reuse fix * tag 'v6.16-rc1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: improve directory cache reuse for readdir operations smb: client: fix perf regression with deferred closes smb: client: disable path remapping with POSIX extensions commit ac91b4de4492bfdbbf46b265fb6c5c0ed4b66504 Merge: f713ffa3639cd5 f9705d66fa7107 Author: Linus Torvalds Date: Sat Jun 14 10:01:47 2025 -0700 Merge tag 'iommu-fixes-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu fix from Joerg Roedel: - Fix PTE size calculation for NVidia Tegra * tag 'iommu-fixes-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: iommu/tegra: Fix incorrect size calculation commit f713ffa3639cd57673754a5e83aedebf50dce332 Merge: 6d13760ea3a746 9ce6c9875f3e99 Author: Linus Torvalds Date: Sat Jun 14 09:25:22 2025 -0700 Merge tag 'block-6.16-20250614' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: - Fix for a deadlock on queue freeze with zoned writes - Fix for zoned append emulation - Two bio folio fixes, for sparsemem and for very large folios - Fix for a performance regression introduced in 6.13 when plug insertion was changed - Fix for NVMe passthrough handling for polled IO - Document the ublk auto registration feature - loop lockdep warning fix * tag 'block-6.16-20250614' of git://git.kernel.dk/linux: nvme: always punt polled uring_cmd end_io work to task_work Documentation: ublk: Separate UBLK_F_AUTO_BUF_REG fallback behavior sublists block: Fix bvec_set_folio() for very large folios bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP block: use plug request list tail for one-shot backmerge attempt block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion ublk: document auto buffer registration(UBLK_F_AUTO_BUF_REG) loop: move lo_set_size() out of queue freeze commit 713d48878e8a5e4bcca6355324f943eb72cd2c84 Author: Chen-Yu Tsai Date: Sat Jun 7 21:50:29 2025 +0800 clk: sunxi-ng: a523: Mark MBUS clock as critical The MBUS serves as the main data bus for various DMA masters in the system. If its clock is not enabled, the DMA operations will stall, leading to the peripherals stalling or timing out. This has been observed as USB or MMC hosts timing out waiting for transactions when the clock is automatically disabled by the CCF due to it not being used. Mark the clock as critical so that it never gets disabled. Fixes: 74b0443a0d0a ("clk: sunxi-ng: a523: add system mod clocks") Reviewed-by: Andre Przywara Link: https://patch.msgid.link/20250607135029.2085140-1-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit 6d13760ea3a746c329d534b90d2b38a0ef7690d2 Merge: 588adb24b757d5 b62e0efd8a8571 Author: Linus Torvalds Date: Sat Jun 14 08:44:54 2025 -0700 Merge tag 'io_uring-6.16-20250614' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: - Fix for a race between SQPOLL exit and fdinfo reading. It's slim and I was only able to reproduce this with an artificial delay in the kernel. Followup sparse fix as well to unify the access to ->thread. - Fix for multiple buffer peeking, avoiding truncation if possible. - Run local task_work for IOPOLL reaping when the ring is exiting. This currently isn't done due to an assumption that polled IO will never need task_work, but a fix on the block side is going to change that. * tag 'io_uring-6.16-20250614' of git://git.kernel.dk/linux: io_uring: run local task_work from ring exit IOPOLL reaping io_uring/kbuf: don't truncate end buffer for multiple buffer peeks io_uring: consistently use rcu semantics with sqpoll thread io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo() commit 588adb24b757d5d9a438056ac0347d8b3ac38dde Merge: 27b9989b87119d 5b2d595efbfc9c Author: Linus Torvalds Date: Sat Jun 14 08:38:34 2025 -0700 Merge tag 'rust-fixes-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux Pull Rust fix from Miguel Ojeda: - 'hrtimer': fix future compile error when the 'impl_has_hr_timer!' macro starts to get called * tag 'rust-fixes-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: rust: time: Fix compile error in impl_has_hr_timer macro commit 27b9989b87119da2f33f2c0fcbb8984ab4ebdf1a Merge: 4774cfe3543abb bb666b7c27073b Author: Linus Torvalds Date: Sat Jun 14 08:18:09 2025 -0700 Merge tag 'mm-hotfixes-stable-2025-06-13-21-56' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "9 hotfixes. 3 are cc:stable and the remainder address post-6.15 issues or aren't considered necessary for -stable kernels. Only 4 are for MM" * tag 'mm-hotfixes-stable-2025-06-13-21-56' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm: add mmap_prepare() compatibility layer for nested file systems init: fix build warnings about export.h MAINTAINERS: add Barry as a THP reviewer drivers/rapidio/rio_cm.c: prevent possible heap overwrite mm: close theoretical race where stale TLB entries could linger mm/vma: reset VMA iterator on commit_merge() OOM failure docs: proc: update VmFlags documentation in smaps scatterlist: fix extraneous '@'-sign kernel-doc notation selftests/mm: skip failed memfd setups in gup_longterm commit d3deabe4c619875714b9a844b1a3d9752dbae1dd Author: Rob Clark Date: Fri Jun 13 07:41:44 2025 -0700 drm/msm: Fix inverted WARN_ON() logic We want to WARN_ON() if info is NULL. Suggested-by: Konrad Dybcio Fixes: 0838fc3e6718 ("drm/msm/adreno: Check for recognized GPU before bind") Tested-by: Neil Armstrong Signed-off-by: Rob Clark Reported-by: Alexey Klimov Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/658631/ commit 60599e4f8a041d1186afe4bcf12ba522afe4c5bc Author: Simon Trimmer Date: Fri Jun 13 14:52:51 2025 +0000 ALSA: hda/realtek: Add quirk for Asus GA605K The GA605K has similar audio hardware to the GA403U so apply the same quirk. Signed-off-by: Simon Trimmer Tested-by: Timofey Titovets Link: https://github.com/alsa-project/alsa-ucm-conf/issues/578 Link: https://patch.msgid.link/20250613145251.397500-1-simont@opensource.cirrus.com Signed-off-by: Takashi Iwai commit efa6bdf1bc75e26cafaa5f1d775e8bb7c5b0c431 Author: Jonathan Lane Date: Wed Jun 11 12:31:25 2025 -0700 ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged Like many Dell laptops, the 3.5mm port by default can not detect a combined headphones+mic headset or even a pure microphone. This change enables the port's functionality. Signed-off-by: Jonathan Lane Cc: Link: https://patch.msgid.link/20250611193124.26141-2-jon@borg.moe Signed-off-by: Takashi Iwai commit 4774cfe3543abb8ee98089f535e28ebfd45b975a Merge: 25294cb8a404e8 5c3ba81923e02a Author: Linus Torvalds Date: Fri Jun 13 16:49:39 2025 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "All fixes for drivers. The core change in the error handler is simply to translate an ALUA specific sense code into a retry the ALUA components can handle and won't impact any other devices" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: error: alua: I/O errors for ALUA state transitions scsi: storvsc: Increase the timeouts to storvsc_timeout scsi: s390: zfcp: Ensure synchronous unit_add scsi: iscsi: Fix incorrect error path labels for flashnode operations scsi: mvsas: Fix typos in per-phy comments and SAS cmd port registers scsi: core: ufs: Fix a hang in the error handler commit 25294cb8a404e8116eecaf2f151ee2fd6c17fb9b Merge: 18531f4d1c8c47 1364af9cb2c571 Author: Linus Torvalds Date: Fri Jun 13 16:27:27 2025 -0700 Merge tag 'drm-fixes-2025-06-14' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Quiet week, only two pull requests came my way, xe has a couple of fixes and then a bunch of fixes across the board, vc4 probably fixes the biggest problem: vc4: - Fix infinite EPROBE_DEFER loop in vc4 probing amdxdna: - Fix amdxdna firmware size meson: - modesetting fixes sitronix: - Kconfig fix for st7171-i2c dma-buf: - Fix -EBUSY WARN_ON_ONCE in dma-buf udmabuf: - Use dma_sync_sgtable_for_cpu in udmabuf xe: - Fix regression disallowing 64K SVM migration - Use a bounce buffer for WA BB" * tag 'drm-fixes-2025-06-14' of https://gitlab.freedesktop.org/drm/kernel: drm/xe/lrc: Use a temporary buffer for WA BB udmabuf: use sgtable-based scatterlist wrappers dma-buf: fix compare in WARN_ON_ONCE drm/sitronix: st7571-i2c: Select VIDEOMODE_HELPERS drm/meson: fix more rounding issues with 59.94Hz modes drm/meson: use vclk_freq instead of pixel_freq in debug print drm/meson: fix debug log statement when setting the HDMI clocks drm/vc4: fix infinite EPROBE_DEFER loop drm/xe/svm: Fix regression disallowing 64K SVM migration accel/amdxdna: Fix incorrect PSP firmware size commit 20c96ed278e362ae4e324ed7d8c69fb48c508d3c Author: Danilo Krummrich Date: Wed Jun 11 19:48:25 2025 +0200 rust: devres: do not dereference to the internal Revocable We can't expose direct access to the internal Revocable, since this allows users to directly revoke the internal Revocable without Devres having the chance to synchronize with the devres callback -- we have to guarantee that the internal Revocable has been fully revoked before the device is fully unbound. Hence, remove the corresponding Deref implementation and, instead, provide indirect accessors for the internal Revocable. Note that we can still support Devres::revoke() by implementing the required synchronization (which would be almost identical to the synchronization in Devres::drop()). Fixes: 76c01ded724b ("rust: add devres abstraction") Reviewed-by: Benno Lossin Link: https://lore.kernel.org/r/20250611174827.380555-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit f744201c6159fc7323c40936fd079525f7063598 Author: Danilo Krummrich Date: Thu Jun 12 14:17:15 2025 +0200 rust: devres: fix race in Devres::drop() In Devres::drop() we first remove the devres action and then drop the wrapped device resource. The design goal is to give the owner of a Devres object control over when the device resource is dropped, but limit the overall scope to the corresponding device being bound to a driver. However, there's a race that was introduced with commit 8ff656643d30 ("rust: devres: remove action in `Devres::drop`"), but also has been (partially) present from the initial version on. In Devres::drop(), the devres action is removed successfully and subsequently the destructor of the wrapped device resource runs. However, there is no guarantee that the destructor of the wrapped device resource completes before the driver core is done unbinding the corresponding device. If in Devres::drop(), the devres action can't be removed, it means that the devres callback has been executed already, or is still running concurrently. In case of the latter, either Devres::drop() wins revoking the Revocable or the devres callback wins revoking the Revocable. If Devres::drop() wins, we (again) have no guarantee that the destructor of the wrapped device resource completes before the driver core is done unbinding the corresponding device. CPU0 CPU1 ------------------------------------------------------------------------ Devres::drop() { Devres::devres_callback() { self.data.revoke() { this.data.revoke() { is_available.swap() == true is_available.swap == false } } // [...] // device fully unbound drop_in_place() { // release device resource } } } Depending on the specific device resource, this can potentially lead to user-after-free bugs. In order to fix this, implement the following logic. In the devres callback, we're always good when we get to revoke the device resource ourselves, i.e. Revocable::revoke() returns true. If Revocable::revoke() returns false, it means that Devres::drop(), concurrently, already drops the device resource and we have to wait for Devres::drop() to signal that it finished dropping the device resource. Note that if we hit the case where we need to wait for the completion of Devres::drop() in the devres callback, it means that we're actually racing with a concurrent Devres::drop() call, which already started revoking the device resource for us. This is rather unlikely and means that the concurrent Devres::drop() already started doing our work and we just need to wait for it to complete it for us. Hence, there should not be any additional overhead from that. (Actually, for now it's even better if Devres::drop() does the work for us, since it can bypass the synchronize_rcu() call implied by Revocable::revoke(), but this goes away anyways once I get to implement the split devres callback approach, which allows us to first flip the atomics of all registered Devres objects of a certain device, execute a single synchronize_rcu() and then drop all revocable objects.) In Devres::drop() we try to revoke the device resource. If that is *not* successful, it means that the devres callback already did and we're good. Otherwise, we try to remove the devres action, which, if successful, means that we're good, since the device resource has just been revoked by us *before* we removed the devres action successfully. If the devres action could not be removed, it means that the devres callback must be running concurrently, hence we signal that the device resource has been revoked by us, using the completion. This makes it safe to drop a Devres object from any task and at any point of time, which is one of the design goals. Fixes: 76c01ded724b ("rust: add devres abstraction") Reported-by: Alice Ryhl Closes: https://lore.kernel.org/lkml/aD64YNuqbPPZHAa5@google.com/ Reviewed-by: Benno Lossin Link: https://lore.kernel.org/r/20250612121817.1621-4-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 4b76fafb20dd4a2becb94949d78e86bc88006509 Author: Danilo Krummrich Date: Thu Jun 12 14:17:14 2025 +0200 rust: revocable: indicate whether `data` has been revoked already Return a boolean from Revocable::revoke() and Revocable::revoke_nosync() to indicate whether the data has been revoked already. Return true if the data hasn't been revoked yet (i.e. this call revoked the data), false otherwise. This is required by Devres in order to synchronize the completion of the revoke process. Reviewed-by: Benno Lossin Acked-by: Miguel Ojeda Link: https://lore.kernel.org/r/20250612121817.1621-3-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 1b56e765bf8990f1f60e124926c11fc4ac63d752 Author: Danilo Krummrich Date: Thu Jun 12 14:17:13 2025 +0200 rust: completion: implement initial abstraction Implement a minimal abstraction for the completion synchronization primitive. This initial abstraction only adds complete_all() and wait_for_completion(), since that is what is required for the subsequent Devres patch. Cc: Ingo Molnar Cc: Peter Zijlstra Cc: Juri Lelli Cc: Vincent Guittot Cc: Dietmar Eggemann Cc: Steven Rostedt Cc: Ben Segall Cc: Mel Gorman Cc: Valentin Schneider Reviewed-by: Alice Ryhl Reviewed-by: Boqun Feng Reviewed-by: Benno Lossin Acked-by: Miguel Ojeda Link: https://lore.kernel.org/r/20250612121817.1621-2-dakr@kernel.org Signed-off-by: Danilo Krummrich commit b62e0efd8a8571460d05922862a451855ebdf3c6 Author: Jens Axboe Date: Fri Jun 13 15:24:53 2025 -0600 io_uring: run local task_work from ring exit IOPOLL reaping In preparation for needing to shift NVMe passthrough to always use task_work for polled IO completions, ensure that those are suitably run at exit time. See commit: 9ce6c9875f3e ("nvme: always punt polled uring_cmd end_io work to task_work") for details on why that is necessary. Signed-off-by: Jens Axboe commit 9ce6c9875f3e995be5fd720b65835291f8a609b1 Author: Jens Axboe Date: Fri Jun 13 13:37:41 2025 -0600 nvme: always punt polled uring_cmd end_io work to task_work Currently NVMe uring_cmd completions will complete locally, if they are polled. This is done because those completions are always invoked from task context. And while that is true, there's no guarantee that it's invoked under the right ring context, or even task. If someone does NVMe passthrough via multiple threads and with a limited number of poll queues, then ringA may find completions from ringB. For that case, completing the request may not be sound. Always just punt the passthrough completions via task_work, which will redirect the completion, if needed. Cc: stable@vger.kernel.org Fixes: 585079b6e425 ("nvme: wire up async polling for io passthrough commands") Signed-off-by: Jens Axboe commit 18531f4d1c8c47c4796289dbbc1ab657ffa063d2 Merge: f688b599d711d1 28b069933d3970 Author: Linus Torvalds Date: Fri Jun 13 13:39:15 2025 -0700 Merge tag 'acpi-6.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "These fix an ACPI APEI error injection driver failure that started to occur after switching it over to using a faux device, address an EC driver issue related to invalid ECDT tables, clean up the usage of mwait_idle_with_hints() in the ACPI PAD driver, add a new IRQ override quirk, and fix a NULL pointer dereference related to nosmp: - Update the faux device handling code in the driver core and address an ACPI APEI error injection driver failure that started to occur after switching it over to using a faux device on top of that (Dan Williams) - Update data types of variables passed as arguments to mwait_idle_with_hints() in the ACPI PAD (processor aggregator device) driver to match the function definition after recent changes (Uros Bizjak) - Fix a NULL pointer dereference in the ACPI CPPC library that occurs when nosmp is passed to the kernel in the command line (Yunhui Cui) - Ignore ECDT tables with an invalid ID string to prevent using an incorrect GPE for signaling events on some systems (Armin Wolf) - Add a new IRQ override quirk for MACHENIKE 16P (Wentao Guan)" * tag 'acpi-6.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: resource: Use IRQ override on MACHENIKE 16P ACPI: EC: Ignore ECDT tables with an invalid ID string ACPI: CPPC: Fix NULL pointer dereference when nosmp is used ACPI: PAD: Update arguments of mwait_idle_with_hints() ACPI: APEI: EINJ: Do not fail einj_init() on faux_device_create() failure driver core: faux: Quiet probe failures driver core: faux: Suppress bind attributes commit f688b599d711d169b22e99f2d055847d66c4e0d3 Merge: 02adc1490e6d86 dd3581853c5f19 Author: Linus Torvalds Date: Fri Jun 13 13:27:41 2025 -0700 Merge tag 'pm-6.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix the cpupower utility installation, fix up the recently added Rust abstractions for cpufreq and OPP, restore the x86 update eliminating mwait_play_dead_cpuid_hint() that has been reverted during the 6.16 merge window along with preventing the failure caused by it from happening, and clean up mwait_idle_with_hints() usage in intel_idle: - Implement CpuId Rust abstraction and use it to fix doctest failure related to the recently introduced cpumask abstraction (Viresh Kumar) - Do minor cleanups in the `# Safety` sections for cpufreq abstractions added recently (Viresh Kumar) - Unbreak cpupower systemd service units installation on some systems by adding a unitdir variable for specifying the location to install them (Francesco Poli) - Eliminate mwait_play_dead_cpuid_hint() again after reverting its elimination during the 6.16 merge window due to a problem with handling "dead" SMT siblings, but this time prevent leaving them in C1 after initialization by taking them online and back offline when a proper cpuidle driver for the platform has been registered (Rafael Wysocki) - Update data types of variables passed as arguments to mwait_idle_with_hints() to match the function definition after recent changes (Uros Bizjak)" * tag 'pm-6.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: rust: cpu: Add CpuId::current() to retrieve current CPU ID rust: Use CpuId in place of raw CPU numbers rust: cpu: Introduce CpuId abstraction intel_idle: Update arguments of mwait_idle_with_hints() cpufreq: Convert `/// SAFETY` lines to `# Safety` sections cpupower: split unitdir from libdir in Makefile Reapply "x86/smp: Eliminate mwait_play_dead_cpuid_hint()" ACPI: processor: Rescan "dead" SMT siblings during initialization intel_idle: Rescan "dead" SMT siblings during initialization x86/smp: PM/hibernate: Split arch_resume_nosmt() intel_idle: Use subsys_initcall_sync() for initialization commit 28b069933d39708af872d9739e78315317b93031 Merge: 162457f5853ce3 2f76d269073bdb 15eece6c5b05e5 7a0d59f6a913a2 c99ad987d3e9b5 Author: Rafael J. Wysocki Date: Fri Jun 13 21:55:30 2025 +0200 Merge branches 'acpi-pad', 'acpi-cppc', 'acpi-ec' and 'acpi-resource' Merge assorted ACPI updates for 6.16-rc2: - Update data types of variables passed as arguments to mwait_idle_with_hints() in the ACPI PAD (processor aggregator device) driver to match the function definition after recent changes (Uros Bizjak). - Fix a NULL pointer dereference in the ACPI CPPC library that occurs when nosmp is passed to the kernel in the command line (Yunhui Cui). - Ignore ECDT tables with an invalid ID string to prevent using an incorrect GPE for signaling events on some systems (Armin Wolf). - Add a new IRQ override quirk for MACHENIKE 16P (Wentao Guan). * acpi-pad: ACPI: PAD: Update arguments of mwait_idle_with_hints() * acpi-cppc: ACPI: CPPC: Fix NULL pointer dereference when nosmp is used * acpi-ec: ACPI: EC: Ignore ECDT tables with an invalid ID string * acpi-resource: ACPI: resource: Use IRQ override on MACHENIKE 16P commit 907a7a2e5bf40c6a359b2f6cc53d6fdca04009e0 Author: Mario Limonciello Date: Wed Jun 11 18:31:16 2025 -0500 PCI/PM: Set up runtime PM even for devices without PCI PM 4d4c10f763d7 ("PCI: Explicitly put devices into D0 when initializing") intended to put PCI devices into D0, but in doing so unintentionally changed runtime PM initialization not to occur on devices that don't support PCI PM. This caused a regression in vfio-pci due to an imbalance with its use. Adjust the logic in pci_pm_init() so that even if PCI PM isn't supported runtime PM is still initialized. Fixes: 4d4c10f763d7 ("PCI: Explicitly put devices into D0 when initializing") Reported-by: Giovanni Cabiddu Closes: https://lore.kernel.org/linux-pci/20250424043232.1848107-1-superm1@kernel.org/T/#m7e8929d6421690dc8bd6dc639d86c2b4db27cbc4 Reported-by: Nicolas Dichtel Closes: https://lore.kernel.org/linux-pci/20250424043232.1848107-1-superm1@kernel.org/T/#m40d277dcdb9be64a1609a82412d1aa906263e201 Signed-off-by: Mario Limonciello Signed-off-by: Bjorn Helgaas Tested-by: Giovanni Cabiddu Tested-by: Nicolas Dichtel Reviewed-by: Kuppuswamy Sathyanarayanan Acked-by: Rafael J. Wysocki Cc: Alex Williamson Link: https://patch.msgid.link/20250611233117.61810-1-superm1@kernel.org commit dd3581853c5f190c3a7bd1de78f5ecb2905a77a7 Merge: ea2867608b311a 72840238e2bcb8 Author: Rafael J. Wysocki Date: Fri Jun 13 21:28:07 2025 +0200 Merge branch 'pm-cpuidle' Merge cpuidle updates for 6.16-rc2: - Update data types of variables passed as arguments to mwait_idle_with_hints() to match the function definition after recent changes (Uros Bizjak). - Eliminate mwait_play_dead_cpuid_hint() again after reverting its elimination during the merge window due to a problem with handling "dead" SMT siblings, but this time prevent leaving them in C1 after initialization by taking them online and back offline when a proper cpuidle driver for the platform has been registered (Rafael Wysocki). * pm-cpuidle: intel_idle: Update arguments of mwait_idle_with_hints() Reapply "x86/smp: Eliminate mwait_play_dead_cpuid_hint()" ACPI: processor: Rescan "dead" SMT siblings during initialization intel_idle: Rescan "dead" SMT siblings during initialization x86/smp: PM/hibernate: Split arch_resume_nosmt() intel_idle: Use subsys_initcall_sync() for initialization commit ea2867608b311a4bcf4f231cd065825b5d8dc4f9 Merge: 332d6a94ce80ef d08293ef1ede6a Author: Rafael J. Wysocki Date: Fri Jun 13 21:25:38 2025 +0200 Merge branch 'pm-tools' Merge a cpupower utility fix for 6.16-rc2 that unbreaks systemd service units installation on some sysems (Francesco Poli). * pm-tools: cpupower: split unitdir from libdir in Makefile commit 02adc1490e6d8681cc81057ed86d123d0240909b Merge: 601dddb6c5d6bf 9f0ad43b158d07 Author: Linus Torvalds Date: Fri Jun 13 11:01:44 2025 -0700 Merge tag 'spi-fix-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A collection of driver specific fixes, most minor apart from the OMAP ones which disable some recent performance optimisations in some non-standard cases where we could start driving the bus incorrectly. The change to the stm32-ospi driver to use the newer reset APIs is a fix for interactions with other IP sharing the same reset line in some SoCs" * tag 'spi-fix-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: spi-pci1xxxx: Drop MSI-X usage as unsupported by DMA engine spi: stm32-ospi: clean up on error in probe() spi: stm32-ospi: Make usage of reset_control_acquire/release() API spi: offload: check offload ops existence before disabling the trigger spi: spi-pci1xxxx: Fix error code in probe spi: loongson: Fix build warnings about export.h spi: omap2-mcspi: Disable multi-mode when the previous message kept CS asserted spi: omap2-mcspi: Disable multi mode when CS should be kept asserted after message commit 601dddb6c5d6bf63c63b2efba98231db5f861696 Merge: f90fff1e152ded 06118ae36855b7 Author: Linus Torvalds Date: Fri Jun 13 11:00:19 2025 -0700 Merge tag 'regulator-fix-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "One minor fix for a leak in the DT parsing code in the max20086 driver" * tag 'regulator-fix-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt() commit f90fff1e152dedf52b932240ebbd670d83330eca Author: Oleg Nesterov Date: Fri Jun 13 19:26:50 2025 +0200 posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail. Add the tsk->exit_state check into run_posix_cpu_timers() to fix this. This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case. Cc: stable@vger.kernel.org Reported-by: Benoît Sevens Fixes: 0bdd2ed4138e ("sched: run_posix_cpu_timers: Don't check ->exit_state, use lock_task_sighand()") Signed-off-by: Oleg Nesterov Signed-off-by: Linus Torvalds commit 3ca933aad0aca463512d2f54a79fc65b8ecb0f48 Merge: dde63797055cf3 8a157d8a00e815 Author: Linus Torvalds Date: Fri Jun 13 10:51:11 2025 -0700 Merge tag 'trace-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fix from Steven Rostedt: - Do not free "head" variable in filter_free_subsystem_filters() The first error path jumps to "free_now" label but first frees the newly allocated "head" variable. But the "free_now" code checks this variable, and if it is not NULL, it will iterate the list. As this list variable was already initialized, the "free_now" code will not do anything as it is empty. But freeing it will cause a UAF bug. The error path should simply jump to the "free_now" label and leave the "head" variable alone. * tag 'trace-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Do not free "head" on error path of filter_free_subsystem_filters() commit 13b86ea92ebf0fa587fbadfb8a60ca2e9993203f Author: Raven Black Date: Fri Jun 13 07:51:25 2025 -0400 ASoC: amd: yc: update quirk data for HP Victus Make the internal microphone work on HP Victus laptops. Signed-off-by: Raven Black Link: https://patch.msgid.link/20250613-support-hp-victus-microphone-v1-1-bebc4c3a2041@gmail.com Signed-off-by: Mark Brown commit dc8b60918fc5ba281743f3694e9b671ddbf0e930 Merge: f59427932885f9 fa8fae5f82e48d Author: Mark Brown Date: Fri Jun 13 18:12:49 2025 +0100 ASoC: cs35l56: Change firmware filenames for SoundWire Merge series from Richard Fitzgerald : Change the firmware filename format on SoundWire systems to directly tie it to the physical amp it applies to. This is mainly to decouple it from the ALSA prefix strings to avoid complications when the SoundWire machine driver starts creating dailinks based on SDCA Disco info instead of hardcoded match tables. It also avoids errors from having to rename firmware files from a hardware-address to a ALSA-prefix naming for Linux publication. There are already published firmware files for the L56 B0 silicon so that has a fallback scheme for backward compatibility which has been separated into its own patch on top of the main change. We'd like to get this into 6.16 so that the L63 support starts "clean" with this new naming and we don't have to support one kernel version with L63 using the old naming. Unfortunately we didn't manage to get these patches through internal review and testing before the merge window opened. commit dde63797055cf3615bdac744d641e19e165467bb Merge: ad6159087fbbd7 8046d29dde1700 Author: Linus Torvalds Date: Fri Jun 13 10:05:31 2025 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "ARM: - Rework of system register accessors for system registers that are directly writen to memory, so that sanitisation of the in-memory value happens at the correct time (after the read, or before the write). For convenience, RMW-style accessors are also provided. - Multiple fixes for the so-called "arch-timer-edge-cases' selftest, which was always broken. x86: - Make KVM_PRE_FAULT_MEMORY stricter for TDX, allowing userspace to pass only the "untouched" addresses and flipping the shared/private bit in the implementation. - Disable SEV-SNP support on initialization failure * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY KVM: SEV: Disable SEV-SNP support on initialization failure KVM: arm64: selftests: Determine effective counter width in arch_timer_edge_cases KVM: arm64: selftests: Fix xVAL init in arch_timer_edge_cases KVM: arm64: selftests: Fix thread migration in arch_timer_edge_cases KVM: arm64: selftests: Fix help text for arch_timer_edge_cases KVM: arm64: Make __vcpu_sys_reg() a pure rvalue operand KVM: arm64: Don't use __vcpu_sys_reg() to get the address of a sysreg KVM: arm64: Add RMW specific sysreg accessor KVM: arm64: Add assignment-specific sysreg accessor commit 26ec15e4b0c1d7b25214d9c0be1d50492e2f006c Author: Jens Axboe Date: Fri Jun 13 11:01:49 2025 -0600 io_uring/kbuf: don't truncate end buffer for multiple buffer peeks If peeking a bunch of buffers, normally io_ring_buffers_peek() will truncate the end buffer. This isn't optimal as presumably more data will be arriving later, and hence it's better to stop with the last full buffer rather than truncate the end buffer. Cc: stable@vger.kernel.org Fixes: 35c8711c8fc4 ("io_uring/kbuf: add helpers for getting/peeking multiple buffers") Reported-by: Christian Mazakas Signed-off-by: Jens Axboe commit ad6159087fbbd754bfe940bd62b6322307925faa Merge: 36df6f734a7ad6 40a98e702b528c Author: Linus Torvalds Date: Fri Jun 13 09:59:29 2025 -0700 Merge tag 'v6.16-p4' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: "Fix a broken self-test in hkdf (new regression)" * tag 'v6.16-p4' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: hkdf - move to late_initcall commit 36df6f734a7ad69880c5262543165c47cb57169f Merge: d080d3b5444850 aef22f6fe7a630 Author: Linus Torvalds Date: Fri Jun 13 09:49:07 2025 -0700 Merge tag 'bcachefs-2025-06-12' of git://evilpiepirate.org/bcachefs Pull bcachefs fixes from Kent Overstreet: "As usual, highlighting the ones users have been noticing: - Fix a small issue with has_case_insensitive not being propagated on snapshot creation; this led to fsck errors, which we're harmless because we're not using this flag yet (it's for overlayfs + casefolding). - Log the error being corrected in the journal when we're doing fsck repair: this was one of the "lessons learned" from the i_nlink 0 -> subvolume deletion bug, where reconstructing what had happened by analyzing the journal was a bit more difficult than it needed to be. - Don't schedule btree node scan to run in the superblock: this fixes a regression from the 6.16 recovery passes rework, and let to it running unnecessarily. The real issue here is that we don't have online, "self healing" style topology repair yet: topology repair currently has to run before we go RW, which means that we may schedule it unnecessarily after a transient error. This will be fixed in the future. - We now track, in btree node flags, the reason it was scheduled to be rewritten. We discovered a deadlock in recovery when many btree nodes need to be rewritten because they're degraded: fully fixing this will take some work but it's now easier to see what's going on. For the bug report where this came up, a device had been kicked RO due to transient errors: manually setting it back to RW was sufficient to allow recovery to succeed. - Mark a few more fsck errors as autofix: as a reminder to users, please do keep reporting cases where something needs to be repaired and is not repaired automatically (i.e. cases where -o fix_errors or fsck -y is required). - rcu_pending.c now works with PREEMPT_RT - 'bcachefs device add', then umount, then remount wasn't working - we now emit a uevent so that the new device's new superblock is correctly picked up - Assorted repair fixes: btree node scan will no longer incorrectly update sb->version_min, - Assorted syzbot fixes" * tag 'bcachefs-2025-06-12' of git://evilpiepirate.org/bcachefs: (23 commits) bcachefs: Don't trace should_be_locked unless changing bcachefs: Ensure that snapshot creation propagates has_case_insensitive bcachefs: Print devices we're mounting on multi device filesystems bcachefs: Don't trust sb->nr_devices in members_to_text() bcachefs: Fix version checks in validate_bset() bcachefs: ioctl: avoid stack overflow warning bcachefs: Don't pass trans to fsck_err() in gc_accounting_done bcachefs: Fix leak in bch2_fs_recovery() error path bcachefs: Fix rcu_pending for PREEMPT_RT bcachefs: Fix downgrade_table_extra() bcachefs: Don't put rhashtable on stack bcachefs: Make sure opts.read_only gets propagated back to VFS bcachefs: Fix possible console lock involved deadlock bcachefs: mark more errors autofix bcachefs: Don't persistently run scan_for_btree_nodes bcachefs: Read error message now prints if self healing bcachefs: Only run 'increase_depth' for keys from btree node csan bcachefs: Mark need_discard_freespace_key_bad autofix bcachefs: Update /dev/disk/by-uuid on device add bcachefs: Add more flags to btree nodes for rewrite reason ... commit ab107276607af90b13a5994997e19b7b9731e251 Author: Madhavan Srinivasan Date: Sat May 17 19:52:37 2025 +0530 powerpc: Fix struct termio related ioctl macros Since termio interface is now obsolete, include/uapi/asm/ioctls.h has some constant macros referring to "struct termio", this caused build failure at userspace. In file included from /usr/include/asm/ioctl.h:12, from /usr/include/asm/ioctls.h:5, from tst-ioctls.c:3: tst-ioctls.c: In function 'get_TCGETA': tst-ioctls.c:12:10: error: invalid application of 'sizeof' to incomplete type 'struct termio' 12 | return TCGETA; | ^~~~~~ Even though termios.h provides "struct termio", trying to juggle definitions around to make it compile could introduce regressions. So better to open code it. Reported-by: Tulio Magno Suggested-by: Nicholas Piggin Tested-by: Justin M. Forbes Reviewed-by: Michael Ellerman Closes: https://lore.kernel.org/linuxppc-dev/8734dji5wl.fsf@ascii.art.br/ Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250517142237.156665-1-maddy@linux.ibm.com commit d57e92dd660014ccac884eda616cafc7b04601e0 Author: Thierry Reding Date: Fri Jun 13 14:30:37 2025 +0200 spi: tegra210-qspi: Remove cache operations The DMA memory for this driver is allocated using dma_alloc_coherent(), which ends up mapping the allocated memory as uncached. Performing the various dma_sync_*() operations on this memory causes issues during SPI flashing: [ 7.818017] pc : dcache_inval_poc+0x40/0x58 [ 7.822128] lr : arch_sync_dma_for_cpu+0x2c/0x4c [ 7.826854] sp : ffff80008193bcf0 [ 7.830267] x29: ffff80008193bcf0 x28: ffffa3fe5ff1e908 x27: ffffa3fe627bb130 [ 7.837528] x26: ffff000086952180 x25: ffff00008015c8ac x24: ffff000086c9b480 [ 7.844878] x23: ffff00008015c800 x22: 0000000000000002 x21: 0000000000010000 [ 7.852229] x20: 0000000106dae000 x19: ffff000080112410 x18: 0000000000000001 [ 7.859580] x17: ffff000080159400 x16: ffffa3fe607a9bd8 x15: ffff0000eac1b180 [ 7.866753] x14: 000000000000000c x13: 0000000000000001 x12: 000000000000025a [ 7.874104] x11: 0000000000000000 x10: 7f73e96357f6a07f x9 : db1fc8072a7f5e3a [ 7.881365] x8 : ffff000086c9c588 x7 : ffffa3fe607a9bd8 x6 : ffff80008193bc28 [ 7.888630] x5 : 000000000000ffff x4 : 0000000000000009 x3 : 000000000000003f [ 7.895892] x2 : 0000000000000040 x1 : ffff000086dbe000 x0 : ffff000086db0000 [ 7.903155] Call trace: [ 7.905606] dcache_inval_poc+0x40/0x58 (P) [ 7.909804] iommu_dma_sync_single_for_cpu+0xb4/0xb8 [ 7.914617] __dma_sync_single_for_cpu+0x158/0x194 [ 7.919428] __this_module+0x5b020/0x5baf8 [spi_tegra210_quad] [ 7.925291] irq_thread_fn+0x2c/0xc0 [ 7.928966] irq_thread+0x16c/0x318 [ 7.932467] kthread+0x12c/0x214 Fix this by removing all calls to the dma_sync_*() functions. This isn't ideal because DMA is used only for relatively large (> 64 words or 256 bytes) and using uncached memory for this might be slow. Reworking this to use cached memory for faster access and reintroducing the cache maintenance calls is probably worth a follow-up patch. Reported-by: Brad Griffis Fixes: 017f1b0bae08 ("spi: tegra210-quad: Add support for internal DMA") Signed-off-by: Thierry Reding Link: https://patch.msgid.link/20250613123037.2082788-1-thierry.reding@gmail.com Signed-off-by: Mark Brown commit 3c70ec71abdaf4e4fa48cd8fdfbbd864d78235a8 Author: Dan Williams Date: Thu Jun 12 12:20:43 2025 -0700 cxl/ras: Fix CPER handler device confusion By inspection, cxl_cper_handle_prot_err() is making a series of fragile assumptions that can lead to crashes: 1/ It assumes that endpoints identified in the record are a CXL-type-3 device, nothing guarantees that. 2/ It assumes that the device is bound to the cxl_pci driver, nothing guarantees that. 3/ Minor, it holds the device lock over the switch-port tracing for no reason as the trace is 100% generated from data in the record. Correct those by checking that the PCIe endpoint parents a cxl_memdev before assuming the format of the driver data, and move the lock to where it is required. Consequently this also makes the implementation ready for CXL accelerators that are not bound to cxl_pci. Fixes: 36f257e3b0ba ("acpi/ghes, cxl/pci: Process CXL CPER Protocol Errors") Cc: Terry Bowman Cc: Li Ming Cc: Alison Schofield Cc: Ira Weiny Cc: Tony Luck Reviewed-by: Smita Koralahalli Reviewed-by: Dave Jiang Signed-off-by: Dan Williams Reviewed-by: Jonathan Cameron Reviewed-by: Li Ming Link: https://patch.msgid.link/20250612192043.2254617-1-dan.j.williams@intel.com Signed-off-by: Dave Jiang commit a403fe6c0b17f472e01246eb350f5eef105243ac Author: Li Ming Date: Fri Jun 13 09:16:48 2025 +0800 cxl/edac: Fix potential memory leak issues In cxl_store_rec_gen_media() and cxl_store_rec_dram(), use kmemdup() to duplicate a cxl gen_media/dram event to store the event in a xarray by xa_store(). The cxl gen_media/dram event allocated by kmemdup() should be freed in the case that the xa_store() fails. Fixes: 0b5ccb0de1e2 ("cxl/edac: Support for finding memory operation attributes from the current boot") Signed-off-by: Li Ming Tested-by: Shiju Jose Reviewed-by: Shiju Jose Reviewed-by: Ira Weiny Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20250613011648.102840-1-ming.li@zohomail.com Signed-off-by: Dave Jiang commit db3dfae1a2f662e69d535827703bcdbb04b8d72b Author: Bagas Sanjaya Date: Fri Jun 13 09:38:57 2025 +0700 Documentation: ublk: Separate UBLK_F_AUTO_BUF_REG fallback behavior sublists Stephen Rothwell reports htmldocs warning on ublk docs: Documentation/block/ublk.rst:414: ERROR: Unexpected indentation. [docutils] Fix the warning by separating sublists of auto buffer registration fallback behavior from their appropriate parent list item. Fixes: ff20c516485e ("ublk: document auto buffer registration(UBLK_F_AUTO_BUF_REG)") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/linux-next/20250612132638.193de386@canb.auug.org.au/ Signed-off-by: Bagas Sanjaya Link: https://lore.kernel.org/r/20250613023857.15971-1-bagasdotme@gmail.com Signed-off-by: Jens Axboe commit f9705d66fa7107fcd619083f7aae2afb0554a593 Author: Jason Gunthorpe Date: Tue Jun 3 16:14:45 2025 -0300 iommu/tegra: Fix incorrect size calculation This driver uses a mixture of ways to get the size of a PTE, tegra_smmu_set_pde() did it as sizeof(*pd) which became wrong when pd switched to a struct tegra_pd. Switch pd back to a u32* in tegra_smmu_set_pde() so the sizeof(*pd) returns 4. Fixes: 50568f87d1e2 ("iommu/terga: Do not use struct page as the handle for as->pd memory") Reported-by: Diogo Ivo Closes: https://lore.kernel.org/all/62e7f7fe-6200-4e4f-ad42-d58ad272baa6@tecnico.ulisboa.pt/ Signed-off-by: Jason Gunthorpe Acked-by: Thierry Reding Reviewed-by: Jerry Snitselaar Tested-by: Diogo Ivo Link: https://lore.kernel.org/r/0-v1-da7b8b3d57eb+ce-iommu_terga_sizeof_jgg@nvidia.com Signed-off-by: Joerg Roedel commit 553ab30a181043f01b99a493ba13f9c011eb75ae Author: Bagas Sanjaya Date: Wed Jun 11 09:08:06 2025 +0700 Documentation: nouveau: Update GSP message queue kernel-doc reference GSP message queue docs has been moved following RPC handling split in commit 8a8b1ec5261f20 ("drm/nouveau/gsp: split rpc handling out on its own"), before GSP-RM implementation is versioned in commit c472d828348caf ("drm/nouveau/gsp: move subdev/engine impls to subdev/gsp/rm/r535/"). However, the kernel-doc reference in nouveau docs is left behind, which triggers htmldocs warnings: ERROR: Cannot find file ./drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c WARNING: No kernel-doc for file ./drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c Update the reference. Fixes: c472d828348c ("drm/nouveau/gsp: move subdev/engine impls to subdev/gsp/rm/r535/") Fixes: 8a8b1ec5261f ("drm/nouveau/gsp: split rpc handling out on its own") Signed-off-by: Bagas Sanjaya Acked-by: Randy Dunlap Tested-by: Randy Dunlap Link: https://lore.kernel.org/r/20250611020805.22418-2-bagasdotme@gmail.com Signed-off-by: Danilo Krummrich commit 61b2b3737499f1fb361a54a16828db24a8345e85 Author: Jacob Keller Date: Tue Jun 10 14:54:51 2025 -0700 drm/nouveau/bl: increase buffer size to avoid truncate warning The nouveau_get_backlight_name() function generates a unique name for the backlight interface, appending an id from 1 to 99 for all backlight devices after the first. GCC 15 (and likely other compilers) produce the following -Wformat-truncation warning: nouveau_backlight.c: In function ‘nouveau_backlight_init’: nouveau_backlight.c:56:69: error: ‘%d’ directive output may be truncated writing between 1 and 10 bytes into a region of size 3 [-Werror=format-truncation=] 56 | snprintf(backlight_name, BL_NAME_SIZE, "nv_backlight%d", nb); | ^~ In function ‘nouveau_get_backlight_name’, inlined from ‘nouveau_backlight_init’ at nouveau_backlight.c:351:7: nouveau_backlight.c:56:56: note: directive argument in the range [1, 2147483647] 56 | snprintf(backlight_name, BL_NAME_SIZE, "nv_backlight%d", nb); | ^~~~~~~~~~~~~~~~ nouveau_backlight.c:56:17: note: ‘snprintf’ output between 14 and 23 bytes into a destination of size 15 56 | snprintf(backlight_name, BL_NAME_SIZE, "nv_backlight%d", nb); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The warning started appearing after commit ab244be47a8f ("drm/nouveau: Fix a potential theorical leak in nouveau_get_backlight_name()") This fix for the ida usage removed the explicit value check for ids larger than 99. The compiler is unable to intuit that the ida_alloc_max() limits the returned value range between 0 and 99. Because the compiler can no longer infer that the number ranges from 0 to 99, it thinks that it could use as many as 11 digits (10 + the potential - sign for negative numbers). The warning has gone unfixed for some time, with at least one kernel test robot report. The code breaks W=1 builds, which is especially frustrating with the introduction of CONFIG_WERROR. The string is stored temporarily on the stack and then copied into the device name. Its not a big deal to use 11 more bytes of stack rounding out to an even 24 bytes. Increase BL_NAME_SIZE to 24 to avoid the truncation warning. This fixes the W=1 builds that include this driver. Compile tested only. Fixes: ab244be47a8f ("drm/nouveau: Fix a potential theorical leak in nouveau_get_backlight_name()") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202312050324.0kv4PnfZ-lkp@intel.com/ Suggested-by: Timur Tabi Signed-off-by: Jacob Keller Link: https://lore.kernel.org/r/20250610-jk-nouveua-drm-bl-snprintf-fix-v2-1-7fdd4b84b48e@intel.com Signed-off-by: Danilo Krummrich commit 9802f0a63b641f4cddb2139c814c2e95cb825099 Author: Zhi Wang Date: Tue May 27 16:37:12 2025 +0000 drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() The RPC container is released after being passed to r535_gsp_rpc_send(). When sending the initial fragment of a large RPC and passing the caller's RPC container, the container will be freed prematurely. Subsequent attempts to send remaining fragments will therefore result in a use-after-free. Allocate a temporary RPC container for holding the initial fragment of a large RPC when sending. Free the caller's container when all fragments are successfully sent. Fixes: 176fdcbddfd2 ("drm/nouveau/gsp/r535: add support for booting GSP-RM") Signed-off-by: Zhi Wang Link: https://lore.kernel.org/r/20250527163712.3444-1-zhiw@nvidia.com [ Rebase onto Blackwell changes. - Danilo ] Signed-off-by: Danilo Krummrich commit 08a0d93c353bd55de8b5fb77b464d89425be0215 Author: Sven Peter Date: Wed Jun 11 15:18:53 2025 +0000 arm64: dts: apple: Move touchbar mipi {address,size}-cells from dtsi to dts Move the {address,size}-cells property from the (disabled) touchbar screen mipi node inside the dtsi file to the model-specific dts file where it's enabled to fix the following W=1 warnings: t8103.dtsi:404.34-433.5: Warning (avoid_unnecessary_addr_size): /soc/dsi@228600000: unnecessary #address-cells/#size-cells without "ranges", "dma-ranges" or child "reg" property t8112.dtsi:419.34-448.5: Warning (avoid_unnecessary_addr_size): /soc/dsi@228600000: unnecessary #address-cells/#size-cells without "ranges", "dma-ranges" or child "reg" property Fixes: 7275e795e520 ("arm64: dts: apple: Add touchbar screen nodes") Reviewed-by: Janne Grunau Link: https://lore.kernel.org/r/20250611-display-pipe-mipi-warning-v1-1-bd80ba2c0eea@kernel.org Signed-off-by: Sven Peter commit 811a909978bf59caa25359e0aca4e30500dcff26 Author: Sven Peter Date: Tue Jun 10 19:19:24 2025 +0000 arm64: dts: apple: Drop {address,size}-cells from SPI NOR Fix the following warning by dropping #{address,size}-cells from the SPI NOR node which only has a single child node without reg property: spi1-nvram.dtsi:19.10-38.4: Warning (avoid_unnecessary_addr_size): /soc/spi@235104000/flash@0: unnecessary #address-cells/#size-cells without "ranges", "dma-ranges" or child "reg" property Fixes: 3febe9de5ca5 ("arm64: dts: apple: Add SPI NOR nvram partition to all devices") Reviewed-by: Janne Grunau Link: https://lore.kernel.org/r/20250610-apple-dts-warnings-v1-1-70b53e8108a0@kernel.org Signed-off-by: Sven Peter commit ac1daa91e9370e3b88ef7826a73d62a4d09e2717 Author: Janne Grunau Date: Wed Jun 11 22:30:31 2025 +0200 arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename Fix the following `make dtbs_check` warnings for all t8103 based devices: arch/arm64/boot/dts/apple/t8103-j274.dtb: network@0,0: $nodename:0: 'network@0,0' does not match '^wifi(@.*)?$' from schema $id: http://devicetree.org/schemas/net/wireless/brcm,bcm4329-fmac.yaml# arch/arm64/boot/dts/apple/t8103-j274.dtb: network@0,0: Unevaluated properties are not allowed ('local-mac-address' was unexpected) from schema $id: http://devicetree.org/schemas/net/wireless/brcm,bcm4329-fmac.yaml# Fixes: bf2c05b619ff ("arm64: dts: apple: t8103: Expose PCI node for the WiFi MAC address") Signed-off-by: Janne Grunau Reviewed-by: Sven Peter Link: https://lore.kernel.org/r/20250611-arm64_dts_apple_wifi-v1-1-fb959d8e1eb4@jannau.net Signed-off-by: Sven Peter commit 80626ae6ffe57917915c6e6d8ea1e908689954fd Author: Colin Ian King Date: Thu May 22 14:15:12 2025 +0100 drm/nouveau/gsp: Fix potential integer overflow on integer shifts The left shift int 32 bit integer constants 1 is evaluated using 32 bit arithmetic and then assigned to a 64 bit unsigned integer. In the case where the shift is 32 or more this can lead to an overflow. Avoid this by shifting using the BIT_ULL macro instead. Fixes: 6c3ac7bcfcff ("drm/nouveau/gsp: support deeper page tables in COPY_SERVER_RESERVED_PDES") Signed-off-by: Colin Ian King Signed-off-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250522131512.2768310-1-colin.i.king@gmail.com commit 8a2277a3c9e4cc5398f80821afe7ecbe9bdf2819 Author: Gyeyoung Baek Date: Thu Jun 12 21:48:27 2025 +0900 genirq/irq_sim: Initialize work context pointers properly Initialize `ops` member's pointers properly by using kzalloc() instead of kmalloc() when allocating the simulation work context. Otherwise the pointers contain random content leading to invalid dereferencing. Signed-off-by: Gyeyoung Baek Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250612124827.63259-1-gye976@gmail.com commit 72218d74c9c57b8ea36c2a58875dff406fc10462 Author: Brian Norris Date: Thu Jun 12 11:32:52 2025 -0700 genirq/cpuhotplug: Restore affinity even for suspended IRQ Commit 788019eb559f ("genirq: Retain disable depth for managed interrupts across CPU hotplug") tried to make managed shutdown/startup properly reference counted, but it missed the fact that the unplug and hotplug code has an intentional imbalance by skipping IRQS_SUSPENDED interrupts on the "restore" path. This means that if a managed-affinity interrupt was both suspended and managed-shutdown (such as may happen during system suspend / S3), resume skips calling irq_startup_managed(), and would again have an unbalanced depth this time, with a positive value (i.e., remaining unexpectedly masked). This IRQS_SUSPENDED check was introduced in commit a60dd06af674 ("genirq/cpuhotplug: Skip suspended interrupts when restoring affinity") for essentially the same reason as commit 788019eb559f, to prevent that irq_startup() would unconditionally re-enable an interrupt too early. Because irq_startup_managed() now respsects the disable-depth count, the IRQS_SUSPENDED check is not longer needed, and instead, it causes harm. Thus, drop the IRQS_SUSPENDED check, and restore balance. This effectively reverts commit a60dd06af674 ("genirq/cpuhotplug: Skip suspended interrupts when restoring affinity"), because it is replaced by commit 788019eb559f ("genirq: Retain disable depth for managed interrupts across CPU hotplug"). Fixes: 788019eb559f ("genirq: Retain disable depth for managed interrupts across CPU hotplug") Reported-by: Aleksandrs Vinarskis Signed-off-by: Brian Norris Signed-off-by: Thomas Gleixner Tested-by: Aleksandrs Vinarskis Link: https://lore.kernel.org/all/20250612183303.3433234-3-briannorris@chromium.org Closes: https://lore.kernel.org/lkml/24ec4adc-7c80-49e9-93ee-19908a97ab84@gmail.com/ commit 2b32fc8ff08deac3aa509f321a28e21b1eea5525 Author: Brian Norris Date: Thu Jun 12 11:32:51 2025 -0700 genirq/cpuhotplug: Rebalance managed interrupts across multi-CPU hotplug Commit 788019eb559f ("genirq: Retain disable depth for managed interrupts across CPU hotplug") intended to only decrement the disable depth once per managed shutdown, but instead it decrements for each CPU hotplug in the affinity mask, until its depth reaches a point where it finally gets re-started. For example, consider: 1. Interrupt is affine to CPU {M,N} 2. disable_irq() -> depth is 1 3. CPU M goes offline -> interrupt migrates to CPU N / depth is still 1 4. CPU N goes offline -> irq_shutdown() / depth is 2 5. CPU N goes online -> irq_restore_affinity_of_irq() -> irqd_is_managed_and_shutdown()==true -> irq_startup_managed() -> depth is 1 6. CPU M goes online -> irq_restore_affinity_of_irq() -> irqd_is_managed_and_shutdown()==true -> irq_startup_managed() -> depth is 0 *** BUG: driver expects the interrupt is still disabled *** -> irq_startup() -> irqd_clr_managed_shutdown() 7. enable_irq() -> depth underflow / unbalanced enable_irq() warning This should clear the managed-shutdown flag at step 6, so that further hotplugs don't cause further imbalance. Note: It might be cleaner to also remove the irqd_clr_managed_shutdown() invocation from __irq_startup_managed(). But this is currently not possible because of irq_update_affinity_desc() as it sets IRQD_MANAGED_SHUTDOWN and expects irq_startup() to clear it. Fixes: 788019eb559f ("genirq: Retain disable depth for managed interrupts across CPU hotplug") Reported-by: Aleksandrs Vinarskis Signed-off-by: Brian Norris Signed-off-by: Thomas Gleixner Tested-by: Aleksandrs Vinarskis Link: https://lore.kernel.org/all/20250612183303.3433234-2-briannorris@chromium.org commit b5acc3628898baa63658bc4125f9525f9b3dd4f3 Author: Niklas Cassel Date: Thu Jun 12 16:17:51 2025 +0200 ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard A user has bisected a regression which causes graphical corruptions on his screen to commit 7627a0edef54 ("ata: ahci: Drop low power policy board type"). Simply reverting commit 7627a0edef54 ("ata: ahci: Drop low power policy board type") makes the graphical corruptions on his screen to go away. (Note: there are no visible messages in dmesg that indicates a problem with AHCI.) The user also reports that the problem occurs regardless if there is an HDD or an SSD connected via AHCI, so the problem is not device related. The devices also work fine on other motherboards, so it seems specific to the ASUSPRO-D840SA motherboard. While enabling low power modes for AHCI is not supposed to affect completely unrelated hardware, like a graphics card, it does however allow the system to enter deeper PC-states, which could expose ACPI issues that were previously not visible (because the system never entered these lower power states before). There are previous examples where enabling LPM exposed serious BIOS/ACPI bugs, see e.g. commit 240630e61870 ("ahci: Disable LPM on Lenovo 50 series laptops with a too old BIOS"). Since there hasn't been any BIOS update in years for the ASUSPRO-D840SA motherboard, disable LPM for this board, in order to avoid entering lower PC-states, which triggers graphical corruptions. Cc: stable@vger.kernel.org Reported-by: Andy Yang Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220111 Fixes: 7627a0edef54 ("ata: ahci: Drop low power policy board type") Reviewed-by: Damien Le Moal Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250612141750.2108342-2-cassel@kernel.org Signed-off-by: Niklas Cassel commit 5e223e06ee7c6d8f630041a0645ac90e39a42cc6 Author: Matthew Wilcox (Oracle) Date: Thu Jun 12 15:42:53 2025 +0100 block: Fix bvec_set_folio() for very large folios Similarly to 26064d3e2b4d ("block: fix adding folio to bio"), if we attempt to add a folio that is larger than 4GB, we'll silently truncate the offset and len. Widen the parameters to size_t, assert that the length is less than 4GB and set the first page that contains the interesting data rather than the first page of the folio. Fixes: 26db5ee15851 (block: add a bvec_set_folio helper) Signed-off-by: Matthew Wilcox (Oracle) Link: https://lore.kernel.org/r/20250612144255.2850278-1-willy@infradead.org Signed-off-by: Jens Axboe commit f826ec7966a63d48e16e0868af4e038bf9a1a3ae Author: Matthew Wilcox (Oracle) Date: Thu Jun 12 15:41:25 2025 +0100 bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP It is possible for physically contiguous folios to have discontiguous struct pages if SPARSEMEM is enabled and SPARSEMEM_VMEMMAP is not. This is correctly handled by folio_page_idx(), so remove this open-coded implementation. Fixes: 640d1930bef4 (block: Add bio_for_each_folio_all()) Signed-off-by: Matthew Wilcox (Oracle) Link: https://lore.kernel.org/r/20250612144126.2849931-1-willy@infradead.org Signed-off-by: Jens Axboe commit e2468dc700743683e1d1793bbd855e2536fd3de2 Author: Kurt Borja Date: Wed Jun 11 18:30:40 2025 -0300 Revert "platform/x86: alienware-wmi-wmax: Add G-Mode support to Alienware m16 R1" This reverts commit 5ff79cabb23a2f14d2ed29e9596aec908905a0e6. Although the Alienware m16 R1 AMD model supports G-Mode, it actually has a lower power ceiling than plain "performance" profile, which results in lower performance. Reported-by: Cihan Ozakca Cc: stable@vger.kernel.org # 6.15.x Signed-off-by: Kurt Borja Link: https://lore.kernel.org/r/20250611-m16-rev-v1-1-72d13bad03c9@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 9ba75ccad85708c5a484637dccc1fc59295b0a83 Author: Mario Limonciello Date: Wed Jun 11 15:33:40 2025 -0500 platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list Every other s2idle cycle fails to reach hardware sleep when keyboard wakeup is enabled. This appears to be an EC bug, but the vendor refuses to fix it. It was confirmed that turning off i8042 wakeup avoids ths issue (albeit keyboard wakeup is disabled). Take the lesser of two evils and add it to the i8042 quirk list. Reported-by: Raoul Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220116 Tested-by: Raoul Signed-off-by: Mario Limonciello Link: https://lore.kernel.org/r/20250611203341.3733478-1-superm1@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 9f0ad43b158d07bc7144d219ceabdea36e28e392 Author: Thangaraj Samynathan Date: Thu Jun 12 08:00:59 2025 +0530 spi: spi-pci1xxxx: Drop MSI-X usage as unsupported by DMA engine Removes MSI-X from the interrupt request path, as the DMA engine used by the SPI controller does not support MSI-X interrupts. Signed-off-by: Thangaraj Samynathan Link: https://patch.msgid.link/20250612023059.71726-1-thangaraj.s@microchip.com Signed-off-by: Mark Brown commit f59427932885f9b47b22b532b079478905b9ad08 Author: Sven Peter Date: Thu Jun 12 21:11:34 2025 +0000 ASoC: apple: mca: Drop default ARCH_APPLE in Kconfig When the first driver for Apple Silicon was upstreamed we accidentally included `default ARCH_APPLE` in its Kconfig which then spread to almost every subsequent driver. As soon as ARCH_APPLE is set to y this will pull in many drivers as built-ins which is not what we want. Thus, drop `default ARCH_APPLE` from Kconfig. Signed-off-by: Sven Peter Reviewed-by: Janne Grunau Link: https://patch.msgid.link/20250612-apple-kconfig-defconfig-v1-10-0e6f9cb512c1@kernel.org Signed-off-by: Mark Brown commit ac90aad0e9bf7c37e706fdc08ce763a553890bdf Author: Eric Biggers Date: Thu Jun 12 10:47:09 2025 -0700 crypto: testmgr - reinstate kconfig control over full self-tests Commit 698de822780f ("crypto: testmgr - make it easier to enable the full set of tests") removed support for building kernels that run only the "fast" set of crypto self-tests by default. This assumed that nearly everyone actually wanted the full set of tests, *if* they had already chosen to enable the tests at all. Unfortunately, it turns out that both Debian and Fedora intentionally have the crypto self-tests enabled in their production kernels. And for production kernels we do need to keep the testing time down, which implies just running the "fast" tests, not the full set of tests. For Fedora, a reason for enabling the tests in production is that they are being (mis)used to meet the FIPS 140-3 pre-operational testing requirement. However, the other reason for enabling the tests in production, which applies to both distros, is that they provide some value in protecting users from buggy drivers. Unfortunately, the crypto/ subsystem has many buggy and untested drivers for off-CPU hardware accelerators on rare platforms. These broken drivers get shipped to users, and there have been multiple examples of the tests preventing these buggy drivers from being used. So effectively, the tests are being relied on in production kernels. I think this is kind of crazy (untested drivers should just not be enabled at all), but that seems to be how things work currently. Thus, reintroduce a kconfig option that controls the level of testing. Call it CRYPTO_SELFTESTS_FULL instead of the original name CRYPTO_MANAGER_EXTRA_TESTS, which was slightly misleading. Moreover, given the "production kernel" use case, make CRYPTO_SELFTESTS depend on EXPERT instead of DEBUG_KERNEL. I also haven't reinstated all the #ifdefs in crypto/testmgr.c. Instead, just rely on the compiler to optimize out unused code. Fixes: 40b9969796bf ("crypto: testmgr - replace CRYPTO_MANAGER_DISABLE_TESTS with CRYPTO_SELFTESTS") Fixes: 698de822780f ("crypto: testmgr - make it easier to enable the full set of tests") Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit 93adf20ff4d6e865e0b974110d3cf2f07c057177 Author: wangdicheng Date: Fri Jun 13 14:36:36 2025 +0800 ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card PCM1 not in Pulseaudio's control list; standardize control to "Speaker" and "Headphone". Signed-off-by: wangdicheng Cc: Link: https://patch.msgid.link/20250613063636.239683-1-wangdich9700@163.com Signed-off-by: Takashi Iwai commit b0823d5fbacb1c551d793cbfe7af24e0d1fa45ed Author: Kan Liang Date: Thu Jun 12 07:38:18 2025 -0700 perf/x86/intel: Fix crash in icl_update_topdown_event() The perf_fuzzer found a hard-lockup crash on a RaptorLake machine: Oops: general protection fault, maybe for address 0xffff89aeceab400: 0000 CPU: 23 UID: 0 PID: 0 Comm: swapper/23 Tainted: [W]=WARN Hardware name: Dell Inc. Precision 9660/0VJ762 RIP: 0010:native_read_pmc+0x7/0x40 Code: cc e8 8d a9 01 00 48 89 03 5b cd cc cc cc cc 0f 1f ... RSP: 000:fffb03100273de8 EFLAGS: 00010046 .... Call Trace: icl_update_topdown_event+0x165/0x190 ? ktime_get+0x38/0xd0 intel_pmu_read_event+0xf9/0x210 __perf_event_read+0xf9/0x210 CPUs 16-23 are E-core CPUs that don't support the perf metrics feature. The icl_update_topdown_event() should not be invoked on these CPUs. It's a regression of commit: f9bdf1f95339 ("perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read") The bug introduced by that commit is that the is_topdown_event() function is mistakenly used to replace the is_topdown_count() call to check if the topdown functions for the perf metrics feature should be invoked. Fix it. Fixes: f9bdf1f95339 ("perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read") Closes: https://lore.kernel.org/lkml/352f0709-f026-cd45-e60c-60dfd97f73f3@maine.edu/ Reported-by: Vince Weaver Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Tested-by: Vince Weaver Cc: stable@vger.kernel.org # v6.15+ Link: https://lore.kernel.org/r/20250612143818.2889040-1-kan.liang@linux.intel.com commit e75cb6010838f61b9d63e921d1763a8ab177e38e Author: J. Neuschäfer Date: Wed Jun 11 21:01:01 2025 +0200 powerpc: dts: mpc8315erdb: Add GPIO controller node The MPC8315E SoC and variants have a GPIO controller at IMMR + 0xc00. This node was previously missing from the device tree. Signed-off-by: J. Neuschäfer Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250611-mpc-gpio-v1-1-02d1f75336e2@posteo.net commit 4e6d080acfda5344ccbc63afe778830e22be4be9 Author: J. Neuschäfer Date: Wed Jun 11 23:07:49 2025 +0200 powerpc/microwatt: Fix model property in device tree The standard property for the model name is called "model". Signed-off-by: J. Neuschäfer Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250611-microwatt-v2-1-80847bbc5f9c@posteo.net commit 33bc69cf6655cf60829a803a45275f11a74899e5 Author: Narayana Murty N Date: Thu May 8 02:29:28 2025 -0400 powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery VFIO EEH recovery for PCI passthrough devices fails on PowerNV and pseries platforms due to missing host-side PE bridge reconfiguration. In the current implementation, eeh_pe_configure() only performs RTAS or OPAL-based bridge reconfiguration for native host devices, but skips it entirely for PEs managed through VFIO in guest passthrough scenarios. This leads to incomplete EEH recovery when a PCI error affects a passthrough device assigned to a QEMU/KVM guest. Although VFIO triggers the EEH recovery flow through VFIO_EEH_PE_ENABLE ioctl, the platform-specific bridge reconfiguration step is silently bypassed. As a result, the PE's config space is not fully restored, causing subsequent config space access failures or EEH freeze-on-access errors inside the guest. This patch fixes the issue by ensuring that eeh_pe_configure() always invokes the platform's configure_bridge() callback (e.g., pseries_eeh_phb_configure_bridge) even for VFIO-managed PEs. This ensures that RTAS or OPAL calls to reconfigure the PE bridge are correctly issued on the host side, restoring the PE's configuration space after an EEH event. This fix is essential for reliable EEH recovery in QEMU/KVM guests using VFIO PCI passthrough on PowerNV and pseries systems. Tested with: - QEMU/KVM guest using VFIO passthrough (IBM Power9,(lpar)Power11 host) - Injected EEH errors with pseries EEH errinjct tool on host, recovery verified on qemu guest. - Verified successful config space access and CAP_EXP DevCtl restoration after recovery Fixes: 212d16cdca2d ("powerpc/eeh: EEH support for VFIO PCI device") Signed-off-by: Narayana Murty N Reviewed-by: Vaibhav Jain Reviewed-by: Ganesh Goudar Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250508062928.146043-1-nnmlinux@linux.ibm.com commit b93755f408325170edb2156c6a894ed1cae5f4f6 Author: Christophe Leroy Date: Mon May 12 20:14:55 2025 +0200 powerpc/vdso: Fix build of VDSO32 with pcrel Building vdso32 on power10 with pcrel leads to following errors: VDSO32A arch/powerpc/kernel/vdso/gettimeofday-32.o arch/powerpc/kernel/vdso/gettimeofday.S: Assembler messages: arch/powerpc/kernel/vdso/gettimeofday.S:40: Error: syntax error; found `@', expected `,' arch/powerpc/kernel/vdso/gettimeofday.S:71: Info: macro invoked from here arch/powerpc/kernel/vdso/gettimeofday.S:40: Error: junk at end of line: `@notoc' arch/powerpc/kernel/vdso/gettimeofday.S:71: Info: macro invoked from here ... make[2]: *** [arch/powerpc/kernel/vdso/Makefile:85: arch/powerpc/kernel/vdso/gettimeofday-32.o] Error 1 make[1]: *** [arch/powerpc/Makefile:388: vdso_prepare] Error 2 Once the above is fixed, the following happens: VDSO32C arch/powerpc/kernel/vdso/vgettimeofday-32.o cc1: error: '-mpcrel' requires '-mcmodel=medium' make[2]: *** [arch/powerpc/kernel/vdso/Makefile:89: arch/powerpc/kernel/vdso/vgettimeofday-32.o] Error 1 make[1]: *** [arch/powerpc/Makefile:388: vdso_prepare] Error 2 make: *** [Makefile:251: __sub-make] Error 2 Make sure pcrel version of CFUNC() macro is used only for powerpc64 builds and remove -mpcrel for powerpc32 builds. Fixes: 7e3a68be42e1 ("powerpc/64: vmlinux support building with PCREL addresing") Signed-off-by: Christophe Leroy Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/1fa3453f07d42a50a70114da9905bf7b73304fca.1747073669.git.christophe.leroy@csgroup.eu commit 2e3395ab2a358ba8d1c80d8df35dcfb882cfc28e Author: Thomas Zimmermann Date: Thu Jun 12 10:53:02 2025 +0200 drm/mgag200: Do not include Fix the compile-time warning drivers/gpu/drm/mgag200/mgag200_ddc.c: warning: EXPORT_SYMBOL() is not used, but #include is present Signed-off-by: Thomas Zimmermann Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250612085308.203861-1-tzimmermann@suse.de commit d742f3ec1cb91c4dd86b981f55cd291e07f03094 Author: Thomas Zimmermann Date: Thu Jun 12 10:42:55 2025 +0200 drm/ast: Do not include Fix the compile-time warning drivers/gpu/drm/ast/ast_mode.c: warning: EXPORT_SYMBOL() is not used, but #include is present Signed-off-by: Thomas Zimmermann Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250612084257.200907-1-tzimmermann@suse.de commit 1364af9cb2c5716f1905113cc84ff77ddf16a22e Merge: a24823d14b2d35 afe382843717d4 Author: Dave Airlie Date: Fri Jun 13 14:57:09 2025 +1000 Merge tag 'drm-misc-fixes-2025-06-12' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes drm-misc-fixes for v6.16-rc2: - Fix infinite EPROBE_DEFER loop in vc4 probing. - Fix amdxdna firmware size. - mode fixes for meson. - Kconfig fix for st7171-i2c. - Fix -EBUSY WARN_ON_ONCE in dma-buf - Use dma_sync_sgtable_for_cpu in udmabuf. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://lore.kernel.org/r/62c06195-8bc1-4dae-8777-e86d94e4d9d9@linux.intel.com commit bb666b7c27073b986b75699e51a7102910f58060 Author: Lorenzo Stoakes Date: Mon Jun 9 17:57:49 2025 +0100 mm: add mmap_prepare() compatibility layer for nested file systems Nested file systems, that is those which invoke call_mmap() within their own f_op->mmap() handlers, may encounter underlying file systems which provide the f_op->mmap_prepare() hook introduced by commit c84bf6dd2b83 ("mm: introduce new .mmap_prepare() file callback"). We have a chicken-and-egg scenario here - until all file systems are converted to using .mmap_prepare(), we cannot convert these nested handlers, as we can't call f_op->mmap from an .mmap_prepare() hook. So we have to do it the other way round - invoke the .mmap_prepare() hook from an .mmap() one. in order to do so, we need to convert VMA state into a struct vm_area_desc descriptor, invoking the underlying file system's f_op->mmap_prepare() callback passing a pointer to this, and then setting VMA state accordingly and safely. This patch achieves this via the compat_vma_mmap_prepare() function, which we invoke from call_mmap() if f_op->mmap_prepare() is specified in the passed in file pointer. We place the fundamental logic into mm/vma.h where VMA manipulation belongs. We also update the VMA userland tests to accommodate the changes. The compat_vma_mmap_prepare() function and its associated machinery is temporary, and will be removed once the conversion of file systems is complete. We carefully place this code so it can be used with CONFIG_MMU and also with cutting edge nommu silicon. [akpm@linux-foundation.org: export compat_vma_mmap_prepare tp fix build] [lorenzo.stoakes@oracle.com: remove unused declarations] Link: https://lkml.kernel.org/r/ac3ae324-4c65-432a-8c6d-2af988b18ac8@lucifer.local Link: https://lkml.kernel.org/r/20250609165749.344976-1-lorenzo.stoakes@oracle.com Fixes: c84bf6dd2b83 ("mm: introduce new .mmap_prepare() file callback"). Signed-off-by: Lorenzo Stoakes Reported-by: Jann Horn Closes: https://lore.kernel.org/linux-mm/CAG48ez04yOEVx1ekzOChARDDBZzAKwet8PEoPM4Ln3_rk91AzQ@mail.gmail.com/ Reviewed-by: Pedro Falcato Reviewed-by: Vlastimil Babka Cc: Al Viro Cc: Christian Brauner Cc: Jan Kara Cc: Jann Horn Cc: Liam Howlett Signed-off-by: Andrew Morton commit 5466491c9e3309ed5c7adbb8fad6e93fcc9a8fe9 Author: Brett Creeley Date: Mon Jun 9 14:28:27 2025 -0700 ionic: Prevent driver/fw getting out of sync on devcmd(s) Some stress/negative firmware testing around devcmd(s) returning EAGAIN found that the done bit could get out of sync in the firmware when it wasn't cleared in a retry case. While here, change the type of the local done variable to a bool to match the return type from ionic_dev_cmd_done(). Fixes: ec8ee714736e ("ionic: stretch heartbeat detection") Signed-off-by: Brett Creeley Signed-off-by: Shannon Nelson Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250609212827.53842-1-shannon.nelson@amd.com Signed-off-by: Jakub Kicinski commit a24823d14b2d35909e1299d10c34d85dfbf23434 Merge: 19272b37aa4f83 9c7632faad434c Author: Dave Airlie Date: Fri Jun 13 11:05:23 2025 +1000 Merge tag 'drm-xe-fixes-2025-06-12' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Driver Changes: - Fix regression disallowing 64K SVM migration (Maarten) - Use a bounce buffer for WA BB (Lucas) Signed-off-by: Dave Airlie From: Thomas Hellstrom Link: https://lore.kernel.org/r/aEsBQoh5Si3ouPgE@fedora commit 8b3ac9fabaa825b7bae850ee7b4580c5cba32699 Author: Benjamin Coddington Date: Mon Jun 9 13:21:56 2025 -0400 SUNRPC: Cleanup/fix initial rq_pages allocation While investigating some reports of memory-constrained NUMA machines failing to mount v3 and v4.0 nfs mounts, we found that svc_init_buffer() was not attempting to retry allocations from the bulk page allocator. Typically, this results in a single page allocation being returned and the mount attempt fails with -ENOMEM. A retry would have allowed the mount to succeed. Additionally, it seems that the bulk allocation in svc_init_buffer() is redundant because svc_alloc_arg() will perform the required allocation and does the correct thing to retry the allocations. The call to allocate memory in svc_alloc_arg() drops the preferred node argument, but I expect we'll still allocate on the preferred node because the allocation call happens within the svc thread context, which chooses the node with memory closest to the current thread's execution. This patch cleans out the bulk allocation in svc_init_buffer() to allow svc_alloc_arg() to handle the allocation/retry logic for rq_pages. Signed-off-by: Benjamin Coddington Reviewed-by: Jeff Layton Fixes: ed603bcf4fea ("sunrpc: Replace the rq_pages array with dynamically-allocated memory") Signed-off-by: Chuck Lever commit 32ce6b3a83b71d8abf0c0837dc78775f16c9902f Author: Chuck Lever Date: Sun Jun 8 18:08:51 2025 -0400 NFSD: Avoid corruption of a referring call list The new code neglects to remove a freshly-allocated RCL from the callback's referring call list when no matching referring call is found. Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202505171002.cE46sdj5-lkp@intel.com/ Fixes: 4f3c8d8c9e10 ("NFSD: Implement CB_SEQUENCE referring call lists") Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 2aa5801ada29948ce510fc8b1e3b3ec8162423e2 Author: Palmer Dabbelt Date: Tue Jun 10 14:30:58 2025 -0700 RISC-V: uaccess: Wrap the get_user_8 uaccess macro I must have lost this rebasing things during the merge window, I know I got it at some point but it's not here now. Without this I get warnings along the lines of include/linux/fs.h:3975:15: warning: label followed by a declaration is a C23 extension [-Wc23-extensions] 3975 | if (unlikely(get_user(c, path))) | ^ arch/riscv/include/asm/uaccess.h:274:3: note: expanded from macro 'get_user' 274 | __get_user((x), __p) : \ | ^ arch/riscv/include/asm/uaccess.h:244:2: note: expanded from macro '__get_user' 244 | __get_user_error(__gu_val, __gu_ptr, __gu_err); \ | ^ arch/riscv/include/asm/uaccess.h:207:2: note: expanded from macro '__get_user_error' 207 | __ge LD [M] net/802/psnap.ko t_user_nocheck(x, ptr, __gu_failed); \ | ^ arch/riscv/include/asm/uaccess.h:196:3: note: expanded from macro '__get_user_nocheck' 196 | __get_user_8((x), __gu_ptr, label); \ | ^ arch/riscv/include/asm/uaccess.h:130:2: note: expanded from macro '__get_user_8' 130 | u32 __user *__ptr = (u32 __user *)(ptr); \ | ^ Link: https://lore.kernel.org/r/20250610213058.24852-1-palmer@dabbelt.com Reviewed-by: Alexandre Ghiti Cc: stable@vger.kernel.org Fixes: f6bff7827a48 ("riscv: uaccess: use 'asm_goto_output' for get_user()") Signed-off-by: Palmer Dabbelt commit d080d3b54448501ddb0f9e1f85a8043253100f55 Merge: 27605c8c0f69e3 11fcf368506d34 Author: Linus Torvalds Date: Thu Jun 12 12:32:09 2025 -0700 Merge tag 'bitmap-for-6.16-rc2' of https://github.com/norov/linux Pull bitmap fix from Yury Norov: "Fix for __GENMASK() and __GENMASK_ULL() in UAPI" * tag 'bitmap-for-6.16-rc2' of https://github.com/norov/linux: uapi: bitops: use UAPI-safe variant of BITS_PER_LONG again commit dbe0038b65ff4b8c13b862f24c0381e0d9196e5f Merge: 5c5ecd1f3413cc bc75552b80e668 Author: Palmer Dabbelt Date: Thu Jun 12 12:20:46 2025 -0700 Merge patch "Fix a segmentation fault also add raid6test for RISC-V support" This is a fix in the middle of a feature set, so I'm going to take the fix onto fixes on its own. * b4-shazam-merge: raid6: riscv: Fix NULL pointer dereference issue Link: https://lore.kernel.org/r/20250610101234.1100660-1-zhangchunyan@iscas.ac.cn Signed-off-by: Palmer Dabbelt commit bc75552b80e6683b2def5a0459433607ea4788f5 Author: Chunyan Zhang Date: Tue Jun 10 18:12:32 2025 +0800 raid6: riscv: Fix NULL pointer dereference caused by a missing clobber When running the raid6 user-space test program on RISC-V QEMU, there's a segmentation fault which seems caused by accessing a NULL pointer, which is the pointer variable p/q in raid6_rvv*_gen/xor_syndrome_real(), p/q should have been equal to dptr[x], but when I use GDB command to see its value, which was 0x10 like below: " Program received signal SIGSEGV, Segmentation fault. 0x0000000000011062 in raid6_rvv2_xor_syndrome_real (disks=, start=0, stop=, bytes=4096, ptrs=) at rvv.c:386 (gdb) p p $1 = (u8 *) 0x10 " The issue was found to be related with: 1) Compile optimization There's no segmentation fault if compiling the raid6test program with the optimization flag -O0. 2) The RISC-V vector command vsetvli If not used t0 as the first parameter in vsetvli, there's no segmentation fault either. This patch selects the 2nd solution to fix the issue. [Palmer: The actual issue here is a missing clobber in the vsetvli code. It's a little tricky: we've already probed for VLENB so we don't need to look at the output register, we just need to have an X register in the instruction as that's the form required to actually set VL. Thus we clobber a register, and without describing that we end up breaking compilers.] Fixes: 6093faaf9593 ("raid6: Add RISC-V SIMD syndrome and recovery calculations") Signed-off-by: Chunyan Zhang Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250610101234.1100660-3-zhangchunyan@iscas.ac.cn Signed-off-by: Palmer Dabbelt commit 5c5ecd1f3413cce5474a16255f4212680d3ca5d5 Merge: 8d90d9872edae7 2b9518684f8558 Author: Palmer Dabbelt Date: Thu Jun 12 11:59:05 2025 -0700 Merge tag 'riscv-fixes-6.16-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/alexghiti/linux into fixes riscv fixes for 6.16-rc1 - A fix for the newly introduced getrandom vdso where clang optimizes away a register variable which is both an input and an output parameter - A fix for theadvector where we did not save all the vector registers, only a few of them * tag 'riscv-fixes-6.16-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/alexghiti/linux: RISC-V: vDSO: Correct inline assembly constraints in the getrandom syscall wrapper riscv: vector: Fix context save/restore with xtheadvector commit 2b9518684f8558cd61a7c608cc03a27822cf7b03 Author: Xi Ruoyao Date: Fri Jun 6 17:24:44 2025 +0800 RISC-V: vDSO: Correct inline assembly constraints in the getrandom syscall wrapper As recently pointed out by Thomas, if a register is forced for two different register variables, among them one is used as "+" (both input and output) and another is only used as input, Clang would treat the conflicting input parameters as undefined behaviour and optimize away the argument assignment. Instead use "=r" (only output) for the output parameter and "r" (only input) for the input parameter. While the example from the GCC documentation uses "0" for the input parameter, this is not necessary as confirmed by the GCC developers and "r" matches what the other architectures' vDSO implementations are using. [ alex: Update log to match v2 (Thomas) ] Link: https://lore.kernel.org/all/20250603-loongarch-vdso-syscall-v1-1-6d12d6dfbdd0@linutronix.de/ Link: https://gcc.gnu.org/onlinedocs/gcc-15.1.0/gcc/Local-Register-Variables.html Link: https://gcc.gnu.org/pipermail/gcc-help/2025-June/144266.html Cc: Thomas Weißschuh Cc: Nathan Chancellor Signed-off-by: Xi Ruoyao Reviewed-by: Thomas Weißschuh Fixes: ee0d03053e70 ("RISC-V: vDSO: Wire up getrandom() vDSO") Link: https://lore.kernel.org/r/20250606092443.73650-2-xry111@xry111.site Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit 4262bd0d9cc704ea1365ac00afc1272400c2cbef Author: Han Gao Date: Fri May 23 18:25:56 2025 +0800 riscv: vector: Fix context save/restore with xtheadvector Previously only v0-v7 were correctly saved/restored, and the context of v8-v31 are damanged. Correctly save/restore v8-v31 to avoid breaking userspace. Fixes: d863910eabaf ("riscv: vector: Support xtheadvector save/restore") Cc: stable@vger.kernel.org Signed-off-by: Han Gao Tested-by: Xiongchuan Tan Reviewed-by: Charlie Jenkins Reviewed-by: Yanteng Si Reviewed-by: Andy Chiu Link: https://lore.kernel.org/r/9b9eb2337f3d5336ce813721f8ebea51e0b2b553.1747994822.git.rabenda.cn@gmail.com Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit 72dd7961a4bb4fa1fc456169a61dd12e68e50645 Author: Bharath SM Date: Wed Jun 11 16:59:02 2025 +0530 smb: improve directory cache reuse for readdir operations Currently, cached directory contents were not reused across subsequent 'ls' operations because the cache validity check relied on comparing the ctx pointer, which changes with each readdir invocation. As a result, the cached dir entries was not marked as valid and the cache was not utilized for subsequent 'ls' operations. This change uses the file pointer, which remains consistent across all readdir calls for a given directory instance, to associate and validate the cache. As a result, cached directory contents can now be correctly reused, improving performance for repeated directory listings. Performance gains with local windows SMB server: Without the patch and default actimeo=1: 1000 directory enumeration operations on dir with 10k files took 135.0s With this patch and actimeo=0: 1000 directory enumeration operations on dir with 10k files took just 5.1s Signed-off-by: Bharath SM Reviewed-by: Shyam Prasad N Cc: stable@vger.kernel.org Signed-off-by: Steve French commit b64af6bcd3b0f3fc633d6a70adb0991737abfef4 Author: Paulo Alcantara Date: Thu Jun 12 12:45:04 2025 -0300 smb: client: fix perf regression with deferred closes Customer reported that one of their applications started failing to open files with STATUS_INSUFFICIENT_RESOURCES due to NetApp server hitting the maximum number of opens to same file that it would allow for a single client connection. It turned out the client was failing to reuse open handles with deferred closes because matching ->f_flags directly without masking off O_CREAT|O_EXCL|O_TRUNC bits first broke the comparision and then client ended up with thousands of deferred closes to same file. Those bits are already satisfied on the original open, so no need to check them against existing open handles. Reproducer: #include #include #include #include #include #include #define NR_THREADS 4 #define NR_ITERATIONS 2500 #define TEST_FILE "/mnt/1/test/dir/foo" static char buf[64]; static void *worker(void *arg) { int i, j; int fd; for (i = 0; i < NR_ITERATIONS; i++) { fd = open(TEST_FILE, O_WRONLY|O_CREAT|O_APPEND, 0666); for (j = 0; j < 16; j++) write(fd, buf, sizeof(buf)); close(fd); } } int main(int argc, char *argv[]) { pthread_t t[NR_THREADS]; int fd; int i; fd = open(TEST_FILE, O_WRONLY|O_CREAT|O_TRUNC, 0666); close(fd); memset(buf, 'a', sizeof(buf)); for (i = 0; i < NR_THREADS; i++) pthread_create(&t[i], NULL, worker, NULL); for (i = 0; i < NR_THREADS; i++) pthread_join(t[i], NULL); return 0; } Before patch: $ mount.cifs //srv/share /mnt/1 -o ... $ mkdir -p /mnt/1/test/dir $ gcc repro.c && ./a.out ... number of opens: 1391 After patch: $ mount.cifs //srv/share /mnt/1 -o ... $ mkdir -p /mnt/1/test/dir $ gcc repro.c && ./a.out ... number of opens: 1 Cc: linux-cifs@vger.kernel.org Cc: David Howells Cc: Jay Shin Cc: Pierguido Lambri Fixes: b8ea3b1ff544 ("smb: enable reuse of deferred file handles for write operations") Acked-by: Shyam Prasad N Signed-off-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French commit 27605c8c0f69e319df156b471974e4e223035378 Merge: 9cc7d5904bab74 d5705afbaca2f5 Author: Linus Torvalds Date: Thu Jun 12 09:50:36 2025 -0700 Merge tag 'net-6.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from bluetooth and wireless. Current release - regressions: - af_unix: allow passing cred for embryo without SO_PASSCRED/SO_PASSPIDFD Current release - new code bugs: - eth: airoha: correct enable mask for RX queues 16-31 - veth: prevent NULL pointer dereference in veth_xdp_rcv when peer disappears under traffic - ipv6: move fib6_config_validate() to ip6_route_add(), prevent invalid routes Previous releases - regressions: - phy: phy_caps: don't skip better duplex match on non-exact match - dsa: b53: fix untagged traffic sent via cpu tagged with VID 0 - Revert "wifi: mwifiex: Fix HT40 bandwidth issue.", it caused transient packet loss, exact reason not fully understood, yet Previous releases - always broken: - net: clear the dst when BPF is changing skb protocol (IPv4 <> IPv6) - sched: sfq: fix a potential crash on gso_skb handling - Bluetooth: intel: improve rx buffer posting to avoid causing issues in the firmware - eth: intel: i40e: make reset handling robust against multiple requests - eth: mlx5: ensure FW pages are always allocated on the local NUMA node, even when device is configure to 'serve' another node - wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850, prevent kernel crashes - wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request() for 3 sec if fw_stats_done is not set" * tag 'net-6.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (70 commits) selftests: drv-net: rss_ctx: Add test for ntuple rules targeting default RSS context net: ethtool: Don't check if RSS context exists in case of context 0 af_unix: Allow passing cred for embryo without SO_PASSCRED/SO_PASSPIDFD. ipv6: Move fib6_config_validate() to ip6_route_add(). net: drv: netdevsim: don't napi_complete() from netpoll net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() veth: prevent NULL pointer dereference in veth_xdp_rcv net_sched: remove qdisc_tree_flush_backlog() net_sched: ets: fix a race in ets_qdisc_change() net_sched: tbf: fix a race in tbf_change() net_sched: red: fix a race in __red_change() net_sched: prio: fix a race in prio_tune() net_sched: sch_sfq: reject invalid perturb period net: phy: phy_caps: Don't skip better duplex macth on non-exact match MAINTAINERS: Update Kuniyuki Iwashima's email address. selftests: net: add test case for NAT46 looping back dst net: clear the dst when changing skb protocol net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper net/mlx5e: Fix leak of Geneve TLV option object net/mlx5: HWS, make sure the uplink is the last destination ... commit 39dfc971e42d886e7df01371cd1bef505076d84c Author: Tengda Wu Date: Wed Jun 4 00:55:33 2025 +0000 arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() KASAN reports a stack-out-of-bounds read in regs_get_kernel_stack_nth(). Call Trace: [ 97.283505] BUG: KASAN: stack-out-of-bounds in regs_get_kernel_stack_nth+0xa8/0xc8 [ 97.284677] Read of size 8 at addr ffff800089277c10 by task 1.sh/2550 [ 97.285732] [ 97.286067] CPU: 7 PID: 2550 Comm: 1.sh Not tainted 6.6.0+ #11 [ 97.287032] Hardware name: linux,dummy-virt (DT) [ 97.287815] Call trace: [ 97.288279] dump_backtrace+0xa0/0x128 [ 97.288946] show_stack+0x20/0x38 [ 97.289551] dump_stack_lvl+0x78/0xc8 [ 97.290203] print_address_description.constprop.0+0x84/0x3c8 [ 97.291159] print_report+0xb0/0x280 [ 97.291792] kasan_report+0x84/0xd0 [ 97.292421] __asan_load8+0x9c/0xc0 [ 97.293042] regs_get_kernel_stack_nth+0xa8/0xc8 [ 97.293835] process_fetch_insn+0x770/0xa30 [ 97.294562] kprobe_trace_func+0x254/0x3b0 [ 97.295271] kprobe_dispatcher+0x98/0xe0 [ 97.295955] kprobe_breakpoint_handler+0x1b0/0x210 [ 97.296774] call_break_hook+0xc4/0x100 [ 97.297451] brk_handler+0x24/0x78 [ 97.298073] do_debug_exception+0xac/0x178 [ 97.298785] el1_dbg+0x70/0x90 [ 97.299344] el1h_64_sync_handler+0xcc/0xe8 [ 97.300066] el1h_64_sync+0x78/0x80 [ 97.300699] kernel_clone+0x0/0x500 [ 97.301331] __arm64_sys_clone+0x70/0x90 [ 97.302084] invoke_syscall+0x68/0x198 [ 97.302746] el0_svc_common.constprop.0+0x11c/0x150 [ 97.303569] do_el0_svc+0x38/0x50 [ 97.304164] el0_svc+0x44/0x1d8 [ 97.304749] el0t_64_sync_handler+0x100/0x130 [ 97.305500] el0t_64_sync+0x188/0x190 [ 97.306151] [ 97.306475] The buggy address belongs to stack of task 1.sh/2550 [ 97.307461] and is located at offset 0 in frame: [ 97.308257] __se_sys_clone+0x0/0x138 [ 97.308910] [ 97.309241] This frame has 1 object: [ 97.309873] [48, 184) 'args' [ 97.309876] [ 97.310749] The buggy address belongs to the virtual mapping at [ 97.310749] [ffff800089270000, ffff800089279000) created by: [ 97.310749] dup_task_struct+0xc0/0x2e8 [ 97.313347] [ 97.313674] The buggy address belongs to the physical page: [ 97.314604] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14f69a [ 97.315885] flags: 0x15ffffe00000000(node=1|zone=2|lastcpupid=0xfffff) [ 97.316957] raw: 015ffffe00000000 0000000000000000 dead000000000122 0000000000000000 [ 97.318207] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 97.319445] page dumped because: kasan: bad access detected [ 97.320371] [ 97.320694] Memory state around the buggy address: [ 97.321511] ffff800089277b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 97.322681] ffff800089277b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 97.323846] >ffff800089277c00: 00 00 f1 f1 f1 f1 f1 f1 00 00 00 00 00 00 00 00 [ 97.325023] ^ [ 97.325683] ffff800089277c80: 00 00 00 00 00 00 00 00 00 f3 f3 f3 f3 f3 f3 f3 [ 97.326856] ffff800089277d00: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 This issue seems to be related to the behavior of some gcc compilers and was also fixed on the s390 architecture before: commit d93a855c31b7 ("s390/ptrace: Avoid KASAN false positives in regs_get_kernel_stack_nth()") As described in that commit, regs_get_kernel_stack_nth() has confirmed that `addr` is on the stack, so reading the value at `*addr` should be allowed. Use READ_ONCE_NOCHECK() helper to silence the KASAN check for this case. Fixes: 0a8ea52c3eb1 ("arm64: Add HAVE_REGS_AND_STACK_ACCESS_API feature") Signed-off-by: Tengda Wu Link: https://lore.kernel.org/r/20250604005533.1278992-1-wutengda@huaweicloud.com [will: Use '*addr' as the argument to READ_ONCE_NOCHECK()] Signed-off-by: Will Deacon commit d2be3270f40b1330f8c1c9512c59dd085a758ac0 Author: Mark Brown Date: Wed Jun 11 17:28:13 2025 +0100 arm64/gcs: Don't call gcs_free() during flush_gcs() Currently we call gcs_free() during flush_gcs() to reset the thread state for GCS. This includes unmapping any kernel allocated GCS, but this is redundant when doing a flush_thread() since we are reinitialising the thread memory too. Inline the reinitialisation of the thread struct. Signed-off-by: Mark Brown Reviewed-by: Catalin Marinas Link: https://lore.kernel.org/r/20250611-arm64-gcs-flush-thread-v1-1-cc26feeddabd@kernel.org Signed-off-by: Will Deacon commit 9c7632faad434c98f1f2cc06f3647a5a5d05ddbf Author: Lucas De Marchi Date: Wed Jun 4 08:03:05 2025 -0700 drm/xe/lrc: Use a temporary buffer for WA BB In case the BO is in iomem, we can't simply take the vaddr and write to it. Instead, prepare a separate buffer that is later copied into io memory. Right now it's just a few words that could be using xe_map_write32(), but the intention is to grow the WA BB for other uses. Fixes: 617d824c5323 ("drm/xe: Add WA BB to capture active context utilization") Cc: Umesh Nerlige Ramappa Cc: Tvrtko Ursulin Reviewed-by: Matthew Brost Reviewed-by: Umesh Nerlige Ramappa Link: https://lore.kernel.org/r/20250604-wa-bb-fix-v1-1-0dfc5dafcef0@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit ef48715b2d3df17c060e23b9aa636af3d95652f8) Signed-off-by: Thomas Hellström commit 9cc7d5904bab74f54aad4948a04535c1f07c74d8 Merge: 3d853391c44196 5558f27a58459a Author: Linus Torvalds Date: Thu Jun 12 08:21:13 2025 -0700 Merge tag 'pinctrl-v6.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: - Add some missing pins on the Qualcomm QCM2290, along with a managed resources patch that make it clean and nice - Drop an unused function in the ST Micro driver - Drop bouncing MAINTAINER entry - Drop of_match_ptr() macro to rid compile warnings in the TB10x driver - Fix up calculation of pin numbers from base in the Sunxi driver * tag 'pinctrl-v6.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: sunxi: dt: Consider pin base when calculating bank number from pin pinctrl: tb10x: Drop of_match_ptr for ID table pinctrl: MAINTAINERS: Drop bouncing Jianlong Huang pinctrl: st: Drop unused st_gpio_bank() function pinctrl: qcom: pinctrl-qcm2290: Add missing pins pinctrl: qcom: switch to devm_gpiochip_add_data() commit 3d853391c441965d30cc94d00d59e8bb2dd0668c Merge: 2c4a1f3fe03eda 179e949719fe81 Author: Linus Torvalds Date: Thu Jun 12 08:17:56 2025 -0700 Merge tag 'arc-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc Pull ARC fixes from Vineet Gupta: - arch_atomic64_cmpxchg relaxed variant [Jason] - use of inbuilt swap in stack unwinder [Yu-Chun Lin] - use of __ASSEMBLER__ in kernel headers [Thomas Huth] * tag 'arc-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc: ARC: Replace __ASSEMBLY__ with __ASSEMBLER__ in the non-uapi headers ARC: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers ARC: unwind: Use built-in sort swap to reduce code size and improve performance ARC: atomics: Implement arch_atomic64_cmpxchg using _relaxed commit d5705afbaca2f5b3fb8766391ca6c43105d229b2 Merge: 613fd52ea75d70 f87586598fffac Author: Jakub Kicinski Date: Thu Jun 12 08:16:47 2025 -0700 Merge tag 'wireless-2025-06-12' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Another quick round of updates: - revert mwifiex HT40 that was causing issues - many ath10k/ath11k/ath12k fixes - re-add some iwlwifi code I lost in a merge - use kfree_sensitive() on an error path in cfg80211 * tag 'wireless-2025-06-12' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: cfg80211: use kfree_sensitive() for connkeys cleanup wifi: iwlwifi: fix merge damage related to iwl_pci_resume Revert "wifi: mwifiex: Fix HT40 bandwidth issue." wifi: ath12k: fix uaf in ath12k_core_init() wifi: ath12k: Fix hal_reo_cmd_status kernel-doc wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready wifi: ath11k: consistently use ath11k_mac_get_fw_stats() wifi: ath11k: move locking outside of ath11k_mac_get_fw_stats() wifi: ath11k: adjust unlock sequence in ath11k_update_stats_event() wifi: ath11k: move some firmware stats related functions outside of debugfs wifi: ath11k: don't wait when there is no vdev started wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process() wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request() wil6210: fix support for sparrow chipsets wifi: ath10k: Avoid vdev delete timeout when firmware is already down ath10k: snoc: fix unbalanced IRQ enable in crash recovery ==================== Link: https://patch.msgid.link/20250612082519.11447-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 613fd52ea75d70275fa67de0af5af2b5d65bed16 Merge: d5441acae780c3 56c5d291e88538 Author: Jakub Kicinski Date: Thu Jun 12 08:15:37 2025 -0700 Merge branch 'fix-ntuple-rules-targeting-default-rss' Gal Pressman says: ==================== Fix ntuple rules targeting default RSS This series addresses a regression in ethtool flow steering where rules targeting the default RSS context (context 0) were incorrectly rejected. The default RSS context always exists but is not stored in the rss_ctx xarray like additional contexts. The current validation logic was checking for the existence of context 0 in this array, causing valid flow steering rules to be rejected. This prevented configurations such as: - High priority rules directing specific traffic to the default context - Low priority catch-all rules directing remaining traffic to additional contexts Patch 1 fixes the validation logic to skip the existence check for context 0. Patch 2 adds a selftest that verifies this behavior. v3: https://lore.kernel.org/20250609120250.1630125-1-gal@nvidia.com v2: https://lore.kernel.org/20250225071348.509432-1-gal@nvidia.com ==================== Link: https://patch.msgid.link/20250612071958.1696361-1-gal@nvidia.com Signed-off-by: Jakub Kicinski commit 56c5d291e88538621029e5c7c5f60540d37846a8 Author: Gal Pressman Date: Thu Jun 12 10:19:58 2025 +0300 selftests: drv-net: rss_ctx: Add test for ntuple rules targeting default RSS context Add test_rss_default_context_rule() to verify that ntuple rules can correctly direct traffic to the default RSS context (context 0). The test creates two ntuple rules with explicit location priorities: - A high-priority rule (loc 0) directing specific port traffic to context 0. - A low-priority rule (loc 1) directing all other TCP traffic to context 1. This validates that: 1. Rules targeting the default context function properly. 2. Traffic steering works as expected when mixing default and additional RSS contexts. The test was written by AI, and reviewed by humans. Reviewed-by: Nimrod Oren Signed-off-by: Gal Pressman Link: https://patch.msgid.link/20250612071958.1696361-3-gal@nvidia.com Signed-off-by: Jakub Kicinski commit d78ebc772c7ceccf6e655ddb93099f49a1268af4 Author: Gal Pressman Date: Thu Jun 12 10:19:57 2025 +0300 net: ethtool: Don't check if RSS context exists in case of context 0 Context 0 (default context) always exists, there is no need to check whether it exists or not when adding a flow steering rule. The existing check fails when creating a flow steering rule for context 0 as it is not stored in the rss_ctx xarray. For example: $ ethtool --config-ntuple eth2 flow-type tcp4 dst-ip 194.237.147.23 dst-port 19983 context 0 loc 618 rmgr: Cannot insert RX class rule: Invalid argument Cannot insert classification rule An example usecase for this could be: - A high-priority rule (loc 0) directing specific port traffic to context 0. - A low-priority rule (loc 1) directing all other TCP traffic to context 1. This is a user-visible regression that was caught in our testing environment, it was not reported by a user yet. Fixes: de7f7582dff2 ("net: ethtool: prevent flow steering to RSS contexts which don't exist") Reviewed-by: Tariq Toukan Reviewed-by: Nimrod Oren Signed-off-by: Gal Pressman Reviewed-by: Joe Damato Reviewed-by: Edward Cree Link: https://patch.msgid.link/20250612071958.1696361-2-gal@nvidia.com Signed-off-by: Jakub Kicinski commit d5441acae780c346c04213a62d3eb189216daab1 Merge: 43fb2b30eea7cf 7dd38ba4acbea9 Author: Jakub Kicinski Date: Thu Jun 12 08:13:47 2025 -0700 Merge tag 'for-net-2025-06-11' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - eir: Fix NULL pointer deference on eir_get_service_data - eir: Fix possible crashes on eir_create_adv_data - hci_sync: Fix broadcast/PA when using an existing instance - ISO: Fix using BT_SK_PA_SYNC to detect BIS sockets - ISO: Fix not using bc_sid as advertisement SID - MGMT: Fix sparse errors * tag 'for-net-2025-06-11' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: MGMT: Fix sparse errors Bluetooth: ISO: Fix not using bc_sid as advertisement SID Bluetooth: ISO: Fix using BT_SK_PA_SYNC to detect BIS sockets Bluetooth: eir: Fix possible crashes on eir_create_adv_data Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance Bluetooth: Fix NULL pointer deference on eir_get_service_data ==================== Link: https://patch.msgid.link/20250611204944.1559356-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit 43fb2b30eea7cfc40214484935b026ec29838a91 Author: Kuniyuki Iwashima Date: Wed Jun 11 13:27:35 2025 -0700 af_unix: Allow passing cred for embryo without SO_PASSCRED/SO_PASSPIDFD. Before the cited commit, the kernel unconditionally embedded SCM credentials to skb for embryo sockets even when both the sender and listener disabled SO_PASSCRED and SO_PASSPIDFD. Now, the credentials are added to skb only when configured by the sender or the listener. However, as reported in the link below, it caused a regression for some programs that assume credentials are included in every skb, but sometimes not now. The only problematic scenario would be that a socket starts listening before setting the option. Then, there will be 2 types of non-small race window, where a client can send skb without credentials, which the peer receives as an "invalid" message (and aborts the connection it seems ?): Client Server ------ ------ s1.listen() <-- No SO_PASS{CRED,PIDFD} s2.connect() s2.send() <-- w/o cred s1.setsockopt(SO_PASS{CRED,PIDFD}) s2.send() <-- w/ cred or Client Server ------ ------ s1.listen() <-- No SO_PASS{CRED,PIDFD} s2.connect() s2.send() <-- w/o cred s3, _ = s1.accept() <-- Inherit cred options s2.send() <-- w/o cred but not set yet s3.setsockopt(SO_PASS{CRED,PIDFD}) s2.send() <-- w/ cred It's unfortunate that buggy programs depend on the behaviour, but let's restore the previous behaviour. Fixes: 3f84d577b79d ("af_unix: Inherit sk_flags at connect().") Reported-by: Jacek Łuczak Closes: https://lore.kernel.org/all/68d38b0b-1666-4974-85d4-15575789c8d4@gmail.com/ Signed-off-by: Kuniyuki Iwashima Tested-by: Christian Heusel Tested-by: André Almeida Tested-by: Jacek Łuczak Link: https://patch.msgid.link/20250611202758.3075858-1-kuni1840@gmail.com Signed-off-by: Jakub Kicinski commit b3979e3d2fc92bf1a2da614fc383b75b9859ef58 Author: Kuniyuki Iwashima Date: Wed Jun 11 12:35:02 2025 -0700 ipv6: Move fib6_config_validate() to ip6_route_add(). syzkaller created an IPv6 route from a malformed packet, which has a prefix len > 128, triggering the splat below. [0] This is a similar issue fixed by commit 586ceac9acb7 ("ipv6: Restore fib6_config validation for SIOCADDRT."). The cited commit removed fib6_config validation from some callers of ip6_add_route(). Let's move the validation back to ip6_route_add() and ip6_route_multipath_add(). [0]: UBSAN: array-index-out-of-bounds in ./include/net/ipv6.h:616:34 index 20 is out of range for type '__u8 [16]' CPU: 1 UID: 0 PID: 7444 Comm: syz.0.708 Not tainted 6.16.0-rc1-syzkaller-g19272b37aa4f #0 PREEMPT Hardware name: riscv-virtio,qemu (DT) Call Trace: [] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:132 [] show_stack+0x30/0x3c arch/riscv/kernel/stacktrace.c:138 [] __dump_stack lib/dump_stack.c:94 [inline] [] dump_stack_lvl+0x12e/0x1a6 lib/dump_stack.c:120 [] dump_stack+0x1c/0x24 lib/dump_stack.c:129 [] ubsan_epilogue+0x14/0x46 lib/ubsan.c:233 [] __ubsan_handle_out_of_bounds+0xf6/0xf8 lib/ubsan.c:455 [] ipv6_addr_prefix include/net/ipv6.h:616 [inline] [] ip6_route_info_create+0x8f8/0x96e net/ipv6/route.c:3793 [] ip6_route_add+0x2a/0x1aa net/ipv6/route.c:3889 [] addrconf_prefix_route+0x2c4/0x4e8 net/ipv6/addrconf.c:2487 [] addrconf_prefix_rcv+0x1720/0x1e62 net/ipv6/addrconf.c:2878 [] ndisc_router_discovery+0x1a06/0x3504 net/ipv6/ndisc.c:1570 [] ndisc_rcv+0x500/0x600 net/ipv6/ndisc.c:1874 [] icmpv6_rcv+0x145e/0x1e0a net/ipv6/icmp.c:988 [] ip6_protocol_deliver_rcu+0x18a/0x1976 net/ipv6/ip6_input.c:436 [] ip6_input_finish+0xf4/0x174 net/ipv6/ip6_input.c:480 [] NF_HOOK include/linux/netfilter.h:317 [inline] [] NF_HOOK include/linux/netfilter.h:311 [inline] [] ip6_input+0x16a/0x70c net/ipv6/ip6_input.c:491 [] ip6_mc_input+0x5c8/0x1268 net/ipv6/ip6_input.c:588 [] dst_input include/net/dst.h:469 [inline] [] ip6_rcv_finish net/ipv6/ip6_input.c:79 [inline] [] NF_HOOK include/linux/netfilter.h:317 [inline] [] NF_HOOK include/linux/netfilter.h:311 [inline] [] ipv6_rcv+0x5ae/0x6e0 net/ipv6/ip6_input.c:309 [] __netif_receive_skb_one_core+0x106/0x16e net/core/dev.c:5977 [] __netif_receive_skb+0x2c/0x144 net/core/dev.c:6090 [] netif_receive_skb_internal net/core/dev.c:6176 [inline] [] netif_receive_skb+0x1aa/0xbf2 net/core/dev.c:6235 [] tun_rx_batched.isra.0+0x430/0x686 drivers/net/tun.c:1485 [] tun_get_user+0x2952/0x3d6c drivers/net/tun.c:1938 [] tun_chr_write_iter+0xc4/0x21c drivers/net/tun.c:1984 [] new_sync_write fs/read_write.c:593 [inline] [] vfs_write+0x56c/0xa9a fs/read_write.c:686 [] ksys_write+0x126/0x228 fs/read_write.c:738 [] __do_sys_write fs/read_write.c:749 [inline] [] __se_sys_write fs/read_write.c:746 [inline] [] __riscv_sys_write+0x6e/0x94 fs/read_write.c:746 [] syscall_handler+0x94/0x118 arch/riscv/include/asm/syscall.h:112 [] do_trap_ecall_u+0x396/0x530 arch/riscv/kernel/traps.c:341 [] handle_exception+0x146/0x152 arch/riscv/kernel/entry.S:197 Fixes: fa76c1674f2e ("ipv6: Move some validation from ip6_route_info_create() to rtm_to_fib6_config().") Reported-by: syzbot+4c2358694722d304c44e@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6849b8c3.a00a0220.1eb5f5.00f0.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250611193551.2999991-1-kuni1840@gmail.com Signed-off-by: Jakub Kicinski commit 1264971017b4d7141352a7fe29021bdfce5d885d Author: Jakub Kicinski Date: Wed Jun 11 10:46:43 2025 -0700 net: drv: netdevsim: don't napi_complete() from netpoll netdevsim supports netpoll. Make sure we don't call napi_complete() from it, since it may not be scheduled. Breno reports hitting a warning in napi_complete_done(): WARNING: CPU: 14 PID: 104 at net/core/dev.c:6592 napi_complete_done+0x2cc/0x560 __napi_poll+0x2d8/0x3a0 handle_softirqs+0x1fe/0x710 This is presumably after netpoll stole the SCHED bit prematurely. Reported-by: Breno Leitao Fixes: 3762ec05a9fb ("netdevsim: add NAPI support") Tested-by: Breno Leitao Link: https://patch.msgid.link/20250611174643.2769263-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 1619bdf4389c829f16af5c7d5b4fa5f1673614d7 Author: Dan Carpenter Date: Wed Jun 11 16:14:32 2025 +0300 net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() Check for if ida_alloc() or rhashtable_lookup_get_insert_fast() fails. Fixes: 17e0accac577 ("net/mlx5: HWS, support complex matchers") Signed-off-by: Dan Carpenter Reviewed-by: Yevgeny Kliteynik Link: https://patch.msgid.link/aEmBONjyiF6z5yCV@stanley.mountain Signed-off-by: Jakub Kicinski commit 9337c54401a5bb6ac3c9f6c71dd2a9130cfba82e Author: Jesper Dangaard Brouer Date: Wed Jun 11 14:40:04 2025 +0200 veth: prevent NULL pointer dereference in veth_xdp_rcv The veth peer device is RCU protected, but when the peer device gets deleted (veth_dellink) then the pointer is assigned NULL (via RCU_INIT_POINTER). This patch adds a necessary NULL check in veth_xdp_rcv when accessing the veth peer net_device. This fixes a bug introduced in commit dc82a33297fc ("veth: apply qdisc backpressure on full ptr_ring to reduce TX drops"). The bug is a race and only triggers when having inflight packets on a veth that is being deleted. Reported-by: Ihor Solodrai Closes: https://lore.kernel.org/all/fecfcad0-7a16-42b8-bff2-66ee83a6e5c4@linux.dev/ Reported-by: syzbot+c4c7bf27f6b0c4bd97fe@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/683da55e.a00a0220.d8eae.0052.GAE@google.com/ Fixes: dc82a33297fc ("veth: apply qdisc backpressure on full ptr_ring to reduce TX drops") Signed-off-by: Jesper Dangaard Brouer Acked-by: Ihor Solodrai Link: https://patch.msgid.link/174964557873.519608.10855046105237280978.stgit@firesoul Signed-off-by: Jakub Kicinski commit a844b0c864a28e43affa3f1a048414b7122def40 Merge: 7ca52541c05c83 adcaa890c7a4a9 Author: Jakub Kicinski Date: Thu Jun 12 08:05:53 2025 -0700 Merge branch 'net_sched-no-longer-use-qdisc_tree_flush_backlog' Eric Dumazet says: ==================== net_sched: no longer use qdisc_tree_flush_backlog() This series is based on a report from Gerrard Tai. Essentially, all users of qdisc_tree_flush_backlog() are racy. We must instead use qdisc_purge_queue(). ==================== Link: https://patch.msgid.link/20250611111515.1983366-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit adcaa890c7a4a91a422168d8fb629183fff07b2f Author: Eric Dumazet Date: Wed Jun 11 11:15:15 2025 +0000 net_sched: remove qdisc_tree_flush_backlog() This function is no longer used after the four prior fixes. Given all prior uses were wrong, it seems better to remove it. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250611111515.1983366-6-edumazet@google.com Signed-off-by: Jakub Kicinski commit d92adacdd8c2960be856e0b82acc5b7c5395fddb Author: Eric Dumazet Date: Wed Jun 11 11:15:14 2025 +0000 net_sched: ets: fix a race in ets_qdisc_change() Gerrard Tai reported a race condition in ETS, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: lock root [2]: qdisc_tree_flush_backlog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() | [4]: qdisc_put() This can be abused to underflow a parent's qlen. Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock. Fixes: b05972f01e7d ("net: sched: tbf: don't call qdisc_put() while holding tree lock") Reported-by: Gerrard Tai Suggested-by: Gerrard Tai Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250611111515.1983366-5-edumazet@google.com Signed-off-by: Jakub Kicinski commit 43eb466041216d25dedaef1c383ad7bd89929cbc Author: Eric Dumazet Date: Wed Jun 11 11:15:13 2025 +0000 net_sched: tbf: fix a race in tbf_change() Gerrard Tai reported a race condition in TBF, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: lock root [2]: qdisc_tree_flush_backlog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() | [4]: qdisc_put() This can be abused to underflow a parent's qlen. Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock. Fixes: b05972f01e7d ("net: sched: tbf: don't call qdisc_put() while holding tree lock") Reported-by: Gerrard Tai Suggested-by: Gerrard Tai Signed-off-by: Eric Dumazet Cc: Zhengchao Shao Link: https://patch.msgid.link/20250611111515.1983366-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit 85a3e0ede38450ea3053b8c45d28cf55208409b8 Author: Eric Dumazet Date: Wed Jun 11 11:15:12 2025 +0000 net_sched: red: fix a race in __red_change() Gerrard Tai reported a race condition in RED, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: lock root [2]: qdisc_tree_flush_backlog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() | [4]: qdisc_put() This can be abused to underflow a parent's qlen. Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock. Fixes: 0c8d13ac9607 ("net: sched: red: delay destroying child qdisc on replace") Reported-by: Gerrard Tai Suggested-by: Gerrard Tai Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250611111515.1983366-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit d35acc1be3480505b5931f17e4ea9b7617fea4d3 Author: Eric Dumazet Date: Wed Jun 11 11:15:11 2025 +0000 net_sched: prio: fix a race in prio_tune() Gerrard Tai reported a race condition in PRIO, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: lock root [2]: qdisc_tree_flush_backlog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() | [4]: qdisc_put() This can be abused to underflow a parent's qlen. Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock. Fixes: 7b8e0b6e6599 ("net: sched: prio: delay destroying child qdiscs on change") Reported-by: Gerrard Tai Suggested-by: Gerrard Tai Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250611111515.1983366-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit 7ca52541c05c832d32b112274f81a985101f9ba8 Author: Eric Dumazet Date: Wed Jun 11 08:35:01 2025 +0000 net_sched: sch_sfq: reject invalid perturb period Gerrard Tai reported that SFQ perturb_period has no range check yet, and this can be used to trigger a race condition fixed in a separate patch. We want to make sure ctl->perturb_period * HZ will not overflow and is positive. Tested: tc qd add dev lo root sfq perturb -10 # negative value : error Error: sch_sfq: invalid perturb period. tc qd add dev lo root sfq perturb 1000000000 # too big : error Error: sch_sfq: invalid perturb period. tc qd add dev lo root sfq perturb 2000000 # acceptable value tc -s -d qd sh dev lo qdisc sfq 8005: root refcnt 2 limit 127p quantum 64Kb depth 127 flows 128 divisor 1024 perturb 2000000sec Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) backlog 0b 0p requeues 0 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Gerrard Tai Signed-off-by: Eric Dumazet Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250611083501.1810459-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit d4e6cb324dcc952618fec6b25aa3fc7bfc2750b4 Author: Maxime Chevallier Date: Fri Jun 6 11:43:20 2025 +0200 net: phy: phy_caps: Don't skip better duplex macth on non-exact match When performing a non-exact phy_caps lookup, we are looking for a supported mode that matches as closely as possible the passed speed/duplex. Blamed patch broke that logic by returning a match too early in case the caller asks for half-duplex, as a full-duplex linkmode may match first, and returned as a non-exact match without even trying to mach on half-duplex modes. Reported-by: Jijie Shao Closes: https://lore.kernel.org/netdev/20250603102500.4ec743cf@fedora/T/#m22ed60ca635c67dc7d9cbb47e8995b2beb5c1576 Tested-by: Jijie Shao Reviewed-by: Larysa Zaremba Fixes: fc81e257d19f ("net: phy: phy_caps: Allow looking-up link caps based on speed and duplex") Signed-off-by: Maxime Chevallier Link: https://patch.msgid.link/20250606094321.483602-1-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit 650768c512faba8070bf4cfbb28c95eb5cd203f3 Author: Dev Jain Date: Tue May 27 13:56:33 2025 +0530 arm64: Restrict pagetable teardown to avoid false warning Commit 9c006972c3fe ("arm64: mmu: drop pXd_present() checks from pXd_free_pYd_table()") removes the pxd_present() checks because the caller checks pxd_present(). But, in case of vmap_try_huge_pud(), the caller only checks pud_present(); pud_free_pmd_page() recurses on each pmd through pmd_free_pte_page(), wherein the pmd may be none. Thus it is possible to hit a warning in the latter, since pmd_none => !pmd_table(). Thus, add a pmd_present() check in pud_free_pmd_page(). This problem was found by code inspection. Fixes: 9c006972c3fe ("arm64: mmu: drop pXd_present() checks from pXd_free_pYd_table()") Cc: stable@vger.kernel.org Reported-by: Ryan Roberts Acked-by: David Hildenbrand Signed-off-by: Dev Jain Reviewed-by: Catalin Marinas Reviewed-by: Anshuman Khandual Reviewed-by: Ryan Roberts Link: https://lore.kernel.org/r/20250527082633.61073-1-dev.jain@arm.com Signed-off-by: Will Deacon commit c0c7fa4e7a512006710c8e4d6b6f7b40c9f786cd Author: Lorenzo Pieralisi Date: Tue Jun 10 14:09:35 2025 +0200 docs: arm64: Fix ICC_SRE_EL2 register typo in booting.rst Fix trivial ICC_SRE_EL2 register spelling typo in booting.rst. Signed-off-by: Lorenzo Pieralisi Cc: Jonathan Corbet Cc: Will Deacon CC: Catalin Marinas Link: https://lore.kernel.org/r/20250610120935.852034-1-lpieralisi@kernel.org Signed-off-by: Will Deacon commit c538f400fae22725580842deb2bef546701b64bd Author: Keith Busch Date: Wed Jun 11 13:53:43 2025 -0700 io_uring: consistently use rcu semantics with sqpoll thread The sqpoll thread is dereferenced with rcu read protection in one place, so it needs to be annotated as an __rcu type, and should consistently use rcu helpers for access and assignment to make sparse happy. Since most of the accesses occur under the sqd->lock, we can use rcu_dereference_protected() without declaring an rcu read section. Provide a simple helper to get the thread from a locked context. Fixes: ac0b8b327a5677d ("io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo()") Signed-off-by: Keith Busch Link: https://lore.kernel.org/r/20250611205343.1821117-1-kbusch@meta.com [axboe: fold in fix for register.c] Signed-off-by: Jens Axboe commit ba06528ad5a31923efc24324706116ccd17e12d8 Author: Gabriel Santese Date: Fri May 30 02:52:32 2025 +0200 ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic MSI Bravo 17 (D7VF), like other laptops from the family, has broken ACPI tables and needs a quirk for internal mic to work properly. Signed-off-by: Gabriel Santese Link: https://patch.msgid.link/20250530005444.23398-1-santesegabriel@gmail.com Signed-off-by: Mark Brown commit 0b9d62a47149083d581d8b2abb04124b6175cb29 Author: Darrick J. Wong Date: Wed Jun 11 09:40:44 2025 -0700 fs: unlock the superblock during iterate_supers_type This function takes super_lock in shared mode, so it should release the same lock. Cc: stable@vger.kernel.org # v6.16-rc1 Fixes: af7551cf13cf7f ("super: remove pointless s_root checks") Signed-off-by: "Darrick J. Wong" Link: https://lore.kernel.org/20250611164044.GF6138@frogsfrogsfrogs Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 527c88d8390d6c0358dea4d71696795c05328925 Author: Amir Goldstein Date: Thu Jun 12 09:22:45 2025 +0200 ovl: fix debug print in case of mkdir error We want to print the name in case of mkdir failure and now we will get a cryptic (efault) as name. Fixes: c54b386969a5 ("VFS: Change vfs_mkdir() to return the dentry.") Signed-off-by: Amir Goldstein Link: https://lore.kernel.org/20250612072245.2825938-1-amir73il@gmail.com Signed-off-by: Christian Brauner commit fa8fae5f82e48db1a06ba570a2a3fdc087fc93c0 Author: Richard Fitzgerald Date: Thu Jun 12 13:14:28 2025 +0100 ASoC: doc: cs35l56: Update to add new SoundWire firmware filename suffix Add the new firmware filename suffix used for SoundWire systems with CS35L57, CS35L63 or CS35L56 later than B0 silicon. This uses the SoundWire physical address of the amp to identify which firmware file to load on that amp. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20250612121428.1667-4-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit e5d5b3aebdc8acf9f52d1369a7744a2ab9ca591c Author: Richard Fitzgerald Date: Thu Jun 12 13:14:27 2025 +0100 ASoC: cs35l56: Use SoundWire address as alternate firmware suffix on L56 B0 Use the SoundWire link number and device unique ID as the firmware file qualifier suffix on CS35L56 B0 if .bin files are not found with the older suffix. Some changes in wm_adsp needed to support this have been included in this patch because they are trivial. The allows future products with CS35L56 B0 silicon to use the same firmware file naming as CS35L57 and cs35L63, while retaining backward compatibility for firmware that has already been published with the old naming scheme. The old suffix is searched first, partly because there are already many files using that naming scheme, but also because they are a smaller subset of all the possible fallback name options offered by wm_adsp so we know that it will either find the qualified files or fail. All the firmware files already published have the wmfw qualified with only the ACPI SSID and the bin files qualified with both SSID and the suffix. Originally, the firmware file names indicated which amplifier instance they were for by appending the ALSA prefix string. This is the standard ASoC way of distinguishing different instances of the same device. However, on SoundWire systems the SoundWire physical unique address is available as a unique identifier for each amp, and this address is hardwired by the address pin on the amp. The firmware files are specific for each physical amp so they must be applied to that amp. Using the ALSA prefix for the filename qualifier means that to name a firmware file it must be determined what prefix string the machine driver will assign to each device and then use that to name the firmware file correctly. This is straightforward in traditional ASoC systems where the machine driver is specific to a particular piece of hardware. But on SoundWire the machine driver is generic and can handle a very wide range of hardware. It is more difficult to determine exactly what the prefix will be on any particular production device, and more prone to mistakes. Also, when the machine driver switches to generating this automatically from SDCA properties in ACPI, there is an additional layer of complexity in determining the mapping. This uncertainty is unnecessary because the firmware is built for a specific amp. with known address, so we can use that directly instead of introducing a redundant intermediate alias. This ensures the firmware is applied to the amp it was intended for. There are already many published firmware for CS35L56 B0 silicon so this first looks for the original name suffix, to keep backward compatibility. If this doesn't find .bin files it will switch to using the new name suffix so that future products using CS35L56 B0 can start to use the new suffix. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20250612121428.1667-3-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit d1fc7687959b0fbf335815a8d808e6076b969309 Author: Richard Fitzgerald Date: Thu Jun 12 13:14:26 2025 +0100 ASoC: cs35l56: Use SoundWire address as firmware name suffix for new silicon Use the SoundWire link number and device unique ID as the firmware file qualifier suffix on CS35L57, CS35L63 and revisions of CS35L56 after B0. The change in wm_adsp needed to support this has been included in this patch because it is fairly trivial. Originally, the firmware file names indicated which amplifier instance they were for by appending the ALSA prefix string. This is the standard ASoC way of distinguishing different instances of the same device. However, on SoundWire systems the SoundWire physical unique address is available as a unique identifier for each amp, and this address is hardwired by a pin on the amp. The firmware files are specific for each physical amp so they must be applied to that amp. Using the ALSA prefix for the filename qualifier means that to name a firmware file it must be determined what prefix string the machine driver will assign to each device and then use that to name the firmware file correctly. This is straightforward in traditional ASoC systems where the machine driver is specific to a particular piece of hardware. But on SoundWire the machine driver is generic and can handle a very wide range of hardware. It is more difficult to determine exactly what the prefix will be on any particular production device, and more prone to mistakes. Also, when the machine driver switches to generating this automatically from SDCA properties in ACPI, there is an additional layer of complexity in determining the mapping. This uncertainty is unnecessary because the firmware is built for a specific amp. with known address, so we can use that directly instead of introducing the redundant intermediate alias. This ensures the firmware is applied to the amp it was intended for. There have not been any firmwares published for CS35L57 or CS35L63, so these can safely be switched to using the SoundWire unique address as the suffix string. Also note that the machine driver in older kernel version only has match entries for the CS35L56 Soundwire identity so any future product with a cs35L57 or CS35L63 would require a new kernel anyway. There are already many published firmware for CS35L56 B0 silicon so this keeps the original naming scheme on those, to preserve backward compatibility. Note that although sdw_slave.id contains a unique_id field, this cannot be trusted because the SoundWire core code also puts magic values into it that it uses as a flag. So the unique ID is read from the chip register. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20250612121428.1667-2-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 8ecbad4853f83d9853d7bb0c2d8373afab8851d3 Author: Alexander Stein Date: Fri May 23 08:40:41 2025 +0200 drm/arm/malidp: Silence informational message When checking for unsupported expect an error is printed every time. This spams the log for platforms where this is expected, e.g. ls1028a having a Vivante (etnaviv) GPU and Mali display processor. Signed-off-by: Alexander Stein Signed-off-by: Liviu Dudau Link: https://lore.kernel.org/r/20250523064042.3275926-1-alexander.stein@ew.tq-group.com commit e479da4054875c4cc53a7fb956ebff03d2dac939 Author: John Keeping Date: Wed Jun 11 12:13:06 2025 +0100 drm/ssd130x: fix ssd132x_clear_screen() columns The number of columns relates to the width, not the height. Use the correct variable. Signed-off-by: John Keeping Reviewed-by: Javier Martinez Canillas Fixes: fdd591e00a9c ("drm/ssd130x: Add support for the SSD132x OLED controller family") Link: https://lore.kernel.org/r/20250611111307.1814876-1-jkeeping@inmusicbrands.com Signed-off-by: Javier Martinez Canillas commit 332d6a94ce80efae2e6b38e01a46e92230577354 Merge: 19272b37aa4f83 c7f005f70d22cd Author: Rafael J. Wysocki Date: Thu Jun 12 13:23:56 2025 +0200 Merge tag 'cpufreq-arm-fixes-6.16-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Merge CPUFreq fixes for 6.16-rc from Viresh Kumar: "- Implement CpuId rust abstraction and use it to fix doctest failure (Viresh Kumar). - Minor cleanups in the `# Safety` sections for cpufreq abstractions (Viresh Kumar)." * tag 'cpufreq-arm-fixes-6.16-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: rust: cpu: Add CpuId::current() to retrieve current CPU ID rust: Use CpuId in place of raw CPU numbers rust: cpu: Introduce CpuId abstraction cpufreq: Convert `/// SAFETY` lines to `# Safety` sections commit 312d02adb959ea199372f375ada06e0186f651e4 Author: Jens Wiklander Date: Mon Jun 2 14:04:35 2025 +0200 optee: ffa: fix sleep in atomic context The OP-TEE driver registers the function notif_callback() for FF-A notifications. However, this function is called in an atomic context leading to errors like this when processing asynchronous notifications: | BUG: sleeping function called from invalid context at kernel/locking/mutex.c:258 | in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 9, name: kworker/0:0 | preempt_count: 1, expected: 0 | RCU nest depth: 0, expected: 0 | CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.14.0-00019-g657536ebe0aa #13 | Hardware name: linux,dummy-virt (DT) | Workqueue: ffa_pcpu_irq_notification notif_pcpu_irq_work_fn | Call trace: | show_stack+0x18/0x24 (C) | dump_stack_lvl+0x78/0x90 | dump_stack+0x18/0x24 | __might_resched+0x114/0x170 | __might_sleep+0x48/0x98 | mutex_lock+0x24/0x80 | optee_get_msg_arg+0x7c/0x21c | simple_call_with_arg+0x50/0xc0 | optee_do_bottom_half+0x14/0x20 | notif_callback+0x3c/0x48 | handle_notif_callbacks+0x9c/0xe0 | notif_get_and_handle+0x40/0x88 | generic_exec_single+0x80/0xc0 | smp_call_function_single+0xfc/0x1a0 | notif_pcpu_irq_work_fn+0x2c/0x38 | process_one_work+0x14c/0x2b4 | worker_thread+0x2e4/0x3e0 | kthread+0x13c/0x210 | ret_from_fork+0x10/0x20 Fix this by adding work queue to process the notification in a non-atomic context. Fixes: d0476a59de06 ("optee: ffa_abi: add asynchronous notifications") Cc: stable@vger.kernel.org Reviewed-by: Sumit Garg Tested-by: Sudeep Holla Link: https://lore.kernel.org/r/20250602120452.2507084-1-jens.wiklander@linaro.org Signed-off-by: Jens Wiklander commit 0c44b46f51a17baa7ab67de1464427116e9c4eaa Author: Arnd Bergmann Date: Tue Jun 10 11:34:55 2025 +0200 platform/x86/intel-uncore-freq: avoid non-literal format string Using a string variable in place of a format string causes a W=1 build warning: drivers/platform/x86/intel/uncore-frequency/uncore-frequency-common.c:61:40: error: format string is not a string literal (potentially insecure) [-Werror,-Wformat-security] 61 | length += sysfs_emit_at(buf, length, agent_name[agent]); | ^~~~~~~~~~~~~~~~~ Use the safer "%s" format string to print it instead. Fixes: b98fa870fce2 ("platform/x86/intel-uncore-freq: Add attributes to show agent types") Signed-off-by: Arnd Bergmann Tested-by: Srinivas Pandruvada Link: https://lore.kernel.org/r/20250610093459.2646337-1-arnd@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit be574d5eee9808a422cff0293da9b08c0e434ed0 Author: Xi Pardee Date: Tue Jun 10 16:04:07 2025 -0700 platform/x86/intel/pmc: Add Panther Lake support to Intel PMC SSRAM Telemetry Add Panther Lake support to Intel PMC SSRAM Telemetry driver. Signed-off-by: Xi Pardee Link: https://lore.kernel.org/r/20250610230416.622970-2-xi.pardee@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 2d5a84c3ecc075d87bcb16c1cc80277b5837c153 Author: Xi Pardee Date: Tue Jun 10 16:04:06 2025 -0700 platform/x86/intel/pmc: Add Lunar Lake support to Intel PMC SSRAM Telemetry Add Lunar Lake support to Intel PMC SSRAM Telemetry driver. Signed-off-by: Xi Pardee Link: https://lore.kernel.org/r/20250610230416.622970-1-xi.pardee@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit b26852daaa83f535109253d114426d1fa674155d Author: Arnd Bergmann Date: Tue Jun 10 11:28:42 2025 +0200 RDMA/mlx5: reduce stack usage in mlx5_ib_ufile_hw_cleanup This function has an array of eight mlx5_async_cmd structures, which often fits on the stack, but depending on the configuration can end up blowing the stack frame warning limit: drivers/infiniband/hw/mlx5/devx.c:2670:6: error: stack frame size (1392) exceeds limit (1280) in 'mlx5_ib_ufile_hw_cleanup' [-Werror,-Wframe-larger-than] Change this to a dynamic allocation instead. While a kmalloc() can theoretically fail, a GFP_KERNEL allocation under a page will block until memory has been freed up, so in the worst case, this only adds extra time in an already constrained environment. Fixes: 7c891a4dbcc1 ("RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation") Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20250610092846.2642535-1-arnd@kernel.org Signed-off-by: Leon Romanovsky commit 614b1c3cbfb0ecbafd40284d2f8e67c865818714 Author: Wolfram Sang Date: Thu Jun 12 09:27:22 2025 +0200 i2c: use inclusive callbacks in struct i2c_algorithm Convert the I2C subsystem to drop using the 'master_'-prefixed callbacks in favor of the simplified ones. Fix alignment of '=' while here. Signed-off-by: Wolfram Sang commit aa807b9f22df2eee28593cbbabba0f93f4aa26c1 Author: Feng Tang Date: Thu Jun 12 10:14:17 2025 +0800 dma-contiguous: hornor the cma address limit setup by user When porting a cma related usage from x86_64 server to arm64 server, the "cma=4G@4G" setup failed on arm64. The reason is arm64 and some other architectures have specific physical address limit for reserved cma area, like 4GB due to the device's need for 32 bit dma. Actually lots of platforms of those architectures don't have this device dma limit, but still have to obey it, and are not able to reserve a huge cma pool. This situation could be improved by honoring the user input cma physical address than the arch limit. As when users specify it, they already knows what the default is which probably can't suit them. Suggested-by: Robin Murphy Signed-off-by: Feng Tang Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20250612021417.44929-1-feng.tang@linux.alibaba.com commit 66ac1a4d366d3faa95fcf6082b555f8d77f1e8db Author: Huacai Chen Date: Sun Jun 8 22:12:35 2025 +0800 init: fix build warnings about export.h After commit a934a57a42f64a4 ("scripts/misc-check: check missing #include when W=1") and 7d95680d64ac8e836c ("scripts/misc-check: check unnecessary #include when W=1"), we get some build warnings with W=1: init/main.c: warning: EXPORT_SYMBOL() is used, but #include is missing init/initramfs.c: warning: EXPORT_SYMBOL() is used, but #include is missing So fix these build warnings for the init code. Link: https://lkml.kernel.org/r/20250608141235.155206-1-chenhuacai@loongson.cn Fixes: a934a57a42f6 ("scripts/misc-check: check missing #include when W=1") Signed-off-by: Huacai Chen Reviewed-by: Masahiro Yamada Cc: Al Viro Cc: Christian Brauner Cc: Jan Kara Signed-off-by: Andrew Morton commit 02fb36505c61c35d5fd879f5a66a97935dbcb2ee Author: Barry Song Date: Mon Jun 9 12:24:42 2025 +1200 MAINTAINERS: add Barry as a THP reviewer I have been actively contributing to mTHP and reviewing related patches for an extended period, and I would like to continue supporting patch reviews. Link: https://lkml.kernel.org/r/20250609002442.1856-1-21cnbao@gmail.com Signed-off-by: Barry Song Acked-by: Zi Yan Acked-by: Baolin Wang Acked-by: Dev Jain Acked-by: Lorenzo Stoakes Reviewed-by: Ryan Roberts Cc: David Hildenbrand Cc: Liam R. Howlett Cc: Nico Pache Signed-off-by: Andrew Morton commit 50695153d7ddde3b1696dbf0085be0033bf3ddb3 Author: Andrew Morton Date: Sat Jun 7 17:43:18 2025 -0700 drivers/rapidio/rio_cm.c: prevent possible heap overwrite In riocm_cdev_ioctl(RIO_CM_CHAN_SEND) -> cm_chan_msg_send() -> riocm_ch_send() cm_chan_msg_send() checks that userspace didn't send too much data but riocm_ch_send() failed to check that userspace sent sufficient data. The result is that riocm_ch_send() can write to fields in the rio_ch_chan_hdr which were outside the bounds of the space which cm_chan_msg_send() allocated. Address this by teaching riocm_ch_send() to check that the entire rio_ch_chan_hdr was copied in from userspace. Reported-by: maher azz Cc: Matt Porter Cc: Alexandre Bounine Cc: Linus Torvalds Cc: Signed-off-by: Andrew Morton commit 383c4613c67c26e90e8eebb72e3083457d02033f Author: Ryan Roberts Date: Fri Jun 6 10:28:07 2025 +0100 mm: close theoretical race where stale TLB entries could linger Commit 3ea277194daa ("mm, mprotect: flush TLB if potentially racing with a parallel reclaim leaving stale TLB entries") described a theoretical race as such: """ Nadav Amit identified a theoretical race between page reclaim and mprotect due to TLB flushes being batched outside of the PTL being held. He described the race as follows: CPU0 CPU1 ---- ---- user accesses memory using RW PTE [PTE now cached in TLB] try_to_unmap_one() ==> ptep_get_and_clear() ==> set_tlb_ubc_flush_pending() mprotect(addr, PROT_READ) ==> change_pte_range() ==> [ PTE non-present - no flush ] user writes using cached RW PTE ... try_to_unmap_flush() The same type of race exists for reads when protecting for PROT_NONE and also exists for operations that can leave an old TLB entry behind such as munmap, mremap and madvise. """ The solution was to introduce flush_tlb_batched_pending() and call it under the PTL from mprotect/madvise/munmap/mremap to complete any pending tlb flushes. However, while madvise_free_pte_range() and madvise_cold_or_pageout_pte_range() were both retro-fitted to call flush_tlb_batched_pending() immediately after initially acquiring the PTL, they both temporarily release the PTL to split a large folio if they stumble upon one. In this case, where re-acquiring the PTL flush_tlb_batched_pending() must be called again, but it previously was not. Let's fix that. There are 2 Fixes: tags here: the first is the commit that fixed madvise_free_pte_range(). The second is the commit that added madvise_cold_or_pageout_pte_range(), which looks like it copy/pasted the faulty pattern from madvise_free_pte_range(). This is a theoretical bug discovered during code review. Link: https://lkml.kernel.org/r/20250606092809.4194056-1-ryan.roberts@arm.com Fixes: 3ea277194daa ("mm, mprotect: flush TLB if potentially racing with a parallel reclaim leaving stale TLB entries") Fixes: 9c276cc65a58 ("mm: introduce MADV_COLD") Signed-off-by: Ryan Roberts Reviewed-by: Jann Horn Acked-by: David Hildenbrand Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mel Gorman Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit 0cf4b1687a187ba9247c71721d8b064634eda1f7 Author: Lorenzo Stoakes Date: Fri Jun 6 13:50:32 2025 +0100 mm/vma: reset VMA iterator on commit_merge() OOM failure While an OOM failure in commit_merge() isn't really feasible due to the allocation which might fail (a maple tree pre-allocation) being 'too small to fail', we do need to handle this case correctly regardless. In vma_merge_existing_range(), we can theoretically encounter failures which result in an OOM error in two ways - firstly dup_anon_vma() might fail with an OOM error, and secondly commit_merge() failing, ultimately, to pre-allocate a maple tree node. The abort logic for dup_anon_vma() resets the VMA iterator to the initial range, ensuring that any logic looping on this iterator will correctly proceed to the next VMA. However the commit_merge() abort logic does not do the same thing. This resulted in a syzbot report occurring because mlockall() iterates through VMAs, is tolerant of errors, but ended up with an incorrect previous VMA being specified due to incorrect iterator state. While making this change, it became apparent we are duplicating logic - the logic introduced in commit 41e6ddcaa0f1 ("mm/vma: add give_up_on_oom option on modify/merge, use in uffd release") duplicates the vmg->give_up_on_oom check in both abort branches. Additionally, we observe that we can perform the anon_dup check safely on dup_anon_vma() failure, as this will not be modified should this call fail. Finally, we need to reset the iterator in both cases, so now we can simply use the exact same code to abort for both. We remove the VM_WARN_ON(err != -ENOMEM) as it would be silly for this to be otherwise and it allows us to implement the abort check more neatly. Link: https://lkml.kernel.org/r/20250606125032.164249-1-lorenzo.stoakes@oracle.com Fixes: 47b16d0462a4 ("mm: abort vma_modify() on merge out of memory failure") Signed-off-by: Lorenzo Stoakes Reported-by: syzbot+d16409ea9ecc16ed261a@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-mm/6842cc67.a00a0220.29ac89.003b.GAE@google.com/ Reviewed-by: Pedro Falcato Reviewed-by: Vlastimil Babka Reviewed-by: Liam R. Howlett Cc: Jann Horn Cc: Signed-off-by: Andrew Morton commit 1b8e4091ffb4655c761354eb33f41b618e809427 Author: wangfushuai Date: Sat Jun 7 23:36:14 2025 +0800 docs: proc: update VmFlags documentation in smaps Remove outdated VM_DENYWRITE("dw") reference and add missing VM_LOCKONFAULT("lf") and VM_UFFD_MINOR("ui") flags. [akpm@linux-foundation.org: add "dp" (VM_DROPPABLE), per Tal] Link: https://lkml.kernel.org/r/20250607153614.81914-1-wangfushuai@baidu.com Signed-off-by: wangfushuai Cc: Andrii Nakryiko Cc: Catalin Marinas Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Mariano Pache Cc: xu xin Cc: Tal Zussman Signed-off-by: Andrew Morton commit 331843c845d15413e9d89fd91cdcfa6912e291c3 Author: Randy Dunlap Date: Wed Jun 4 17:23:37 2025 -0700 scatterlist: fix extraneous '@'-sign kernel-doc notation Using "@argname@" in kernel-doc produces "argname****" (with "argname" in bold) in the generated html output, so use the expected kernel-doc notation of just "@argname" instead. "Fixes:" lines are added in case Matthew's patch [1] is backported. Link: https://lkml.kernel.org/r/20250605002337.2842659-1-rdunlap@infradead.org Link: https://lore.kernel.org/linux-doc/3bc4e779-7a79-42c1-8867-024f643a22fc@infradead.org/T/#m5d2bd9d21fb34f297aa4e7db069f09bc27b89007 [1] Fixes: 0db9299f48eb ("SG: Move functions to lib/scatterlist.c and add sg chaining allocator helpers") Fixes: 8d1d4b538bb1 ("scatterlist: inline sg_next()") Fixes: 18dabf473e15 ("Change table chaining layout") Signed-off-by: Randy Dunlap Reviewed-by: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit b1a529bdb9641392b4f5fc91545598793c0b3b96 Author: Mark Brown Date: Thu Jun 5 22:34:31 2025 +0100 selftests/mm: skip failed memfd setups in gup_longterm Unlike the other cases gup_longterm's memfd tests previously skipped the test when failing to set up the file descriptor to test. Restore this behavior to avoid hitting failures when hugetlb isn't configured. Link: https://lkml.kernel.org/r/20250605-selftest-mm-gup-longterm-tweaks-v1-1-2fae34b05958@kernel.org Fixes: 66bce7afbaca ("selftests/mm: fix test result reporting in gup_longterm") Signed-off-by: Mark Brown Reported-by: Lorenzo Stoakes Closes: https://lkml.kernel.org/r/a76fc252-0fe3-4d4b-a9a1-4a2895c2680d@lucifer.local Reviewed-by: Lorenzo Stoakes Tested-by: Lorenzo Stoakes Acked-by: David Hildenbrand Cc: Shuah Khan Signed-off-by: Andrew Morton commit c0f21029f123d1b15f8eddc8e3976bf0c8781c43 Author: Leon Romanovsky Date: Sun Jun 8 10:42:53 2025 +0300 xfrm: always initialize offload path Offload path is used for GRO with SW IPsec, and not just for HW offload. So initialize it anyway. Fixes: 585b64f5a620 ("xfrm: delay initialization of offload path till its actually requested") Reported-by: Sabrina Dubroca Closes: https://lore.kernel.org/all/aEGW_5HfPqU1rFjl@krikkit Signed-off-by: Leon Romanovsky Signed-off-by: Steffen Klassert commit c7f005f70d22cd5613cac30bf6d34867189e36a9 Author: Viresh Kumar Date: Mon Jun 9 16:44:16 2025 +0530 rust: cpu: Add CpuId::current() to retrieve current CPU ID Introduce `CpuId::current()`, a constructor that wraps the C function `raw_smp_processor_id()` to retrieve the current CPU identifier without guaranteeing stability. This function should be used only when the caller can ensure that the CPU ID won't change unexpectedly due to preemption or migration. Suggested-by: Boqun Feng Signed-off-by: Viresh Kumar Reviewed-by: Boqun Feng commit 33db8c97b4cfa0328054fb755dfbcd6e7f3c7a9d Author: Viresh Kumar Date: Mon Jun 9 14:26:54 2025 +0530 rust: Use CpuId in place of raw CPU numbers Use the newly defined `CpuId` abstraction instead of raw CPU numbers. This also fixes a doctest failure for configurations where `nr_cpu_ids < 4`. The C `cpumask_{set|clear}_cpu()` APIs emit a warning when given an invalid CPU number — but only if `CONFIG_DEBUG_PER_CPU_MAPS=y` is set. Meanwhile, `cpumask_weight()` only considers CPUs up to `nr_cpu_ids`, which can cause inconsistencies: a CPU number greater than `nr_cpu_ids` may be set in the mask, yet the weight calculation won't reflect it. This leads to doctest failures when `nr_cpu_ids < 4`, as the test tries to set CPUs 2 and 3: rust_doctest_kernel_cpumask_rs_0.location: rust/kernel/cpumask.rs:180 rust_doctest_kernel_cpumask_rs_0: ASSERTION FAILED at rust/kernel/cpumask.rs:190 Fixes: 8961b8cb3099 ("rust: cpumask: Add initial abstractions") Reported-by: Miguel Ojeda Closes: https://lore.kernel.org/rust-for-linux/CANiq72k3ozKkLMinTLQwvkyg9K=BeRxs1oYZSKhJHY-veEyZdg@mail.gmail.com/ Reported-by: Andreas Hindborg Closes: https://lore.kernel.org/all/87qzzy3ric.fsf@kernel.org/ Suggested-by: Boqun Feng Signed-off-by: Viresh Kumar Reviewed-by: Boqun Feng commit 8046d29dde17002523f94d3e6e0ebe486ce52166 Author: Paolo Bonzini Date: Thu Jun 12 00:47:44 2025 -0400 KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY Only let userspace pass the same addresses that were used in KVM_SET_USER_MEMORY_REGION (or KVM_SET_USER_MEMORY_REGION2); gpas in the the upper half of the address space are an implementation detail of TDX and KVM. Extracted from a patch by Sean Christopherson . Signed-off-by: Paolo Bonzini commit aa2024c01a9afba6728b362626f868811ca872ee Author: Paolo Bonzini Date: Tue Jun 10 20:10:18 2025 -0400 KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY Bug[*] reported for TDX case when enabling KVM_PRE_FAULT_MEMORY in QEMU. It turns out that @gpa passed to kvm_mmu_do_page_fault() doesn't have shared bit set when the memory attribute of it is shared, and it leads to wrong root in tdp_mmu_get_root_for_fault(). Fix it by embedding the direct bits in the gpa that is passed to kvm_tdp_map_page(), when the memory of the gpa is not private. [*] https://lore.kernel.org/qemu-devel/4a757796-11c2-47f1-ae0d-335626e818fd@intel.com/ Reported-by: Xiaoyao Li Closes: https://lore.kernel.org/qemu-devel/4a757796-11c2-47f1-ae0d-335626e818fd@intel.com/ Signed-off-by: Paolo Bonzini Signed-off-by: Xiaoyao Li Message-ID: <20250611001018.2179964-1-xiaoyao.li@intel.com> Signed-off-by: Paolo Bonzini commit aef22f6fe7a630d536f9eaa0a7a2ed0f90ea369e Author: Kent Overstreet Date: Tue Jun 10 22:32:14 2025 -0400 bcachefs: Don't trace should_be_locked unless changing Signed-off-by: Kent Overstreet commit cd1124244be30fd3e87da9186508aab371e9307d Author: Kent Overstreet Date: Sun Jun 8 12:35:20 2025 -0400 bcachefs: Ensure that snapshot creation propagates has_case_insensitive We normally can't create a new directory with the case-insensitive option already set - except when we're creating a snapshot. And if casefolding is enabled filesystem wide, we should still set it even though not strictly required, for consistency. Signed-off-by: Kent Overstreet commit b68baf9a87330148d3ad074e48503a4e9c5c3929 Author: Kent Overstreet Date: Wed Jun 11 15:57:48 2025 -0400 bcachefs: Print devices we're mounting on multi device filesystems Previously, we only ever logged the filesystem UUID. Signed-off-by: Kent Overstreet commit 205da7c026739d965e605d39001049c7b6728e87 Author: Kent Overstreet Date: Sun Jun 8 11:31:23 2025 -0400 bcachefs: Don't trust sb->nr_devices in members_to_text() We have to be able to print superblock sections even if they fail to validate (for debugging), so we have to calculate the number of entries from the field size. Reported-by: syzbot+5138f00559ffb3cb3610@syzkaller.appspotmail.com Signed-off-by: Kent Overstreet commit 625c494db95624f09f5e7b81b64d4da34e45bd2a Author: Kent Overstreet Date: Wed Jun 11 13:32:58 2025 -0400 bcachefs: Fix version checks in validate_bset() It seems btree node scan picked up a partially overwritten btree node, and corrected the "bset version older than sb version_min" error - resulting in an invalid superblock with a bad version_min field. Don't run this check at all when we're in btree node scan, and when we do run it, do something saner if the bset version is totally crazy. Signed-off-by: Kent Overstreet commit e82b3a63a9a91cc5c585efb3e28f32100f24e3e1 Author: Arnd Bergmann Date: Tue Jun 10 11:24:04 2025 +0200 bcachefs: ioctl: avoid stack overflow warning Multiple ioctl handlers individually use a lot of stack space, and clang chooses to inline them into the bch2_fs_ioctl() function, blowing through the warning limit: fs/bcachefs/chardev.c:655:6: error: stack frame size (1032) exceeds limit (1024) in 'bch2_fs_ioctl' [-Werror,-Wframe-larger-than] 655 | long bch2_fs_ioctl(struct bch_fs *c, unsigned cmd, void __user *arg) By marking the largest two of them as noinline_for_stack, no indidual code path ends up using this much, which avoids the warning and reduces the possible total stack usage in the ioctl handler. Signed-off-by: Arnd Bergmann Signed-off-by: Kent Overstreet commit c3dd25319c1818e067f41f41127f935f153498e6 Author: Kent Overstreet Date: Mon Jun 9 17:28:00 2025 -0400 bcachefs: Don't pass trans to fsck_err() in gc_accounting_done fsck_err() can return a transaction restart if passed a transaction object - this has always been true when it has to drop locks to prompt for user input, but we're seeing this more now that we're logging the error being corrected in the journal. gc_accounting_done() doesn't call fsck_err() from an actual commit loop, and it doesn't need to be holding btree locks when it calls fsck_err(), so the easy fix here for the unhandled transaction restart is to just not pass it the transaction object. We'll miss out on the fancy new logging, but that's ok. Signed-off-by: Kent Overstreet commit 9e48f574e55731106b26dc33d8b0be1adedf3f20 Author: Kent Overstreet Date: Mon Jun 9 17:30:40 2025 -0400 bcachefs: Fix leak in bch2_fs_recovery() error path Fix a small leak of the superblock 'clean' section. Signed-off-by: Kent Overstreet commit 54aacfe3976893ee04582a0bd61967bbee5a7e04 Author: Kent Overstreet Date: Sun Jun 8 12:17:02 2025 -0400 bcachefs: Fix rcu_pending for PREEMPT_RT PREEMPT_RT redefines how standard spinlocks work, so local_irq_save() + spin_lock() is no longer equivalent to spin_lock_irqsave(). Fortunately, we don't strictly need to do it that way. Signed-off-by: Kent Overstreet commit 082c74411491f8b0d31465fc104b8342e66c4056 Author: Kent Overstreet Date: Sun Jun 8 11:58:59 2025 -0400 bcachefs: Fix downgrade_table_extra() Fix a UAF: we were calling darray_make_room() and retaining a pointer to the old buffer. And fix an UBSAN warning: struct bch_sb_field_downgrade_entry uses __counted_by, so set dst->nr_errors before assigning to the array entry. Reported-by: syzbot+14c52d86ddbd89bea13e@syzkaller.appspotmail.com Signed-off-by: Kent Overstreet commit 757601ef853359fe2d57d75c00b5045f62efc608 Author: Kent Overstreet Date: Sun Jun 8 11:40:00 2025 -0400 bcachefs: Don't put rhashtable on stack Object debugging generally needs special provisions for putting said objects on the stack, which rhashtable does not have. Reported-by: syzbot+bcc38a9556d0324c2ec2@syzkaller.appspotmail.com Signed-off-by: Kent Overstreet commit f946ce0be45e75801583a5371fccf7466961d9d0 Author: Kent Overstreet Date: Sat Jun 7 20:18:16 2025 -0400 bcachefs: Make sure opts.read_only gets propagated back to VFS If we think we're read-only but the VFS doesn't, fun will ensue. And now that we know we have to be able to do this safely, just make nochanges imply ro. Reported-by: syzbot+a7d6ceaba099cc21dee4@syzkaller.appspotmail.com Signed-off-by: Kent Overstreet commit 0acb385ec19c99b213d28a309a941790758c53a8 Author: Alan Huang Date: Tue May 20 15:34:28 2025 +0800 bcachefs: Fix possible console lock involved deadlock Link: https://lore.kernel.org/all/6822ab02.050a0220.f2294.00cb.GAE@google.com/T/ Reported-by: syzbot+2c3ef91c9523c3d1a25c@syzkaller.appspotmail.com Signed-off-by: Alan Huang Signed-off-by: Kent Overstreet commit 3315113af178041ab474723804e1322cee7d0a97 Author: Kent Overstreet Date: Sat Jun 7 18:56:28 2025 -0400 bcachefs: mark more errors autofix Signed-off-by: Kent Overstreet commit 263561649ee5875a922f4358e96d3deb17a91021 Author: Kent Overstreet Date: Sat Jun 7 14:27:35 2025 -0400 bcachefs: Don't persistently run scan_for_btree_nodes bch2_btree_lost_data() gets called on btree node read error, but the error might be transient. btree_node_scan is expensive, and there's no need to run it persistently (marking it in the superblock as required to run) - check_topology will run it if required, via bch2_get_scanned_nodes(). Running it non-persistently is fine, to avoid check_topology having to rewind recovery to run it. Signed-off-by: Kent Overstreet commit dd22844f48a71a414bd7e08cd4a9a5847974c07e Author: Kent Overstreet Date: Sat Jun 7 14:22:24 2025 -0400 bcachefs: Read error message now prints if self healing Signed-off-by: Kent Overstreet commit b47a82ff4772ea9d7091b85ef5f34dc78c866a02 Author: Kent Overstreet Date: Sat Jun 7 12:56:33 2025 -0400 bcachefs: Only run 'increase_depth' for keys from btree node csan bch2_btree_increase_depth() was originally for disaster recovery, to get some data back from the journal when a btree root was bad. We don't need it for that purpose anymore; on bad btree root we'll launch btree node scan and reconstruct all the interior nodes. If there's a key in the journal for a depth that doesn't exists, and it's not from check_topology/btree node scan, we should just ignore it. Signed-off-by: Kent Overstreet commit 7b0e6b198e4ef39ec89285d953778c5a3a04d390 Author: Kent Overstreet Date: Sat Jun 7 12:56:15 2025 -0400 bcachefs: Mark need_discard_freespace_key_bad autofix Signed-off-by: Kent Overstreet commit af5b88618a38371545251ad92ce42bc4bfa1142a Author: Kent Overstreet Date: Sat Jun 7 12:01:22 2025 -0400 bcachefs: Update /dev/disk/by-uuid on device add Invalidate pagecache after we write the new superblock and send a uevent. Signed-off-by: Kent Overstreet commit b76cce12700b8bb8d59b9ff444504b94db96dd4b Author: Kent Overstreet Date: Thu Jun 5 20:53:01 2025 -0400 bcachefs: Add more flags to btree nodes for rewrite reason It seems excessive forced btree node rewrites can cause interior btree updates to become wedged during recovery, before we're using the write buffer for backpointer updates. Add more flags so we can determine where these are coming from. Signed-off-by: Kent Overstreet commit c7e351be7aa4e176223f0128e4d1b959ffad9598 Author: Kent Overstreet Date: Thu Jun 5 19:00:11 2025 -0400 bcachefs: Add range being updated to btree_update_to_text() We had a deadlock during recovery where interior btree updates became wedged and all open_buckets were consumed; start adding more introspection. Signed-off-by: Kent Overstreet commit b43f724927686387589b98eb762e1a4109bb1bac Author: Kent Overstreet Date: Sun Jun 1 13:07:31 2025 -0400 bcachefs: Log fsck errors in the journal Log the specific error being corrected in the journal when we're repairing, this helps greatly with 'bcachefs list_journal' analysis. Signed-off-by: Kent Overstreet commit 47fe65b105f29ef22f463c17ab8a4c0eeb741045 Author: Kent Overstreet Date: Sun Jun 1 20:22:17 2025 -0400 bcachefs: Add missing restart handling to check_topology() The next patch will add logging of the specific error being corrected in repair paths to the journal; this means __bch2_fsck_err() can return transaction restarts in places that previously weren't expecting them. check_topology() is old code that doesn't use btree iterators for btree node locking - it'll have to be rewritten in the future to work online. Signed-off-by: Kent Overstreet commit ebf2e500e06f707654572bc7d8bc569a8caa51aa Author: Viresh Kumar Date: Mon Jun 9 12:38:43 2025 +0530 rust: cpu: Introduce CpuId abstraction This adds abstraction for representing a CPU identifier. Suggested-by: Boqun Feng Signed-off-by: Viresh Kumar Reviewed-by: Boqun Feng commit 2c4a1f3fe03edab80db66688360685031802160a Merge: 403d1338a4a59c 9cf1e25053c269 Author: Linus Torvalds Date: Wed Jun 11 19:00:20 2025 -0700 Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull BPF fixes from Alexei Starovoitov - Fix libbpf backward compatibility (Andrii Nakryiko) - Add Stanislav Fomichev as bpf/net reviewer - Fix resolve_btfid build when cross compiling (Suleiman Souhlal) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: MAINTAINERS: Add myself as bpf networking reviewer tools/resolve_btfids: Fix build when cross compiling kernel with clang. libbpf: Handle unsupported mmap-based /sys/kernel/btf/vmlinux correctly commit 903cc7096db22f889d48e2cee8840709ce04fdac Author: Akhil R Date: Tue Jun 3 21:00:20 2025 +0530 dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties Specify the properties which are essential and which are not for the Tegra I2C driver to function correctly. This was not added correctly when the TXT binding was converted to yaml. All the existing DT nodes have these properties already and hence this does not break the ABI. dmas and dma-names which were specified as a must in the TXT binding is now made optional since the driver can work in PIO mode if dmas are missing. Fixes: f10a9b722f80 ("dt-bindings: i2c: tegra: Convert to json-schema”) Signed-off-by: Akhil R Cc: # v5.17+ Reviewed-by: Krzysztof Kozlowski Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250603153022.39434-1-akhilrajeev@nvidia.com commit 27cea0e419d2f9dc6f51bbce5a44c70bc3774b9a Author: Kuniyuki Iwashima Date: Tue Jun 10 23:56:58 2025 +0000 MAINTAINERS: Update Kuniyuki Iwashima's email address. I left Amazon and joined Google, so let's map the email addresses accordingly. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250610235734.88540-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 567766954b2d5d6c29f568ad4382d6351ea48079 Author: Jakub Kicinski Date: Mon Jun 9 17:12:45 2025 -0700 selftests: net: add test case for NAT46 looping back dst Simple test for crash involving multicast loopback and stale dst. Reuse exising NAT46 program. Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250610001245.1981782-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit ba9db6f907ac02215e30128770f85fbd7db2fcf9 Author: Jakub Kicinski Date: Mon Jun 9 17:12:44 2025 -0700 net: clear the dst when changing skb protocol A not-so-careful NAT46 BPF program can crash the kernel if it indiscriminately flips ingress packets from v4 to v6: BUG: kernel NULL pointer dereference, address: 0000000000000000 ip6_rcv_core (net/ipv6/ip6_input.c:190:20) ipv6_rcv (net/ipv6/ip6_input.c:306:8) process_backlog (net/core/dev.c:6186:4) napi_poll (net/core/dev.c:6906:9) net_rx_action (net/core/dev.c:7028:13) do_softirq (kernel/softirq.c:462:3) netif_rx (net/core/dev.c:5326:3) dev_loopback_xmit (net/core/dev.c:4015:2) ip_mc_finish_output (net/ipv4/ip_output.c:363:8) NF_HOOK (./include/linux/netfilter.h:314:9) ip_mc_output (net/ipv4/ip_output.c:400:5) dst_output (./include/net/dst.h:459:9) ip_local_out (net/ipv4/ip_output.c:130:9) ip_send_skb (net/ipv4/ip_output.c:1496:8) udp_send_skb (net/ipv4/udp.c:1040:8) udp_sendmsg (net/ipv4/udp.c:1328:10) The output interface has a 4->6 program attached at ingress. We try to loop the multicast skb back to the sending socket. Ingress BPF runs as part of netif_rx(), pushes a valid v6 hdr and changes skb->protocol to v6. We enter ip6_rcv_core which tries to use skb_dst(). But the dst is still an IPv4 one left after IPv4 mcast output. Clear the dst in all BPF helpers which change the protocol. Try to preserve metadata dsts, those may carry non-routing metadata. Cc: stable@vger.kernel.org Reviewed-by: Maciej Żenczykowski Acked-by: Daniel Borkmann Fixes: d219df60a70e ("bpf: Add ipip6 and ip6ip decap support for bpf_skb_adjust_room()") Fixes: 1b00e0dfe7d0 ("bpf: update skb->protocol in bpf_skb_net_grow") Fixes: 6578171a7ff0 ("bpf: add bpf_skb_change_proto helper") Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250610001245.1981782-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit f75794b6077ec729f57de9a1ad24f14d288a68bb Author: Rob Herring (Arm) Date: Thu May 1 20:15:40 2025 -0500 dt-bindings: serial: Convert altr,uart-1.0 to DT schema Convert the Altera JTAG UART binding to DT schema. The "ALTR,uart-1.0" compatible has long been deprecated, so drop it. Signed-off-by: Rob Herring (Arm) commit ed2a6ff0234e21cd5e56b63d8bff80120bbe5f15 Author: Rob Herring (Arm) Date: Thu May 1 20:14:26 2025 -0500 dt-bindings: serial: Convert altr,juart-1.0 to DT schema Convert the Altera JTAG UART binding to DT schema. The "ALTR,juart-1.0" compatible has long been deprecated, so drop it. Signed-off-by: Rob Herring (Arm) commit 403d1338a4a59cfebb4ded53fa35fbd5119f36b1 Author: Magnus Lindholm Date: Tue Feb 18 18:55:14 2025 +0100 mm: pgtable: fix pte_swp_exclusive Make pte_swp_exclusive return bool instead of int. This will better reflect how pte_swp_exclusive is actually used in the code. This fixes swap/swapoff problems on Alpha due pte_swp_exclusive not returning correct values when _PAGE_SWP_EXCLUSIVE bit resides in upper 32-bits of PTE (like on alpha). Suggested-by: Al Viro Signed-off-by: Magnus Lindholm Cc: Sam James Link: https://lore.kernel.org/lkml/20250218175735.19882-2-linmag7@gmail.com/ Link: https://lore.kernel.org/lkml/20250602041118.GA2675383@ZenIV/ [ Applied as the 'sed' script Al suggested - Linus ] Signed-off-by: Linus Torvalds commit df298062a8f44feca7b22baf7ab1f87f7bef0f30 Merge: c7bdeed31e4c42 875d7c160d6061 Author: Jakub Kicinski Date: Wed Jun 11 14:41:15 2025 -0700 Merge branch 'mlx5-misc-fixes-2025-06-10' Mark Bloch says: ==================== mlx5 misc fixes 2025-06-10 This patchset includes misc fixes from the team for the mlx5 core and Ethernet drivers. ==================== Link: https://patch.msgid.link/20250610151514.1094735-1-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 875d7c160d60616ff06dedb70470ad199661efe7 Author: Shahar Shitrit Date: Tue Jun 10 18:15:14 2025 +0300 net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper When the link is up, either eth_proto_oper or ext_eth_proto_oper typically reports the active link protocol, from which both speed and number of lanes can be retrieved. However, in certain cases, such as when a NIC is connected via a non-standard cable, the firmware may not report the protocol. In such scenarios, the speed can still be obtained from the data_rate_oper field in PTYS register. Since data_rate_oper provides only speed information and lacks lane details, it is incorrect to derive the number of lanes from it. This patch corrects the behavior by setting the number of lanes to UNKNOWN instead of incorrectly using MAX_LANES when relying on data_rate_oper. Fixes: 7e959797f021 ("net/mlx5e: Enable lanes configuration when auto-negotiation is off") Signed-off-by: Shahar Shitrit Reviewed-by: Tariq Toukan Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250610151514.1094735-10-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit aa9c44b842096c553871bc68a8cebc7861fa192b Author: Jianbo Liu Date: Tue Jun 10 18:15:13 2025 +0300 net/mlx5e: Fix leak of Geneve TLV option object Previously, a unique tunnel id was added for the matching on TC non-zero chains, to support inner header rewrite with goto action. Later, it was used to support VF tunnel offload for vxlan, then for Geneve and GRE. To support VF tunnel, a temporary mlx5_flow_spec is used to parse tunnel options. For Geneve, if there is TLV option, a object is created, or refcnt is added if already exists. But the temporary mlx5_flow_spec is directly freed after parsing, which causes the leak because no information regarding the object is saved in flow's mlx5_flow_spec, which is used to free the object when deleting the flow. To fix the leak, call mlx5_geneve_tlv_option_del() before free the temporary spec if it has TLV object. Fixes: 521933cdc4aa ("net/mlx5e: Support Geneve and GRE with VF tunnel offload") Signed-off-by: Jianbo Liu Reviewed-by: Tariq Toukan Reviewed-by: Alex Lazar Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250610151514.1094735-9-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit b8335829518ec5988294280e37d735799209d70d Author: Vlad Dogaru Date: Tue Jun 10 18:15:11 2025 +0300 net/mlx5: HWS, make sure the uplink is the last destination When there are more than one destinations, we create a FW flow table and provide it with all the destinations. FW requires to have wire as the last destination in the list (if it exists), otherwise the operation fails with FW syndrome. This patch fixes the destination array action creation: if it contains a wire destination, it is moved to the end. Fixes: 504e536d9010 ("net/mlx5: HWS, added actions handling") Signed-off-by: Vlad Dogaru Reviewed-by: Yevgeny Kliteynik Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250610151514.1094735-7-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit b5e3c76f35ee7e814c2469c73406c5bbf110d89c Author: Yevgeny Kliteynik Date: Tue Jun 10 18:15:10 2025 +0300 net/mlx5: HWS, fix missing ip_version handling in definer Fix missing field handling in definer - outer IP version. Fixes: 74a778b4a63f ("net/mlx5: HWS, added definers handling") Signed-off-by: Yevgeny Kliteynik Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250610151514.1094735-6-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit a002602676cdae0c9996adb75b9310559b718a93 Author: Vlad Dogaru Date: Tue Jun 10 18:15:09 2025 +0300 net/mlx5: HWS, Init mutex on the correct path The newly introduced mutex is only used for reformat actions, but it was initialized for modify header instead. The struct that contains the mutex is zero-initialized and an all-zero mutex is valid, so the issue only shows up with CONFIG_DEBUG_MUTEXES. Fixes: b206d9ec19df ("net/mlx5: HWS, register reformat actions with fw") Signed-off-by: Vlad Dogaru Reviewed-by: Yevgeny Kliteynik Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250610151514.1094735-5-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 8ec40e3f1f72bf8f8accf18020d487caa99f46a4 Author: Patrisious Haddad Date: Tue Jun 10 18:15:08 2025 +0300 net/mlx5: Fix return value when searching for existing flow group When attempting to add a rule to an existing flow group, if a matching flow group exists but is not active, the error code returned should be EAGAIN, so that the rule can be added to the matching flow group once it is active, rather than ENOENT, which indicates that no matching flow group was found. Fixes: bd71b08ec2ee ("net/mlx5: Support multiple updates of steering rules in parallel") Signed-off-by: Gavi Teitz Signed-off-by: Roi Dayan Signed-off-by: Patrisious Haddad Reviewed-by: Tariq Toukan Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250610151514.1094735-4-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 687560d8a9a2d654829ad0da1ec24242f1de711d Author: Amir Tzin Date: Tue Jun 10 18:15:07 2025 +0300 net/mlx5: Fix ECVF vports unload on shutdown flow Fix shutdown flow UAF when a virtual function is created on the embedded chip (ECVF) of a BlueField device. In such case the vport acl ingress table is not properly destroyed. ECVF functionality is independent of ecpf_vport_exists capability and thus functions mlx5_eswitch_(enable|disable)_pf_vf_vports() should not test it when enabling/disabling ECVF vports. kernel log: [] refcount_t: underflow; use-after-free. [] WARNING: CPU: 3 PID: 1 at lib/refcount.c:28 refcount_warn_saturate+0x124/0x220 ---------------- [] Call trace: [] refcount_warn_saturate+0x124/0x220 [] tree_put_node+0x164/0x1e0 [mlx5_core] [] mlx5_destroy_flow_table+0x98/0x2c0 [mlx5_core] [] esw_acl_ingress_table_destroy+0x28/0x40 [mlx5_core] [] esw_acl_ingress_lgcy_cleanup+0x80/0xf4 [mlx5_core] [] esw_legacy_vport_acl_cleanup+0x44/0x60 [mlx5_core] [] esw_vport_cleanup+0x64/0x90 [mlx5_core] [] mlx5_esw_vport_disable+0xc0/0x1d0 [mlx5_core] [] mlx5_eswitch_unload_ec_vf_vports+0xcc/0x150 [mlx5_core] [] mlx5_eswitch_disable_sriov+0x198/0x2a0 [mlx5_core] [] mlx5_device_disable_sriov+0xb8/0x1e0 [mlx5_core] [] mlx5_sriov_detach+0x40/0x50 [mlx5_core] [] mlx5_unload+0x40/0xc4 [mlx5_core] [] mlx5_unload_one_devl_locked+0x6c/0xe4 [mlx5_core] [] mlx5_unload_one+0x3c/0x60 [mlx5_core] [] shutdown+0x7c/0xa4 [mlx5_core] [] pci_device_shutdown+0x3c/0xa0 [] device_shutdown+0x170/0x340 [] __do_sys_reboot+0x1f4/0x2a0 [] __arm64_sys_reboot+0x2c/0x40 [] invoke_syscall+0x78/0x100 [] el0_svc_common.constprop.0+0x54/0x184 [] do_el0_svc+0x30/0xac [] el0_svc+0x48/0x160 [] el0t_64_sync_handler+0xa4/0x12c [] el0t_64_sync+0x1a4/0x1a8 [] --[ end trace 9c4601d68c70030e ]--- Fixes: a7719b29a821 ("net/mlx5: Add management of EC VF vports") Reviewed-by: Daniel Jurgens Reviewed-by: Moshe Shemesh Signed-off-by: Amir Tzin Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250610151514.1094735-3-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit f37258133c1e95e61db532e14067e28b4881bf24 Author: Moshe Shemesh Date: Tue Jun 10 18:15:06 2025 +0300 net/mlx5: Ensure fw pages are always allocated on same NUMA When firmware asks the driver to allocate more pages, using event of give_pages, the driver should always allocate it from same NUMA, the original device NUMA. Current code uses dev_to_node() which can result in different NUMA as it is changed by other driver flows, such as mlx5_dma_zalloc_coherent_node(). Instead, use saved numa node for allocating firmware pages. Fixes: 311c7c71c9bb ("net/mlx5e: Allocate DMA coherent memory on reader NUMA node") Signed-off-by: Moshe Shemesh Reviewed-by: Tariq Toukan Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250610151514.1094735-2-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit c7bdeed31e4c421d340c56411c3be2afbf15cbc1 Merge: 260388f79e94fb b4a8085ceefb7b Author: Jakub Kicinski Date: Wed Jun 11 14:28:51 2025 -0700 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2025-06-10 (i40e, iavf, ice, e1000) For i40e: Robert Malz improves reset handling for situations where multiple reset requests could cause some to be missed. For iavf: Ahmed adds detection, and handling, of reset that could occur early in the initialization process to stop long wait/hangs. For ice: Anton, properly, sets missed use_nsecs value. For e1000: Joe Damato moves cancel_work_sync() call to avoid deadlock. * '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: e1000: Move cancel_work_sync to avoid deadlock ice/ptp: fix crosstimestamp reporting iavf: fix reset_task for early reset event i40e: retry VFLR handling if there is ongoing VF reset i40e: return false from i40e_reset_vf if reset is in progress ==================== Link: https://patch.msgid.link/20250610171348.1476574-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 47096d301e39f96962ca1fd6c7b71bfa796c53db Author: Tejun Heo Date: Wed Jun 11 11:05:16 2025 -1000 sched_ext: Update mailing list entry in MAINTAINERS Use sched-ext@lists.linux.dev instead of LKML. Signed-off-by: Tejun Heo commit 7dd38ba4acbea9875b4ee061e20a26413e39d9f4 Author: Luiz Augusto von Dentz Date: Wed Jun 11 16:36:27 2025 -0400 Bluetooth: MGMT: Fix sparse errors This fixes the following errors: net/bluetooth/mgmt.c:5400:59: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected unsigned short [usertype] handle @@ got restricted __le16 [usertype] monitor_handle @@ net/bluetooth/mgmt.c:5400:59: sparse: expected unsigned short [usertype] handle net/bluetooth/mgmt.c:5400:59: sparse: got restricted __le16 [usertype] monitor_handle Fixes: e6ed54e86aae ("Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506060347.ux2O1p7L-lkp@intel.com/ Signed-off-by: Luiz Augusto von Dentz commit 5842c01a9ed1d515c8ba2d6d3733eac78ace89c1 Author: Luiz Augusto von Dentz Date: Fri Jun 6 14:32:49 2025 -0400 Bluetooth: ISO: Fix not using bc_sid as advertisement SID Currently bc_sid is being ignore when acting as Broadcast Source role, so this fix it by passing the bc_sid and then use it when programming the PA: < HCI Command: LE Set Exte.. (0x08|0x0036) plen 25 Handle: 0x01 Properties: 0x0000 Min advertising interval: 140.000 msec (0x00e0) Max advertising interval: 140.000 msec (0x00e0) Channel map: 37, 38, 39 (0x07) Own address type: Random (0x01) Peer address type: Public (0x00) Peer address: 00:00:00:00:00:00 (OUI 00-00-00) Filter policy: Allow Scan Request from Any, Allow Connect Request from Any (0x00) TX power: Host has no preference (0x7f) Primary PHY: LE 1M (0x01) Secondary max skip: 0x00 Secondary PHY: LE 2M (0x02) SID: 0x01 Scan request notifications: Disabled (0x00) Signed-off-by: Luiz Augusto von Dentz commit 2df108c227b266a9ec9e3fda3828d2ac9662aa33 Author: Luiz Augusto von Dentz Date: Mon Jun 9 14:53:53 2025 -0400 Bluetooth: ISO: Fix using BT_SK_PA_SYNC to detect BIS sockets BT_SK_PA_SYNC is only valid for Broadcast Sinks which means socket used for Broadcast Sources wouldn't be able to use the likes of getpeername to read out the sockaddr_iso_bc fields which may have been update (e.g. bc_sid). Fixes: 0a766a0affb5 ("Bluetooth: ISO: Fix getpeername not returning sockaddr_iso_bc fields") Signed-off-by: Luiz Augusto von Dentz commit 47c03902269aff377f959dc3fd94a9733aa31d6e Author: Luiz Augusto von Dentz Date: Tue Jun 10 10:14:35 2025 -0400 Bluetooth: eir: Fix possible crashes on eir_create_adv_data eir_create_adv_data may attempt to add EIR_FLAGS and EIR_TX_POWER without checking if that would fit. Link: https://github.com/bluez/bluez/issues/1117#issuecomment-2958244066 Fixes: 01ce70b0a274 ("Bluetooth: eir: Move EIR/Adv Data functions to its own file") Signed-off-by: Luiz Augusto von Dentz commit 5725bc608252050ed8a4d47d59225b7dd73474c8 Author: Luiz Augusto von Dentz Date: Thu Jun 5 11:15:16 2025 -0400 Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance When using and existing adv_info instance for broadcast source it needs to be updated to periodic first before it can be reused, also in case the existing instance already have data hci_set_adv_instance_data cannot be used directly since it would overwrite the existing data so this reappend the original data after the Broadcast ID, if one was generated. Example: bluetoothctl># Add PBP to EA so it can be later referenced as the BIS ID bluetoothctl> advertise.service 0x1856 0x00 0x00 bluetoothctl> advertise on ... < HCI Command: LE Set Extended Advertising Data (0x08|0x0037) plen 13 Handle: 0x01 Operation: Complete extended advertising data (0x03) Fragment preference: Minimize fragmentation (0x01) Data length: 0x09 Service Data: Public Broadcast Announcement (0x1856) Data[2]: 0000 Flags: 0x06 LE General Discoverable Mode BR/EDR Not Supported ... bluetoothctl># Attempt to acquire Broadcast Source transport bluetoothctl>transport.acquire /org/bluez/hci0/pac_bcast0/fd0 ... < HCI Command: LE Set Extended Advertising Data (0x08|0x0037) plen 255 Handle: 0x01 Operation: Complete extended advertising data (0x03) Fragment preference: Minimize fragmentation (0x01) Data length: 0x0e Service Data: Broadcast Audio Announcement (0x1852) Broadcast ID: 11371620 (0xad8464) Service Data: Public Broadcast Announcement (0x1856) Data[2]: 0000 Flags: 0x06 LE General Discoverable Mode BR/EDR Not Supported Link: https://github.com/bluez/bluez/issues/1117 Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections") Signed-off-by: Luiz Augusto von Dentz commit 20a2aa01f5aeb6daad9aeaa7c33dd512c58d81eb Author: Luiz Augusto von Dentz Date: Thu Jun 5 11:14:25 2025 -0400 Bluetooth: Fix NULL pointer deference on eir_get_service_data The len parameter is considered optional so it can be NULL so it cannot be used for skipping to next entry of EIR_SERVICE_DATA. Fixes: 8f9ae5b3ae80 ("Bluetooth: eir: Add helpers for managing service data") Signed-off-by: Luiz Augusto von Dentz commit 62a65b32bddb0f242b106b8c464913f2f01c108d Author: Drew Fustini Date: Fri Jun 6 11:11:17 2025 -0700 dt-bindings: pmem: Convert binding to YAML Convert the PMEM device tree binding from text to YAML. This will allow device trees with pmem-region nodes to pass dtbs_check. [iweiny: fix ups from Rob/Drew] Acked-by: Conor Dooley Acked-by: Oliver O'Halloran Signed-off-by: Drew Fustini Acked-by: Dan Williams Link: https://patch.msgid.link/20250606184405.359812-4-drew@pdp7.com Signed-off-by: Ira Weiny commit 488ef3560196ee10fc1c5547e1574a87068c3494 Author: Herbert Xu Date: Wed May 28 13:18:17 2025 +0100 KEYS: Invert FINAL_PUT bit Invert the FINAL_PUT bit so that test_bit_acquire and clear_bit_unlock can be used instead of smp_mb. Signed-off-by: Herbert Xu Signed-off-by: David Howells Reviewed-by: Jarkko Sakkinen Signed-off-by: Linus Torvalds commit 179a8427fcbffe36ccfed5e138d7c9b6180caff9 Author: Ashish Kalra Date: Mon May 12 22:16:34 2025 +0000 KVM: SEV: Disable SEV-SNP support on initialization failure During platform init, SNP initialization may fail for several reasons, such as firmware command failures and incompatible versions. However, the KVM capability may continue to advertise support for it. The platform may have SNP enabled but if SNP_INIT fails then SNP is not supported by KVM. During KVM module initialization query the SNP platform status to obtain the SNP initialization state and use it as an additional condition to determine support for SEV-SNP. Co-developed-by: Sean Christopherson Signed-off-by: Sean Christopherson Co-developed-by: Pratik R. Sampat Signed-off-by: Pratik R. Sampat Reviewed-by: Tom Lendacky Signed-off-by: Ashish Kalra Reviewed-by: Pankaj Gupta Reviewed-by: Pavan Kumar Paluri Message-ID: <20250512221634.12045-1-Ashish.Kalra@amd.com> Signed-off-by: Paolo Bonzini commit ce360c2bfd219130bf1df4282ccf2e9bdf3a5ed5 Merge: 19272b37aa4f83 fad4cf944839da Author: Paolo Bonzini Date: Wed Jun 11 14:25:22 2025 -0400 Merge tag 'kvmarm-fixes-6.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 6.16, take #2 - Rework of system register accessors for system registers that are directly writen to memory, so that sanitisation of the in-memory value happens at the correct time (after the read, or before the write). For convenience, RMW-style accessors are also provided. - Multiple fixes for the so-called "arch-timer-edge-cases' selftest, which was always broken. commit 83f066fac3c231e58e9adf3b307e96fee172dfb3 Author: Dan Carpenter Date: Wed Jun 11 16:09:45 2025 +0300 spi: stm32-ospi: clean up on error in probe() If reset_control_acquire() fails, then we can't return directly. We need to do a little clean up first. Fixes: cf2c3eceb757 ("spi: stm32-ospi: Make usage of reset_control_acquire/release() API") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aEmAGTUzzKZlLe3K@stanley.mountain Signed-off-by: Mark Brown commit 69a14d146f3b87819f3fb73ed5d1de3e1fa680c1 Author: Sebastian Andrzej Siewior Date: Mon Jun 2 13:00:27 2025 +0200 futex: Verify under the lock if hash can be replaced Once the global hash is requested there is no way back to switch back to the per-task private hash. This is checked at the begin of the function. It is possible that two threads simultaneously request the global hash and both pass the initial check and block later on the mm::futex_hash_lock. In this case the first thread performs the switch to the global hash. The second thread will also attempt to switch to the global hash and while doing so, accessing the nonexisting slot 1 of the struct futex_private_hash. The same applies if the hash is made immutable: There is no reference counting and the hash must not be replaced. Verify under mm_struct::futex_phash that neither the global hash nor an immutable hash in use. Tested-by: "Lai, Yi" Reported-by: "Lai, Yi" Closes: https://lore.kernel.org/all/aDwDw9Aygqo6oAx+@ly-workstation/ Fixes: bd54df5ea7cad ("futex: Allow to resize the private local hash") Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/all/20250610104400.1077266-5-bigeasy@linutronix.de/ commit 961296e89dc3800e6a3abc3f5d5bb4192cf31e98 Author: Jens Axboe Date: Wed Jun 11 08:48:46 2025 -0600 block: use plug request list tail for one-shot backmerge attempt Previously, the block layer stored the requests in the plug list in LIFO order. For this reason, blk_attempt_plug_merge() would check just the head entry for a back merge attempt, and abort after that unless requests for multiple queues existed in the plug list. If more than one request is present in the plug list, this makes the one-shot back merging less useful than before, as it'll always fail to find a quick merge candidate. Use the tail entry for the one-shot merge attempt, which is the last added request in the list. If that fails, abort immediately unless there are multiple queues available. If multiple queues are available, then scan the list. Ideally the latter scan would be a backwards scan of the list, but as it currently stands, the plug list is singly linked and hence this isn't easily feasible. Cc: stable@vger.kernel.org Link: https://lore.kernel.org/linux-block/20250611121626.7252-1-abuehaze@amazon.com/ Reported-by: Hazem Mohamed Abuelfotoh Fixes: e70c301faece ("block: don't reorder requests in blk_add_rq_to_plug") Signed-off-by: Jens Axboe commit cf625013d8741c01407bbb4a60c111b61b9fa69d Author: Christoph Hellwig Date: Wed Jun 11 06:44:16 2025 +0200 block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work Bios queued up in the zone write plug have already gone through all all preparation in the submit_bio path, including the freeze protection. Submitting them through submit_bio_noacct_nocheck duplicates the work and can can cause deadlocks when freezing a queue with pending bio write plugs. Go straight to ->submit_bio or blk_mq_submit_bio to bypass the superfluous extra freeze protection and checks. Fixes: 9b1ce7f0c6f8 ("block: Implement zone append emulation") Reported-by: Bart Van Assche Signed-off-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Reviewed-by: Damien Le Moal Tested-by: Damien Le Moal Link: https://lore.kernel.org/r/20250611044416.2351850-1-hch@lst.de Signed-off-by: Jens Axboe commit f705d33c2f0353039d03e5d6f18f70467d86080e Author: Damien Le Moal Date: Wed Jun 11 09:59:15 2025 +0900 block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion When blk_zone_write_plug_bio_endio() is called for a regular write BIO used to emulate a zone append operation, that is, a BIO flagged with BIO_EMULATES_ZONE_APPEND, the BIO operation code is restored to the original REQ_OP_ZONE_APPEND but the BIO_EMULATES_ZONE_APPEND flag is not cleared. Clear it to fully return the BIO to its orginal definition. Fixes: 9b1ce7f0c6f8 ("block: Implement zone append emulation") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20250611005915.89843-1-dlemoal@kernel.org Signed-off-by: Jens Axboe commit ff20c516485efbeb5c32bcb6aa5a24f73774185b Author: Ming Lei Date: Wed Jun 11 16:56:32 2025 +0800 ublk: document auto buffer registration(UBLK_F_AUTO_BUF_REG) Document recently merged feature auto buffer registration(UBLK_F_AUTO_BUF_REG). Cc: Caleb Sander Mateos Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250611085632.109719-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 4bb08cf974c54adc321b8505ce82720c2a15c451 Author: Ming Lei Date: Wed Jun 11 16:49:38 2025 +0800 loop: move lo_set_size() out of queue freeze It isn't necessary to freeze queue for updating disk size given submit_bio() doesn't grab queue usage counter for checking eod. Also many driver won't freeze queue for calling set_capacity_and_notify(). Move lo_set_size() out of queue freeze for fixing many lockdep warning report. Link: https://lore.kernel.org/linux-block/67ea99e0.050a0220.3c3d88.0042.GAE@google.com/ Reported-by: syzbot+9dd7dbb1a4b915dee638@syzkaller.appspotmail.com Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250611084938.108829-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 72f37957007d25f4290e3ba40d40aaec1dd0b0cf Author: Binbin Zhou Date: Tue Jun 10 19:59:26 2025 +0800 gpio: loongson-64bit: Correct Loongson-7A2000 ACPI GPIO access mode According to the description of the Loongson-7A2000 ACPI GPIO register in the manual, its access mode should be BIT_CTRL_MODE, otherwise there maybe some unpredictable behavior. Cc: stable@vger.kernel.org Fixes: 44fe79020b91 ("gpio: loongson-64bit: Add more gpio chip support") Signed-off-by: Binbin Zhou Reviewed-by: Huacai Chen Link: https://lore.kernel.org/r/20250610115926.347845-1-zhoubinbin@loongson.cn Signed-off-by: Bartosz Golaszewski commit bc4394e5e79cdda1b0997e0be1d65e242f523f02 Author: Kan Liang Date: Fri Jun 6 12:25:46 2025 -0700 perf: Fix the throttle error of some clock events Both ARM and IBM CI reports RCU stall, which can be reproduced by the below perf command. perf record -a -e cpu-clock -- sleep 2 The issue is introduced by the generic throttle patch set, which unconditionally invoke the event_stop() when throttle is triggered. The cpu-clock and task-clock are two special SW events, which rely on the hrtimer. The throttle is invoked in the hrtimer handler. The event_stop()->hrtimer_cancel() waits for the handler to finish, which is a deadlock. Instead of invoking the stop(), the HRTIMER_NORESTART should be used to stop the timer. There may be two ways to fix it: - Introduce a PMU flag to track the case. Avoid the event_stop in perf_event_throttle() if the flag is detected. It has been implemented in the https://lore.kernel.org/lkml/20250528175832.2999139-1-kan.liang@linux.intel.com/ The new flag was thought to be an overkill for the issue. - Add a check in the event_stop. Return immediately if the throttle is invoked in the hrtimer handler. Rely on the existing HRTIMER_NORESTART method to stop the timer. The latter is implemented here. Move event->hw.interrupts = MAX_INTERRUPTS before the stop(). It makes the order the same as perf_event_unthrottle(). Except the patch, no one checks the hw.interrupts in the stop(). There is no impact from the order change. When stops in the throttle, the event should not be updated, stop(event, 0). But the cpu_clock_event_stop() doesn't handle the flag. In logic, it's wrong. But it didn't bring any problems with the old code, because the stop() was not invoked when handling the throttle. Checking the flag before updating the event. Fixes: 9734e25fbf5a ("perf: Fix the throttle logic for a group") Closes: https://lore.kernel.org/lkml/20250527161656.GJ2566836@e132581.arm.com/ Closes: https://lore.kernel.org/lkml/djxlh5fx326gcenwrr52ry3pk4wxmugu4jccdjysza7tlc5fef@ktp4rffawgcw/ Closes: https://lore.kernel.org/lkml/8e8f51d8-af64-4d9e-934b-c0ee9f131293@linux.ibm.com/ Closes: https://lore.kernel.org/lkml/4ce106d0-950c-aadc-0b6a-f0215cd39913@maine.edu/ Reported-by: Leo Yan Reported-by: Aishwarya TCV Reported-by: Alexei Starovoitov Reported-by: Venkat Rao Bagalkote Reported-by: Vince Weaver Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Ian Rogers Link: https://lkml.kernel.org/r/20250606192546.915765-1-kan.liang@linux.intel.com commit 260388f79e94fb3026c419a208ece8358bb7b555 Author: Jakub Raczynski Date: Mon Jun 9 17:31:47 2025 +0200 net/mdiobus: Fix potential out-of-bounds clause 45 read/write access When using publicly available tools like 'mdio-tools' to read/write data from/to network interface and its PHY via C45 (clause 45) mdiobus, there is no verification of parameters passed to the ioctl and it accepts any mdio address. Currently there is support for 32 addresses in kernel via PHY_MAX_ADDR define, but it is possible to pass higher value than that via ioctl. While read/write operation should generally fail in this case, mdiobus provides stats array, where wrong address may allow out-of-bounds read/write. Fix that by adding address verification before C45 read/write operation. While this excludes this access from any statistics, it improves security of read/write operation. Fixes: 4e4aafcddbbf ("net: mdio: Add dedicated C45 API to MDIO bus drivers") Signed-off-by: Jakub Raczynski Reported-by: Wenjing Shan Signed-off-by: David S. Miller commit 0e629694126ca388916f059453a1c36adde219c4 Author: Jakub Raczynski Date: Mon Jun 9 17:31:46 2025 +0200 net/mdiobus: Fix potential out-of-bounds read/write access When using publicly available tools like 'mdio-tools' to read/write data from/to network interface and its PHY via mdiobus, there is no verification of parameters passed to the ioctl and it accepts any mdio address. Currently there is support for 32 addresses in kernel via PHY_MAX_ADDR define, but it is possible to pass higher value than that via ioctl. While read/write operation should generally fail in this case, mdiobus provides stats array, where wrong address may allow out-of-bounds read/write. Fix that by adding address verification before read/write operation. While this excludes this access from any statistics, it improves security of read/write operation. Fixes: 080bb352fad00 ("net: phy: Maintain MDIO device and bus statistics") Signed-off-by: Jakub Raczynski Reported-by: Wenjing Shan Signed-off-by: David S. Miller commit afe382843717d44b24ef5014d57dcbaab75a4052 Author: Marek Szyprowski Date: Wed May 7 18:09:12 2025 +0200 udmabuf: use sgtable-based scatterlist wrappers Use common wrappers operating directly on the struct sg_table objects to fix incorrect use of scatterlists sync calls. dma_sync_sg_for_*() functions have to be called with the number of elements originally passed to dma_map_sg_*() function, not the one returned in sgtable's nents. Fixes: 1ffe09590121 ("udmabuf: fix dma-buf cpu access") CC: stable@vger.kernel.org Signed-off-by: Marek Szyprowski Acked-by: Vivek Kasireddy Reviewed-by: Christian König Signed-off-by: Christian König Link: https://lore.kernel.org/r/20250507160913.2084079-3-m.szyprowski@samsung.com commit 6f29d393061c2c1fa30a72a0e9b01e15e09dae34 Author: Niklas Cassel Date: Tue Jun 10 13:07:59 2025 +0200 ata: ahci: Use correct BIOS build date for ThinkPad W541 quirk Fix the TODO in ahci_broken_lpm() by using the proper BIOS build date. The proper BIOS build date was provided by Hans, see Link. Link: https://lore.kernel.org/linux-ide/6ea509c8-b38d-4941-8a29-c1117ff3dd5b@redhat.com/ Reviewed-by: Damien Le Moal Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250610110757.1318959-6-cassel@kernel.org Signed-off-by: Niklas Cassel commit 3e5378779091c2f9a96d4404066e1923c92ceb8b Author: Philipp Stanner Date: Tue Jun 10 15:54:14 2025 +0200 ata: pata_macio: Fix PCI region leak pci_request_regions() became a managed devres functions if the PCI device was enabled with pcim_enable_device(), which is the case for pata_macio. The PCI subsystem recently removed this hybrid feature from pci_request_region(). When doing so, pata_macio was forgotten to be ported to use pcim_request_all_regions(). If that function is not used, pata_macio will fail on driver-reload because the PCI regions will remain blocked. Fix the region leak by replacing pci_request_regions() with its managed counterpart, pcim_request_all_regions(). Fixes: 51f6aec99cb0 ("PCI: Remove hybrid devres nature from request functions") Signed-off-by: Philipp Stanner Reviewed-by: Kuppuswamy Sathyanarayanan Reviewed-by: Damien Le Moal Link: https://lore.kernel.org/r/20250610135413.35930-2-phasta@kernel.org Signed-off-by: Niklas Cassel commit ad5a0351064c8f744416df3a49156d2c61af5bc0 Author: NeilBrown Date: Tue Jun 10 11:04:04 2025 +1000 VFS: change try_lookup_noperm() to skip revalidation The recent change from using d_hash_and_lookup() to using try_lookup_noperm() inadvertently introduce a d_revalidate() call when the lookup was successful. Steven French reports that this resulted in worse than halving of performance in some cases. Prior to the offending patch the only caller of try_lookup_noperm() was autofs which does not need the d_revalidate(). So it is safe to remove the d_revalidate() call providing we stop using try_lookup_noperm() to implement lookup_noperm(). The "try_" in the name is strongly suggestive that the caller isn't expecting much effort, so it seems reasonable to avoid the effort of d_revalidate(). Fixes: 06c567403ae5 ("Use try_lookup_noperm() instead of d_hash_and_lookup() outside of VFS") Reported-by: Steve French Link: https://lore.kernel.org/all/CAH2r5mu5SfBrdc2CFHwzft8=n9koPMk+Jzwpy-oUMx-wCRCesQ@mail.gmail.com/ Signed-off-by: NeilBrown Link: https://lore.kernel.org/174951744454.608730.18354002683881684261@noble.neil.brown.name Tested-by: Steve French Signed-off-by: Christian Brauner commit 6bdd3a01fe4627ad7a562ba38eb759eba715b671 Author: Christoph Hellwig Date: Tue Jun 10 16:00:20 2025 +0200 fs: add missing values to TRACE_IOCB_STRINGS Make sure all values are covered. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/20250610140020.2227932-1-hch@lst.de Signed-off-by: Christian Brauner commit aa3f93cd75bf8195e434deefff853d70d723d6f0 Author: Christian König Date: Thu Jun 5 10:38:30 2025 +0200 dma-buf: fix compare in WARN_ON_ONCE Smatch pointed out this trivial typo: drivers/dma-buf/dma-buf.c:1123 dma_buf_map_attachment() warn: passing positive error code '16' to 'ERR_PTR' drivers/dma-buf/dma-buf.c 1113 dma_resv_assert_held(attach->dmabuf->resv); 1114 1115 if (dma_buf_pin_on_map(attach)) { 1116 ret = attach->dmabuf->ops->pin(attach); 1117 /* 1118 * Catch exporters making buffers inaccessible even when 1119 * attachments preventing that exist. 1120 */ 1121 WARN_ON_ONCE(ret == EBUSY); ^^^^^ This was probably intended to be -EBUSY? 1122 if (ret) --> 1123 return ERR_PTR(ret); ^^^ Otherwise we will eventually crash. 1124 } 1125 1126 sg_table = attach->dmabuf->ops->map_dma_buf(attach, direction); 1127 if (!sg_table) 1128 sg_table = ERR_PTR(-ENOMEM); 1129 if (IS_ERR(sg_table)) 1130 goto error_unpin; 1131 Signed-off-by: Christian König Reviewed-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20250605085336.62156-1-christian.koenig@amd.com commit f87586598fffac31afc1141471b789251b030a76 Author: Zilin Guan Date: Fri May 23 11:01:56 2025 +0000 wifi: cfg80211: use kfree_sensitive() for connkeys cleanup The nl80211_parse_connkeys() function currently uses kfree() to release the 'result' structure in error handling paths. However, if an error occurs due to result->def being less than 0, the 'result' structure may contain sensitive information. To prevent potential leakage of sensitive data, replace kfree() with kfree_sensitive() when freeing 'result'. This change aligns with the approach used in its caller, nl80211_join_ibss(), enhancing the overall security of the wireless subsystem. Signed-off-by: Zilin Guan Link: https://patch.msgid.link/20250523110156.4017111-1-zilin@seu.edu.cn Signed-off-by: Johannes Berg commit 8d60350891b185553836ebea1c406078a69a56e4 Merge: 6a0f81c549a00f f3fe49dbddd73f Author: Johannes Berg Date: Wed Jun 11 11:28:35 2025 +0200 Merge tag 'ath-current-20250608' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git updates for v6.16-rc2 Fix a handful of both build and stability issues across multiple drivers. ================== Signed-off-by: Johannes Berg commit 6a0f81c549a00f87865ff0ad2400944ca0726868 Author: Emmanuel Grumbach Date: Tue Jun 3 12:17:54 2025 +0300 wifi: iwlwifi: fix merge damage related to iwl_pci_resume The changes I made in wifi: iwlwifi: don't warn if the NIC is gone in resume conflicted with a major rework done in this area. The merge de-facto removed my changes. Re-add them. Signed-off-by: Emmanuel Grumbach Link: https://patch.msgid.link/20250603091754.70182-1-emmanuel.grumbach@intel.com Fixes: 06c4b2036818 ("Merge tag 'iwlwifi-next-2025-05-15' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next") Signed-off-by: Johannes Berg commit 570896604f47d44d4ff6882d2a588428d2a6ef17 Author: Francesco Dolcini Date: Thu Jun 5 15:03:02 2025 +0200 Revert "wifi: mwifiex: Fix HT40 bandwidth issue." This reverts commit 4fcfcbe45734 ("wifi: mwifiex: Fix HT40 bandwidth issue.") That commit introduces a regression, when HT40 mode is enabled, received packets are lost, this was experience with W8997 with both SDIO-UART and SDIO-SDIO variants. From an initial investigation the issue solves on its own after some time, but it's not clear what is the reason. Given that this was just a performance optimization, let's revert it till we have a better understanding of the issue and a proper fix. Cc: Jeff Chen Cc: stable@vger.kernel.org Fixes: 4fcfcbe45734 ("wifi: mwifiex: Fix HT40 bandwidth issue.") Closes: https://lore.kernel.org/all/20250603203337.GA109929@francesco-nb/ Signed-off-by: Francesco Dolcini Link: https://patch.msgid.link/20250605130302.55555-1-francesco@dolcini.it [fix commit reference format] Signed-off-by: Johannes Berg commit 7cd9a11dd0c3d1dd225795ed1b5b53132888e7b5 Author: Mike Rapoport (Microsoft) Date: Tue Jun 3 14:14:45 2025 +0300 Revert "mm/execmem: Unify early execmem_cache behaviour" The commit d6d1e3e6580c ("mm/execmem: Unify early execmem_cache behaviour") changed early behaviour of execemem ROX cache to allow its usage in early x86 code that allocates text pages when CONFIG_MITGATION_ITS is enabled. The permission management of the pages allocated from execmem for ITS mitigation is now completely contained in arch/x86/kernel/alternatives.c and therefore there is no need to special case early allocations in execmem. This reverts commit d6d1e3e6580ca35071ad474381f053cbf1fb6414. Signed-off-by: Mike Rapoport (Microsoft) Signed-off-by: Peter Zijlstra (Intel) Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20250603111446.2609381-6-rppt@kernel.org commit a82b26451de126a5ae130361081986bc459afe9b Author: Peter Zijlstra (Intel) Date: Tue Jun 3 14:14:44 2025 +0300 x86/its: explicitly manage permissions for ITS pages execmem_alloc() sets permissions differently depending on the kernel configuration, CPU support for PSE and whether a page is allocated before or after mark_rodata_ro(). Add tracking for pages allocated for ITS when patching the core kernel and make sure the permissions for ITS pages are explicitly managed for both kernel and module allocations. Fixes: 872df34d7c51 ("x86/its: Use dynamic thunks for indirect branches") Signed-off-by: Peter Zijlstra (Intel) Co-developed-by: Mike Rapoport (Microsoft) Signed-off-by: Mike Rapoport (Microsoft) Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Nikolay Borisov Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20250603111446.2609381-5-rppt@kernel.org commit 0b0cae7119a0ec9449d7261b5e672a5fed765068 Author: Mike Rapoport (Microsoft) Date: Tue Jun 3 14:14:43 2025 +0300 x86/its: move its_pages array to struct mod_arch_specific The of pages with ITS thunks allocated for modules are tracked by an array in 'struct module'. Since this is very architecture specific data structure, move it to 'struct mod_arch_specific'. No functional changes. Fixes: 872df34d7c51 ("x86/its: Use dynamic thunks for indirect branches") Suggested-by: Peter Zijlstra (Intel) Signed-off-by: Mike Rapoport (Microsoft) Signed-off-by: Peter Zijlstra (Intel) Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20250603111446.2609381-4-rppt@kernel.org commit 47410d839fcda6890cb82828f874f97710982f24 Author: Mike Rapoport (Microsoft) Date: Tue Jun 3 14:14:42 2025 +0300 x86/Kconfig: only enable ROX cache in execmem when STRICT_MODULE_RWX is set Currently ROX cache in execmem is enabled regardless of STRICT_MODULE_RWX setting. This breaks an assumption that module memory is writable when STRICT_MODULE_RWX is disabled, for instance for kernel debuggin. Only enable ROX cache in execmem when STRICT_MODULE_RWX is set to restore the original behaviour of module text permissions. Fixes: 64f6a4e10c05 ("x86: re-enable EXECMEM_ROX support") Signed-off-by: Mike Rapoport (Microsoft) Signed-off-by: Peter Zijlstra (Intel) Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20250603111446.2609381-3-rppt@kernel.org commit 1dbf30fdb5e57fb2c39f17f35f2b544d5de34397 Author: Juergen Gross Date: Tue Jun 3 14:14:41 2025 +0300 x86/mm/pat: don't collapse pages without PSE set Collapsing pages to a leaf PMD or PUD should be done only if X86_FEATURE_PSE is available, which is not the case when running e.g. as a Xen PV guest. Fixes: 41d88484c71c ("x86/mm/pat: restore large ROX pages after fragmentation") Signed-off-by: Juergen Gross Signed-off-by: Mike Rapoport (Microsoft) Signed-off-by: Peter Zijlstra (Intel) Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250528123557.12847-3-jgross@suse.com commit d9816ec74e6d6aa29219d010bba3f780ba1d9d75 Author: Carlos Fernandez Date: Mon Jun 9 09:26:26 2025 +0200 macsec: MACsec SCI assignment for ES = 0 According to 802.1AE standard, when ES and SC flags in TCI are zero, used SCI should be the current active SC_RX. Current code uses the header MAC address. Without this patch, when ES flag is 0 (using a bridge or switch), header MAC will not fit the SCI and MACSec frames will be discarted. In order to test this issue, MACsec link should be stablished between two interfaces, setting SC and ES flags to zero and a port identifier different than one. For example, using ip macsec tools: ip link add link $ETH0 macsec0 type macsec port 11 send_sci off end_station off ip macsec add macsec0 tx sa 0 pn 2 on key 01 $ETH1_KEY ip macsec add macsec0 rx port 11 address $ETH1_MAC ip macsec add macsec0 rx port 11 address $ETH1_MAC sa 0 pn 2 on key 02 ip link set dev macsec0 up ip link add link $ETH1 macsec1 type macsec port 11 send_sci off end_station off ip macsec add macsec1 tx sa 0 pn 2 on key 01 $ETH0_KEY ip macsec add macsec1 rx port 11 address $ETH0_MAC ip macsec add macsec1 rx port 11 address $ETH0_MAC sa 0 pn 2 on key 02 ip link set dev macsec1 up Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver") Co-developed-by: Andreu Montiel Signed-off-by: Andreu Montiel Signed-off-by: Carlos Fernandez Reviewed-by: Subbaraya Sundeep Signed-off-by: David S. Miller commit b8d3291d3185b5c69ba36362ae1a370f06a33e5c Author: Nathan Chancellor Date: Tue Jun 10 12:40:38 2025 -0700 drm/sitronix: st7571-i2c: Select VIDEOMODE_HELPERS This driver requires of_get_display_timing() from CONFIG_VIDEOMODE_HELPERS but does not select it. If no other driver selects it, there will be a failure from the linker if the driver is built in or modpost if it is a module. ERROR: modpost: "of_get_display_timing" [drivers/gpu/drm/sitronix/st7571-i2c.ko] undefined! Select CONFIG_VIDEOMODE_HELPERS to resolve the build failure. Fixes: 4b35f0f41ee2 ("drm/st7571-i2c: add support for Sitronix ST7571 LCD controller") Signed-off-by: Nathan Chancellor Link: https://lore.kernel.org/r/20250610-drm-st7571-i2c-select-videomode-helpers-v1-1-d30b50ff6e64@kernel.org Signed-off-by: Maxime Ripard commit 40a98e702b528c631094f2e524d309faf33dc774 Author: Eric Biggers Date: Tue Jun 10 12:16:00 2025 -0700 crypto: hkdf - move to late_initcall The HKDF self-tests depend on the HMAC algorithms being registered. HMAC is now registered at module_init, which put it at the same level as HKDF. Move HKDF to late_initcall so that it runs afterwards. Fixes: ef93f1562803 ("Revert "crypto: run initcalls for generic implementations earlier"") Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit 8d90d9872edae7e78c3a12b98e239bfaa66f3639 Author: Charles Mirabile Date: Fri May 30 17:14:22 2025 -0400 riscv: fix runtime constant support for nommu kernels the `__runtime_fixup_32` function does not handle the case where `val` is zero correctly (as might occur when patching a nommu kernel and referring to a physical address below the 4GiB boundary whose upper 32 bits are all zero) because nothing in the existing logic prevents the code from taking the `else` branch of both nop-checks and emitting two `nop` instructions. This leaves random garbage in the register that is supposed to receive the upper 32 bits of the pointer instead of zero that when combined with the value for the lower 32 bits yields an invalid pointer and causes a kernel panic when that pointer is eventually accessed. The author clearly considered the fact that if the `lui` is converted into a `nop` that the second instruction needs to be adjusted to become an `li` instead of an `addi`, hence introducing the `addi_insn_mask` variable, but didn't follow that logic through fully to the case where the `else` branch executes. To fix it just adjust the logic to ensure that the second `else` branch is not taken if the first instruction will be patched to a `nop`. Fixes: a44fb5722199 ("riscv: Add runtime constant support") Signed-off-by: Charles Mirabile Reviewed-by: Charlie Jenkins Tested-by: Charlie Jenkins Link: https://lore.kernel.org/r/20250530211422.784415-2-cmirabil@redhat.com Signed-off-by: Palmer Dabbelt commit f478d68b653323b691280b40fbd3b8ca1ac75aa2 Author: Lorenzo Bianconi Date: Mon Jun 9 22:40:35 2025 +0200 net: airoha: Enable RX queues 16-31 Fix RX_DONE_INT_MASK definition in order to enable RX queues 16-31. Fixes: f252493e18353 ("net: airoha: Enable multiple IRQ lines support in airoha_eth driver.") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250609-aioha-fix-rx-queue-mask-v1-1-f33706a06fa2@kernel.org Signed-off-by: Jakub Kicinski commit c85bf1975108d2e2431c11d1cb7e95aca587dfbe Author: Gustavo Luiz Duarte Date: Mon Jun 9 11:24:20 2025 -0700 netconsole: fix appending sysdata when sysdata_fields == SYSDATA_RELEASE Before appending sysdata, prepare_extradata() checks if any feature is enabled in sysdata_fields (and exits early if none is enabled). When SYSDATA_RELEASE was introduced, we missed adding it to the list of features being checked against sysdata_fields in prepare_extradata(). The result was that, if only SYSDATA_RELEASE is enabled in sysdata_fields, we incorreclty exit early and fail to append the release. Instead of checking specific bits in sysdata_fields, check if sysdata_fields has ALL bit zeroed and exit early if true. This fixes case when only SYSDATA_RELEASE enabled and makes the code more general / less error prone in future feature implementation. Signed-off-by: Gustavo Luiz Duarte Reviewed-by: Breno Leitao Fixes: cfcc9239e78a ("netconsole: append release to sysdata") Link: https://patch.msgid.link/20250609-netconsole-fix-v1-1-17543611ae31@gmail.com Signed-off-by: Jakub Kicinski commit 2660a544fdc0940bba15f70508a46cf9a6491230 Author: Michal Luczaj Date: Mon Jun 9 19:08:03 2025 +0200 net: Fix TOCTOU issue in sk_is_readable() sk->sk_prot->sock_is_readable is a valid function pointer when sk resides in a sockmap. After the last sk_psock_put() (which usually happens when socket is removed from sockmap), sk->sk_prot gets restored and sk->sk_prot->sock_is_readable becomes NULL. This makes sk_is_readable() racy, if the value of sk->sk_prot is reloaded after the initial check. Which in turn may lead to a null pointer dereference. Ensure the function pointer does not turn NULL after the check. Fixes: 8934ce2fd081 ("bpf: sockmap redirect ingress support") Suggested-by: Jakub Sitnicki Signed-off-by: Michal Luczaj Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250609-skisreadable-toctou-v1-1-d0dfb2d62c37@rbox.co Signed-off-by: Jakub Kicinski commit f3054152c12e2eed1e72704aff47b0ea58229584 Author: Thomas Zeitlhofer Date: Mon May 19 10:54:46 2025 +0200 HID: wacom: fix crash in wacom_aes_battery_handler() Commit fd2a9b29dc9c ("HID: wacom: Remove AES power_supply after extended inactivity") introduced wacom_aes_battery_handler() which is scheduled as a delayed work (aes_battery_work). In wacom_remove(), aes_battery_work is not canceled. Consequently, if the device is removed while aes_battery_work is still pending, then hard crashes or "Oops: general protection fault..." are experienced when wacom_aes_battery_handler() is finally called. E.g., this happens with built-in USB devices after resume from hibernate when aes_battery_work was still pending at the time of hibernation. So, take care to cancel aes_battery_work in wacom_remove(). Fixes: fd2a9b29dc9c ("HID: wacom: Remove AES power_supply after extended inactivity") Signed-off-by: Thomas Zeitlhofer Acked-by: Ping Cheng Signed-off-by: Jiri Kosina commit dc9c67820f81ee0d34f9095195228fcb828315ff Author: Lucas Sanchez Sagrado Date: Mon Jun 9 16:55:36 2025 +0200 net: usb: r8152: Add device ID for TP-Link UE200 The TP-Link UE200 is a RTL8152B based USB 2.0 Fast Ethernet adapter. This patch adds its device ID. It has been tested on Ubuntu 22.04.5. Signed-off-by: Lucas Sanchez Sagrado Reviewed-by: Subbaraya Sundeep Link: https://patch.msgid.link/20250609145536.26648-1-lucsansag@gmail.com Signed-off-by: Jakub Kicinski commit 85cc50bfcb8b08c9304925b66cd2bc83c1c765bf Author: Li Ming Date: Tue Jun 3 18:43:14 2025 +0800 cxl/Documentation: Add more description about min/max scrub cycle user can configurare scrub cycle for a region or a memory device via sysfs interface. Currently, these interfaces have not enough description for the return value. So adding return value description to these interfaces. Suggested-by: Alison Schofield Signed-off-by: Shiju Jose Signed-off-by: Li Ming Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Reviewed-by: Davidlohr Bueso Link: https://patch.msgid.link/20250603104314.25569-2-ming.li@zohomail.com Signed-off-by: Dave Jiang commit fdc9be90929081ed5a9658583aa5f3121d5e8365 Author: Li Ming Date: Tue Jun 3 18:43:13 2025 +0800 cxl/edac: Fix the min_scrub_cycle of a region miscalculation When trying to update the scrub_cycle value of a cxl region, which means updating the scrub_cycle value of each memdev under a cxl region. cxl driver needs to guarantee the new scrub_cycle value is greater than the min_scrub_cycle value of a memdev, otherwise the updating operation will fail(Per Table 8-223 in CXL r3.2 section 8.2.10.9.11.1). Current implementation logic of getting the min_scrub_cycle value of a cxl region is that getting the min_scrub_cycle value of each memdevs under the cxl region, then using the minimum min_scrub_cycle value as the region's min_scrub_cycle. Checking if the new scrub_cycle value is greater than this value. If yes, updating the new scrub_cycle value to each memdevs. The issue is that the new scrub_cycle value is possibly greater than the minimum min_scrub_cycle value of all memdevs but less than the maximum min_scrub_cycle value of all memdevs if memdevs have a different min_scrub_cycle value. The updating operation will always fail on these memdevs which have a greater min_scrub_cycle than the new scrub_cycle. The correct implementation logic is to get the maximum value of these memdevs' min_scrub_cycle, check if the new scrub_cycle value is greater than the value. If yes, the new scrub_cycle value is fit for the region. The change also impacts the result of cxl_patrol_scrub_get_min_scrub_cycle(), the interface returned the minimum min_scrub_cycle value among all memdevs under the region before the change. The interface will return the maximum min_scrub_cycle value among all memdevs under the region with the change. Signed-off-by: Li Ming Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Reviewed-by: Shiju Jose Reviewed-by: Davidlohr Bueso Link: https://patch.msgid.link/20250603104314.25569-1-ming.li@zohomail.com Signed-off-by: Dave Jiang commit e0eb1b6b0cd29ca7793c501d5960fd36ba11f110 Author: Fangrui Song Date: Mon Jun 2 20:48:44 2025 -0700 riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment .rodata is implicitly included in the PT_DYNAMIC segment due to inheriting the segment of the preceding .dynamic section (in both GNU ld and LLD). When the .rodata section's size is not a multiple of 16 bytes on riscv64, llvm-readelf will report a "PT_DYNAMIC dynamic table is invalid" warning. Note: in the presence of the .dynamic section, GNU readelf and llvm-readelf's -d option decodes the dynamic section using the section. This issue arose after commit 8f8c1ff879fab60f80f3a7aec3000f47e5b03ba9 ("riscv: vdso.lds.S: remove hardcoded 0x800 .text start addr"), which placed .rodata directly after .dynamic by removing .eh_frame. This patch resolves the implicit inclusion into PT_DYNAMIC by explicitly specifying the :text output section phdr. Reported-by: Nathan Chancellor Closes: https://github.com/ClangBuiltLinux/linux/issues/2093 Signed-off-by: Fangrui Song Tested-by: Nathan Chancellor Link: https://lore.kernel.org/r/20250602-riscv-vdso-v1-1-0620cf63cff0@maskray.me Signed-off-by: Palmer Dabbelt commit 5cdb49a680b45f467e9d915c0e74756bc0c67c57 Author: Zhang Lixu Date: Tue Jun 10 10:01:32 2025 +0800 HID: intel-ish-hid: ipc: Add Wildcat Lake PCI device ID Add device ID of Wildcat Lake into ishtp support list. Signed-off-by: Zhang Lixu Acked-by: Srinivas Pandruvada Signed-off-by: Jiri Kosina commit 0e97f5b6a0808fa2ea865280708511c817d4bca3 Author: Zhang Lixu Date: Tue Jun 10 10:01:31 2025 +0800 hid: intel-ish-hid: Use PCI_DEVICE_DATA() macro for ISH device table Replace the usage of PCI_VDEVICE() with driver_data assignment in the ISH PCI device table with the PCI_DEVICE_DATA() macro. This improves code readability. Signed-off-by: Zhang Lixu Acked-by: Srinivas Pandruvada Signed-off-by: Jiri Kosina commit 9327e3ee5b077c4ab4495a09b67624f670ed88b6 Author: Iusico Maxim Date: Thu Jun 5 19:55:50 2025 +0200 HID: lenovo: Restrict F7/9/11 mode to compact keyboards only Commit 2f2bd7cbd1d1 ("hid: lenovo: Resend all settings on reset_resume for compact keyboards") introduced a regression for ThinkPad TrackPoint Keyboard II by removing the conditional check for enabling F7/9/11 mode needed for compact keyboards only. As a result, the non-compact keyboards can no longer toggle Fn-lock via Fn+Esc, although it can be controlled via sysfs knob that directly sends raw commands. This patch restores the previous conditional check without any additions. Cc: stable@vger.kernel.org Fixes: 2f2bd7cbd1d1 ("hid: lenovo: Resend all settings on reset_resume for compact keyboards") Signed-off-by: Iusico Maxim Signed-off-by: Jiri Kosina commit 1a8953f4f7746c6a515989774fe03047c522c613 Author: Zhang Heng Date: Thu Jun 5 15:29:59 2025 +0800 HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY MARTLINKTECHNOLOGY is a microphone device, when the HID interface in an audio device is requested to get specific report id, the following error may occur. [ 562.939373] usb 1-1.4.1.2: new full-speed USB device number 21 using xhci_hcd [ 563.104908] usb 1-1.4.1.2: New USB device found, idVendor=4c4a, idProduct=4155, bcdDevice= 1.00 [ 563.104910] usb 1-1.4.1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 563.104911] usb 1-1.4.1.2: Product: USB Composite Device [ 563.104912] usb 1-1.4.1.2: Manufacturer: SmartlinkTechnology [ 563.104913] usb 1-1.4.1.2: SerialNumber: 20201111000001 [ 563.229499] input: SmartlinkTechnology USB Composite Device as /devices/pci0000:00/0000:00:07.1/0000:04:00.3/usb1/1-1/1-1.4/1-1.4.1/1-1.4.1.2/1-1.4.1.2:1.2/0003:4C4A:4155.000F/input/input35 [ 563.291505] hid-generic 0003:4C4A:4155.000F: input,hidraw2: USB HID v2.01 Keyboard [SmartlinkTechnology USB Composite Device] on usb-0000:04:00.3-1.4.1.2/input2 [ 563.291557] usbhid 1-1.4.1.2:1.3: couldn't find an input interrupt endpoint [ 568.506654] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110) [ 573.626656] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110) [ 578.746657] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110) [ 583.866655] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110) [ 588.986657] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110) Ignore HID interface. The device is working properly. Signed-off-by: Zhang Heng Signed-off-by: Jiri Kosina commit 9cf1e25053c269d64b9e9fa25e8697d6d58028d4 Author: Stanislav Fomichev Date: Tue Jun 10 10:54:37 2025 -0700 MAINTAINERS: Add myself as bpf networking reviewer I've been focusing on networking BPF bits lately, add myself as a reviewer. Signed-off-by: Stanislav Fomichev Acked-by: KP Singh Acked-by: Daniel Borkmann Acked-by: Jakub Kicinski Link: https://lore.kernel.org/r/20250610175442.2138504-1-stfomichev@gmail.com Signed-off-by: Alexei Starovoitov commit fa10d4515817274a50af510d5d283d3c7fffc1ae Author: Mario Limonciello Date: Fri May 23 11:10:07 2025 -0500 HID: input: lower message severity of 'No inputs registered, leaving' to debug Plugging in a "Blue snowball" microphone always shows the error 'No inputs registered, leaving', but the device functions as intended. When a HID device is started using the function hid_hw_start() and the argument HID_CONNECT_DEFAULT it will try all various hid connect requests. Not all devices will create an input device and so the message is needlessly noisy. Decrease it to debug instead. [jkosina@suse.com: edit shortlog] Signed-off-by: Mario Limonciello Signed-off-by: Jiri Kosina commit 54bae4c17c11688339eb73a04fd24203bb6e7494 Author: Chia-Lin Kao (AceLan) Date: Tue May 6 13:50:15 2025 +0800 HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras The Chicony Electronics HP 5MP Cameras (USB ID 04F2:B824 & 04F2:B82C) report a HID sensor interface that is not actually implemented. Attempting to access this non-functional sensor via iio_info causes system hangs as runtime PM tries to wake up an unresponsive sensor. Add these 2 devices to the HID ignore list since the sensor interface is non-functional by design and should not be exposed to userspace. Signed-off-by: Chia-Lin Kao (AceLan) Signed-off-by: Jiri Kosina commit 0b3bc018e86afdc0cbfef61328c63d5c08f8b370 Author: Kai Huang Date: Sat Jun 7 01:07:37 2025 +1200 x86/virt/tdx: Avoid indirect calls to TDX assembly functions Two 'static inline' TDX helper functions (sc_retry() and sc_retry_prerr()) take function pointer arguments which refer to assembly functions. Normally, the compiler inlines the TDX helper, realizes that the function pointer targets are completely static -- thus can be resolved at compile time -- and generates direct call instructions. But, other times (like when CONFIG_CC_OPTIMIZE_FOR_SIZE=y), the compiler declines to inline the helpers and will instead generate indirect call instructions. Indirect calls to assembly functions require special annotation (for various Control Flow Integrity mechanisms). But TDX assembly functions lack the special annotations and can only be called directly. Annotate both the helpers as '__always_inline' to prod the compiler into maintaining the direct calls. There is no guarantee here, but Peter has volunteered to report the compiler bug if this assumption ever breaks[1]. Fixes: 1e66a7e27539 ("x86/virt/tdx: Handle SEAMCALL no entropy error in common code") Fixes: df01f5ae07dd ("x86/virt/tdx: Add SEAMCALL error printing for module initialization") Signed-off-by: Kai Huang Signed-off-by: Dave Hansen Cc: stable@vger.kernel.org Link: https://lore.kernel.org/lkml/20250605145914.GW39944@noisy.programming.kicks-ass.net/ [1] Link: https://lore.kernel.org/all/20250606130737.30713-1-kai.huang%40intel.com commit 73f3a7415d93cf418c7625d03bce72da84344406 Author: Even Xu Date: Wed May 14 14:26:38 2025 +0800 HID: Intel-thc-hid: Intel-quicki2c: Enhance QuickI2C reset flow During customer board enabling, it was found: some touch devices prepared reset response, but either forgot sending interrupt or THC missed reset interrupt because of timing issue. THC QuickI2C driver depends on interrupt to read reset response, in this case, it will cause driver waiting timeout. This patch enhances the flow by adding manually reset response reading after waiting for reset interrupt timeout. Signed-off-by: Even Xu Tested-by: Chong Han Fixes: 66b59bfce6d9 ("HID: intel-thc-hid: intel-quicki2c: Complete THC QuickI2C driver") Signed-off-by: Jiri Kosina commit 4a0381080397e77792a5168069f174d3e56175ff Author: Daniel J. Ogorchock Date: Tue May 13 03:47:00 2025 -0400 HID: nintendo: avoid bluetooth suspend/resume stalls Ensure we don't stall or panic the kernel when using bluetooth-connected controllers. This was reported as an issue on android devices using kernel 6.6 due to the resume hook which had been added for usb joycons. First, set a new state value to JOYCON_CTLR_STATE_SUSPENDED in a newly-added nintendo_hid_suspend. This makes sure we will not stall out the kernel waiting for input reports during led classdev suspend. The stalls could happen if connectivity is unreliable or lost to the controller prior to suspend. Second, since we lose connectivity during suspend, do not try joycon_init() for bluetooth controllers in the nintendo_hid_resume path. Tested via multiple suspend/resume flows when using the controller both in USB and bluetooth modes. Signed-off-by: Daniel J. Ogorchock Reviewed-by: Silvan Jegen Signed-off-by: Jiri Kosina commit 85a720f4337f0ddf1603c8b75a8f1ffbbe022ef9 Author: Qasim Ijaz Date: Fri Jun 6 19:49:59 2025 +0100 HID: wacom: fix kobject reference count leak When sysfs_create_files() fails in wacom_initialize_remotes() the error is returned and the cleanup action will not have been registered yet. As a result the kobject???s refcount is never dropped, so the kobject can never be freed leading to a reference leak. Fix this by calling kobject_put() before returning. Fixes: 83e6b40e2de6 ("HID: wacom: EKR: have the wacom resources dynamically allocated") Acked-by: Ping Cheng Cc: stable@vger.kernel.org Signed-off-by: Qasim Ijaz Signed-off-by: Jiri Kosina commit 1a19ae437ca5d5c7d9ec2678946fb339b1c706bf Author: Qasim Ijaz Date: Fri Jun 6 19:49:58 2025 +0100 HID: wacom: fix memory leak on sysfs attribute creation failure When sysfs_create_files() fails during wacom_initialize_remotes() the fifo buffer is not freed leading to a memory leak. Fix this by calling kfifo_free() before returning. Fixes: 83e6b40e2de6 ("HID: wacom: EKR: have the wacom resources dynamically allocated") Reviewed-by: Ping Cheng Cc: stable@vger.kernel.org Signed-off-by: Qasim Ijaz Signed-off-by: Jiri Kosina commit 5ae416c5b1e2e816aee7b3fc8347adf70afabb4c Author: Qasim Ijaz Date: Fri Jun 6 19:49:57 2025 +0100 HID: wacom: fix memory leak on kobject creation failure During wacom_initialize_remotes() a fifo buffer is allocated with kfifo_alloc() and later a cleanup action is registered during devm_add_action_or_reset() to clean it up. However if the code fails to create a kobject and register it with sysfs the code simply returns -ENOMEM before the cleanup action is registered leading to a memory leak. Fix this by ensuring the fifo is freed when the kobject creation and registration process fails. Fixes: 83e6b40e2de6 ("HID: wacom: EKR: have the wacom resources dynamically allocated") Reviewed-by: Ping Cheng Cc: stable@vger.kernel.org Signed-off-by: Qasim Ijaz Signed-off-by: Jiri Kosina commit 72840238e2bcb8fb24cb35d8d1d5a822c04e62a4 Author: Uros Bizjak Date: Mon Jun 9 08:35:01 2025 +0200 intel_idle: Update arguments of mwait_idle_with_hints() Commit a17b37a3f416 ("x86/idle: Change arguments of mwait_idle_with_hints() to u32") changed the type of arguments of mwait_idle_with_hints() from unsigned long to u32. Change the type of variables in the call to mwait_idle_with_hints() to unsigned int to follow the change. Signed-off-by: Uros Bizjak Reviewed-by: Artem Bityutskiy Link: https://patch.msgid.link/20250609063528.48715-1-ubizjak@gmail.com Signed-off-by: Rafael J. Wysocki commit c99ad987d3e9b550e9839d5df22de97d90462e5f Author: Wentao Guan Date: Tue Jun 3 20:20:59 2025 +0800 ACPI: resource: Use IRQ override on MACHENIKE 16P Use ACPI IRQ override on MACHENIKE laptop to make the internal keyboard work. Add a new entry to the irq1_edge_low_force_override structure, similar to the existing ones. Link: https://bbs.deepin.org.cn/zh/post/287628 Signed-off-by: Wentao Guan Link: https://patch.msgid.link/20250603122059.1072790-1-guanwentao@uniontech.com Signed-off-by: Rafael J. Wysocki commit 7a0d59f6a913a2bc7680c663b8cf1e45d1bdbf26 Author: Armin Wolf Date: Fri May 30 01:53:10 2025 +0200 ACPI: EC: Ignore ECDT tables with an invalid ID string On the MSI Modern 14 C5M the ECDT table contains invalid data: UID : 00000000 GPE Number : 00 /* Invalid, 03 would be correct */ Namepath : "" /* Invalid, "\_SB.PCI0.SBRG.EC" would * be correct */ This slows down the EC access as the wrong GPE event is used for communication. Additionally the ID string is invalid. Ignore such faulty ECDT tables by verifying that the ID string has a valid format. Tested-by: glpnk@proton.me Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20250529235310.540530-1-W_Armin@gmx.de Signed-off-by: Rafael J. Wysocki commit 15eece6c5b05e5f9db0711978c3e3b7f1a2cfe12 Author: Yunhui Cui Date: Wed Jun 4 10:30:36 2025 +0800 ACPI: CPPC: Fix NULL pointer dereference when nosmp is used With nosmp in cmdline, other CPUs are not brought up, leaving their cpc_desc_ptr NULL. CPU0's iteration via for_each_possible_cpu() dereferences these NULL pointers, causing panic. Panic backtrace: [ 0.401123] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000b8 ... [ 0.403255] [] cppc_allow_fast_switch+0x6a/0xd4 ... Kernel panic - not syncing: Attempted to kill init! Fixes: 3cc30dd00a58 ("cpufreq: CPPC: Enable fast_switch") Reported-by: Xu Lu Signed-off-by: Yunhui Cui Link: https://patch.msgid.link/20250604023036.99553-1-cuiyunhui@bytedance.com [ rjw: New subject ] Signed-off-by: Rafael J. Wysocki commit 2f76d269073bdb2971b253ef87d1f96f1a94c50e Author: Uros Bizjak Date: Mon Jun 9 08:42:06 2025 +0200 ACPI: PAD: Update arguments of mwait_idle_with_hints() Commit a17b37a3f416 ("x86/idle: Change arguments of mwait_idle_with_hints() to u32") changed the type of arguments of mwait_idle_with_hints() from unsigned long to u32. Change the type of variables in the call to mwait_idle_with_hints() to unsigned int to follow the change. Signed-off-by: Uros Bizjak Link: https://patch.msgid.link/20250609064235.49146-1-ubizjak@gmail.com Signed-off-by: Rafael J. Wysocki commit 5b2d595efbfc9c46823bdb9ef11e1f9fa46adf9d Author: FUJITA Tomonori Date: Fri Jun 6 11:05:05 2025 +0900 rust: time: Fix compile error in impl_has_hr_timer macro Fix a compile error in the `impl_has_hr_timer!` macro as follows: error[E0599]: no method named cast_mut found for raw pointer *mut Foo in the current scope The `container_of!` macro already returns a mutable pointer when used in a `*mut T` context so the `.cast_mut()` method is not available. [ We missed this one because there is no caller yet and it is a macro. - Miguel ] Fixes: 74d6a606c2b3 ("rust: retain pointer mut-ness in `container_of!`") Signed-off-by: FUJITA Tomonori Reviewed-by: Benno Lossin Acked-by: Andreas Hindborg Link: https://lore.kernel.org/r/20250606020505.3186533-1-fujita.tomonori@gmail.com Signed-off-by: Miguel Ojeda commit 162457f5853ce3348e7956666916f5e5e31be51f Author: Dan Williams Date: Fri Jun 6 20:32:28 2025 -0700 ACPI: APEI: EINJ: Do not fail einj_init() on faux_device_create() failure CXL has a symbol dependency on einj_core.ko, so if einj_init() fails then cxl_core.ko fails to load. Prior to the faux_device_create() conversion, einj_probe() failures were tracked by the einj_initialized flag without failing einj_init(). Revert to that behavior and always succeed einj_init() given there is no way, and no pressing need, to discern faux device-create vs device-probe failures. This situation arose because CXL knows proper kernel named objects to trigger errors against, but acpi-einj knows how to perform the error injection. The injection mechanism is shared with non-CXL use cases. The result is CXL now has a module dependency on einj-core.ko, and init/probe failures are handled at runtime. Fixes: 6cb9441bfe8d ("ACPI: APEI: EINJ: Transition to the faux device interface") Signed-off-by: Dan Williams Reviewed-by: Ben Cheatham Acked-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20250607033228.1475625-4-dan.j.williams@intel.com Signed-off-by: Rafael J. Wysocki commit ff53a6e247285687df1a71d8ee5c457939792c13 Author: Dan Williams Date: Fri Jun 6 20:32:27 2025 -0700 driver core: faux: Quiet probe failures The acpi-einj conversion to faux_device_create() leads to a noisy error message when the error injection facility is disabled. Quiet the error as CXL error injection via ACPI expects the module to stay loaded even if the error injection facility is disabled. This situation arose because CXL knows proper kernel named objects to trigger errors against, but acpi-einj knows how to perform the error injection. The injection mechanism is shared with non-CXL use cases. The result is CXL now has a module dependency on einj-core.ko, and init/probe failures are handled at runtime. Fixes: 6cb9441bfe8d ("ACPI: APEI: EINJ: Transition to the faux device interface") Signed-off-by: Dan Williams Reviewed-by: Jonathan Cameron Acked-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20250607033228.1475625-3-dan.j.williams@intel.com Signed-off-by: Rafael J. Wysocki commit c393befa14ab26596fb86d702566d648832dae06 Author: Dan Williams Date: Fri Jun 6 20:32:26 2025 -0700 driver core: faux: Suppress bind attributes faux_device_create() is almost a suitable candidate to replace platform_driver_probe() if not for the fact that faux_device_create() supports dynamic attach/detach of the driver. Drop the bind attributes with the expectation that simple faux devices can always assume that the device is permanently bound at create, and only unbound at 'destroy'. The acpi-einj driver depends on static bind. Fixes: 6cb9441bfe8d ("ACPI: APEI: EINJ: Transition to the faux device interface") Signed-off-by: Dan Williams Reviewed-by: Jonathan Cameron Acked-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20250607033228.1475625-2-dan.j.williams@intel.com Signed-off-by: Rafael J. Wysocki commit aef17cb3d3c43854002956f24c24ec8e1a0e3546 Author: Linus Torvalds Date: Tue Jun 10 10:22:15 2025 -0700 Revert "mm/damon/Kconfig: enable CONFIG_DAMON by default" This reverts commit 28615e6eed152f2fda5486680090b74aeed7b554. No, we don't make random features default to being on. Reported-by: Geert Uytterhoeven Cc: Andrew Morton Cc: SeongJae Park Signed-off-by: Linus Torvalds commit ac0b8b327a5677dc6fecdf353d808161525b1ff0 Author: Penglei Jiang Date: Tue Jun 10 10:18:01 2025 -0700 io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo() syzbot reports: BUG: KASAN: slab-use-after-free in getrusage+0x1109/0x1a60 Read of size 8 at addr ffff88810de2d2c8 by task a.out/304 CPU: 0 UID: 0 PID: 304 Comm: a.out Not tainted 6.16.0-rc1 #1 PREEMPT(voluntary) Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: dump_stack_lvl+0x53/0x70 print_report+0xd0/0x670 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? getrusage+0x1109/0x1a60 kasan_report+0xce/0x100 ? getrusage+0x1109/0x1a60 getrusage+0x1109/0x1a60 ? __pfx_getrusage+0x10/0x10 __io_uring_show_fdinfo+0x9fe/0x1790 ? ksys_read+0xf7/0x1c0 ? do_syscall_64+0xa4/0x260 ? vsnprintf+0x591/0x1100 ? __pfx___io_uring_show_fdinfo+0x10/0x10 ? __pfx_vsnprintf+0x10/0x10 ? mutex_trylock+0xcf/0x130 ? __pfx_mutex_trylock+0x10/0x10 ? __pfx_show_fd_locks+0x10/0x10 ? io_uring_show_fdinfo+0x57/0x80 io_uring_show_fdinfo+0x57/0x80 seq_show+0x38c/0x690 seq_read_iter+0x3f7/0x1180 ? inode_set_ctime_current+0x160/0x4b0 seq_read+0x271/0x3e0 ? __pfx_seq_read+0x10/0x10 ? __pfx__raw_spin_lock+0x10/0x10 ? __mark_inode_dirty+0x402/0x810 ? selinux_file_permission+0x368/0x500 ? file_update_time+0x10f/0x160 vfs_read+0x177/0xa40 ? __pfx___handle_mm_fault+0x10/0x10 ? __pfx_vfs_read+0x10/0x10 ? mutex_lock+0x81/0xe0 ? __pfx_mutex_lock+0x10/0x10 ? fdget_pos+0x24d/0x4b0 ksys_read+0xf7/0x1c0 ? __pfx_ksys_read+0x10/0x10 ? do_user_addr_fault+0x43b/0x9c0 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f0f74170fc9 Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 8 RSP: 002b:00007fffece049e8 EFLAGS: 00000206 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0f74170fc9 RDX: 0000000000001000 RSI: 00007fffece049f0 RDI: 0000000000000004 RBP: 00007fffece05ad0 R08: 0000000000000000 R09: 00007fffece04d90 R10: 0000000000000000 R11: 0000000000000206 R12: 00005651720a1100 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Allocated by task 298: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_slab_alloc+0x6e/0x70 kmem_cache_alloc_node_noprof+0xe8/0x330 copy_process+0x376/0x5e00 create_io_thread+0xab/0xf0 io_sq_offload_create+0x9ed/0xf20 io_uring_setup+0x12b0/0x1cc0 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 22: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x37/0x50 kmem_cache_free+0xc4/0x360 rcu_core+0x5ff/0x19f0 handle_softirqs+0x18c/0x530 run_ksoftirqd+0x20/0x30 smpboot_thread_fn+0x287/0x6c0 kthread+0x30d/0x630 ret_from_fork+0xef/0x1a0 ret_from_fork_asm+0x1a/0x30 Last potentially related work creation: kasan_save_stack+0x33/0x60 kasan_record_aux_stack+0x8c/0xa0 __call_rcu_common.constprop.0+0x68/0x940 __schedule+0xff2/0x2930 __cond_resched+0x4c/0x80 mutex_lock+0x5c/0xe0 io_uring_del_tctx_node+0xe1/0x2b0 io_uring_clean_tctx+0xb7/0x160 io_uring_cancel_generic+0x34e/0x760 do_exit+0x240/0x2350 do_group_exit+0xab/0x220 __x64_sys_exit_group+0x39/0x40 x64_sys_call+0x1243/0x1840 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88810de2cb00 which belongs to the cache task_struct of size 3712 The buggy address is located 1992 bytes inside of freed 3712-byte region [ffff88810de2cb00, ffff88810de2d980) which is caused by the task_struct pointed to by sq->thread being released while it is being used in the function __io_uring_show_fdinfo(). Holding ctx->uring_lock does not prevent ehre relase or exit of sq->thread. Fix this by assigning and looking up ->thread under RCU, and grabbing a reference to the task_struct. This ensures that it cannot get released while fdinfo is using it. Reported-by: syzbot+531502bbbe51d2f769f4@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/682b06a5.a70a0220.3849cf.00b3.GAE@google.com Fixes: 3fcb9d17206e ("io_uring/sqpoll: statistics of the true utilization of sq threads") Signed-off-by: Penglei Jiang Link: https://lore.kernel.org/r/20250610171801.70960-1-superman.xpt@gmail.com [axboe: massage commit message] Signed-off-by: Jens Axboe commit d08293ef1ede6a558b9cf2577aa34473f6298ca7 Merge: 19272b37aa4f83 e044b8a9545cd8 Author: Rafael J. Wysocki Date: Tue Jun 10 19:15:54 2025 +0200 Merge tag 'linux-cpupower-6.16-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux Merge an urgent cpupower utility fix for 6.16-rc1 from Shuah Khan: "Add unitdir variable for specifying the location to install systemd service units instead of installing under ${libdir}/systemd/system which doesn't work on some distributions." * tag 'linux-cpupower-6.16-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux: cpupower: split unitdir from libdir in Makefile commit c33453d08a56a45c2e72f9f56043610b8f7449c7 Author: Vitaly Kuznetsov Date: Fri Jun 6 17:41:12 2025 +0200 efi: Drop preprocessor directives from zboot.lds Older versions of `ld` don't seem to support preprocessor directives in linker scripts, e.g. on RHEL9's ld-2.35.2-63.el9 the build fails with: ld:./drivers/firmware/efi/libstub/zboot.lds:32: ignoring invalid character `#' in expression ld:./drivers/firmware/efi/libstub/zboot.lds:33: syntax error We don't seem to need these '#ifdef', no empty .sbat section is created when CONFIG_EFI_SBAT_FILE="": # objdump -h arch/arm64/boot/vmlinuz.efi arch/arm64/boot/vmlinuz.efi: file format pei-aarch64-little Sections: Idx Name Size VMA LMA File off Algn 0 .text 00b94000 0000000000001000 0000000000001000 00001000 2**2 CONTENTS, ALLOC, LOAD, READONLY, CODE 1 .data 00000200 0000000000b95000 0000000000b95000 00b95000 2**2 CONTENTS, ALLOC, LOAD, DATA Fixes: 0f9a1739dd0e ("efi: zboot specific mechanism for embedding SBAT section") Signed-off-by: Vitaly Kuznetsov Signed-off-by: Ard Biesheuvel commit b4a8085ceefb7bbb12c2b71c55e71fc946c6929f Author: Joe Damato Date: Tue Jun 3 16:34:01 2025 +0000 e1000: Move cancel_work_sync to avoid deadlock Previously, e1000_down called cancel_work_sync for the e1000 reset task (via e1000_down_and_stop), which takes RTNL. As reported by users and syzbot, a deadlock is possible in the following scenario: CPU 0: - RTNL is held - e1000_close - e1000_down - cancel_work_sync (cancel / wait for e1000_reset_task()) CPU 1: - process_one_work - e1000_reset_task - take RTNL To remedy this, avoid calling cancel_work_sync from e1000_down (e1000_reset_task does nothing if the device is down anyway). Instead, call cancel_work_sync for e1000_reset_task when the device is being removed. Fixes: e400c7444d84 ("e1000: Hold RTNL when e1000_down can be called") Reported-by: syzbot+846bb38dc67fe62cc733@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/683837bf.a00a0220.52848.0003.GAE@google.com/ Reported-by: John Closes: https://lore.kernel.org/netdev/CAP=Rh=OEsn4y_2LvkO3UtDWurKcGPnZ_NPSXK=FbgygNXL37Sw@mail.gmail.com/ Signed-off-by: Joe Damato Acked-by: Stanislav Fomichev Acked-by: Jacob Keller Signed-off-by: Tony Nguyen commit a5a441ae283d54ec329aadc7426991dc32786d52 Author: Anton Nadezhdin Date: Tue May 20 10:42:16 2025 +0200 ice/ptp: fix crosstimestamp reporting Set use_nsecs=true as timestamp is reported in ns. Lack of this result in smaller timestamp error window which cause error during phc2sys execution on E825 NICs: phc2sys[1768.256]: ioctl PTP_SYS_OFFSET_PRECISE: Invalid argument This problem was introduced in the cited commit which omitted setting use_nsecs to true when converting the ice driver to use convert_base_to_cs(). Testing hints (ethX is PF netdev): phc2sys -s ethX -c CLOCK_REALTIME -O 37 -m phc2sys[1769.256]: CLOCK_REALTIME phc offset -5 s0 freq -0 delay 0 Fixes: d4bea547ebb57 ("ice/ptp: Remove convert_art_to_tsc()") Signed-off-by: Anton Nadezhdin Reviewed-by: Aleksandr Loktionov Reviewed-by: Arkadiusz Kubalewski Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 0c6f4631436ecea841f1583b98255aedd7495b18 Author: Ahmed Zaki Date: Thu Apr 24 15:50:13 2025 +0200 iavf: fix reset_task for early reset event If a reset event is received from the PF early in the init cycle, the state machine hangs for about 25 seconds. Reproducer: echo 1 > /sys/class/net/$PF0/device/sriov_numvfs ip link set dev $PF0 vf 0 mac $NEW_MAC The log shows: [792.620416] ice 0000:5e:00.0: Enabling 1 VFs [792.738812] iavf 0000:5e:01.0: enabling device (0000 -> 0002) [792.744182] ice 0000:5e:00.0: Enabling 1 VFs with 17 vectors and 16 queues per VF [792.839964] ice 0000:5e:00.0: Setting MAC 52:54:00:00:00:11 on VF 0. VF driver will be reinitialized [813.389684] iavf 0000:5e:01.0: Failed to communicate with PF; waiting before retry [818.635918] iavf 0000:5e:01.0: Hardware came out of reset. Attempting reinit. [818.766273] iavf 0000:5e:01.0: Multiqueue Enabled: Queue pair count = 16 Fix it by scheduling the reset task and making the reset task capable of resetting early in the init cycle. Fixes: ef8693eb90ae3 ("i40evf: refactor reset handling") Signed-off-by: Ahmed Zaki Tested-by: Przemek Kitszel Reviewed-by: Przemek Kitszel Signed-off-by: Marcin Szycik Reviewed-by: Simon Horman Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit fb4e9239e029954a37a00818b21e837cebf2aa10 Author: Robert Malz Date: Tue May 20 10:31:52 2025 +0200 i40e: retry VFLR handling if there is ongoing VF reset When a VFLR interrupt is received during a VF reset initiated from a different source, the VFLR may be not fully handled. This can leave the VF in an undefined state. To address this, set the I40E_VFLR_EVENT_PENDING bit again during VFLR handling if the reset is not yet complete. This ensures the driver will properly complete the VF reset in such scenarios. Fixes: 52424f974bc5 ("i40e: Fix VF hang when reset is triggered on another VF") Signed-off-by: Robert Malz Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit a2c90d63b71223d69a813333c1abf4fdacddbbe5 Author: Robert Malz Date: Tue May 20 10:31:51 2025 +0200 i40e: return false from i40e_reset_vf if reset is in progress The function i40e_vc_reset_vf attempts, up to 20 times, to handle a VF reset request, using the return value of i40e_reset_vf as an indicator of whether the reset was successfully triggered. Currently, i40e_reset_vf always returns true, which causes new reset requests to be ignored if a different VF reset is already in progress. This patch updates the return value of i40e_reset_vf to reflect when another VF reset is in progress, allowing the caller to properly use the retry mechanism. Fixes: 52424f974bc5 ("i40e: Fix VF hang when reset is triggered on another VF") Signed-off-by: Robert Malz Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit a298bbab903e3fb4cbe16d36d6195e68fad1b776 Author: Suleiman Souhlal Date: Fri Jun 6 16:45:38 2025 +0900 tools/resolve_btfids: Fix build when cross compiling kernel with clang. When cross compiling the kernel with clang, we need to override CLANG_CROSS_FLAGS when preparing the step libraries. Prior to commit d1d096312176 ("tools: fix annoying "mkdir -p ..." logs when building tools in parallel"), MAKEFLAGS would have been set to a value that wouldn't set a value for CLANG_CROSS_FLAGS, hiding the fact that we weren't properly overriding it. Fixes: 56a2df7615fa ("tools/resolve_btfids: Compile resolve_btfids as host program") Signed-off-by: Suleiman Souhlal Signed-off-by: Andrii Nakryiko Acked-by: Jiri Olsa Cc: stable@vger.kernel.org Link: https://lore.kernel.org/bpf/20250606074538.1608546-1-suleiman@google.com commit 6dea74e454c260cd757b53a2f6861fffe6d83308 Author: Matthew Wilcox (Oracle) Date: Sun Jun 1 01:26:54 2025 +0100 f2fs: Fix __write_node_folio() conversion This conversion moved the folio_unlock() to inside __write_node_folio(), but missed one caller so we had a double-unlock on this path. Cc: Christoph Hellwig Cc: Chao Yu Cc: Jaegeuk Kim Reported-by: syzbot+c0dc46208750f063d0e0@syzkaller.appspotmail.com Fixes: 80f31d2a7e5f (f2fs: return bool from __write_node_folio) Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Christoph Hellwig Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit e8d3dc45f2d3b0fea089e0e6e351d1287a5a2a29 Author: Johan Hovold Date: Wed Apr 23 09:51:43 2025 +0200 arm64: dts: qcom: x1e80100: describe uefi rtc offset On many Qualcomm platforms the PMIC RTC control and time registers are read-only so that the RTC time can not be updated. Instead an offset needs be stored in some machine-specific non-volatile memory, which a driver can take into account. On platforms where the offset is stored in a Qualcomm specific UEFI variable the variables are also accessed in a non-standard way, which means that the OS cannot assume that the variable service is available by the time the RTC driver probes. Use the new 'qcom,uefi-rtc-info' property to indicate that the offset is stored in a UEFI variable so that the OS can determine whether to wait for it to become available. Fixes: b53c2c23d3c2 ("arm64: dts: qcom: x1e80100: enable rtc") Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20250423075143.11157-5-johan+linaro@kernel.org Signed-off-by: Bjorn Andersson commit 869971de8221b97acb6aa4d7ff4fa67eb71adc87 Author: Johan Hovold Date: Wed Apr 23 09:51:42 2025 +0200 arm64: dts: qcom: sc8280xp-x13s: describe uefi rtc offset On many Qualcomm platforms the PMIC RTC control and time registers are read-only so that the RTC time can not be updated. Instead an offset needs be stored in some machine-specific non-volatile memory, which a driver can take into account. On platforms where the offset is stored in a Qualcomm specific UEFI variable the variables are also accessed in a non-standard way, which means that the OS cannot assume that the variable service is available by the time the RTC driver probes. Use the new 'qcom,uefi-rtc-info' property to indicate that the offset is stored in a UEFI variable so that the OS can determine whether to wait for it to become available. Fixes: 409803681a55 ("arm64: dts: qcom: sc8280xp-x13s: switch to uefi rtc offset") Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20250423075143.11157-4-johan+linaro@kernel.org Signed-off-by: Bjorn Andersson commit 8a157d8a00e815cab4432653cb50c9cedbbb4931 Author: Steven Rostedt Date: Tue Jun 10 09:33:48 2025 -0400 tracing: Do not free "head" on error path of filter_free_subsystem_filters() The variable "head" is allocated and initialized as a list before allocating the first "item" for the list. If the allocation of "item" fails, it frees "head" and then jumps to the label "free_now" which will process head and free it. This will cause a UAF of "head", and it doesn't need to free it before jumping to the "free_now" label as that code will free it. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20250610093348.33c5643a@gandalf.local.home Fixes: a9d0aab5eb33 ("tracing: Fix regression of filter waiting a long time on RCU synchronization") Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202506070424.lCiNreTI-lkp@intel.com/ Signed-off-by: Steven Rostedt (Google) commit 5558f27a58459a4038ebb23bcb5bd40c1e345c57 Author: Chen-Yu Tsai Date: Sat Jun 7 21:52:03 2025 +0800 pinctrl: sunxi: dt: Consider pin base when calculating bank number from pin In prepare_function_table() when the pinctrl function table IRQ entries are generated, the pin bank is calculated from the absolute pin number; however the IRQ bank mux array is indexed from the first pin bank of the controller. For R_PIO controllers, this means the absolute pin bank is way off from the relative pin bank used for array indexing. Correct this by taking into account the pin base of the controller. Fixes: f5e2cd34b12f ("pinctrl: sunxi: allow reading mux values from DT") Signed-off-by: Chen-Yu Tsai Link: https://lore.kernel.org/20250607135203.2085226-1-wens@kernel.org Signed-off-by: Linus Walleij commit fe5b391fc56f77cf3c22a9dd4f0ce20db0e3533f Author: Johannes Berg Date: Fri Jun 6 11:01:11 2025 +0200 ata: pata_cs5536: fix build on 32-bit UML On 32-bit ARCH=um, CONFIG_X86_32 is still defined, so it doesn't indicate building on real X86 machines. There's no MSR on UML though, so add a check for CONFIG_X86. Reported-by: Arnd Bergmann Signed-off-by: Johannes Berg Link: https://lore.kernel.org/r/20250606090110.15784-2-johannes@sipsolutions.net Signed-off-by: Niklas Cassel commit 0cee6c4d3518b2e757aedae78771f17149f57653 Author: Martin Blumenstingl Date: Mon Jun 9 22:27:51 2025 +0200 drm/meson: fix more rounding issues with 59.94Hz modes Commit 1017560164b6 ("drm/meson: use unsigned long long / Hz for frequency types") attempts to resolve video playback using 59.94Hz. using YUV420 by changing the clock calculation to use Hz instead of kHz (thus yielding more precision). The basic calculation itself is correct, however the comparisions in meson_vclk_vic_supported_freq() and meson_vclk_setup() don't work anymore for 59.94Hz modes (using the freq * 1000 / 1001 logic). For example, drm/edid specifies a 593407kHz clock for 3840x2160@59.94Hz. With the mentioend commit we convert this to Hz. Then meson_vclk tries to find a matchig "params" entry (as the clock setup code currently only supports specific frequencies) by taking the venc_freq from the params and calculating the "alt frequency" (used for the 59.94Hz modes) from it, which is: (594000000Hz * 1000) / 1001 = 593406593Hz Similar calculation is applied to the phy_freq (TMDS clock), which is 10 times the pixel clock. Implement a new meson_vclk_freqs_are_matching_param() function whose purpose is to compare if the requested and calculated frequencies. They may not match exactly (for the reasons mentioned above). Allow the clocks to deviate slightly to make the 59.94Hz modes again. Fixes: 1017560164b6 ("drm/meson: use unsigned long long / Hz for frequency types") Reported-by: Christian Hewitt Signed-off-by: Martin Blumenstingl Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250609202751.962208-1-martin.blumenstingl@googlemail.com commit faf2f8382088e8c74bd6eeb236c8c9190e61615e Author: Martin Blumenstingl Date: Sat Jun 7 00:10:31 2025 +0200 drm/meson: use vclk_freq instead of pixel_freq in debug print meson_vclk_vic_supported_freq() has a debug print which includes the pixel freq. However, within the whole function the pixel freq is irrelevant, other than checking the end of the params array. Switch to printing the vclk_freq which is being compared / matched against the inputs to the function to avoid confusion when analyzing error reports from users. Fixes: e5fab2ec9ca4 ("drm/meson: vclk: add support for YUV420 setup") Signed-off-by: Martin Blumenstingl Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250606221031.3419353-1-martin.blumenstingl@googlemail.com commit d17e61ab63fb7747b340d6a66bf1408cd5c6562b Author: Martin Blumenstingl Date: Fri Jun 6 22:37:29 2025 +0200 drm/meson: fix debug log statement when setting the HDMI clocks The "phy" and "vclk" frequency labels were swapped, making it more difficult to debug driver errors. Swap the label order to make them match with the actual frequencies printed to correct this. Fixes: e5fab2ec9ca4 ("drm/meson: vclk: add support for YUV420 setup") Signed-off-by: Martin Blumenstingl Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250606203729.3311592-1-martin.blumenstingl@googlemail.com commit 33877220b8641b4cde474a4229ea92c0e3637883 Author: Tasos Sahanidis Date: Mon May 19 11:56:55 2025 +0300 ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled On at least an ASRock 990FX Extreme 4 with a VIA VT6330, the devices have not yet been enabled by the first time ata_acpi_cbl_80wire() is called. This means that the ata_for_each_dev loop is never entered, and a 40 wire cable is assumed. The VIA controller on this board does not report the cable in the PCI config space, thus having to fall back to ACPI even though no SATA bridge is present. The _GTM values are correctly reported by the firmware through ACPI, which has already set up faster transfer modes, but due to the above the controller is forced down to a maximum of UDMA/33. Resolve this by modifying ata_acpi_cbl_80wire() to directly return the cable type. First, an unknown cable is assumed which preserves the mode set by the firmware, and then on subsequent calls when the devices have been enabled, an 80 wire cable is correctly detected. Since the function now directly returns the cable type, it is renamed to ata_acpi_cbl_pata_type(). Signed-off-by: Tasos Sahanidis Link: https://lore.kernel.org/r/20250519085945.1399466-1-tasos@tasossah.com Signed-off-by: Niklas Cassel commit d29fc02caad7f94b62d56ee1b01c954f9c961ba7 Author: Tasos Sahanidis Date: Mon May 19 11:49:45 2025 +0300 ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 The controller has a hardware bug that can hard hang the system when doing ATAPI DMAs without any trace of what happened. Depending on the device attached, it can also prevent the system from booting. In this case, the system hangs when reading the ATIP from optical media with cdrecord -vvv -atip on an _NEC DVD_RW ND-4571A 1-01 and an Optiarc DVD RW AD-7200A 1.06 attached to an ASRock 990FX Extreme 4, running at UDMA/33. The issue can be reproduced by running the same command with a cygwin build of cdrecord on WinXP, although it requires more attempts to cause it. The hang in that case is also resolved by forcing PIO. It doesn't appear that VIA has produced any drivers for that OS, thus no known workaround exists. HDDs attached to the controller do not suffer from any DMA issues. Cc: stable@vger.kernel.org Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/916677 Signed-off-by: Tasos Sahanidis Link: https://lore.kernel.org/r/20250519085508.1398701-1-tasos@tasossah.com Signed-off-by: Niklas Cassel commit 6325766d69900d1aa9733fc7572456fc4427b708 Author: Thorsten Blum Date: Tue Jun 10 12:32:16 2025 +0200 ASoC: sdw_utils: Fix potential NULL pointer deref in is_sdca_endpoint_present() Check the return value of kzalloc() and exit early to avoid a potential NULL pointer dereference. Cc: stable@vger.kernel.org Fixes: 4f8ef33dd44a ("ASoC: soc_sdw_utils: skip the endpoint that doesn't present") Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20250610103225.1475-2-thorsten.blum@linux.dev Signed-off-by: Mark Brown commit 4823a58093c6dfa20df62b5c18da613621b9716e Author: Viresh Kumar Date: Tue Jun 10 16:38:56 2025 +0530 cpufreq: Convert `/// SAFETY` lines to `# Safety` sections Replace `/// SAFETY` comments in doc comments with proper `# Safety` sections, as per rustdoc conventions. Also mark the C FFI callbacks as `unsafe` to correctly reflect their safety requirements. Reported-by: Miguel Ojeda Closes: https://github.com/Rust-for-Linux/linux/issues/1169 Signed-off-by: Viresh Kumar commit c0317ad44f45b3c1f0ff46a4e28d14c7bccdedf4 Author: Gabriel Dalimonte Date: Sun Jun 1 12:45:36 2025 -0400 drm/vc4: fix infinite EPROBE_DEFER loop `vc4_hdmi_audio_init` calls `devm_snd_dmaengine_pcm_register` which may return EPROBE_DEFER. Calling `drm_connector_hdmi_audio_init` adds a child device. The driver model docs[1] state that adding a child device prior to returning EPROBE_DEFER may result in an infinite loop. [1] https://www.kernel.org/doc/html/v6.14/driver-api/driver-model/driver.html Fixes: 9640f1437a88 ("drm/vc4: hdmi: switch to using generic HDMI Codec infrastructure") Signed-off-by: Gabriel Dalimonte Link: https://lore.kernel.org/r/20250601-vc4-audio-inf-probe-v2-1-9ad43c7b6147@gmail.com Signed-off-by: Maxime Ripard commit 8d2c2fa2209e83d0eb10f7330d8a0bbdc1df32ff Author: Tudor Ambarus Date: Fri Jun 6 10:45:37 2025 +0000 firmware: exynos-acpm: fix timeouts on xfers handling The mailbox framework has a single inflight request at a time. If a request is sent while another is still active, it will be queued to the mailbox core ring buffer. ACPM protocol did not serialize the calls to the mailbox subsystem so we could start the timeout ticks in parallel for multiple requests, while just one was being inflight. Consider a hypothetical case where the xfer timeout is 100ms and an ACPM transaction takes 90ms: | 0ms: Message #0 is queued in mailbox layer and sent out, then sits | at acpm_dequeue_by_polling() with a timeout of 100ms | 1ms: Message #1 is queued in mailbox layer but not sent out yet. | Since send_message() doesn't block, it also sits at | acpm_dequeue_by_polling() with a timeout of 100ms | ... | 90ms: Message #0 is completed, txdone is called and message #1 is sent | 101ms: Message #1 times out since the count started at 1ms. Even though | it has only been inflight for 11ms. Fix the problem by moving mbox_send_message() and mbox_client_txdone() immediately after the message has been written to the TX queue and while still keeping the ACPM TX queue lock. We thus tie together the TX write with the doorbell ring and mark the TX as done after the doorbell has been rung. This guarantees that the doorbell has been rang before starting the timeout ticks. We should also see some performance improvement as we no longer wait to receive a response before ringing the doorbell for the next request, so the ACPM firmware shall be able to drain faster the TX queue. Another benefit is that requests are no longer able to ring the doorbell one for the other, so it eases debugging. Finally, the mailbox software queue will always contain a single doorbell request due to the serialization done at the ACPM TX queue level. Protocols like ACPM, that handle their own hardware queues need a passthrough mailbox API, where they are able to just ring the doorbell or flip a bit directly into the mailbox controller. The mailbox software queue mechanism, the locking done into the mailbox core is not really needed, so hopefully this lays the foundation for a passthrough mailbox API. Reported-by: André Draszik Fixes: a88927b534ba ("firmware: add Exynos ACPM protocol driver") Signed-off-by: Tudor Ambarus Link: https://lore.kernel.org/r/20250606-acpm-timeout-v2-1-306b1aa07a6c@linaro.org Signed-off-by: Krzysztof Kozlowski commit f17d5b90947a7b89a27913abf47cb0c7063b3430 Author: Casey Connolly Date: Fri May 23 13:55:34 2025 +0200 arm64: defconfig: update renamed PHY_SNPS_EUSB2 This config option was renamed, update the defconfig to match. Fixes: 8d3b5f637546 ("phy: move phy-qcom-snps-eusb2 out of its vendor sub-directory") Signed-off-by: Casey Connolly Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250523115630.459249-3-casey.connolly@linaro.org Signed-off-by: Krzysztof Kozlowski commit e0d4a0f1d066f14522049e827107a577444d9183 Author: Yang Shen Date: Thu May 29 11:40:23 2025 +0800 MAINTAINERS: Update HiSilicon GPIO driver maintainer Add Yang Shen as the maintainer of the HiSilicon GPIO driver, replacing Jay Fang. Signed-off-by: Yang Shen Reviewed-by: Jay Fang Link: https://lore.kernel.org/r/20250529034023.3780376-1-shenyang39@huawei.com Signed-off-by: Bartosz Golaszewski commit 766f6a784bdfd0747c66e40102e53c48bb89e135 Merge: b56bbaf8c9ffe0 7eb11c0ab70777 Author: Steffen Klassert Date: Tue Jun 10 09:51:54 2025 +0200 Merge branch 'xfrm: fixes for xfrm_state_find under preemption' Sabrina Dubroca says: ==================== While looking at the pcpu_id changes, I found two issues that can happen if we get preempted and the cpu_id changes. The second patch takes care of both problems. The first patch also makes sure we don't use state_ptrs uninitialized, which could currently happen. syzbot seems to have hit this issue [1]. [1] https://syzkaller.appspot.com/bug?extid=7ed9d47e15e88581dc5b ==================== Signed-off-by: Steffen Klassert commit 3fbf25ecf8b7b524b4774b427657d30a24e696ef Author: Hans de Goede Date: Mon Jun 9 16:35:57 2025 +0200 MAINTAINERS: .mailmap: Update Hans de Goede's email address I'm moving all my kernel work over to using my kernel.org email address. Update .mailmap and MAINTAINER entries still using hdegoede@redhat.com. Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20250609143558.42941-2-hansg@kernel.org Signed-off-by: Ilpo Järvinen commit ea7af94548159c57747aa8e86408a19192a1e1fe Author: Stuart Hayes Date: Mon Jun 9 13:46:59 2025 -0500 platform/x86: dell_rbu: Bump version Bump the module version. Signed-off-by: Stuart Hayes Link: https://lore.kernel.org/r/20250609184659.7210-6-stuart.w.hayes@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit f4b0fa38d5fefe9aed6ed831f3bd3538c168ee19 Author: Stuart Hayes Date: Mon Jun 9 13:46:58 2025 -0500 platform/x86: dell_rbu: Stop overwriting data buffer The dell_rbu driver will use memset() to clear the data held by each packet when it is no longer needed (when the driver is unloaded, the packet size is changed, etc). The amount of memory that is cleared (before this patch) is the normal packet size. However, the last packet in the list may be smaller. Fix this to only clear the memory actually used by each packet, to prevent it from writing past the end of data buffer. Because the packet data buffers are allocated with __get_free_pages() (in page-sized increments), this bug could only result in a buffer being overwritten when a packet size larger than one page is used. The only user of the dell_rbu module should be the Dell BIOS update program, which uses a packet size of 4096, so no issues should be seen without the patch, it just blocks the possiblity. Fixes: 6c54c28e69f2 ("[PATCH] dell_rbu: new Dell BIOS update driver") Signed-off-by: Stuart Hayes Link: https://lore.kernel.org/r/20250609184659.7210-5-stuart.w.hayes@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 61ce04601e0d8265ec6d2ffa6df5a7e1bce64854 Author: Stuart Hayes Date: Mon Jun 9 13:46:56 2025 -0500 platform/x86: dell_rbu: Fix list usage Pass the correct list head to list_for_each_entry*() when looping through the packet list. Without this patch, reading the packet data via sysfs will show the data incorrectly (because it starts at the wrong packet), and clearing the packet list will result in a NULL pointer dereference. Fixes: d19f359fbdc6 ("platform/x86: dell_rbu: don't open code list_for_each_entry*()") Signed-off-by: Stuart Hayes Link: https://lore.kernel.org/r/20250609184659.7210-3-stuart.w.hayes@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a2f32c7467e843727f20cae0e9b1545e1504a977 Author: Stuart Hayes Date: Mon Jun 9 13:46:55 2025 -0500 platform/x86: dell_rbu: Fix lock context warning Fix a sparse lock context warning. Signed-off-by: Stuart Hayes Link: https://lore.kernel.org/r/20250609184659.7210-2-stuart.w.hayes@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d7186dfd41924ef01ef490be5b82ab63cc417b31 Author: Mario Limonciello Date: Wed May 21 19:34:57 2025 -0500 platform/x86/amd: pmf: Simplify error flow in amd_pmf_init_smart_pc() commit 5b1122fc4995f ("platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc()") adjusted the error handling flow to use a ladder but this isn't actually needed because work is only scheduled in amd_pmf_start_policy_engine() and with device managed cleanups pointers for allocations don't need to be freed. Adjust the error flow to a single call to amd_pmf_deinit_smart_pc() for the cases that need to clean up. Cc: Dan Carpenter Link: https://lore.kernel.org/r/20250512211154.2510397-4-superm1@kernel.org Signed-off-by: Mario Limonciello Link: https://lore.kernel.org/r/20250522003457.1516679-4-superm1@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 93103d56650d7a38ed37ba4041578310f82776ae Author: Mario Limonciello Date: Wed May 21 19:34:56 2025 -0500 platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice If any of the tee init fails, pass up the errors and clear the tee_ctx pointer. This will prevent cleaning up multiple times. Fixes: ac052d8c08f9d ("platform/x86/amd/pmf: Add PMF TEE interface") Suggested-by: Dan Carpenter Link: https://lore.kernel.org/r/20250512211154.2510397-3-superm1@kernel.org Signed-off-by: Mario Limonciello Link: https://lore.kernel.org/r/20250522003457.1516679-3-superm1@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d9db3a941270d92bbd1a6a6b54a10324484f2f2d Author: Mario Limonciello Date: Wed May 21 19:34:55 2025 -0500 platform/x86/amd: pmf: Use device managed allocations If setting up smart PC fails for any reason then this can lead to a double free when unloading amd-pmf. This is because dev->buf was freed but never set to NULL and is again freed in amd_pmf_remove(). To avoid subtle allocation bugs in failures leading to a double free change all allocations into device managed allocations. Fixes: 5b1122fc4995f ("platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc()") Link: https://lore.kernel.org/r/20250512211154.2510397-2-superm1@kernel.org Signed-off-by: Mario Limonciello Link: https://lore.kernel.org/r/20250522003457.1516679-2-superm1@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 4c267ae2ef349639b4d9ebf00dd28586a82fdbe6 Author: Takashi Iwai Date: Tue Jun 10 08:43:20 2025 +0200 ALSA: sb: Force to disable DMAs once when DMA mode is changed When the DMA mode is changed on the (still real!) SB AWE32 after playing a stream and closing, the previous DMA setup was still silently kept, and it can confuse the hardware, resulting in the unexpected noises. As a workaround, enforce the disablement of DMA setups when the DMA setup is changed by the kcontrol. https://bugzilla.kernel.org/show_bug.cgi?id=218185 Link: https://patch.msgid.link/20250610064322.26787-2-tiwai@suse.de Signed-off-by: Takashi Iwai commit ed29e073ba93f2d52832804cabdd831d5d357d33 Author: Takashi Iwai Date: Tue Jun 10 08:43:19 2025 +0200 ALSA: sb: Don't allow changing the DMA mode during operations When a PCM stream is already running, one shouldn't change the DMA mode via kcontrol, which may screw up the hardware. Return -EBUSY instead. Link: https://bugzilla.kernel.org/show_bug.cgi?id=218185 Link: https://patch.msgid.link/20250610064322.26787-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 7b23887a0c70d15459f02c51651a111e9e5cab86 Author: Richard Fitzgerald Date: Mon Jun 9 11:21:25 2025 +0100 ALSA: hda/realtek: Add quirk for Asus GU605C The GU605C has similar audio hardware to the GU605M so apply the same quirk. Note that in the linked bugzilla there are two separate problems with the GU605C. This patch fixes one of the problems, so I haven't added a Closes: tag. Signed-off-by: Richard Fitzgerald Reported-by: Nick Karaolidis Link: https://bugzilla.kernel.org/show_bug.cgi?id=220152 Cc: Link: https://patch.msgid.link/20250609102125.63196-1-rf@opensource.cirrus.com Signed-off-by: Takashi Iwai commit c6451a7325874c119def1d4094f6815c0c8fdc23 Author: Chris Chiu Date: Tue Jun 10 11:56:07 2025 +0800 ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA The built-in mic of ASUS VivoBook X513EA is broken recently by the fix of the pin sort. The fixup ALC256_FIXUP_ASUS_MIC_NO_PRESENCE is working for addressing the regression, too. Fixes: 3b4309546b48 ("ALSA: hda: Fix headset detection failure due to unstable sort") Signed-off-by: Chris Chiu Cc: Link: https://patch.msgid.link/20250610035607.690771-1-chris.chiu@canonical.com Signed-off-by: Takashi Iwai commit f09079bd04a924c72d555cd97942d5f8d7eca98c Merge: 19272b37aa4f83 0d67f0dee6c917 Author: Linus Torvalds Date: Mon Jun 9 20:06:58 2025 -0700 Merge tag 'powerpc-6.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Madhavan Srinivasan: - a couple of fixes for out of bounds issues in memtrace and vas Thanks to Ritesh Harjani (IBM), Haren Myneni, and Jonathan Greental * tag 'powerpc-6.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap commit 0d67f0dee6c9176bc09a5482dd7346e3a0f14d0b Author: Haren Myneni Date: Tue Jun 10 07:42:27 2025 +0530 powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() The user space calls mmap() to map VAS window paste address and the kernel returns the complete mapped page for each window. So return -EINVAL if non-zero is passed for offset parameter to mmap(). See Documentation/arch/powerpc/vas-api.rst for mmap() restrictions. Co-developed-by: Jonathan Greental Signed-off-by: Jonathan Greental Reported-by: Jonathan Greental Fixes: dda44eb29c23 ("powerpc/vas: Add VAS user space API") Signed-off-by: Haren Myneni Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250610021227.361980-2-maddy@linux.ibm.com commit 3871b51a684275e3a47fbebf93c0a0e7a05d7f9f Author: Bjorn Andersson Date: Thu Jun 5 19:06:06 2025 -0500 arm64: defconfig: Enable Qualcomm CPUCP mailbox driver The Qualcomm CPUCP mailbox driver needs to be enabled for CPU frequency scaling to work on the X Elite platform, so enable this driver. Signed-off-by: Bjorn Andersson Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250605-enable-cpucp-v1-1-111ecef7e4c9@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit cd097df4596f3a1e9d75eb8520162de1eb8485b2 Author: Ritesh Harjani (IBM) Date: Tue Jun 10 07:42:26 2025 +0530 powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap memtrace mmap issue has an out of bounds issue. This patch fixes the by checking that the requested mapping region size should stay within the allocated region size. Reported-by: Jonathan Greental Fixes: 08a022ad3dfa ("powerpc/powernv/memtrace: Allow mmaping trace buffers") Signed-off-by: Ritesh Harjani (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250610021227.361980-1-maddy@linux.ibm.com commit 5c3ba81923e02adae354ec8afd006f93289b4a3c Author: Rajashekhar M A Date: Fri Jun 6 15:59:24 2025 +0200 scsi: error: alua: I/O errors for ALUA state transitions When a host is configured with a few LUNs and I/O is running, injecting FC faults repeatedly leads to path recovery problems. The LUNs have 4 paths each and 3 of them come back active after say an FC fault which makes 2 of the paths go down, instead of all 4. This happens after several iterations of continuous FC faults. Reason here is that we're returning an I/O error whenever we're encountering sense code 06/04/0a (LOGICAL UNIT NOT ACCESSIBLE, ASYMMETRIC ACCESS STATE TRANSITION) instead of retrying. Signed-off-by: Rajashekhar M A Signed-off-by: Hannes Reinecke Link: https://lore.kernel.org/r/20250606135924.27397-1-hare@kernel.org Reviewed-by: Lee Duncan Signed-off-by: Martin K. Petersen commit b2f966568faaad326de97481096d0f3dc0971c43 Author: Dexuan Cui Date: Fri Jun 6 13:57:39 2025 -0700 scsi: storvsc: Increase the timeouts to storvsc_timeout Currently storvsc_timeout is only used in storvsc_sdev_configure(), and 5s and 10s are used elsewhere. It turns out that rarely the 5s is not enough on Azure, so let's use storvsc_timeout everywhere. In case a timeout happens and storvsc_channel_init() returns an error, close the VMBus channel so that any host-to-guest messages in the channel's ringbuffer, which might come late, can be safely ignored. Add a "const" to storvsc_timeout. Cc: stable@kernel.org Signed-off-by: Dexuan Cui Link: https://lore.kernel.org/r/1749243459-10419-1-git-send-email-decui@microsoft.com Reviewed-by: Long Li Signed-off-by: Martin K. Petersen commit 0838fc3e6718743d595bf26e0e69ae55aa51fad1 Author: Rob Clark Date: Mon Jun 9 11:24:37 2025 -0700 drm/msm/adreno: Check for recognized GPU before bind If we have a newer dtb than kernel, we could end up in a situation where the GPU device is present in the dtb, but not in the drivers device table. We don't want this to prevent the display from probing. So check that we recognize the GPU before adding the GPU component. v2: use %pOF Signed-off-by: Rob Clark Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/657701/ commit fdd9ebccfc32c060d027ab9a2c957097e6997de6 Merge: 82ffbe7776d0ac 6fe26f694c824b Author: Jakub Kicinski Date: Mon Jun 9 15:47:29 2025 -0700 Merge tag 'for-net-2025-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - MGMT: Fix UAF on mgmt_remove_adv_monitor_complete - MGMT: Protect mgmt_pending list with its own lock - hci_core: fix list_for_each_entry_rcu usage - btintel_pcie: Increase the tx and rx descriptor count - btintel_pcie: Reduce driver buffer posting to prevent race condition - btintel_pcie: Fix driver not posting maximum rx buffers * tag 'for-net-2025-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: MGMT: Protect mgmt_pending list with its own lock Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition Bluetooth: btintel_pcie: Increase the tx and rx descriptor count Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers Bluetooth: hci_core: fix list_for_each_entry_rcu usage ==================== Link: https://patch.msgid.link/20250605191136.904411-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit 82ffbe7776d0ac084031f114167712269bf3d832 Author: Eric Dumazet Date: Fri Jun 6 16:51:27 2025 +0000 net_sched: sch_sfq: fix a potential crash on gso_skb handling SFQ has an assumption of always being able to queue at least one packet. However, after the blamed commit, sch->q.len can be inflated by packets in sch->gso_skb, and an enqueue() on an empty SFQ qdisc can be followed by an immediate drop. Fix sfq_drop() to properly clear q->tail in this situation. Tested: ip netns add lb ip link add dev to-lb type veth peer name in-lb netns lb ethtool -K to-lb tso off # force qdisc to requeue gso_skb ip netns exec lb ethtool -K in-lb gro on # enable NAPI ip link set dev to-lb up ip -netns lb link set dev in-lb up ip addr add dev to-lb 192.168.20.1/24 ip -netns lb addr add dev in-lb 192.168.20.2/24 tc qdisc replace dev to-lb root sfq limit 100 ip netns exec lb netserver netperf -H 192.168.20.2 -l 100 & netperf -H 192.168.20.2 -l 100 & netperf -H 192.168.20.2 -l 100 & netperf -H 192.168.20.2 -l 100 & Fixes: a53851e2c321 ("net: sched: explicit locking in gso_cpu fallback") Reported-by: Marcus Wichelmann Closes: https://lore.kernel.org/netdev/9da42688-bfaa-4364-8797-e9271f3bdaef@hetzner-cloud.de/ Signed-off-by: Eric Dumazet Reviewed-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20250606165127.3629486-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 93310053663ba647e402ef67e4bb18ec06ff8dc4 Author: Philipp Kerling Date: Sun Jun 8 20:59:00 2025 +0200 smb: client: disable path remapping with POSIX extensions If SMB 3.1.1 POSIX Extensions are available and negotiated, the client should be able to use all characters and not remap anything. Currently, the user has to explicitly request this behavior by specifying the "nomapposix" mount option. Link: https://lore.kernel.org/4195bb677b33d680e77549890a4f4dd3b474ceaf.camel@rx2.rx-server.de Signed-off-by: Philipp Kerling Reviewed-by: Namjae Jeon Signed-off-by: Steve French commit 9ab29ed505557bd106e292184fa4917955eb8e6e Author: Mario Limonciello Date: Sun Jun 8 21:34:08 2025 -0500 gpiolib: acpi: Add a quirk for Acer Nitro V15 It is reported that on Acer Nitro V15 suspend only works properly if the keyboard backlight is turned off. In looking through the issue Acer Nitro V15 has a GPIO (#8) specified in _AEI but it has no matching notify device in _EVT. The values for GPIO #8 change as keyboard backlight is turned on and off. This makes it seem that GPIO #8 is actually supposed to be solely for keyboard backlight. Turning off the interrupt for this GPIO fixes the issue. Add a quirk that does just that. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4169 Signed-off-by: Mario Limonciello Acked-by: Mika Westerberg Signed-off-by: Andy Shevchenko commit 1efb73791c828f3d1ac68ebbc5eddc35a562f9d0 Author: Rob Clark Date: Mon Jun 9 11:24:36 2025 -0700 drm/msm/adreno: Pass device_node to find_chipid() We are going to want to re-use this before the component is bound, when we don't yet have the device pointer (but we do have the of node). v2: use %pOF Signed-off-by: Rob Clark Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/657705/ commit 1453b532d193a0b1b94429c657365e14dd4f361e Author: Rob Clark Date: Mon Jun 9 11:24:35 2025 -0700 drm/msm: Rename add_components_mdp() To better match add_gpu_components(). Signed-off-by: Rob Clark Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/657700/ commit ba64c6737f8656aa86e9fbcc1ff56e56316e62f6 Author: Ryan Eatmon Date: Sat May 24 21:25:37 2025 +0530 drivers: gpu: drm: msm: registers: improve reproducibility The files generated by gen_header.py capture the source path to the input files and the date. While that can be informative, it varies based on where and when the kernel was built as the full path is captured. Since all of the files that this tool is run on is under the drivers directory, this modifies the application to strip all of the path before drivers. Additionally it prints instead of the date. Signed-off-by: Ryan Eatmon Signed-off-by: Bruce Ashfield Signed-off-by: Viswanath Kraleti Acked-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/655599/ Signed-off-by: Rob Clark commit 2b520c6104f34e3a548525173c38ebca4402cac3 Author: Connor Abbott Date: Tue May 20 18:28:06 2025 -0400 drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE Calling this packet is necessary when we switch contexts because there are various pieces of state used by userspace to synchronize between BR and BV that are persistent across submits and we need to make sure that they are in a "safe" state when switching contexts. Otherwise a userspace submission in one context could cause another context to function incorrectly and hang, effectively a denial of service (although without leaking data). This was missed during initial a7xx bringup. Fixes: af66706accdf ("drm/msm/a6xx: Add skeleton A7xx support") Signed-off-by: Connor Abbott Patchwork: https://patchwork.freedesktop.org/patch/654924/ Signed-off-by: Rob Clark commit b1c9e797ad37d188675505b66a3a4bbeea5d9560 Author: Connor Abbott Date: Tue May 20 18:28:05 2025 -0400 drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names Based on kgsl. Fixes: af66706accdf ("drm/msm/a6xx: Add skeleton A7xx support") Signed-off-by: Connor Abbott Patchwork: https://patchwork.freedesktop.org/patch/654922/ Signed-off-by: Rob Clark commit a3da9388c66782dbd808a63709e376ebe81ccca5 Merge: 19272b37aa4f83 9697ca0d53e3db Author: Martin K. Petersen Date: Mon Jun 9 15:34:06 2025 -0400 Merge branch '6.16/scsi-queue' into 6.16/scsi-fixes Pull in remaining fixes from queue branch. Signed-off-by: Martin K. Petersen commit 9697ca0d53e3db357be26d2414276143c4a2cd49 Author: Peter Oberparleiter Date: Tue Jun 3 20:21:56 2025 +0200 scsi: s390: zfcp: Ensure synchronous unit_add Improve the usability of the unit_add sysfs attribute by ensuring that the associated FCP LUN scan processing is completed synchronously. This enables configuration tooling to consistently determine the end of the scan process to allow for serialization of follow-on actions. While the scan process associated with unit_add typically completes synchronously, it is deferred to an asynchronous background process if unit_add is used before initial remote port scanning has completed. This occurs when unit_add is used immediately after setting the associated FCP device online. To ensure synchronous unit_add processing, wait for remote port scanning to complete before initiating the FCP LUN scan. Cc: stable@vger.kernel.org Reviewed-by: M Nikhil Reviewed-by: Nihar Panda Signed-off-by: Peter Oberparleiter Signed-off-by: Nihar Panda Link: https://lore.kernel.org/r/20250603182252.2287285-2-niharp@linux.ibm.com Signed-off-by: Martin K. Petersen commit 9b17621366d210ffee83262a8754086ebbde5e55 Author: Alok Tiwari Date: Fri May 30 12:29:35 2025 -0700 scsi: iscsi: Fix incorrect error path labels for flashnode operations Correct the error handling goto labels used when host lookup fails in various flashnode-related event handlers: - iscsi_new_flashnode() - iscsi_del_flashnode() - iscsi_login_flashnode() - iscsi_logout_flashnode() - iscsi_logout_flashnode_sid() scsi_host_put() is not required when shost is NULL, so jumping to the correct label avoids unnecessary operations. These functions previously jumped to the wrong goto label (put_host), which did not match the intended cleanup logic. Use the correct exit labels (exit_new_fnode, exit_del_fnode, etc.) to ensure proper error handling. Also remove the unused put_host label under iscsi_new_flashnode() as it is no longer needed. No functional changes beyond accurate error path correction. Fixes: c6a4bb2ef596 ("[SCSI] scsi_transport_iscsi: Add flash node mgmt support") Signed-off-by: Alok Tiwari Link: https://lore.kernel.org/r/20250530193012.3312911-1-alok.a.tiwari@oracle.com Reviewed-by: Mike Christie Signed-off-by: Martin K. Petersen commit ad0f54842cd23127070d8c310dd06d8f7add025c Author: Ankit Chauhan Date: Wed May 28 16:36:04 2025 +0530 scsi: mvsas: Fix typos in per-phy comments and SAS cmd port registers Spelling fixes: Deocder --> Decoder Memroy --> Memory This is a non-functional change aimed at improving code clarity. Signed-off-by: Ankit Chauhan Link: https://lore.kernel.org/r/20250528110604.59528-1-ankitchauhan2065@gmail.com Signed-off-by: Martin K. Petersen commit b13044092c1e30453d2f7e9be596d3a2616582a0 Author: Connor Abbott Date: Tue May 20 15:08:59 2025 -0400 drm/msm: Temporarily disable stall-on-fault after a page fault When things go wrong, the GPU is capable of quickly generating millions of faulting translation requests per second. When that happens, in the stall-on-fault model each access will stall until it wins the race to signal the fault and then the RESUME register is written. This slows processing page faults to a crawl as the GPU can generate faults much faster than the CPU can acknowledge them. It also means that all available resources in the SMMU are saturated waiting for the stalled transactions, so that other transactions such as transactions generated by the GMU, which shares translation resources with the GPU, cannot proceed. This causes a GMU watchdog timeout, which leads to a failed reset because GX cannot collapse when there is a transaction pending and a permanently hung GPU. On older platforms with qcom,smmu-v2, it seems that when one transaction is stalled subsequent faulting transactions are terminated, which avoids this problem, but the MMU-500 follows the spec here. To work around these problems, disable stall-on-fault as soon as we get a page fault until a cooldown period after pagefaults stop. This allows the GMU some guaranteed time to continue working. We only use stall-on-fault to halt the GPU while we collect a devcoredump and we always terminate the transaction afterward, so it's fine to miss some subsequent page faults. We also keep it disabled so long as the current devcoredump hasn't been deleted, because in that case we likely won't capture another one if there's a fault. After this commit HFI messages still occasionally time out, because the crashdump handler doesn't run fast enough to let the GMU resume, but the driver seems to recover from it. This will probably go away after the HFI timeout is increased. Signed-off-by: Connor Abbott Reviewed-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/654891/ Signed-off-by: Rob Clark commit dedf404be8cf97e6fabbed7ad97000ab816897eb Author: Connor Abbott Date: Tue May 20 15:08:58 2025 -0400 drm/msm: Delete resume_translation() Unused since the previous commit. Signed-off-by: Connor Abbott Patchwork: https://patchwork.freedesktop.org/patch/654890/ Signed-off-by: Rob Clark commit 0c5fea1eb0dc234cd321bcd19a6bd0f51273b4c6 Author: Connor Abbott Date: Tue May 20 15:08:57 2025 -0400 drm/msm: Don't use a worker to capture fault devcoredump Now that we use a threaded IRQ, it should be safe to do this in the fault handler. We can also remove fault_info from struct msm_gpu and just pass it directly. Signed-off-by: Connor Abbott Patchwork: https://patchwork.freedesktop.org/patch/654889/ Signed-off-by: Rob Clark commit f681c2aa8676a890eacc84044717ab0fd26e058f Author: Rob Clark Date: Wed May 14 09:33:33 2025 -0700 drm/msm: Fix another leak in the submit error path put_unused_fd() doesn't free the installed file, if we've already done fd_install(). So we need to also free the sync_file. Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/653583/ Signed-off-by: Rob Clark commit 5d319f75ccf7f0927425a7545aa1a22b3eedc189 Author: Rob Clark Date: Wed May 14 09:33:32 2025 -0700 drm/msm: Fix a fence leak in submit error path In error paths, we could unref the submit without calling drm_sched_entity_push_job(), so msm_job_free() will never get called. Since drm_sched_job_cleanup() will NULL out the s_fence, we can use that to detect this case. Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/653584/ Signed-off-by: Rob Clark commit bd30b995df8fd053e13d10f78dbc7b2fa5ed1aae Merge: cf2c3eceb757e3 10c24e0d2f7cd2 Author: Mark Brown Date: Mon Jun 9 18:45:20 2025 +0100 SPI: omap2-mcspi: Fix SPI CS behaviour around Merge series from Félix Piédallu : These patches fix the behaviour of the SPI Chip Select of the OMAP2 MCSPI driver used on TI SoCs. The omap2-mcspi driver supports the use of multi mode (multichannel in TI documentation). In this mode, the CS is asserted and deasserted by the hardware. The multi mode is disabled for messages when cs_change=0 for all transfers (e.g when CS is kept asserted between transfers of a same message). The multi mode also needs to be disabled for messages when cs_change=1 on the last transfer (e.g when CS is kept asserted after the WHOLE message), and the message right after. Currently, that is not the case and it CS is deasserted by hardware when it shouldn't. This breaks peripheral drivers that send multiple messages with the CS asserted in between. Patch 1 ensures that multi mode is disabled when cs_change=1 on the last transfer of the message. Patch 2 ensures that multi mode is disable on a message following one with cs_change=1 on the last transfer. This is the case for the TPM TIS SPI driver that uses this logic for flow control purposes. Tested on an AM6442 platform with a TPM ST33HTPH2X32AHE4. commit 87b42c114cdda76c8ad3002f2096699ad5146cb3 Author: Dan Carpenter Date: Wed May 28 11:11:41 2025 +0300 cxl: fix return value in cxlctl_validate_set_features() The cxlctl_validate_set_features() function is type bool. It's supposed to return true for valid requests and false for invalid. However, this error path returns ERR_PTR(-EINVAL) which is true when it was intended to return false. The incorrect return will result in kernel failing to prevent a incorrect op_size passed in from userspace to be detected. [ dj: Add user impact to commit log ] Fixes: f76e0bbc8bc3 ("cxl: Update prototype of function get_support_feature_info()") Signed-off-by: Dan Carpenter Reviewed-by: Ira Weiny Link: https://patch.msgid.link/aDbFPSCujpJLY1if@stanley.mountain Signed-off-by: Dave Jiang commit 179e949719fe81219a3e23f1e716ac2d02eea845 Author: Thomas Huth Date: Fri Mar 14 08:09:36 2025 +0100 ARC: Replace __ASSEMBLY__ with __ASSEMBLER__ in the non-uapi headers While the GCC and Clang compilers already define __ASSEMBLER__ automatically when compiling assembly code, __ASSEMBLY__ is a macro that only gets defined by the Makefiles in the kernel. This can be very confusing when switching between userspace and kernelspace coding, or when dealing with uapi headers that rather should use __ASSEMBLER__ instead. So let's standardize on the __ASSEMBLER__ macro that is provided by the compilers now. This is a completely mechanical patch (done with a simple "sed -i" statement). Cc: linux-snps-arc@lists.infradead.org Signed-off-by: Thomas Huth Signed-off-by: Vineet Gupta commit 2cb74be378675c860af0fcaf1ec2801beebdf028 Author: Thomas Huth Date: Fri Mar 14 08:09:35 2025 +0100 ARC: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers __ASSEMBLY__ is only defined by the Makefile of the kernel, so this is not really useful for uapi headers (unless the userspace Makefile defines it, too). Let's switch to __ASSEMBLER__ which gets set automatically by the compiler when compiling assembly code. Cc: linux-snps-arc@lists.infradead.org Signed-off-by: Thomas Huth Signed-off-by: Vineet Gupta commit 857f4517965b282234e12f6bca0c21ef10eec09b Author: Yu-Chun Lin Date: Thu Apr 10 01:11:16 2025 +0800 ARC: unwind: Use built-in sort swap to reduce code size and improve performance The custom swap function used in sort() was identical to the default built-in sort swap. Remove the custom swap function and passes NULL to sort(), allowing it to use the default swap function. This change reduces code size and improves performance, particularly when CONFIG_MITIGATION_RETPOLINE is enabled. With RETPOLINE mitigation, indirect function calls incur significant overhead, and using the default swap function avoids this cost. $ ./scripts/bloat-o-meter ./unwind.o.old ./unwind.o.new add/remove: 0/1 grow/shrink: 0/1 up/down: 0/-22 (-22) Function old new delta init_unwind_hdr.constprop 544 540 -4 swap_eh_frame_hdr_table_entries 18 - -18 Total: Before=4410, After=4388, chg -0.50% Signed-off-by: Yu-Chun Lin Signed-off-by: Vineet Gupta commit ea7caffedd011f7d40abe93a884ffbe46f122535 Author: Jason Gunthorpe Date: Tue Apr 8 14:22:56 2025 -0300 ARC: atomics: Implement arch_atomic64_cmpxchg using _relaxed The core atomic code has a number of macros where it elaborates architecture primitives into more functions. ARC uses arch_atomic64_cmpxchg() as it's architecture primitive which disable alot of the additional functions. Instead provide arch_cmpxchg64_relaxed() as the primitive and rely on the core macros to create arch_cmpxchg64(). The macros will also provide other functions, for instance, try_cmpxchg64_release(), giving a more complete implementation. Suggested-by: Mark Rutland Link: https://lore.kernel.org/r/Z0747n5bSep4_1VX@J2N7QTR9R3 Signed-off-by: Jason Gunthorpe Signed-off-by: Vineet Gupta commit e044b8a9545cd8265c7110c179aeec2624c16455 Author: Francesco Poli (wintermute) Date: Wed May 21 23:14:39 2025 +0200 cpupower: split unitdir from libdir in Makefile Improve the installation procedure for the systemd service unit 'cpupower.service', to be more flexible. Some distros install libraries to /usr/lib64/, but systemd service units have to be installed to /usr/lib/systemd/system: as a consequence, the installation procedure should not assume that systemd service units can be installed to ${libdir}/systemd/system ... Define a dedicated variable ("unitdir") in the Makefile. Link: https://lore.kernel.org/linux-pm/260b6d79-ab61-43b7-a0eb-813e257bc028@leemhuis.info/T/#m0601940ab439d5cbd288819d2af190ce59e810e6 Fixes: 9c70b779ad91 ("cpupower: add a systemd service to run cpupower") Link: https://lore.kernel.org/r/20250521211656.65646-1-invernomuto@paranoici.org Signed-off-by: Francesco Poli (wintermute) Tested-by: Thorsten Leemhuis Signed-off-by: Shuah Khan commit 86a4371b76976158be875dc654ceee35c574b27b Author: Vijendar Mukunda Date: Fri May 30 11:13:39 2025 +0530 soundwire: amd: fix for handling slave alerts after link is down Sometimes, its observed that during system level suspend callback execution, after link is down, handling pending slave status workqueue results in mipi register access failures as shown below. soundwire sdw-master-0-0: trf on Slave 1 failed:-110 read addr 0 count 1 rt722-sdca sdw:0:0:025d:0722:01: SDW_DP0_INT recheck read failed:-110 rt722-sdca sdw:0:0:025d:0722:01: Slave 1 alert handling failed: -110 amd_sdw_manager amd_sdw_manager.0: SDW0 cmd response timeout occurred amd_sdw_manager amd_sdw_manager.0: command timeout for Slave 1 soundwire sdw-master-0-0: trf on Slave 1 failed:-110 write addr 5c count 1 amd_sdw_manager amd_sdw_manager.0: SDW0 previous cmd status clear failed amd_sdw_manager amd_sdw_manager.0: command timeout for Slave 1 soundwire sdw-master-0-0: trf on Slave 1 failed:-110 write addr 5d count 1 amd_sdw_manager amd_sdw_manager.0: SDW0 previous cmd status clear failed amd_sdw_manager amd_sdw_manager.0: command timeout for Slave 1 Cancel the pending slave status workqueue prior to initiating clock stop sequence during suspend callback execution for both the power modes. Fixes: 9cf1efc5ed2d ("soundwire: amd: add pm_prepare callback and pm ops support") Signed-off-by: Vijendar Mukunda Link: https://lore.kernel.org/r/20250530054447.1645807-2-Vijendar.Mukunda@amd.com Signed-off-by: Vinod Koul commit f287822688eeb44ae1cf6ac45701d965efc33218 Author: Xin Li (Intel) Date: Mon Jun 9 01:40:54 2025 -0700 selftests/x86: Add a test to detect infinite SIGTRAP handler loop When FRED is enabled, if the Trap Flag (TF) is set without an external debugger attached, it can lead to an infinite loop in the SIGTRAP handler. To avoid this, the software event flag in the augmented SS must be cleared, ensuring that no single-step trap remains pending when ERETU completes. This test checks for that specific scenario—verifying whether the kernel correctly prevents an infinite SIGTRAP loop in this edge case when FRED is enabled. The test should _always_ pass with IDT event delivery, thus no need to disable the test even when FRED is not enabled. Signed-off-by: Xin Li (Intel) Signed-off-by: Dave Hansen Tested-by: Sohil Mehta Cc:stable@vger.kernel.org Link: https://lore.kernel.org/all/20250609084054.2083189-3-xin%40zytor.com commit e34dbbc85d64af59176fe59fad7b4122f4330fe2 Author: Xin Li (Intel) Date: Mon Jun 9 01:40:53 2025 -0700 x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler Clear the software event flag in the augmented SS to prevent immediate repeat of single step trap on return from SIGTRAP handler if the trap flag (TF) is set without an external debugger attached. Following is a typical single-stepping flow for a user process: 1) The user process is prepared for single-stepping by setting RFLAGS.TF = 1. 2) When any instruction in user space completes, a #DB is triggered. 3) The kernel handles the #DB and returns to user space, invoking the SIGTRAP handler with RFLAGS.TF = 0. 4) After the SIGTRAP handler finishes, the user process performs a sigreturn syscall, restoring the original state, including RFLAGS.TF = 1. 5) Goto step 2. According to the FRED specification: A) Bit 17 in the augmented SS is designated as the software event flag, which is set to 1 for FRED event delivery of SYSCALL, SYSENTER, or INT n. B) If bit 17 of the augmented SS is 1 and ERETU would result in RFLAGS.TF = 1, a single-step trap will be pending upon completion of ERETU. In step 4) above, the software event flag is set upon the sigreturn syscall, and its corresponding ERETU would restore RFLAGS.TF = 1. This combination causes a pending single-step trap upon completion of ERETU. Therefore, another #DB is triggered before any user space instruction is executed, which leads to an infinite loop in which the SIGTRAP handler keeps being invoked on the same user space IP. Fixes: 14619d912b65 ("x86/fred: FRED entry/exit and dispatch code") Suggested-by: H. Peter Anvin (Intel) Signed-off-by: Xin Li (Intel) Signed-off-by: Dave Hansen Tested-by: Sohil Mehta Cc:stable@vger.kernel.org Link: https://lore.kernel.org/all/20250609084054.2083189-2-xin%40zytor.com commit cf2c3eceb757e3f28e6f1034f9bc178e1535f5cc Author: Patrice Chotard Date: Mon Jun 9 17:05:04 2025 +0200 spi: stm32-ospi: Make usage of reset_control_acquire/release() API As ospi reset is consumed by both OMM and OSPI drivers, use the reset acquire/release mechanism which ensure exclusive reset usage. This avoid to call reset_control_get/put() in OMM driver each time we need to reset OSPI children and guarantee the reset line stays deasserted. During resume, OMM driver takes temporarily control of reset. Fixes: 79b8a705e26c ("spi: stm32: Add OSPI driver") Signed-off-by: Patrice Chotard Reviewed-by: Philipp Zabel Link: https://patch.msgid.link/20250609-b4-upstream_ospi_reset_update-v6-1-5b602b567e8a@foss.st.com Signed-off-by: Mark Brown commit d6fb4f01736a1d18cc981eb04fa2907a7121fc27 Author: Maarten Lankhorst Date: Wed May 21 11:01:02 2025 +0200 drm/xe/svm: Fix regression disallowing 64K SVM migration When changing the condition from >= SZ_64K, it was changed to <= SZ_64K. This disallows migration of 64K, which is the exact minimum allowed. Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/5057 Fixes: 794f5493f518 ("drm/xe: Strict migration policy for atomic SVM faults") Cc: stable@vger.kernel.org Cc: Matthew Brost Cc: Himal Prasad Ghimiray Reviewed-by: Himal Prasad Ghimiray Signed-off-by: Maarten Lankhorst Link: https://lore.kernel.org/r/20250521090102.2965100-1-dev@lankhorst.se (cherry picked from commit 531bef26d189b28bf0d694878c0e064b30990b6c) Signed-off-by: Thomas Hellström commit d53fd59707c402d03ec740b4e90a2ddcb5312006 Author: Rob Herring (Arm) Date: Wed May 7 16:59:02 2025 -0500 dt-bindings: soc: fsl,ls1028a-reset: Drop extra "/" in $id The $id value has a double "//". Drop it. Fixes: 9ca5a7d9d2e0 ("dt-bindings: soc: fsl: Add fsl,ls1028a-reset for reset syscon node") Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250507215903.2748698-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 779a0c9e06a91d0007f2a4f4071e3b9a8102b15e Author: Lizhi Hou Date: Wed Jun 4 07:32:17 2025 -0700 accel/amdxdna: Fix incorrect PSP firmware size The incorrect PSP firmware size is used for initializing. It may cause error for newer version firmware. Fixes: 8c9ff1b181ba ("accel/amdxdna: Add a new driver for AMD AI Engine") Acked-by: Alex Deucher Signed-off-by: Lizhi Hou Link: https://lore.kernel.org/r/20250604143217.1386272-1-lizhi.hou@amd.com commit 539d80575b810c7a5987c7ac8915e3bc99c03695 Author: Masami Hiramatsu (Google) Date: Thu Jun 5 10:07:38 2025 +0900 mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data When swiotlb buffer is full, the dma_map_sg() returns 0 to msdc_prepare_data(), but it does not check it and sets the MSDC_PREPARE_FLAG. swiotlb_tbl_map_single() /* prints "swiotlb buffer is full" */ <-swiotlb_map() <-dma_direct_map_page() <-dma_direct_map_sg() <-__dma_map_sg_attrs() <-dma_map_sg_attrs() <-dma_map_sg() /* returns 0 (pages mapped) */ <-msdc_prepare_data() Then, the msdc_unprepare_data() checks MSDC_PREPARE_FLAG and calls dma_unmap_sg() with unmapped pages. It causes a page fault. To fix this problem, Do not set MSDC_PREPARE_FLAG if dma_map_sg() fails because this is not prepared. Fixes: 208489032bdd ("mmc: mediatek: Add Mediatek MMC driver") Signed-off-by: Masami Hiramatsu (Google) Tested-by: Sergey Senozhatsky Reviewed-by: AngeloGioacchino Del Regno Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/174908565814.4056588.769599127120955383.stgit@mhiramat.tok.corp.google.com Signed-off-by: Ulf Hansson commit 3358b836d4369ad47823c26834b3613778fe75b2 Author: Dan Carpenter Date: Tue May 27 08:55:01 2025 +0300 mmc: sdhci-of-k1: Fix error code in probe() If spacemit_sdhci_get_clocks() fails, then propagate the error code. Don't return success. Fixes: e5502d15b0f3 ("mmc: sdhci-of-k1: add support for SpacemiT K1 SoC") Signed-off-by: Dan Carpenter Reviewed-by: Yixun Lan Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/aDVTtQdXVtRhxOrb@stanley.mountain Signed-off-by: Ulf Hansson commit 009c3a4bc41e855fd76f92727f9fbae4e5917d7f Author: Avri Altman Date: Mon May 26 14:44:45 2025 +0300 mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier Move the BROKEN_SD_DISCARD quirk for certain SanDisk SD cards from the `mmc_blk_fixups[]` to `mmc_sd_fixups[]`. This ensures the quirk is applied earlier in the device initialization process, aligning with the reasoning in [1]. Applying the quirk sooner prevents the kernel from incorrectly enabling discard support on affected cards during initial setup. [1] https://lore.kernel.org/all/20240820230631.GA436523@sony.com Fixes: 07d2872bf4c8 ("mmc: core: Add SD card quirk for broken discard") Signed-off-by: Avri Altman Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250526114445.675548-1-avri.altman@sandisk.com Signed-off-by: Ulf Hansson commit e51a086117ed857ea455c9ea774dbfb82f53e517 Author: Andres Urian Florez Date: Sun Jun 8 18:04:21 2025 -0500 spi: offload: check offload ops existence before disabling the trigger Add a safe guard in spi_offload_trigger to check the existence of offload->ops before invoking the trigger_disable callback Signed-off-by: Andres Urian Florez Link: https://patch.msgid.link/20250608230422.325360-1-andres.emb.sys@gmail.com Signed-off-by: Mark Brown commit 4c46a471be12216347ba707f8eadadbf5d68e698 Author: Viresh Kumar Date: Tue Jun 3 16:38:53 2025 +0530 firmware: arm_ffa: Fix the missing entry in struct ffa_indirect_msg_hdr As per the spec, one 32 bit reserved entry is missing here, add it. Signed-off-by: Viresh Kumar Fixes: 910cc1acc9b4 ("firmware: arm_ffa: Add support for passing UUID in FFA_MSG_SEND2") Reviewed-by: Bertrand Marquis Message-Id: <28a624fbf416975de4fbe08cfbf7c2db89cb630e.1748948911.git.viresh.kumar@linaro.org> Signed-off-by: Sudeep Holla commit 9ca7a421229bbdfbe2e1e628cff5cfa782720a10 Author: Sudeep Holla Date: Wed May 28 09:49:43 2025 +0100 firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context The current use of a mutex to protect the notifier hashtable accesses can lead to issues in the atomic context. It results in the below kernel warnings: | BUG: sleeping function called from invalid context at kernel/locking/mutex.c:258 | in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 9, name: kworker/0:0 | preempt_count: 1, expected: 0 | RCU nest depth: 0, expected: 0 | CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.14.0 #4 | Workqueue: ffa_pcpu_irq_notification notif_pcpu_irq_work_fn | Call trace: | show_stack+0x18/0x24 (C) | dump_stack_lvl+0x78/0x90 | dump_stack+0x18/0x24 | __might_resched+0x114/0x170 | __might_sleep+0x48/0x98 | mutex_lock+0x24/0x80 | handle_notif_callbacks+0x54/0xe0 | notif_get_and_handle+0x40/0x88 | generic_exec_single+0x80/0xc0 | smp_call_function_single+0xfc/0x1a0 | notif_pcpu_irq_work_fn+0x2c/0x38 | process_one_work+0x14c/0x2b4 | worker_thread+0x2e4/0x3e0 | kthread+0x13c/0x210 | ret_from_fork+0x10/0x20 To address this, replace the mutex with an rwlock to protect the notifier hashtable accesses. This ensures that read-side locking does not sleep and multiple readers can acquire the lock concurrently, avoiding unnecessary contention and potential deadlocks. Writer access remains exclusive, preserving correctness. This change resolves warnings from lockdep about potential sleep in atomic context. Cc: Jens Wiklander Reported-by: Jérôme Forissier Closes: https://github.com/OP-TEE/optee_os/issues/7394 Fixes: e0573444edbf ("firmware: arm_ffa: Add interfaces to request notification callbacks") Message-Id: <20250528-ffa_notif_fix-v1-3-5ed7bc7f8437@arm.com> Reviewed-by: Jens Wiklander Tested-by: Jens Wiklander Signed-off-by: Sudeep Holla commit 27e850c88df0e25474a8caeb2903e2e90b62c1dc Author: Sudeep Holla Date: Wed May 28 09:49:42 2025 +0100 firmware: arm_ffa: Move memory allocation outside the mutex locking The notifier callback node allocation is currently done while holding the notify_lock mutex. While this is safe even if memory allocation may sleep, we need to move the allocation outside the locked region in preparation to move from using muxtes to rwlocks. Move the memory allocation to avoid potential sleeping in atomic context once the locks are moved from mutex to rwlocks. Fixes: e0573444edbf ("firmware: arm_ffa: Add interfaces to request notification callbacks") Message-Id: <20250528-ffa_notif_fix-v1-2-5ed7bc7f8437@arm.com> Reviewed-by: Jens Wiklander Signed-off-by: Sudeep Holla commit a833d31ad867103ba72a0b73f3606f4ab8601719 Author: Sudeep Holla Date: Wed May 28 09:49:41 2025 +0100 firmware: arm_ffa: Fix memory leak by freeing notifier callback node Commit e0573444edbf ("firmware: arm_ffa: Add interfaces to request notification callbacks") adds support for notifier callbacks by allocating and inserting a callback node into a hashtable during registration of notifiers. However, during unregistration, the code only removes the node from the hashtable without freeing the associated memory, resulting in a memory leak. Resolve the memory leak issue by ensuring the allocated notifier callback node is properly freed after it is removed from the hashtable entry. Fixes: e0573444edbf ("firmware: arm_ffa: Add interfaces to request notification callbacks") Message-Id: <20250528-ffa_notif_fix-v1-1-5ed7bc7f8437@arm.com> Reviewed-by: Jens Wiklander Signed-off-by: Sudeep Holla commit 98570e8cb8b0c0893810f285b4a3b1a3ab81a556 Author: Andy Yan Date: Sat May 24 14:42:13 2025 +0800 arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B cd-gpios is used for sdcard detects for sdmmc. Fixes: 3f5d336d64d6 ("arm64: dts: rockchip: Add support for rk3588s based board Cool Pi 4B") Signed-off-by: Andy Yan Link: https://lore.kernel.org/r/20250524064223.5741-2-andyshrk@163.com Signed-off-by: Heiko Stuebner commit e625e284172d235be5cd906a98c6c91c365bb9b1 Author: Andy Yan Date: Sat May 24 14:42:12 2025 +0800 arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 cd-gpios is used for sdcard detects for sdmmc. Fixes: 791c154c3982 ("arm64: dts: rockchip: Add support for rk3588 based board Cool Pi CM5 EVB") Signed-off-by: Andy Yan Link: https://lore.kernel.org/r/20250524064223.5741-1-andyshrk@163.com Signed-off-by: Heiko Stuebner commit af9feb0b85f92d2972061224839c5fea5ee39f6d Author: Andy Yan Date: Thu May 22 10:05:24 2025 +0800 arm64: dts: rockchip: Adjust the HDMI DDC IO driver strength for rk3588 For the RK3588 HDMI controller, the falling edge of DDC SDA and SCL almost coincide and cannot be adjusted by HDMI registrer, resulting in poor compatibility of DDC communication. An improvement of the compatibility of DDC can be done by increasing the driver strength of SCL and decreasing the driver strength of SDA to increase the slope of the falling edge. It should be noted that the maximum driving strength of hdmim0_tx1_scl is only 3, which is different from that of the other IOs. Signed-off-by: Andy Yan Tested-by: Nicolas Frattaroli Link: https://lore.kernel.org/r/20250522020537.1884771-1-andyshrk@163.com Signed-off-by: Heiko Stuebner commit af0f43d5d0d6e486b6a83190000dfa7ad447f825 Author: Shawn Lin Date: Tue Jun 3 10:35:40 2025 +0800 arm64: dts: rockchip: fix rk3576 pcie1 linux,pci-domain pcie0 already used 0 as its pci-domain, so pcie1 will fail to allocate the same pci-domain if both of them are used. rk-pcie 2a210000.pcie: PCIe Link up, LTSSM is 0x130011 rk-pcie 2a210000.pcie: PCIe Gen.2 x1 link up rk-pcie 2a210000.pcie: Scanning root bridge failed rk-pcie 2a210000.pcie: failed to initialize host Fixes: d4b9fc2af45d ("arm64: dts: rockchip: Add rk3576 pcie nodes") Signed-off-by: Shawn Lin Link: https://lore.kernel.org/r/1748918140-212263-1-git-send-email-shawn.lin@rock-chips.com Signed-off-by: Heiko Stuebner commit 24b0277c1c539cd41539d9297baafc62df04464a Author: Krzysztof Kozlowski Date: Sun Jun 1 12:51:01 2025 +0200 pinctrl: tb10x: Drop of_match_ptr for ID table The driver can match only via the DT table so the table should be always used and the of_match_ptr does not have any sense (this also allows ACPI matching via PRP0001, even though it might not be relevant here). This also fixes !CONFIG_OF warning: pinctrl-tb10x.c:815:34: warning: unused variable 'tb10x_pinctrl_dt_ids' [-Wunused-const-variable] Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202505301317.EI1caRC0-lkp@intel.com/ Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/20250601105100.27927-2-krzysztof.kozlowski@linaro.org Signed-off-by: Linus Walleij commit d38e00c417e1ca0c586802e47ad7d54347c91f67 Author: Krzysztof Kozlowski Date: Wed May 28 12:45:15 2025 +0200 pinctrl: MAINTAINERS: Drop bouncing Jianlong Huang Emails to Jianlong Huang bounce since 9 months, so drop the person from maintainers: 550 5.4.1 Recipient address rejected: Access denied. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/20250528104514.184122-2-krzysztof.kozlowski@linaro.org Signed-off-by: Linus Walleij commit fcd65d65fd85dbde090ef8c2615760ebc5ccf9e3 Author: Krzysztof Kozlowski Date: Wed May 28 11:22:02 2025 +0200 pinctrl: st: Drop unused st_gpio_bank() function Static inline st_gpio_bank() function is not referenced: pinctrl-st.c:377:19: error: unused function 'st_gpio_bank' [-Werror,-Wunused-function] Fixes: 701016c0cba5 ("pinctrl: st: Add pinctrl and pinconf support.") Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/20250528092201.52132-2-krzysztof.kozlowski@linaro.org Signed-off-by: Linus Walleij commit 315345610faee8a0568b522dba9e35067d1732ab Author: Wojciech Slenska Date: Fri May 23 12:14:37 2025 +0200 pinctrl: qcom: pinctrl-qcm2290: Add missing pins Added the missing pins to the qcm2290_pins table. Signed-off-by: Wojciech Slenska Fixes: 48e049ef1238 ("pinctrl: qcom: Add QCM2290 pinctrl driver") Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/20250523101437.59092-1-wojciech.slenska@gmail.com Signed-off-by: Linus Walleij commit 56ec63a6e107e724619e61c7e605b49d365dfa07 Author: Dmitry Baryshkov Date: Tue May 13 21:38:59 2025 +0300 pinctrl: qcom: switch to devm_gpiochip_add_data() In order to simplify cleanup actions, use devres-enabled version of gpiochip_add_data(). As the msm_pinctrl_remove() function is now empty, drop it and all its calls from the corresponding pinctrl drivers. Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/20250513-pinctrl-msm-fix-v2-3-249999af0fc1@oss.qualcomm.com Signed-off-by: Linus Walleij commit a0914bf56e26d2cf457690602883f9cd2ec2c646 Author: Edip Hazuri Date: Mon Jun 9 10:59:44 2025 +0300 ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx The mute led on those laptops is using ALC245 but requires a quirk to work This patch enables the existing quirk for the devices. Tested on my Victus 16-s1011nt Laptop and my friend's Victus 15-fa1xxx. The LED behaviour works as intended. Cc: Signed-off-by: Edip Hazuri Link: https://patch.msgid.link/20250609075943.13934-2-edip@medip.dev Signed-off-by: Takashi Iwai commit f00de8e82cab24ef2e2cae0b297b4dc46c3e37ca Author: Brahmajit Das Date: Sat Jun 7 02:10:00 2025 +0530 ALSA: ctxfi: Replace deprecated strcpy() with strscpy() strcpy() is deprecated; use strscpy() instead. Use strscpy() to copy the long name because there's no string to format with sprintf(). No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Brahmajit Das Link: https://patch.msgid.link/20250606204000.8156-1-listout@listout.xyz Signed-off-by: Takashi Iwai commit 784e48a82976ee0b645788750343cd1b28a372f3 Author: Jake Hillion Date: Thu Jun 5 19:09:27 2025 +0100 x86/platform/amd: replace down_timeout() with down_interruptible() Currently hsmp_send_message() uses down_timeout() with a 100ms timeout to take the semaphore. However __hsmp_send_message(), the content of the critical section, has a sleep in it. On systems with significantly delayed scheduling behaviour this may take over 100ms. Convert this method to down_interruptible(). Leave the error handling the same as the documentation currently is not specific about what error is returned. Previous behaviour: a caller who competes with another caller stuck in the critical section due to scheduler delays would receive -ETIME. New behaviour: a caller who competes with another caller stuck in the critical section due to scheduler delays will complete successfully. Reviewed-by: Suma Hegde Tested-by: Suma Hegde Signed-off-by: Jake Hillion Link: https://lore.kernel.org/r/20250605-amd-hsmp-v2-2-a811bc3dd74a@hillion.co.uk Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit f8afb12a2d7503de6558c23cacd7acbf6e9fe678 Author: Jake Hillion Date: Thu Jun 5 19:09:26 2025 +0100 x86/platform/amd: move final timeout check to after final sleep __hsmp_send_message sleeps between result read attempts and has a timeout of 100ms. Under extreme load it's possible for these sleeps to take a long time, exceeding the 100ms. In this case the current code does not check the register and fails with ETIMEDOUT. Refactor the loop to ensure there is at least one read of the register after a sleep of any duration. This removes instances of ETIMEDOUT with a single caller, even with a misbehaving scheduler. Tested on AMD Bergamo machines. Suggested-by: Blaise Sanouillet Reviewed-by: Suma Hegde Tested-by: Suma Hegde Signed-off-by: Jake Hillion Link: https://lore.kernel.org/r/20250605-amd-hsmp-v2-1-a811bc3dd74a@hillion.co.uk Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 4dbd11796f3a8eb95647507befc41995458a4023 Author: Mario Limonciello Date: Tue Jun 3 08:24:08 2025 -0500 platform/x86/amd: pmc: Clear metrics table at start of cycle The area of memory that contains the metrics table may contain garbage when the cycle starts. This normally doesn't matter because the cycle itself will populate it with valid data, however commit 9f5595d5f03fd ("platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles") started to use it during the check() phase. Depending upon what garbage is in the table it's possible that the system will wait 2.5 seconds for even the first cycle, which will be visible to a user. To prevent this from happening explicitly clear the table when logging is started. Fixes: 9f5595d5f03fd ("platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles") Signed-off-by: Mario Limonciello Link: https://lore.kernel.org/r/20250603132412.3555302-1-superm1@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 1d0a61940e22e165e6acc4a9c6fb26edbe69112e Author: Dan Carpenter Date: Fri Jun 6 12:04:32 2025 +0300 platform/x86/intel: power-domains: Fix error code in tpmi_init() Return -ENOMEM instead of success if kcalloc() fails. Fixes: e37be5d85c60 ("platform/x86/intel: power-domains: Add interface to get Linux die ID") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/aEKvIGCt6d8Gcx4S@stanley.mountain Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit afbdc4bbb3a6418778cf969b0795bbaa8237cdd3 Author: Joshua Grisham Date: Fri Jun 6 15:09:08 2025 +0200 platform/x86: samsung-galaxybook: Add SAM0426 Add device ID SAM0426 (Notebook 9 Pro and similar devices) as reported and tested by GitHub user "diego-karsa" [1]. [1]: https://github.com/joshuagrisham/samsung-galaxybook-extras/issues/69 Signed-off-by: Joshua Grisham Reviewed-by: Armin Wolf Link: https://lore.kernel.org/r/20250606130909.207047-1-josh@joshuagrisham.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit c987a390f1b3b8bdac11031d7004e3410fe259bd Author: Takashi Iwai Date: Sun Jun 8 11:14:14 2025 +0200 ALSA: hda/intel: Add Thinkpad E15 to PM deny list Lenovo Thinkpad E15 with Conexant CX8070 codec seems causing ugly noises after runtime-PM suspend. Disable the codec runtime PM as a workaround. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220210 Cc: Link: https://patch.msgid.link/20250608091415.21170-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 685f88c72a0c4d12d3bd2ff50286938f14486f85 Author: Srinivas Pandruvada Date: Fri Jun 6 13:53:00 2025 -0700 platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL Address a Smatch static checker warning regarding an unchecked dereference in the function call: set_cdie_id(i, cluster_info, plat_info) when plat_info is NULL. Instead of addressing this one case, in general if plat_info is NULL then it can cause other issues. For example in a two package system it will give warning for duplicate sysfs entry as package ID will be always zero for both packages when creating string for attribute group name. plat_info is derived from TPMI ID TPMI_BUS_INFO, which is integral to the core TPMI design. Therefore, it should not be NULL on a production platform. Consequently, the module should fail to load if plat_info is NULL. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/platform-driver-x86/aEKvGCLd1qmX04Tc@stanley.mountain/T/#u Fixes: 8a54e2253e4c ("platform/x86/intel-uncore-freq: Uncore frequency control via TPMI") Signed-off-by: Srinivas Pandruvada Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250606205300.2384494-1-srinivas.pandruvada@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 5808c34216954cd832bd4b8bc52dfa287049122b Author: Rong Zhang Date: Mon May 26 04:18:07 2025 +0800 platform/x86: ideapad-laptop: use usleep_range() for EC polling It was reported that ideapad-laptop sometimes causes some recent (since 2024) Lenovo ThinkBook models shut down when: - suspending/resuming - closing/opening the lid - (dis)connecting a charger - reading/writing some sysfs properties, e.g., fan_mode, touchpad - pressing down some Fn keys, e.g., Brightness Up/Down (Fn+F5/F6) - (seldom) loading the kmod The issue has existed since the launch day of such models, and there have been some out-of-tree workarounds (see Link:) for the issue. One disables some functionalities, while another one simply shortens IDEAPAD_EC_TIMEOUT. The disabled functionalities have read_ec_data() in their call chains, which calls schedule() between each poll. It turns out that these models suffer from the indeterminacy of schedule() because of their low tolerance for being polled too frequently. Sometimes schedule() returns too soon due to the lack of ready tasks, causing the margin between two polls to be too short. In this case, the command is somehow aborted, and too many subsequent polls (they poll for "nothing!") may eventually break the state machine in the EC, resulting in a hard shutdown. This explains why shortening IDEAPAD_EC_TIMEOUT works around the issue - it reduces the total number of polls sent to the EC. Even when it doesn't lead to a shutdown, frequent polls may also disturb the ongoing operation and notably delay (+ 10-20ms) the availability of EC response. This phenomenon is unlikely to be exclusive to the models mentioned above, so dropping the schedule() manner should also slightly improve the responsiveness of various models. Fix these issues by migrating to usleep_range(150, 300). The interval is chosen to add some margin to the minimal 50us and considering EC responses are usually available after 150-2500us based on my test. It should be enough to fix these issues on all models subject to the EC bug without introducing latency on other models. Tested on ThinkBook 14 G7+ ASP and solved both issues. No regression was introduced in the test on a model without the EC bug (ThinkBook X IMH, thanks Eric). Link: https://github.com/ty2/ideapad-laptop-tb2024g6plus/commit/6c5db18c9e8109873c2c90a7d2d7f552148f7ad4 Link: https://github.com/ferstar/ideapad-laptop-tb/commit/42d1e68e5009529d31bd23f978f636f79c023e80 Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218771 Fixes: 6a09f21dd1e2 ("ideapad: add ACPI helpers") Cc: stable@vger.kernel.org Tested-by: Felix Yan Tested-by: Eric Long Tested-by: Jianfei Zhang Tested-by: Mingcong Bai Tested-by: Minh Le Tested-by: Sicheng Zhu Signed-off-by: Rong Zhang Link: https://lore.kernel.org/r/20250525201833.37939-1-i@rong.moe Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 8d8d7c1dbc46aa07a76acab7336a42ddd900be10 Author: Fabio Estevam Date: Fri May 16 14:39:00 2025 -0300 iio: adc: max1363: Reorder mode_list[] entries The IIO core issues warnings when a scan mask is a subset of a previous entry in the available_scan_masks array. On a board using a MAX11601, the following warning is observed: max1363 1-0064: available_scan_mask 7 subset of 6. Never used This occurs because the entries in the max11607_mode_list[] array are not ordered correctly. To fix this, reorder the entries so that no scan mask is a subset of an earlier one. While at it, reorder the mode_list[] arrays for other supported chips as well, to prevent similar warnings on different variants. Note fixes tag dropped as these were introduced over many commits a long time back and the side effect until recently was a reduction in sampling rate due to reading too many channels when only a few were desired. Now we have a sanity check that reports this error but that is not where the issue was introduced. Cc: stable@vger.kernel.org Signed-off-by: Fabio Estevam Acked-by: Matti Vaittinen Link: https://patch.msgid.link/20250516173900.677821-2-festevam@gmail.com Signed-off-by: Jonathan Cameron commit 6d21f2c2dd843bceefd9455f2919f6bb526797f0 Author: Fabio Estevam Date: Fri May 16 14:38:59 2025 -0300 iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] Since commit 2718f15403fb ("iio: sanity check available_scan_masks array"), booting a board populated with a MAX11601 results in a flood of warnings: max1363 1-0064: available_scan_mask 8 subset of 0. Never used max1363 1-0064: available_scan_mask 9 subset of 0. Never used max1363 1-0064: available_scan_mask 10 subset of 0. Never used max1363 1-0064: available_scan_mask 11 subset of 0. Never used max1363 1-0064: available_scan_mask 12 subset of 0. Never used max1363 1-0064: available_scan_mask 13 subset of 0. Never used ... These warnings are caused by incorrect offsets used for differential channels in the MAX1363_4X_CHANS() and MAX1363_8X_CHANS() macros. The max1363_mode_table[] defines the differential channel mappings as follows: MAX1363_MODE_DIFF_SINGLE(0, 1, 1 << 12), MAX1363_MODE_DIFF_SINGLE(2, 3, 1 << 13), MAX1363_MODE_DIFF_SINGLE(4, 5, 1 << 14), MAX1363_MODE_DIFF_SINGLE(6, 7, 1 << 15), MAX1363_MODE_DIFF_SINGLE(8, 9, 1 << 16), MAX1363_MODE_DIFF_SINGLE(10, 11, 1 << 17), MAX1363_MODE_DIFF_SINGLE(1, 0, 1 << 18), MAX1363_MODE_DIFF_SINGLE(3, 2, 1 << 19), MAX1363_MODE_DIFF_SINGLE(5, 4, 1 << 20), MAX1363_MODE_DIFF_SINGLE(7, 6, 1 << 21), MAX1363_MODE_DIFF_SINGLE(9, 8, 1 << 22), MAX1363_MODE_DIFF_SINGLE(11, 10, 1 << 23), Update the macros to follow this same pattern, ensuring that the scan masks are valid and preventing the warnings. Cc: stable@vger.kernel.org Suggested-by: Jonathan Cameron Signed-off-by: Fabio Estevam Acked-by: Matti Vaittinen Link: https://patch.msgid.link/20250516173900.677821-1-festevam@gmail.com Signed-off-by: Jonathan Cameron commit e8ad595064f6ebd5d2d1a5d5d7ebe0efce623091 Author: Chen Ni Date: Thu May 15 16:31:01 2025 +0800 iio: adc: stm32-adc: Fix race in installing chained IRQ handler Fix a race where a pending interrupt could be received and the handler called before the handler's data has been setup, by converting to irq_set_chained_handler_and_data(). Fixes: 1add69880240 ("iio: adc: Add support for STM32 ADC core") Signed-off-by: Chen Ni Reviewed-by: Nuno Sá Tested-by: Fabrice Gasnier Reviewed-by: Fabrice Gasnier Link: https://patch.msgid.link/20250515083101.3811350-1-nichen@iscas.ac.cn Cc: Signed-off-by: Jonathan Cameron commit 16285a0931869baa618b1f5d304e1e9d090470a8 Author: Markus Burri Date: Thu May 8 15:06:09 2025 +0200 iio: fix potential out-of-bound write The buffer is set to 20 characters. If a caller write more characters, count is truncated to the max available space in "simple_write_to_buffer". To protect from OoB access, check that the input size fit into buffer and add a zero terminator after copy to the end of the copied data. Fixes: 6d5dd486c715 iio: core: make use of simple_write_to_buffer() Signed-off-by: Markus Burri Link: https://patch.msgid.link/20250508130612.82270-4-markus.burri@mt.com Signed-off-by: Jonathan Cameron commit da9374819eb3885636934c1006d450c3cb1a02ed Author: Markus Burri Date: Thu May 8 15:06:07 2025 +0200 iio: backend: fix out-of-bound write The buffer is set to 80 character. If a caller write more characters, count is truncated to the max available space in "simple_write_to_buffer". But afterwards a string terminator is written to the buffer at offset count without boundary check. The zero termination is written OUT-OF-BOUND. Add a check that the given buffer is smaller then the buffer to prevent. Fixes: 035b4989211d ("iio: backend: make sure to NULL terminate stack buffer") Signed-off-by: Markus Burri Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250508130612.82270-2-markus.burri@mt.com Cc: Signed-off-by: Jonathan Cameron commit 8a48e35becb214743214f5504e726c3ec131cd6d Author: Krzysztof Kozlowski Date: Tue May 20 13:13:26 2025 +0200 drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate Driver unconditionally saves current state on first init in dsi_pll_10nm_init(), but does not save the VCO rate, only some of the divider registers. The state is then restored during probe/enable via msm_dsi_phy_enable() -> msm_dsi_phy_pll_restore_state() -> dsi_10nm_pll_restore_state(). Restoring calls dsi_pll_10nm_vco_set_rate() with pll_10nm->vco_current_rate=0, which basically overwrites existing rate of VCO and messes with clock hierarchy, by setting frequency to 0 to clock tree. This makes anyway little sense - VCO rate was not saved, so should not be restored. If PLL was not configured configure it to minimum rate to avoid glitches and configuring entire in clock hierarchy to 0 Hz. Suggested-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/sz4kbwy5nwsebgf64ia7uq4ee7wbsa5uy3xmlqwcstsbntzcov@ew3dcyjdzmi2/ Signed-off-by: Krzysztof Kozlowski Fixes: a4ccc37693a2 ("drm/msm/dsi_pll_10nm: restore VCO rate during Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/654796/ Link: https://lore.kernel.org/r/20250520111325.92352-2-krzysztof.kozlowski@linaro.org Signed-off-by: Dmitry Baryshkov commit 146e87f3e11de0dfa091ff87e34b4bc6eec761a4 Author: James A. MacInnes Date: Wed Feb 12 15:03:47 2025 -0800 drm/msm/disp: Correct porch timing for SDM845 Type-C DisplayPort inoperable due to incorrect porch settings. - Re-used wide_bus_en as flag to prevent porch shifting Fixes: c943b4948b58 ("drm/msm/dp: add displayPort driver support") Signed-off-by: James A. MacInnes Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/636945/ Link: https://lore.kernel.org/r/20250212-sdm845_dp-v2-2-4954e51458f4@gmail.com Signed-off-by: Dmitry Baryshkov commit 83c4c67076c209787515e06fffd41dd0bdab09b9 Author: James A. MacInnes Date: Wed Feb 12 15:03:46 2025 -0800 drm/msm/dp: Disable wide bus support for SDM845 When widebus was enabled for DisplayPort in commit c7c412202623 ("drm/msm/dp: enable widebus on all relevant chipsets") it was clarified that it is only supported on DPU 5.0.0 onwards which includes SC7180 on DPU revision 6.2. However, this patch missed that the description structure for SC7180 is also reused for SDM845 (because of identical io_start address) which is only DPU 4.0.0, leading to a wrongly enbled widebus feature and corruption on that platform. Create a separate msm_dp_desc_sdm845 structure for this SoC compatible, with the wide_bus_supported flag turned off. Fixes: c7c412202623 ("drm/msm/dp: enable widebus on all relevant chipsets") Signed-off-by: James A. MacInnes [DB: reworded commit text following Marijn's suggestion] Reviewed-by: Abhinav Kumar Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/636944/ Link: https://lore.kernel.org/r/20250212-sdm845_dp-v2-1-4954e51458f4@gmail.com Signed-off-by: Dmitry Baryshkov commit 2b74aea6d078ade810a3b0f7d1bcfcba2eaad416 Author: Dan Carpenter Date: Fri Jun 6 12:04:14 2025 +0300 spi: spi-pci1xxxx: Fix error code in probe Return the error code if pci_alloc_irq_vectors() fails. Don't return success. Fixes: b4608e944177 ("spi: spi-pci1xxxx: Fix Probe failure with Dual SPI instance with INTx interrupts") Signed-off-by: Dan Carpenter Reviewed-by: Thangaraj Samynathan Link: https://patch.msgid.link/aEKvDrUxD19GWi0u@stanley.mountain Signed-off-by: Mark Brown commit 1dd630088332b5b310f3dd7eaacae9f3c4465651 Author: Huacai Chen Date: Sun Jun 8 22:29:39 2025 +0800 spi: loongson: Fix build warnings about export.h After commit a934a57a42f64a4 ("scripts/misc-check: check missing #include when W=1") and 7d95680d64ac8e836c ("scripts/misc-check: check unnecessary #include when W=1"), we get some build warnings with W=1: drivers/spi/spi-loongson-core.c: warning: EXPORT_SYMBOL() is used, but #include is missing So fix these build warnings for SPI/Loongson. Signed-off-by: Huacai Chen Link: https://patch.msgid.link/20250608142939.172108-1-chenhuacai@loongson.cn Signed-off-by: Mark Brown commit 10c24e0d2f7cd2bc8a847cf750f01301ce67dbc8 Author: Félix Piédallu Date: Fri Jun 6 15:37:25 2025 +0200 spi: omap2-mcspi: Disable multi-mode when the previous message kept CS asserted When the last transfer of a SPI message has the cs_change flag, the CS is kept asserted after the message. The next message can't use multi-mode because the CS will be briefly deasserted before the first transfer. Remove the early exit of the list_for_each_entry because the last transfer actually needs to be always checked. Fixes: d153ff4056cb ("spi: omap2-mcspi: Add support for MULTI-mode") Signed-off-by: Félix Piédallu Link: https://patch.msgid.link/20250606-cs_change_fix-v1-2-27191a98a2e5@non.se.com Signed-off-by: Mark Brown commit a5bf5272295d3f058adeee025d2a0b6625f8ba7b Author: Félix Piédallu Date: Fri Jun 6 15:37:24 2025 +0200 spi: omap2-mcspi: Disable multi mode when CS should be kept asserted after message When the last transfer of a SPI message has the cs_change flag, the CS is kept asserted after the message. Multi-mode can't respect this as CS is deasserted by the hardware at the end of the message. Disable multi-mode when not applicable to the current message. Fixes: d153ff4056cb ("spi: omap2-mcspi: Add support for MULTI-mode") Signed-off-by: Félix Piédallu Link: https://patch.msgid.link/20250606-cs_change_fix-v1-1-27191a98a2e5@non.se.com Signed-off-by: Mark Brown commit 06118ae36855b7d3d22688298e74a766ccf0cb7a Author: Dan Carpenter Date: Tue May 27 08:44:14 2025 +0300 regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt() There is a missing call to of_node_put() if devm_kcalloc() fails. Fix this by changing the code to use cleanup.h magic to drop the refcount. Fixes: 6b0cd72757c6 ("regulator: max20086: fix invalid memory access") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aDVRLqgJWMxYU03G@stanley.mountain Reviewed-by: Laurent Pinchart Signed-off-by: Mark Brown commit a4e469c1e2e0ec7f08fff9ed29f5500f187ba9f2 Author: Huacai Chen Date: Sun Jun 8 22:27:37 2025 +0800 ASoC: loongson: Fix build warnings about export.h After commit 25704938c86d7b2 ("scripts/misc-check: check missing #include when W=1") and 1239f681359926101e ("scripts/misc-check: check unnecessary #include when W=1"), we get some build warnings with W=1: sound/soc/loongson/loongson_i2s.c: warning: EXPORT_SYMBOL() is used, but #include is missing So fix these build warnings for ASoC/Loongson. Signed-off-by: Huacai Chen Link: https://patch.msgid.link/20250608142737.168829-1-chenhuacai@loongson.cn Signed-off-by: Mark Brown commit b44b2694005b501b2eaeb56aa778f3ca22de4659 Author: Zhang Yi Date: Wed Jun 4 14:18:21 2025 +0800 ASoC: codecs: ES8326: Modify initialization configuration Modify the value of ES8326_SDINOUT1_IO in the initialization Signed-off-by: Zhang Yi Link: https://patch.msgid.link/20250604061821.2678-1-zhangyi@everest-semi.com Signed-off-by: Mark Brown commit 22188b9df60dde48eaba276da22062aaf8e12dfe Author: Harshit Mogalapalli Date: Tue Jun 3 14:48:13 2025 -0700 ASoC: cs48l32: Fix a signedness bug in cs48l32_hw_params() There is a type promotion that can happen when freq(u32) variable is comapared with sclk_target(integer), when sclk_target is a negative value it promotes to a large postive integer which might not be a problem in this particular case as the condition evaluates to false when that happens, but bail out early when sclk_target has negative error codes. cs48l32_sclk_rates[i].freq >= sclk_target Fix this by adding a negative error check when snd_soc_tdm_params_to_bclk() fails Fixes: e2bcbf99d045 ("ASoC: cs48l32: Add driver for Cirrus Logic CS48L32 audio DSP") Signed-off-by: Harshit Mogalapalli Link: https://patch.msgid.link/20250603214813.197346-1-harshit.m.mogalapalli@oracle.com Reviewed-by: Richard Fitzgerald Signed-off-by: Mark Brown commit 19272b37aa4f83ca52bdf9c16d5d81bdd1354494 Author: Linus Torvalds Date: Sun Jun 8 13:44:43 2025 -0700 Linux 6.16-rc1 commit 939f15e640f193616691d3bcde0089760e75b0d3 Merge: be54f8c558027a 42fd37dcc432df Author: Linus Torvalds Date: Sun Jun 8 11:44:41 2025 -0700 Merge tag 'turbostat-2025.06.08' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux Pull turbostat updates from Len Brown: - Add initial DMR support, which required smarter RAPL probe - Fix AMD MSR RAPL energy reporting - Add RAPL power limit configuration output - Minor fixes * tag 'turbostat-2025.06.08' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux: tools/power turbostat: version 2025.06.08 tools/power turbostat: Add initial support for BartlettLake tools/power turbostat: Add initial support for DMR tools/power turbostat: Dump RAPL sysfs info tools/power turbostat: Avoid probing the same perf counters tools/power turbostat: Allow probing RAPL with platform_features->rapl_msrs cleared tools/power turbostat: Clean up add perf/msr counter logic tools/power turbostat: Introduce add_msr_counter() tools/power turbostat: Remove add_msr_perf_counter_() tools/power turbostat: Remove add_cstate_perf_counter_() tools/power turbostat: Remove add_rapl_perf_counter_() tools/power turbostat: Quit early for unsupported RAPL counters tools/power turbostat: Always check rapl_joules flag tools/power turbostat: Fix AMD package-energy reporting tools/power turbostat: Fix RAPL_GFX_ALL typo tools/power turbostat: Add Android support for MSR device handling tools/power turbostat.8: pm_domain wording fix tools/power turbostat.8: fix typo: idle_pct should be pct_idle commit be54f8c558027a218423134dd9b8c7c46d92204a Merge: 0529ef8c36d74a 41cb08555c4164 Author: Linus Torvalds Date: Sun Jun 8 11:33:00 2025 -0700 Merge tag 'timers-cleanups-2025-06-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer cleanup from Thomas Gleixner: "The delayed from_timer() API cleanup: The renaming to the timer_*() namespace was delayed due massive conflicts against Linux-next. Now that everything is upstream finish the conversion" * tag 'timers-cleanups-2025-06-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: treewide, timers: Rename from_timer() to timer_container_of() commit 0529ef8c36d74a05e929ea4adbdecd2c3393b0bb Merge: 4710eacf8daef2 dd2922dcfaa329 Author: Linus Torvalds Date: Sun Jun 8 11:27:20 2025 -0700 Merge tag 'x86-urgent-2025-06-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Thomas Gleixner: "A small set of x86 fixes: - Cure IO bitmap inconsistencies A failed fork cleans up all resources of the newly created thread via exit_thread(). exit_thread() invokes io_bitmap_exit() which does the IO bitmap cleanups, which unfortunately assume that the cleanup is related to the current task, which is obviously bogus. Make it work correctly - A lockdep fix in the resctrl code removed the clearing of the command buffer in two places, which keeps stale error messages around. Bring them back. - Remove unused trace events" * tag 'x86-urgent-2025-06-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: fs/resctrl: Restore the rdt_last_cmd_clear() calls after acquiring rdtgroup_mutex x86/iopl: Cure TIF_IO_BITMAP inconsistencies x86/fpu: Remove unused trace events commit 4710eacf8daef2c6bbb18fbad95ef60603b685ac Merge: d9864e7d151194 434d7f9b0e24e1 Author: Linus Torvalds Date: Sun Jun 8 11:25:13 2025 -0700 Merge tag 'timers-urgent-2025-06-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Thomas Gleixner: "Add the missing seq_file forward declaration in the timer namespace header" * tag 'timers-urgent-2025-06-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: timens: Add struct seq_file forward declaration commit 42fd37dcc432df1ea1987232d41bb84fcb7e150c Author: Len Brown Date: Sun Jun 8 12:31:59 2025 -0400 tools/power turbostat: version 2025.06.08 Add initial DMR support, which required smarter RAPL probe Fix AMD MSR RAPL energy reporting Add RAPL power limit configuration output Minor fixes Signed-off-by: Len Brown commit d8c0f5d973004f2ac86375ea54fae9625ac594fb Author: Zhang Rui Date: Fri Apr 18 14:04:26 2025 +0800 tools/power turbostat: Add initial support for BartlettLake Add initial support for BartlettLake. Signed-off-by: Zhang Rui Signed-off-by: Len Brown commit 83075bd59de25f5c9238a583008540914946f23e Author: Zhang Rui Date: Mon Mar 4 14:54:40 2024 +0800 tools/power turbostat: Add initial support for DMR Add initial support for DMR. Signed-off-by: Zhang Rui Signed-off-by: Len Brown commit 2a535d6cc3b4831cc6dc7e248f2fb4afeeec591d Author: Zhang Rui Date: Fri May 30 14:01:31 2025 +0800 tools/power turbostat: Dump RAPL sysfs info for example: intel-rapl:1: psys 28.0s:100W 976.0us:100W intel-rapl:0: package-0 28.0s:57W,max:15W 2.4ms:57W intel-rapl:0/intel-rapl:0:0: core disabled intel-rapl:0/intel-rapl:0:1: uncore disabled intel-rapl-mmio:0: package-0 28.0s:28W,max:15W 2.4ms:57W [lenb: simplified format] Signed-off-by: Zhang Rui Signed-off-by: Len Brown squish me Signed-off-by: Len Brown commit 69078520fdf1525212a23a80dc79e1a75f2062f6 Author: Zhang Rui Date: Fri May 30 08:09:28 2025 +0800 tools/power turbostat: Avoid probing the same perf counters For the RAPL package energy status counter, Intel and AMD share the same perf_subsys and perf_name, but with different MSR addresses. Both rapl_counter_arch_infos[0] and rapl_counter_arch_infos[1] are introduced to describe this counter for different Vendors. As a result, the perf counter is probed twice, and causes a failure in in get_rapl_counters() because expected_read_size and actual_read_size don't match. Fix the problem by skipping the already probed counter. Note, this is not a perfect fix. For example, if different vendors/platforms use the same MSR value for different purpose, the code can be fooled when it probes a rapl_counter_arch_infos[] entry that does not belong to the running Vendor/Platform. In a long run, better to put rapl_counter_arch_infos[] into the platform_features so that this becomes Vendor/Platform specific. Signed-off-by: Zhang Rui Signed-off-by: Len Brown commit ff3d019e98db83ce2b5eb395333bc2518b37f4f0 Author: Zhang Rui Date: Sat May 17 17:44:50 2025 +0800 tools/power turbostat: Allow probing RAPL with platform_features->rapl_msrs cleared platform_features->rapl_msrs describes the RAPL MSRs supported. While RAPL Perf counters can be exposed from different kernel backend drivers, e.g. RAPL MSR I/F driver, or RAPL TPMI I/F driver. Thus, turbostat should first blindly probe all the available RAPL Perf counters, and falls back to the RAPL MSR counters if they are listed in platform_features->rapl_msrs. With this, platforms that don't have RAPL MSRs can clear the platform_features->rapl_msrs bits and use RAPL Perf counters only. Signed-off-by: Zhang Rui Signed-off-by: Len Brown commit 0362337968ad252e6563fff131906a43450d8940 Author: Zhang Rui Date: Sat May 17 17:35:17 2025 +0800 tools/power turbostat: Clean up add perf/msr counter logic Increase the code readability by moving the no_perf/no_msr flag and the cai->perf_name/cai->msr sanity checks into the counter probe functions. No functional change. Signed-off-by: Zhang Rui Signed-off-by: Len Brown commit 1ab2e19b4c52ee08700938d52024d85bd15c9721 Author: Zhang Rui Date: Sat May 17 15:58:51 2025 +0800 tools/power turbostat: Introduce add_msr_counter() probe_rapl_msr() is reused for probing RAPL MSR counters, cstate MSR counters and MPERF/APERF/SMI MSR counters, thus its name is misleading. Similar to add_perf_counter(), introduce add_msr_counter() to probe a counter via MSR. Introduce wrapper function add_rapl_msr_counter() at the same time to add extra check for Zero return value for specified RAPL counters. No functional change intended. Signed-off-by: Zhang Rui Signed-off-by: Len Brown commit 3403e89f97ce71e473a5128ea389cb83bc27e7a9 Author: Zhang Rui Date: Sat May 17 17:40:08 2025 +0800 tools/power turbostat: Remove add_msr_perf_counter_() As the only caller of add_msr_perf_counter_(), add_msr_perf_counter() just gives extra debug output on top. There is no need to keep both functions. Remove add_msr_perf_counter_() and move all the logic to add_msr_perf_counter(). No functional change. Signed-off-by: Zhang Rui Signed-off-by: Len Brown commit 4d6ced7bef959701533d1e5c003872e837318e38 Author: Zhang Rui Date: Sat May 17 15:43:59 2025 +0800 tools/power turbostat: Remove add_cstate_perf_counter_() As the only caller of add_cstate_perf_counter_(), add_cstate_perf_counter() just gives extra debug output on top. There is no need to keep both functions. Remove add_cstate_perf_counter_() and move all the logic to add_cstate_perf_counter(). No functional change. Signed-off-by: Zhang Rui Signed-off-by: Len Brown commit c8bca955da22269db80576c676eb50a5ef156832 Author: Zhang Rui Date: Sat May 17 12:06:22 2025 +0800 tools/power turbostat: Remove add_rapl_perf_counter_() As the only caller of add_rapl_perf_counter_(), add_rapl_perf_counter() just gives extra debug output on top. There is no need to keep both functions. Remove add_rapl_perf_counter_() and move all the logic to add_rapl_perf_counter(). No functional change. Signed-off-by: Zhang Rui Signed-off-by: Len Brown commit 57b53787f0f7845eb30aedde75464aca37906985 Author: Zhang Rui Date: Sat May 17 10:26:14 2025 +0800 tools/power turbostat: Quit early for unsupported RAPL counters Quit early for unsupported RAPL counters. No functional change. Signed-off-by: Zhang Rui Signed-off-by: Len Brown commit fdea6b883b05b101b6e85674e1c3f58234229bfa Author: Zhang Rui Date: Fri May 30 14:00:33 2025 +0800 tools/power turbostat: Always check rapl_joules flag rapl_joules bit should always be checked even if platform_features->rapl_msrs is not set or no_msr flag is used. Signed-off-by: Zhang Rui Signed-off-by: Len Brown commit adb49732c8c63665dd3476e8e6b7c67a0f851245 Author: Gautham R. Shenoy Date: Thu May 29 17:18:25 2025 +0530 tools/power turbostat: Fix AMD package-energy reporting commit 05a2f07db888 ("tools/power turbostat: read RAPL counters via perf") that adds support to read RAPL counters via perf defines the notion of a RAPL domain_id which is set to physical_core_id on platforms which support per_core_rapl counters (Eg: AMD processors Family 17h onwards) and is set to the physical_package_id on all the other platforms. However, the physical_core_id is only unique within a package and on platforms with multiple packages more than one core can have the same physical_core_id and thus the same domain_id. (For eg, the first cores of each package have the physical_core_id = 0). This results in all these cores with the same physical_core_id using the same entry in the rapl_counter_info_perdomain[]. Since rapl_perf_init() skips the perf-initialization for cores whose domain_ids have already been visited, cores that have the same physical_core_id always read the perf file corresponding to the physical_core_id of the first package and thus the package-energy is incorrectly reported to be the same value for different packages. Note: This issue only arises when RAPL counters are read via perf and not when they are read via MSRs since in the latter case the MSRs are read separately on each core. Fix this issue by associating each CPU with rapl_core_id which is unique across all the packages in the system. Fixes: 05a2f07db888 ("tools/power turbostat: read RAPL counters via perf") Signed-off-by: Gautham R. Shenoy Signed-off-by: Len Brown commit b4a734d3839971f590ce8c435ea5b0d3762b37a8 Author: Kaushlendra Kumar Date: Fri May 23 13:36:59 2025 +0530 tools/power turbostat: Fix RAPL_GFX_ALL typo Fix typo in the currently unused RAPL_GFX_ALL macro definition. Signed-off-by: Kaushlendra Kumar Signed-off-by: Len Brown commit 5663785ae02f66acf64f285a40e35abd21b8a7b2 Author: Kaushlendra Kumar Date: Thu May 22 14:19:46 2025 +0530 tools/power turbostat: Add Android support for MSR device handling It uses /dev/msrN device paths on Android instead of /dev/cpu/N/msr, updates error messages and permission checks to reflect the Android device path, and wraps platform-specific code with #if defined(ANDROID) to ensure correct behavior on both Android and non-Android systems. These changes improve compatibility and usability of turbostat on Android devices. Signed-off-by: Kaushlendra Kumar Signed-off-by: Len Brown commit c967900fcb00927c1758c16130be5cd771993198 Author: Len Brown Date: Fri Apr 18 17:54:39 2025 -0400 tools/power turbostat.8: pm_domain wording fix turbostat.8: clarify that uncore "domains" are Power Management domains, aka pm_domains. Signed-off-by: Len Brown commit 394c1127abd9e8ee829bbfaddb959728d60b0cdc Author: Len Brown Date: Wed Apr 9 00:06:24 2025 -0400 tools/power turbostat.8: fix typo: idle_pct should be pct_idle idle_pct should be pct_idle Signed-off-by: Len Brown commit d9864e7d151194b06c6cdbee8e69f0686238313a Merge: 70b7d651ca6e0d 86aa94cd50b138 Author: Linus Torvalds Date: Sun Jun 8 11:07:33 2025 -0700 Merge tag 'perf-urgent-2025-06-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 perf fix from Thomas Gleixner: "A single fix for the x86 performance counters on Intel CPUs: The MSR offset calculations for fixed performance counters are stored at the wrong index in the configuration array causing the general purpose counter MSR offset to be overwritten, so both the general purpose and the fixed counters offsets are incorrect. Correct the array index calculation to fix that" * tag 'perf-urgent-2025-06-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/intel: Fix incorrect MSR index calculations in intel_pmu_config_acr() commit 70b7d651ca6e0d37cbfd60929b7fdb55ce66d41f Merge: 35b574a6c2279f 9cc82d99b13c1a Author: Linus Torvalds Date: Sun Jun 8 11:02:53 2025 -0700 Merge tag 'irq-urgent-2025-06-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fix from Thomas Gleixner: "A single fix for the PCI/MSI code: The conversion to per device MSI domains created a MSI domain with size 1 instead of sizing it to the maximum possible number of MSI interrupts for the device. This "worked" as the subsequent allocations resized the domain, but the recent change to move the prepare() call into the domain creation path broke this works by chance mechanism. Size the domain properly at creation time" * tag 'irq-urgent-2025-06-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: PCI/MSI: Size device MSI domain with the maximum number of vectors commit 35b574a6c2279fe47d13ffafb8389f1adc87a1d1 Merge: 522cd6acd250de 12f147ddd6de73 Author: Linus Torvalds Date: Sun Jun 8 10:35:12 2025 -0700 Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull mount fixes from Al Viro: "Various mount-related bugfixes: - split the do_move_mount() checks in subtree-of-our-ns and entire-anon cases and adapt detached mount propagation selftest for mount_setattr - allow clone_private_mount() for a path on real rootfs - fix a race in call of has_locked_children() - fix move_mount propagation graph breakage by MOVE_MOUNT_SET_GROUP - make sure clone_private_mnt() caller has CAP_SYS_ADMIN in the right userns - avoid false negatives in path_overmount() - don't leak MNT_LOCKED from parent to child in finish_automount() - do_change_type(): refuse to operate on unmounted/not ours mounts" * tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: do_change_type(): refuse to operate on unmounted/not ours mounts clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns selftests/mount_setattr: adapt detached mount propagation test do_move_mount(): split the checks in subtree-of-our-ns and entire-anon cases fs: allow clone_private_mount() for a path on real rootfs fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) finish_automount(): don't leak MNT_LOCKED from parent to child path_overmount(): avoid false negatives fs/fhandle.c: fix a race in call of has_locked_children() commit 522cd6acd250dea76afaabc52e028fef280fd753 Merge: 538c429a4b430e 8e9d6efccdd728 Author: Linus Torvalds Date: Sun Jun 8 10:20:21 2025 -0700 Merge tag '6.16-rc-part2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull more smb client updates from Steve French: - multichannel/reconnect fixes - move smbdirect (smb over RDMA) defines to fs/smb/common so they will be able to be used in the future more broadly, and a documentation update explaining setting up smbdirect mounts - update email address for Paulo * tag '6.16-rc-part2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: update internal version number MAINTAINERS, mailmap: Update Paulo Alcantara's email address cifs: add documentation for smbdirect setup cifs: do not disable interface polling on failure cifs: serialize other channels when query server interfaces is pending cifs: deal with the channel loading lag while picking channels smb: client: make use of common smbdirect_socket_parameters smb: smbdirect: introduce smbdirect_socket_parameters smb: client: make use of common smbdirect_socket smb: smbdirect: add smbdirect_socket.h smb: client: make use of common smbdirect.h smb: smbdirect: add smbdirect.h with public structures smb: client: make use of common smbdirect_pdu.h smb: smbdirect: add smbdirect_pdu.h with protocol definitions commit 538c429a4b430ef70f428d2d1755ac51724d3245 Merge: 8630c59e99363c 549e914c96ae67 Author: Linus Torvalds Date: Sun Jun 8 08:19:01 2025 -0700 Merge tag 'trace-v6.16-3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull more tracing fixes from Steven Rostedt: - Fix regression of waiting a long time on updating trace event filters When the faultable trace points were added, it needed task trace RCU synchronization. This was added to the tracepoint_synchronize_unregister() function. The filter logic always called this function whenever it updated the trace event filters before freeing the old filters. This increased the time of "trace-cmd record" from taking 13 seconds to running over 2 minutes to complete. Move the freeing of the filters to call_rcu*() logic, which brings the time back down to 13 seconds. - Fix ring_buffer_subbuf_order_set() error path lock protection The error path of the ring_buffer_subbuf_order_set() released the mutex too early and allowed subsequent accesses to setting the subbuffer size to corrupt the data and cause a bug. By moving the mutex locking to the end of the error path, it prevents the reentrant access to the critical data and also allows the function to convert the taking of the mutex over to the guard() logic. - Remove unused power management clock events The clock events were added in 2010 for power management. In 2011 arm used them. In 2013 the code they were used in was removed. These events have been wasting memory since then. - Fix sparse warnings There was a few places that sparse warned about trace_events_filter.c where file->filter was referenced directly, but it is annotated with an __rcu tag. Use the helper functions and fix them up to use rcu_dereference() properly. * tag 'trace-v6.16-3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Add rcu annotation around file->filter accesses tracing: PM: Remove unused clock events ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() tracing: Fix regression of filter waiting a long time on RCU synchronization commit 41cb08555c4164996d67c78b3bf1c658075b75f1 Author: Ingo Molnar Date: Fri May 9 07:51:14 2025 +0200 treewide, timers: Rename from_timer() to timer_container_of() Move this API to the canonical timer_*() namespace. [ tglx: Redone against pre rc1 ] Signed-off-by: Ingo Molnar Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/aB2X0jCKQO56WdMt@gmail.com commit 8630c59e99363c4b655788fd01134aef9bcd9264 Merge: b3154a6ff1f53b c50a04f8f45c7f Author: Linus Torvalds Date: Sat Jun 7 10:05:35 2025 -0700 Merge tag 'kbuild-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild updates from Masahiro Yamada: - Add support for the EXPORT_SYMBOL_GPL_FOR_MODULES() macro, which exports a symbol only to specified modules - Improve ABI handling in gendwarfksyms - Forcibly link lib-y objects to vmlinux even if CONFIG_MODULES=n - Add checkers for redundant or missing inclusion - Deprecate the extra-y syntax - Fix a genksyms bug when including enum constants from *.symref files * tag 'kbuild-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: (28 commits) genksyms: Fix enum consts from a reference affecting new values arch: use always-$(KBUILD_BUILTIN) for vmlinux.lds kbuild: set y instead of 1 to KBUILD_{BUILTIN,MODULES} efi/libstub: use 'targets' instead of extra-y in Makefile module: make __mod_device_table__* symbols static scripts/misc-check: check unnecessary #include when W=1 scripts/misc-check: check missing #include when W=1 scripts/misc-check: add double-quotes to satisfy shellcheck kbuild: move W=1 check for scripts/misc-check to top-level Makefile scripts/tags.sh: allow to use alternative ctags implementation kconfig: introduce menu type enum docs: symbol-namespaces: fix reST warning with literal block kbuild: link lib-y objects to vmlinux forcibly even when CONFIG_MODULES=n tinyconfig: enable CONFIG_LD_DEAD_CODE_DATA_ELIMINATION docs/core-api/symbol-namespaces: drop table of contents and section numbering modpost: check forbidden MODULE_IMPORT_NS("module:") at compile time kbuild: move kbuild syntax processing to scripts/Makefile.build Makefile: remove dependency on archscripts for header installation Documentation/kbuild: Add new gendwarfksyms kABI rules Documentation/kbuild: Drop section numbers ... commit b3154a6ff1f53b794c01096577700f35b1be9cc2 Merge: b7191581a973ab 8a3682601ddaa4 Author: Linus Torvalds Date: Sat Jun 7 10:00:03 2025 -0700 Merge tag 'sh-for-v6.16-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/glaubitz/sh-linux Pull sh updates from John Paul Adrian Glaubitz: - replace the __ASSEMBLY__ with __ASSEMBLER__ macro in all headers since the latter is now defined automatically by both GCC and Clang when compiling assembly code (Thomas Huth) - set the default SPI mode for the ecovec24 board which became necessary after a new mode member as added to the sh_msiof_spi_info struct in cf9e4784f3bd ("spi: sh-msiof: Add slave mode support") (Geert Uytterhoeven) - remove unused variables in the kprobes code in kprobe_exceptions_notify() (Mike Rapoport) * tag 'sh-for-v6.16-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/glaubitz/sh-linux: sh: kprobes: Remove unused variables in kprobe_exceptions_notify() sh: ecovec24: Make SPI mode explicit sh: Replace __ASSEMBLY__ with __ASSEMBLER__ in all headers commit b7191581a973ab2fca45d2ca64416065f1660ae0 Merge: af477f4d5a6c18 f78fb2576f22b0 Author: Linus Torvalds Date: Sat Jun 7 09:56:18 2025 -0700 Merge tag 'loongarch-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch updates from Huacai Chen: - Adjust the 'make install' operation - Support SCHED_MC (Multi-core scheduler) - Enable ARCH_SUPPORTS_MSEAL_SYSTEM_MAPPINGS - Enable HAVE_ARCH_STACKLEAK - Increase max supported CPUs up to 2048 - Introduce the numa_memblks conversion - Add PWM controller nodes in dts - Some bug fixes and other small changes * tag 'loongarch-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: platform/loongarch: laptop: Unregister generic_sub_drivers on exit platform/loongarch: laptop: Add backlight power control support platform/loongarch: laptop: Get brightness setting from EC on probe LoongArch: dts: Add PWM support to Loongson-2K2000 LoongArch: dts: Add PWM support to Loongson-2K1000 LoongArch: dts: Add PWM support to Loongson-2K0500 LoongArch: vDSO: Correctly use asm parameters in syscall wrappers LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() LoongArch: Preserve firmware configuration when desired LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg LoongArch: Introduce the numa_memblks conversion LoongArch: Increase max supported CPUs up to 2048 LoongArch: Enable HAVE_ARCH_STACKLEAK LoongArch: Enable ARCH_SUPPORTS_MSEAL_SYSTEM_MAPPINGS LoongArch: Add SCHED_MC (Multi-core scheduler) support LoongArch: Add some annotations in archhelp LoongArch: Using generic scripts/install.sh in `make install` LoongArch: Add a default install.sh commit af477f4d5a6c183e2dd44f49dd9a7950bfa7bd50 Merge: 5b032cac622533 10db9528524074 Author: Linus Torvalds Date: Sat Jun 7 09:40:08 2025 -0700 Merge tag 'sound-fix-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of fix patches for the 6.16-rc1 merge window. Most of changes are about ASoC, especially lots of AVS driver fixes. Larger LOCs are seen in TAS571x codec drivers, but the changes are trivial and safe. The rest are all device-specific small fixes" * tag 'sound-fix-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (27 commits) ASoC: Intel: avs: boards: Fix rt5663 front end name ASoC: Intel: avs: Simplify verification of parse_int_array() result ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 ALSA: hda: Ignore unsol events for cards being shut down ALSA: hda: Add new pci id for AMD GPU display HD audio controller ALSA: hda: cs35l41: Constify regmap_irq_chip ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock ASoC: ti: omap-hdmi: Re-add dai_link->platform to fix card init ASoC: pcm: Do not open FEs with no BEs connected ASoC: rt1320: fix speaker noise when volume bar is 100% ASoC: Intel: avs: Include missing string.h ASoC: Intel: avs: Verify content returned by parse_int_array() ASoC: Intel: avs: Verify kcalloc() status when setting constraints ASoC: Intel: avs: Fix paths in MODULE_FIRMWARE hints ASoC: Intel: avs: Fix possible null-ptr-deref when initing hw ASoC: Intel: avs: Fix PPLCxFMT calculation ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX ASoC: codecs: hda: Fix RPM usage count underflow ASoC: amd: yc: Add support for Lenovo Yoga 7 16ARP8 ASoC: tas571x: fix tas5733 num_controls ... commit f3fe49dbddd73f0155a8935af47cb63693069dbe Author: Miaoqing Pan Date: Wed Jun 4 13:52:50 2025 +0800 wifi: ath12k: fix uaf in ath12k_core_init() When the execution of ath12k_core_hw_group_assign() or ath12k_core_hw_group_create() fails, the registered notifier chain is not unregistered properly. Its memory is freed after rmmod, which may trigger to a use-after-free (UAF) issue if there is a subsequent access to this notifier chain. Fixes the issue by calling ath12k_core_panic_notifier_unregister() in failure cases. Call trace: notifier_chain_register+0x4c/0x1f0 (P) atomic_notifier_chain_register+0x38/0x68 ath12k_core_init+0x50/0x4e8 [ath12k] ath12k_pci_probe+0x5f8/0xc28 [ath12k] pci_device_probe+0xbc/0x1a8 really_probe+0xc8/0x3a0 __driver_probe_device+0x84/0x1b0 driver_probe_device+0x44/0x130 __driver_attach+0xcc/0x208 bus_for_each_dev+0x84/0x100 driver_attach+0x2c/0x40 bus_add_driver+0x130/0x260 driver_register+0x70/0x138 __pci_register_driver+0x68/0x80 ath12k_pci_init+0x30/0x68 [ath12k] ath12k_init+0x28/0x78 [ath12k] Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Fixes: 6f245ea0ec6c ("wifi: ath12k: introduce device group abstraction") Signed-off-by: Miaoqing Pan Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20250604055250.1228501-1-miaoqing.pan@oss.qualcomm.com Signed-off-by: Jeff Johnson commit b6bca6d7149e0bc1a56e831af0296d45688945ec Author: Jeff Johnson Date: Thu Jun 5 10:27:22 2025 -0700 wifi: ath12k: Fix hal_reo_cmd_status kernel-doc Currently a warning is reported when running: % scripts/kernel-doc -Wall -Werror -none drivers/net/wireless/ath/ath12k/hal.h Warning: drivers/net/wireless/ath/ath12k/hal.h:596 Enum value 'HAL_REO_CMD_RESOURCE_BLOCKED' not described in enum 'hal_reo_cmd_status' Add the missing description of HAL_REO_CMD_RESOURCE_BLOCKED. Link: https://patch.msgid.link/20250605-hal_reo_cmd_status-kdoc-v1-1-e59f4b814b88@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 7588a893cde5385ad308400ff167d29a29913b3a Author: Baochen Qiang Date: Fri May 23 10:23:05 2025 +0800 wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 GCC_GCC_PCIE_HOT_RST is wrongly defined for WCN7850, causing kernel crash on some specific platforms. Since this register is divergent for WCN7850 and QCN9274, move it to register table to allow different definitions. Then correct the register address for WCN7850 to fix this issue. Note IPQ5332 is not affected as it is not PCIe based device. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Reported-by: Parth Pancholi Closes: https://lore.kernel.org/all/86899b2235a59c9134603beebe08f2bb0b244ea0.camel@gmail.com Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Tested-by: Parth Pancholi Link: https://patch.msgid.link/20250523-ath12k-wrong-global-reset-addr-v1-1-3b06eb556196@quicinc.com Signed-off-by: Jeff Johnson commit b0d226a60856a1b765bb9a3848c7b2322fd08c47 Author: Rodrigo Gobbi Date: Thu May 22 17:01:12 2025 -0300 wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready if ath11k_crypto_mode is invalid (not ATH11K_CRYPT_MODE_SW/ATH11K_CRYPT_MODE_HW), ath11k_core_qmi_firmware_ready() will not undo some actions that was previously started/configured. Do the validation as soon as possible in order to avoid undoing actions in that case and also to fix the following smatch warning: drivers/net/wireless/ath/ath11k/core.c:2166 ath11k_core_qmi_firmware_ready() warn: missing unwind goto? Signed-off-by: Rodrigo Gobbi Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202304151955.oqAetVFd-lkp@intel.com/ Fixes: aa2092a9bab3 ("ath11k: add raw mode and software crypto support") Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20250522200519.16858-1-rodrigo.gobbi.7@gmail.com Signed-off-by: Jeff Johnson commit 29e2adf2ef2966379bd3fe002530b10dfc3030ba Author: Baochen Qiang Date: Thu Feb 20 16:24:48 2025 +0800 wifi: ath11k: consistently use ath11k_mac_get_fw_stats() Currently to get firmware stats, ath11k_mac_op_get_txpower() calls ath11k_fw_stats_request() and ath11k_mac_op_sta_statistics() calls ath11k_mac_get_fw_stats(). Those two helpers are basically doing the same, except for: 1. ath11k_mac_get_fw_stats() verifies ar->state inside itself. 2. ath11k_mac_get_fw_stats() calls ath11k_mac_fw_stats_request() which then calls ath11k_mac_fw_stats_reset() to free pdev/vdev stats whereas only pdev stats are freed by ath11k_fw_stats_request(). 3. ath11k_mac_get_fw_stats() waits for ar->fw_stats_complete and ar->fw_stats_done, whereas ath11k_fw_stats_request() only waits for ar->fw_stats_complete. Change to call ath11k_mac_get_fw_stats() in ath11k_mac_op_get_txpower(). This is valid because: 1. ath11k_mac_op_get_txpower() also has the same request on ar->state. 2. it is harmless to call ath11k_fw_stats_vdevs_free() since ar->fw_stats.vdevs should be empty and there should be no one expecting it at that time. 3. ath11k_mac_op_get_txpower() only needs pdev stats. For pdev stats, ar->fw_stats_done is set to true whenever ar->fw_stats_complete is set to true in ath11k_update_stats_event(). So additional wait on ar->fw_stats_done does not wast any time. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.37 Signed-off-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250220082448.31039-8-quic_bqiang@quicinc.com Signed-off-by: Jeff Johnson commit c5b92a2c18938ebb08e8d4062408ab1524da31c3 Author: Baochen Qiang Date: Thu Feb 20 16:24:47 2025 +0800 wifi: ath11k: move locking outside of ath11k_mac_get_fw_stats() Currently ath11k_mac_get_fw_stats() is acquiring/releasing ar->conf_mutex by itself. In order to reuse this function in a context where that lock is already taken, move lock handling to its callers, then the function itself only has to assert it. There is only one caller now, i.e., ath11k_mac_op_sta_statistics(), so add lock handling there. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.37 Signed-off-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250220082448.31039-7-quic_bqiang@quicinc.com Signed-off-by: Jeff Johnson commit 81f64165c9dc2d9b070d8240dd369974ebe188d3 Author: Baochen Qiang Date: Thu Feb 20 16:24:46 2025 +0800 wifi: ath11k: adjust unlock sequence in ath11k_update_stats_event() Currently RCU lock and ar->data_lock are acquired in a sequence of rcu_read_lock() spin_lock_bh(&ar->data_lock) but released in a sequence of rcu_read_unlock() spin_unlock_bh(&ar->data_lock) Although there are no apparent issues with this, reorder them to achieve symmetry. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.37 Signed-off-by: Baochen Qiang Acked-by: Kalle Valo Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250220082448.31039-6-quic_bqiang@quicinc.com Signed-off-by: Jeff Johnson commit 72610ed7d79da17ee09102534d6c696a4ea8a08e Author: Baochen Qiang Date: Thu Feb 20 16:24:45 2025 +0800 wifi: ath11k: move some firmware stats related functions outside of debugfs Commit b488c766442f ("ath11k: report rssi of each chain to mac80211 for QCA6390/WCN6855") and commit c3b39553fc77 ("ath11k: add signal report to mac80211 for QCA6390 and WCN6855") call debugfs functions in mac ops. Those functions are no-ops if CONFIG_ATH11K_DEBUGFS is not enabled, thus cause wrong status reported. Move them to mac.c. Besides, since WMI_REQUEST_RSSI_PER_CHAIN_STAT and WMI_REQUEST_VDEV_STAT stats could also be requested via mac ops, process them directly in ath11k_update_stats_event(). Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.37 Fixes: b488c766442f ("ath11k: report rssi of each chain to mac80211 for QCA6390/WCN6855") Fixes: c3b39553fc77 ("ath11k: add signal report to mac80211 for QCA6390 and WCN6855") Signed-off-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250220082448.31039-5-quic_bqiang@quicinc.com Signed-off-by: Jeff Johnson commit 3b6d00fa883075dcaf49221538230e038a9c0b43 Author: Baochen Qiang Date: Thu Feb 20 16:24:44 2025 +0800 wifi: ath11k: don't wait when there is no vdev started For WMI_REQUEST_VDEV_STAT request, firmware might split response into multiple events dut to buffer limit, hence currently in ath11k_debugfs_fw_stats_process() we wait until all events received. In case there is no vdev started, this results in that below condition would never get satisfied ((++ar->fw_stats.num_vdev_recvd) == total_vdevs_started) finally the requestor would be blocked until wait time out. The same applies to WMI_REQUEST_BCN_STAT request as well due to: ((++ar->fw_stats.num_bcn_recvd) == ar->num_started_vdevs) Change to check the number of started vdev first: if it is zero, finish wait directly; if not, follow the old way. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.37 Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Signed-off-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250220082448.31039-4-quic_bqiang@quicinc.com Signed-off-by: Jeff Johnson commit 2bcf73b2612dda7432f2c2eaad6679bd291791f2 Author: Baochen Qiang Date: Thu Feb 20 16:24:43 2025 +0800 wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process() Currently ath11k_debugfs_fw_stats_process() is using static variables to count firmware stat events. Taking num_vdev as an example, if for whatever reason ( say ar->num_started_vdevs is 0 or firmware bug etc.) the following condition (++num_vdev) == total_vdevs_started is not met, is_end is not set thus num_vdev won't be cleared. Next time when firmware stats is requested again, even if everything is working fine, we will fail due to the condition above will never be satisfied. The same applies to num_bcn as well. Change to use non-static counters so that we have a chance to clear them each time firmware stats is requested. Currently only ath11k_fw_stats_request() and ath11k_debugfs_fw_stats_request() are requesting firmware stats, so clear counters there. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.37 Fixes: da3a9d3c1576 ("ath11k: refactor debugfs code into debugfs.c") Signed-off-by: Baochen Qiang Acked-by: Kalle Valo Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250220082448.31039-3-quic_bqiang@quicinc.com Signed-off-by: Jeff Johnson commit 9f6e82d11bb9692a90d20b10f87345598945c803 Author: Baochen Qiang Date: Thu Feb 20 16:24:42 2025 +0800 wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request() We get report [1] that CPU is running a hot loop in ath11k_debugfs_fw_stats_request(): 94.60% 0.00% i3status [kernel.kallsyms] [k] do_syscall_64 | --94.60%--do_syscall_64 | --94.55%--__sys_sendmsg ___sys_sendmsg ____sys_sendmsg netlink_sendmsg netlink_unicast genl_rcv netlink_rcv_skb genl_rcv_msg | --94.55%--genl_family_rcv_msg_dumpit __netlink_dump_start netlink_dump genl_dumpit nl80211_dump_station | --94.55%--ieee80211_dump_station sta_set_sinfo | --94.55%--ath11k_mac_op_sta_statistics ath11k_debugfs_get_fw_stats | --94.55%--ath11k_debugfs_fw_stats_request | |--41.73%--_raw_spin_lock_bh | |--22.74%--__local_bh_enable_ip | |--9.22%--_raw_spin_unlock_bh | --6.66%--srso_alias_safe_ret This is because, if for whatever reason ar->fw_stats_done is not set by ath11k_update_stats_event(), ath11k_debugfs_fw_stats_request() won't yield CPU before an up to 3s timeout. Change to completion mechanism to avoid CPU burning. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.37 Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Reported-by: Yury Vostrikov Closes: https://lore.kernel.org/all/7324ac7a-8b7a-42a5-aa19-de52138ff638@app.fastmail.com/ # [1] Signed-off-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250220082448.31039-2-quic_bqiang@quicinc.com Signed-off-by: Jeff Johnson commit 593963660919a97a4546acfd706dac93625724f5 Author: Sebastian Gottschall Date: Tue Mar 4 08:21:31 2025 +0700 wil6210: fix support for sparrow chipsets the wil6210 driver irq handling code is unconditionally writing edma irq registers which are supposed to be only used on Talyn chipsets. This however leade to a chipset hang on the older sparrow chipset generation and firmware will not even boot. Fix that by simply checking for edma support before handling these registers. Tested on Netgear R9000 Signed-off-by: Sebastian Gottschall Link: https://patch.msgid.link/20250304012131.25970-2-s.gottschall@dd-wrt.com Signed-off-by: Jeff Johnson commit dc9c4252fe0d7a7f1ee904405ea91534277305bf Author: Loic Poulain Date: Thu May 22 15:17:04 2025 +0200 wifi: ath10k: Avoid vdev delete timeout when firmware is already down In some scenarios, the firmware may be stopped before the interface is removed, either due to a crash or because the remoteproc (e.g., MPSS) is shut down early during system reboot or shutdown. This leads to a delay during interface teardown, as the driver waits for a vdev delete response that never arrives, eventually timing out. Example (SNOC): $ echo stop > /sys/class/remoteproc/remoteproc0/state [ 71.64] remoteproc remoteproc0: stopped remote processor modem $ reboot [ 74.84] ath10k_snoc c800000.wifi: failed to transmit packet, dropping: -108 [ 74.84] ath10k_snoc c800000.wifi: failed to submit frame: -108 [...] [ 82.39] ath10k_snoc c800000.wifi: Timeout in receiving vdev delete response To avoid this, skip waiting for the vdev delete response if the firmware is already marked as unreachable (`ATH10K_FLAG_CRASH_FLUSH`), similar to how `ath10k_mac_wait_tx_complete()` and `ath10k_vdev_setup_sync()` handle this case. Signed-off-by: Loic Poulain Link: https://patch.msgid.link/20250522131704.612206-1-loic.poulain@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 1650d32b92b01db03a1a95d69ee74fcbc34d4b00 Author: Casey Connolly Date: Tue Mar 18 20:50:27 2025 +0000 ath10k: snoc: fix unbalanced IRQ enable in crash recovery In ath10k_snoc_hif_stop() we skip disabling the IRQs in the crash recovery flow, but we still unconditionally call enable again in ath10k_snoc_hif_start(). We can't check the ATH10K_FLAG_CRASH_FLUSH bit since it is cleared before hif_start() is called, so instead check the ATH10K_SNOC_FLAG_RECOVERY flag and skip enabling the IRQs during crash recovery. This fixes unbalanced IRQ enable splats that happen after recovering from a crash. Fixes: 0e622f67e041 ("ath10k: add support for WCN3990 firmware crash recovery") Signed-off-by: Caleb Connolly Tested-by: Loic Poulain Link: https://patch.msgid.link/20250318205043.1043148-1-caleb.connolly@linaro.org Signed-off-by: Jeff Johnson commit 549e914c96ae67760f36b9714b424dc992a0a69b Author: Steven Rostedt Date: Sat Jun 7 10:28:21 2025 -0400 tracing: Add rcu annotation around file->filter accesses Running sparse on trace_events_filter.c triggered several warnings about file->filter being accessed directly even though it's annotated with __rcu. Add rcu_dereference() around it and shuffle the logic slightly so that it's always referenced via accessor functions. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20250607102821.6c7effbf@gandalf.local.home Signed-off-by: Steven Rostedt (Google) commit 5b032cac622533631b8f9b7826498b7ce75001c6 Merge: bdc7f8c5adad50 2b6d96503255a3 Author: Linus Torvalds Date: Sat Jun 7 07:24:07 2025 -0700 Merge tag 'ubifs-for-linus-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs Pull JFFS2 and UBIFS fixes from Richard Weinberger: "JFFS2: - Correctly check return code of jffs2_prealloc_raw_node_refs() UBIFS: - Spelling fixes" * tag 'ubifs-for-linus-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs: jffs2: check jffs2_prealloc_raw_node_refs() result in few other places jffs2: check that raw node were preallocated before writing summary ubifs: Fix grammar in error message commit 8a3682601ddaa4ef0c400f627a7f4b9388bbccef Author: Mike Rapoport Date: Sat May 17 12:30:48 2025 +0300 sh: kprobes: Remove unused variables in kprobe_exceptions_notify() kbuild reports the following warning: arch/sh/kernel/kprobes.c: In function 'kprobe_exceptions_notify': >> arch/sh/kernel/kprobes.c:412:24: warning: variable 'p' set but not used [-Wunused-but-set-variable] 412 | struct kprobe *p = NULL; | ^ The variable 'p' is indeed unused since the commit fa5a24b16f94 ("sh/kprobes: Don't call the ->break_handler() in SH kprobes code") Remove that variable along with 'kprobe_opcode_t *addr' which also becomes unused after 'p' is removed. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202505151341.EuRFR22l-lkp@intel.com/ Fixes: fa5a24b16f94 ("sh/kprobes: Don't call the ->break_handler() in SH kprobes code") Signed-off-by: Mike Rapoport (Microsoft) Reviewed-by: John Paul Adrian Glaubitz Reviewed-by: Geert Uytterhoeven Signed-off-by: John Paul Adrian Glaubitz commit ab0a168fcd984c2fc93eb0fb2367881c6aa62eb3 Author: Geert Uytterhoeven Date: Fri May 2 13:13:36 2025 +0200 sh: ecovec24: Make SPI mode explicit Commit cf9e4784f3bde3e4 ("spi: sh-msiof: Add slave mode support") added a new mode member to the sh_msiof_spi_info structure, but did not update any board files. Hence all users in board files rely on the default being host mode. Make this unambiguous by configuring host mode explicitly. Signed-off-by: Geert Uytterhoeven Reviewed-by: John Paul Adrian Glaubitz Signed-off-by: John Paul Adrian Glaubitz commit 9cc646950eefda5605111cbc387b00b1f741c239 Author: Thomas Huth Date: Fri Mar 14 08:10:03 2025 +0100 sh: Replace __ASSEMBLY__ with __ASSEMBLER__ in all headers While the GCC and Clang compilers already define __ASSEMBLER__ automatically when compiling assembly code, __ASSEMBLY__ is a macro that only gets defined by the Makefiles in the kernel. This can be very confusing when switching between userspace and kernelspace coding, or when dealing with uapi headers that rather should use __ASSEMBLER__ instead. So let's standardize on the __ASSEMBLER__ macro that is provided by the compilers now. This is a completely mechanical patch (done with a simple "sed -i" statement). Cc: Yoshinori Sato Cc: Rich Felker Cc: John Paul Adrian Glaubitz Cc: linux-sh@vger.kernel.org Signed-off-by: Thomas Huth Reviewed-by: John Paul Adrian Glaubitz Signed-off-by: John Paul Adrian Glaubitz commit a18d098f2aab82abde1d59c56aef9beca01c892b Author: Rafael J. Wysocki Date: Thu Jun 5 17:09:35 2025 +0200 Reapply "x86/smp: Eliminate mwait_play_dead_cpuid_hint()" Revert commit 70523f335734 ("Revert "x86/smp: Eliminate mwait_play_dead_cpuid_hint()"") to reapply the changes from commit 96040f7273e2 ("x86/smp: Eliminate mwait_play_dead_cpuid_hint()") reverted by it. Previously, these changes caused idle power to rise on systems booting with "nosmt" in the kernel command line because they effectively caused "dead" SMT siblings to remain in idle state C1 after executing the HLT instruction, which prevented the processor from reaching package idle states deeper than PC2 going forward. Now, the "dead" SMT siblings are rescanned after initializing a proper cpuidle driver for the processor (either intel_idle or ACPI idle), at which point they are able to enter a sufficiently deep idle state in native_play_dead() via cpuidle, so the code changes in question can be reapplied. Signed-off-by: Rafael J. Wysocki Acked-by: Dave Hansen Tested-by: Artem Bityutskiy Link: https://patch.msgid.link/7813065.EvYhyI6sBW@rjwysocki.net commit f694481b1d3177144fcac4242eb750cfcb9f7bd5 Author: Rafael J. Wysocki Date: Thu Jun 5 17:07:31 2025 +0200 ACPI: processor: Rescan "dead" SMT siblings during initialization Make acpi_processor_driver_init() call arch_cpu_rescan_dead_smt_siblings(), via a new wrapper function called acpi_idle_rescan_dead_smt_siblings(), after successfully initializing the driver, to allow the "dead" SMT siblings to go into deep idle states, which is necessary for the processor to be able to reach deep package C-states (like PC10) going forward, so that power can be reduced sufficiently in suspend-to-idle, among other things. However, do it only if the ACPI idle driver is the current cpuidle driver (otherwise it is assumed that another cpuidle driver will take care of this) and avoid doing it on architectures other than x86. Signed-off-by: Rafael J. Wysocki Tested-by: Artem Bityutskiy Link: https://patch.msgid.link/2005721.PYKUYFuaPT@rjwysocki.net commit a430c11f401589a0f4f57fd398271a5d85142c7a Author: Rafael J. Wysocki Date: Thu Jun 5 17:06:08 2025 +0200 intel_idle: Rescan "dead" SMT siblings during initialization Make intel_idle_init() call arch_cpu_rescan_dead_smt_siblings() after successfully registering intel_idle as the cpuidle driver so as to allow the "dead" SMT siblings (if any) to go into deep idle states. This is necessary for the processor to be able to reach deep package C-states (like PC10) going forward which is requisite for reducing power sufficiently in suspend-to-idle, among other things. Signed-off-by: Rafael J. Wysocki Tested-by: Artem Bityutskiy Link: https://patch.msgid.link/10669885.nUPlyArG6x@rjwysocki.net commit 4c529a4a7260776bb4abe264498857b4537aa70d Author: Rafael J. Wysocki Date: Sat Jun 7 14:22:56 2025 +0200 x86/smp: PM/hibernate: Split arch_resume_nosmt() Move the inner part of the arch_resume_nosmt() code into a separate function called arch_cpu_rescan_dead_smt_siblings(), so it can be used in other places where "dead" SMT siblings may need to be taken online and offline again in order to get into deep idle states. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Acked-by: Dave Hansen Tested-by: Artem Bityutskiy Link: https://patch.msgid.link/3361688.44csPzL39Z@rjwysocki.net [ rjw: Prevent build issues with CONFIG_SMP unset ] Signed-off-by: Rafael J. Wysocki commit c50a04f8f45c7f13972f9097622d1d929033ea8c Author: Petr Pavlu Date: Tue Jun 3 15:02:09 2025 +0200 genksyms: Fix enum consts from a reference affecting new values Enumeration constants read from a symbol reference file can incorrectly affect new enumeration constants parsed from an actual input file. Example: $ cat test.c enum { E_A, E_B, E_MAX }; struct bar { int mem[E_MAX]; }; int foo(struct bar *a) {} __GENKSYMS_EXPORT_SYMBOL(foo); $ cat test.c | ./scripts/genksyms/genksyms -T test.0.symtypes #SYMVER foo 0x070d854d $ cat test.0.symtypes E#E_MAX 2 s#bar struct bar { int mem [ E#E_MAX ] ; } foo int foo ( s#bar * ) $ cat test.c | ./scripts/genksyms/genksyms -T test.1.symtypes -r test.0.symtypes :4: warning: foo: modversion changed because of changes in enum constant E_MAX #SYMVER foo 0x9c9dfd81 $ cat test.1.symtypes E#E_MAX ( 2 ) + 3 s#bar struct bar { int mem [ E#E_MAX ] ; } foo int foo ( s#bar * ) The __add_symbol() function includes logic to handle the incrementation of enumeration values, but this code is also invoked when reading a reference file. As a result, the variables last_enum_expr and enum_counter might be incorrectly set after reading the reference file, which later affects parsing of the actual input. Fix the problem by splitting the logic for the incrementation of enumeration values into a separate function process_enum() and call it from __add_symbol() only when processing non-reference data. Fixes: e37ddb825003 ("genksyms: Track changes to enum constants") Signed-off-by: Petr Pavlu Signed-off-by: Masahiro Yamada commit e21efe833eae4e2a56c2c2a11caae870a65926fa Author: Masahiro Yamada Date: Tue Jun 3 03:12:54 2025 +0900 arch: use always-$(KBUILD_BUILTIN) for vmlinux.lds The extra-y syntax is deprecated. Instead, use always-$(KBUILD_BUILTIN), which behaves equivalently. Signed-off-by: Masahiro Yamada Acked-by: Johannes Berg Reviewed-by: Nicolas Schier commit 12f147ddd6de7382dad54812e65f3f08d05809fc Author: Al Viro Date: Wed Jun 4 12:27:08 2025 -0400 do_change_type(): refuse to operate on unmounted/not ours mounts Ensure that propagation settings can only be changed for mounts located in the caller's mount namespace. This change aligns permission checking with the rest of mount(2). Reviewed-by: Christian Brauner Fixes: 07b20889e305 ("beginning of the shared-subtree proper") Reported-by: "Orlando, Noah" Signed-off-by: Al Viro commit 1bf807b8f7e0eada62007f9f1966f3d22329eef9 Author: Masahiro Yamada Date: Tue Jun 3 03:12:53 2025 +0900 kbuild: set y instead of 1 to KBUILD_{BUILTIN,MODULES} KBUILD_BUILTIN is set to 1 unless you are building only modules. KBUILD_MODULES is set to 1 when you are building only modules (a typical use case is "make modules"). It is more useful to set them to 'y' instead, so we can do something like: always-$(KBUILD_BUILTIN) += vmlinux.lds This works equivalently to: extra-y += vmlinux.lds This allows us to deprecate extra-y. extra-y and always-y are quite similar, and we do not need both. Signed-off-by: Masahiro Yamada Reviewed-by: Nathan Chancellor Reviewed-by: Nicolas Schier commit c28f922c9dcee0e4876a2c095939d77fe7e15116 Author: Al Viro Date: Sun Jun 1 20:11:06 2025 -0400 clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns What we want is to verify there is that clone won't expose something hidden by a mount we wouldn't be able to undo. "Wouldn't be able to undo" may be a result of MNT_LOCKED on a child, but it may also come from lacking admin rights in the userns of the namespace mount belongs to. clone_private_mnt() checks the former, but not the latter. There's a number of rather confusing CAP_SYS_ADMIN checks in various userns during the mount, especially with the new mount API; they serve different purposes and in case of clone_private_mnt() they usually, but not always end up covering the missing check mentioned above. Reviewed-by: Christian Brauner Reported-by: "Orlando, Noah" Fixes: 427215d85e8d ("ovl: prevent private clone if bind mount is not allowed") Signed-off-by: Al Viro commit bdc7f8c5adad50dad2ec762e317f8b212f5782ac Merge: d3c82f618a9c2b efe99fabeb11b0 Author: Linus Torvalds Date: Fri Jun 6 22:06:57 2025 -0700 Merge tag 'mm-stable-2025-06-06-16-09' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull more MM updates from Andrew Morton: "The series 'Fix uprobe pte be overwritten when expanding vma' fixes a longstanding and quite obscure bug related to the vma merging of the uprobe mmap page" * tag 'mm-stable-2025-06-06-16-09' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: selftests/mm: add test about uprobe pte be orphan during vma merge selftests/mm: extract read_sysfs and write_sysfs into vm_util mm: expose abnormal new_pte during move_ptes mm: fix uprobe pte be overwritten when expanding vma mm/damon: s/primitives/code/ on comments commit d3c82f618a9c2b764b7651afe16594ffeb50ade9 Merge: 949ea6f3f4c016 2da20fd904f87f Author: Linus Torvalds Date: Fri Jun 6 21:45:45 2025 -0700 Merge tag 'mm-hotfixes-stable-2025-06-06-16-02' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "13 hotfixes. 6 are cc:stable and the remainder address post-6.15 issues or aren't considered necessary for -stable kernels. 11 are for MM" * tag 'mm-hotfixes-stable-2025-06-06-16-02' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: kernel/rcu/tree_stall: add /sys/kernel/rcu_stall_count MAINTAINERS: add mm swap section kmsan: test: add module description MAINTAINERS: add tlb trace events to MMU GATHER AND TLB INVALIDATION mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race mm/hugetlb: unshare page tables during VMA split, not before MAINTAINERS: add Alistair as reviewer of mm memory policy iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec mm/mempolicy: fix incorrect freeing of wi_kobj alloc_tag: handle module codetag load errors as module load failures mm/madvise: handle madvise_lock() failure during race unwinding mm: fix vmstat after removing NR_BOUNCE KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY commit 7054674ee9b9c0c62c2a254243f876f577d36db2 Author: Christian Brauner Date: Thu Jun 5 14:50:54 2025 +0200 selftests/mount_setattr: adapt detached mount propagation test Make sure that detached trees don't receive mount propagation. Signed-off-by: Christian Brauner Signed-off-by: Al Viro commit 290da20e333955637f00647d9fff7c6e3c0b61e0 Author: Al Viro Date: Fri Jun 6 18:31:03 2025 -0400 do_move_mount(): split the checks in subtree-of-our-ns and entire-anon cases ... and fix the breakage in anon-to-anon case. There are two cases acceptable for do_move_mount() and mixing checks for those is making things hard to follow. One case is move of a subtree in caller's namespace. * source and destination must be in caller's namespace * source must be detachable from parent Another is moving the entire anon namespace elsewhere * source must be the root of anon namespace * target must either in caller's namespace or in a suitable anon namespace (see may_use_mount() for details). * target must not be in the same namespace as source. It's really easier to follow if tests are *not* mixed together... Reviewed-by: Christian Brauner Fixes: 3b5260d12b1f ("Don't propagate mounts into detached trees") Reported-by: Allison Karlitskaya Signed-off-by: Al Viro commit 4954346d80fb047cb78776d9f2ebd6a050f80c5f Author: KONDO KAZUMA(近藤　和真) Date: Thu May 15 12:18:30 2025 +0000 fs: allow clone_private_mount() for a path on real rootfs Mounting overlayfs with a directory on real rootfs (initramfs) as upperdir has failed with following message since commit db04662e2f4f ("fs: allow detached mounts in clone_private_mount()"). [ 4.080134] overlayfs: failed to clone upperpath Overlayfs mount uses clone_private_mount() to create internal mount for the underlying layers. The commit made clone_private_mount() reject real rootfs because it does not have a parent mount and is in the initial mount namespace, that is not an anonymous mount namespace. This issue can be fixed by modifying the permission check of clone_private_mount() following [1]. Reviewed-by: Christian Brauner Fixes: db04662e2f4f ("fs: allow detached mounts in clone_private_mount()") Link: https://lore.kernel.org/all/20250514190252.GQ2023217@ZenIV/ [1] Link: https://lore.kernel.org/all/20250506194849.GT2023217@ZenIV/ Suggested-by: Al Viro Signed-off-by: Kazuma Kondo Signed-off-by: Al Viro commit d8cc0362f918d020ca1340d7694f07062dc30f36 Author: Al Viro Date: Tue Jun 3 17:57:27 2025 -0400 fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) 9ffb14ef61ba "move_mount: allow to add a mount into an existing group" breaks assertions on ->mnt_share/->mnt_slave. For once, the data structures in question are actually documented. Documentation/filesystem/sharedsubtree.rst: All vfsmounts in a peer group have the same ->mnt_master. If it is non-NULL, they form a contiguous (ordered) segment of slave list. do_set_group() puts a mount into the same place in propagation graph as the old one. As the result, if old mount gets events from somewhere and is not a pure event sink, new one needs to be placed next to the old one in the slave list the old one's on. If it is a pure event sink, we only need to make sure the new one doesn't end up in the middle of some peer group. "move_mount: allow to add a mount into an existing group" ends up putting the new one in the beginning of list; that's definitely not going to be in the middle of anything, so that's fine for case when old is not marked shared. In case when old one _is_ marked shared (i.e. is not a pure event sink), that breaks the assumptions of propagation graph iterators. Put the new mount next to the old one on the list - that does the right thing in "old is marked shared" case and is just as correct as the current behaviour if old is not marked shared (kudos to Pavel for pointing that out - my original suggested fix changed behaviour in the "nor marked" case, which complicated things for no good reason). Reviewed-by: Christian Brauner Fixes: 9ffb14ef61ba ("move_mount: allow to add a mount into an existing group") Signed-off-by: Al Viro commit bab77c0d191e241d2d59a845c7ed68bfa6e1b257 Author: Al Viro Date: Sun May 4 13:28:37 2025 -0400 finish_automount(): don't leak MNT_LOCKED from parent to child Intention for MNT_LOCKED had always been to protect the internal mountpoints within a subtree that got copied across the userns boundary, not the mountpoint that tree got attached to - after all, it _was_ exposed before the copying. For roots of secondary copies that is enforced in attach_recursive_mnt() - MNT_LOCKED is explicitly stripped for those. For the root of primary copy we are almost always guaranteed that MNT_LOCKED won't be there, so attach_recursive_mnt() doesn't bother. Unfortunately, one call chain got overlooked - triggering e.g. NFS referral will have the submount inherit the public flags from parent; that's fine for such things as read-only, nosuid, etc., but not for MNT_LOCKED. This is particularly pointless since the mount attached by finish_automount() is usually expirable, which makes any protection granted by MNT_LOCKED null and void; just wait for a while and that mount will go away on its own. Include MNT_LOCKED into the set of flags to be ignored by do_add_mount() - it really is an internal flag. Reviewed-by: Christian Brauner Fixes: 5ff9d8a65ce8 ("vfs: Lock in place mounts from more privileged users") Signed-off-by: Al Viro commit 5f31c549382bcddbbd754c72c5433b19420d485d Author: Al Viro Date: Sun Jun 1 14:02:26 2025 -0400 path_overmount(): avoid false negatives Holding namespace_sem is enough to make sure that result remains valid. It is *not* enough to avoid false negatives from __lookup_mnt(). Mounts can be unhashed outside of namespace_sem (stuck children getting detached on final mntput() of lazy-umounted mount) and having an unrelated mount removed from the hash chain while we traverse it may end up with false negative from __lookup_mnt(). We need to sample and recheck the seqlock component of mount_lock... Bug predates the introduction of path_overmount() - it had come from the code in finish_automount() that got abstracted into that helper. Reviewed-by: Christian Brauner Fixes: 26df6034fdb2 ("fix automount/automount race properly") Fixes: 6ac392815628 ("fs: allow to mount beneath top mount") Signed-off-by: Al Viro commit 1f282cdc1d219c4a557f7009e81bc792820d9d9a Author: Al Viro Date: Sun Jun 1 14:23:52 2025 -0400 fs/fhandle.c: fix a race in call of has_locked_children() may_decode_fh() is calling has_locked_children() while holding no locks. That's an oopsable race... The rest of the callers are safe since they are holding namespace_sem and are guaranteed a positive refcount on the mount in question. Rename the current has_locked_children() to __has_locked_children(), make it static and switch the fs/namespace.c users to it. Make has_locked_children() a wrapper for __has_locked_children(), calling the latter under read_seqlock_excl(&mount_lock). Reviewed-by: Christian Brauner Reviewed-by: Jeff Layton Fixes: 620c266f3949 ("fhandle: relax open_by_handle_at() permission checks") Signed-off-by: Al Viro commit f78fb2576f22b0ba5297412a9aa7691920666c41 Author: Yao Zi Date: Thu Jun 5 20:34:46 2025 +0800 platform/loongarch: laptop: Unregister generic_sub_drivers on exit Without correct unregisteration, ACPI notify handlers and the platform drivers installed by generic_subdriver_init() will become dangling references after removing the loongson_laptop module, triggering various kernel faults when a hotkey is sent or at kernel shutdown. Cc: stable@vger.kernel.org Fixes: 6246ed09111f ("LoongArch: Add ACPI-based generic laptop driver") Signed-off-by: Yao Zi Signed-off-by: Huacai Chen commit 53c762b47f726e4079a1f06f684bce2fc0d56fba Author: Yao Zi Date: Thu Jun 5 20:34:46 2025 +0800 platform/loongarch: laptop: Add backlight power control support loongson_laptop_turn_{on,off}_backlight() are designed for controlling the power of the backlight, but they aren't really used in the driver previously. Unify these two functions since they only differ in arguments passed to ACPI method, and wire up loongson_laptop_backlight_update() to update the power state of the backlight as well. Tested on the TongFang L860-T2 Loongson-3A5000 laptop. Cc: stable@vger.kernel.org Fixes: 6246ed09111f ("LoongArch: Add ACPI-based generic laptop driver") Signed-off-by: Yao Zi Signed-off-by: Huacai Chen commit 949ea6f3f4c016852406bfdd3374e2ba5d4c30a9 Merge: 119b1e61a769aa 7831003165d37e Author: Linus Torvalds Date: Fri Jun 6 20:02:51 2025 -0700 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Mostly trivial updates and bug fixes (core update is a comment spelling fix). The bigger UFS update is the clock scaling and frequency fixes" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: qcom: Prevent calling phy_exit() before phy_init() scsi: ufs: qcom: Call ufs_qcom_cfg_timers() in clock scaling path scsi: ufs: qcom: Map devfreq OPP freq to UniPro Core Clock freq scsi: ufs: qcom: Check gear against max gear in vop freq_to_gear() scsi: aacraid: Remove useless code scsi: core: devinfo: Fix typo in comment scsi: ufs: core: Don't perform UFS clkscaling during host async scan commit 119b1e61a769aa98e68599f44721661a4d8c55f3 Merge: d94467aed34e5a 51f1b16367dfde Author: Linus Torvalds Date: Fri Jun 6 18:05:18 2025 -0700 Merge tag 'riscv-for-linus-6.16-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V updates from Palmer Dabbelt: - Support for the FWFT SBI extension, which is part of SBI 3.0 and a dependency for many new SBI and ISA extensions - Support for getrandom() in the VDSO - Support for mseal - Optimized routines for raid6 syndrome and recovery calculations - kexec_file() supports loading Image-formatted kernel binaries - Improvements to the instruction patching framework to allow for atomic instruction patching, along with rules as to how systems need to behave in order to function correctly - Support for a handful of new ISA extensions: Svinval, Zicbop, Zabha, some SiFive vendor extensions - Various fixes and cleanups, including: misaligned access handling, perf symbol mangling, module loading, PUD THPs, and improved uaccess routines * tag 'riscv-for-linus-6.16-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (69 commits) riscv: uaccess: Only restore the CSR_STATUS SUM bit RISC-V: vDSO: Wire up getrandom() vDSO implementation riscv: enable mseal sysmap for RV64 raid6: Add RISC-V SIMD syndrome and recovery calculations riscv: mm: Add support for Svinval extension RISC-V: Documentation: Add enough title underlines to CMODX riscv: Improve Kconfig help for RISCV_ISA_V_PREEMPTIVE MAINTAINERS: Update Atish's email address riscv: uaccess: do not do misaligned accesses in get/put_user() riscv: process: use unsigned int instead of unsigned long for put_user() riscv: make unsafe user copy routines use existing assembly routines riscv: hwprobe: export Zabha extension riscv: Make regs_irqs_disabled() more clear perf symbols: Ignore mapping symbols on riscv RISC-V: Kconfig: Fix help text of CMDLINE_EXTEND riscv: module: Optimize PLT/GOT entry counting riscv: Add support for PUD THP riscv: xchg: Prefetch the destination word for sc.w riscv: Add ARCH_HAS_PREFETCH[W] support with Zicbop riscv: Add support for Zicbop ... commit d94467aed34e5ac9cf26d6178a324eed7367e98c Merge: 27fb892d364bd1 11709abccf93b0 Author: Linus Torvalds Date: Fri Jun 6 18:02:37 2025 -0700 Merge tag 's390-6.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull more s390 updates from Heiko Carstens: - Add missing select CRYPTO_ENGINE to CRYPTO_PAES_S390 - Fix secure storage access exception handling when fault handling is disabled * tag 's390-6.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/mm: Fix in_atomic() handling in do_secure_storage_access() s390/crypto: Select crypto engine in Kconfig when PAES is chosen commit 27fb892d364bd18a66b61a04b63401b18aeee253 Merge: a3fb8a61e4a18f e9ddb37834eb93 Author: Linus Torvalds Date: Fri Jun 6 18:00:36 2025 -0700 Merge tag 'tomoyo-pr-20250606' of git://git.code.sf.net/p/tomoyo/tomoyo Pull tomoyo update from Tetsuo Handa: "Update mailing list address" * tag 'tomoyo-pr-20250606' of git://git.code.sf.net/p/tomoyo/tomoyo: tomoyo: update mailing lists commit a3fb8a61e4a18f11dab281d5afa370e4aaded47b Merge: 28fb80f0891c01 b828b4bf29d10a Author: Linus Torvalds Date: Fri Jun 6 17:56:19 2025 -0700 Merge tag 'ceph-for-6.16-rc1' of https://github.com/ceph/ceph-client Pull ceph updates from Ilya Dryomov: - a one-liner that leads to a startling (but also very much rational) performance improvement in cases where an IMA policy with rules that are based on fsmagic matching is enforced - an encryption-related fixup that addresses generic/397 and other fstest failures - a couple of cleanups in CephFS * tag 'ceph-for-6.16-rc1' of https://github.com/ceph/ceph-client: ceph: fix variable dereferenced before check in ceph_umount_begin() ceph: set superblock s_magic for IMA fsmagic matching ceph: cleanup hardcoded constants of file handle size ceph: fix possible integer overflow in ceph_zero_objects() ceph: avoid kernel BUG for encrypted inode with unaligned file size commit 28fb80f0891c01dc706a5f6cada94c9cf0f2b1c2 Merge: 7a912d04415b37 6f9ccdad0feaef Author: Linus Torvalds Date: Fri Jun 6 17:54:09 2025 -0700 Merge tag 'ovl-update-v2-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs Pull overlayfs update from Miklos Szeredi: - Fix a regression in getting the path of an open file (e.g. in /proc/PID/maps) for a nested overlayfs setup (André Almeida) - Support data-only layers and verity in a user namespace (unprivileged composefs use case) - Fix a gcc warning (Kees) - Cleanups * tag 'ovl-update-v2-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs: ovl: Annotate struct ovl_entry with __counted_by() ovl: Replace offsetof() with struct_size() in ovl_stack_free() ovl: Replace offsetof() with struct_size() in ovl_cache_entry_new() ovl: Check for NULL d_inode() in ovl_dentry_upper() ovl: Use str_on_off() helper in ovl_show_options() ovl: don't require "metacopy=on" for "verity" ovl: relax redirect/metacopy requirements for lower -> data redirect ovl: make redirect/metacopy rejection consistent ovl: Fix nested backing file paths commit de6fdc076d39c97c0f7ed4873bfc84f58909f479 Author: Steven Rostedt Date: Thu Jun 5 16:21:06 2025 -0400 tracing: PM: Remove unused clock events The events clock_enable, clock_disable, and clock_set_rate were added back in 2010. In 2011 they were used by the arm architecture but removed in 2013. These events add around 7K of memory which was wasted for the last 12 years. Remove them. Link: https://lore.kernel.org/all/20250529130138.544ffec4@gandalf.local.home/ Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Kajetan Puchalski Acked-by: Rafael J. Wysocki Link: https://lore.kernel.org/20250605162106.1a459dad@gandalf.local.home Fixes: 74704ac6ea402 ("tracing, perf: Add more power related events") Signed-off-by: Steven Rostedt (Google) commit 40ee2afafc1d9fe3aa44a6fbe440d78a5c96a72e Author: Dmitry Antipov Date: Fri Jun 6 14:22:42 2025 +0300 ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() Enlarge the critical section in ring_buffer_subbuf_order_set() to ensure that error handling takes place with per-buffer mutex held, thus preventing list corruption and other concurrency-related issues. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Tzvetomir Stoyanov Link: https://lore.kernel.org/20250606112242.1510605-1-dmantipov@yandex.ru Reported-by: syzbot+05d673e83ec640f0ced9@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=05d673e83ec640f0ced9 Fixes: f9b94daa542a8 ("ring-buffer: Set new size of the ring buffer sub page") Signed-off-by: Dmitry Antipov Signed-off-by: Steven Rostedt (Google) commit a9d0aab5eb33a44792a66b7af13ff50d7b3e7022 Author: Steven Rostedt Date: Fri Jun 6 20:20:20 2025 -0400 tracing: Fix regression of filter waiting a long time on RCU synchronization When faultable trace events were added, a trace event may no longer use normal RCU to synchronize but instead used synchronize_rcu_tasks_trace(). This synchronization takes a much longer time to synchronize. The filter logic would free the filters by calling tracepoint_synchronize_unregister() after it unhooked the filter strings and before freeing them. With this function now calling synchronize_rcu_tasks_trace() this increased the time to free a filter tremendously. On a PREEMPT_RT system, it was even more noticeable. # time trace-cmd record -p function sleep 1 [..] real 2m29.052s user 0m0.244s sys 0m20.136s As trace-cmd would clear out all the filters before recording, it could take up to 2 minutes to do a recording of "sleep 1". To find out where the issues was: ~# trace-cmd sqlhist -e -n sched_stack select start.prev_state as state, end.next_comm as comm, TIMESTAMP_DELTA_USECS as delta, start.STACKTRACE as stack from sched_switch as start join sched_switch as end on start.prev_pid = end.next_pid Which will produce the following commands (and -e will also execute them): echo 's:sched_stack s64 state; char comm[16]; u64 delta; unsigned long stack[];' >> /sys/kernel/tracing/dynamic_events echo 'hist:keys=prev_pid:__arg_18057_2=prev_state,__arg_18057_4=common_timestamp.usecs,__arg_18057_7=common_stacktrace' >> /sys/kernel/tracing/events/sched/sched_switch/trigger echo 'hist:keys=next_pid:__state_18057_1=$__arg_18057_2,__comm_18057_3=next_comm,__delta_18057_5=common_timestamp.usecs-$__arg_18057_4,__stack_18057_6=$__arg_18057_7:onmatch(sched.sched_switch).trace(sched_stack,$__state_18057_1,$__comm_18057_3,$__delta_18057_5,$__stack_18057_6)' >> /sys/kernel/tracing/events/sched/sched_switch/trigger The above creates a synthetic event that creates a stack trace when a task schedules out and records it with the time it scheduled back in. Basically the time a task is off the CPU. It also records the state of the task when it left the CPU (running, blocked, sleeping, etc). It also saves the comm of the task as "comm" (needed for the next command). ~# echo 'hist:keys=state,stack.stacktrace:vals=delta:sort=state,delta if comm == "trace-cmd" && state & 3' > /sys/kernel/tracing/events/synthetic/sched_stack/trigger The above creates a histogram with buckets per state, per stack, and the value of the total time it was off the CPU for that stack trace. It filters on tasks with "comm == trace-cmd" and only the sleeping and blocked states (1 - sleeping, 2 - blocked). ~# trace-cmd record -p function sleep 1 ~# cat /sys/kernel/tracing/events/synthetic/sched_stack/hist | tail -18 { state: 2, stack.stacktrace __schedule+0x1545/0x3700 schedule+0xe2/0x390 schedule_timeout+0x175/0x200 wait_for_completion_state+0x294/0x440 __wait_rcu_gp+0x247/0x4f0 synchronize_rcu_tasks_generic+0x151/0x230 apply_subsystem_event_filter+0xa2b/0x1300 subsystem_filter_write+0x67/0xc0 vfs_write+0x1e2/0xeb0 ksys_write+0xff/0x1d0 do_syscall_64+0x7b/0x420 entry_SYSCALL_64_after_hwframe+0x76/0x7e } hitcount: 237 delta: 99756288 <<--------------- Delta is 99 seconds! Totals: Hits: 525 Entries: 21 Dropped: 0 This shows that this particular trace waited for 99 seconds on synchronize_rcu_tasks() in apply_subsystem_event_filter(). In fact, there's a lot of places in the filter code that spends a lot of time waiting for synchronize_rcu_tasks_trace() in order to free the filters. Add helper functions that will use call_rcu*() variants to asynchronously free the filters. This brings the timings back to normal: # time trace-cmd record -p function sleep 1 [..] real 0m14.681s user 0m0.335s sys 0m28.616s And the histogram also shows this: ~# cat /sys/kernel/tracing/events/synthetic/sched_stack/hist | tail -21 { state: 2, stack.stacktrace __schedule+0x1545/0x3700 schedule+0xe2/0x390 schedule_timeout+0x175/0x200 wait_for_completion_state+0x294/0x440 __wait_rcu_gp+0x247/0x4f0 synchronize_rcu_normal+0x3db/0x5c0 tracing_reset_online_cpus+0x8f/0x1e0 tracing_open+0x335/0x440 do_dentry_open+0x4c6/0x17a0 vfs_open+0x82/0x360 path_openat+0x1a36/0x2990 do_filp_open+0x1c5/0x420 do_sys_openat2+0xed/0x180 __x64_sys_openat+0x108/0x1d0 do_syscall_64+0x7b/0x420 } hitcount: 2 delta: 77044 Totals: Hits: 55 Entries: 28 Dropped: 0 Where the total waiting time of synchronize_rcu_tasks_trace() is 77 milliseconds. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: "Paul E. McKenney" Cc: Jan Kiszka Cc: Andreas Ziegler Cc: Felix MOESSBAUER Link: https://lore.kernel.org/20250606201936.1e3d09a9@batman.local.home Reported-by: "Flot, Julien" Tested-by: Julien Flot Fixes: a363d27cdbc2 ("tracing: Allow system call tracepoints to handle page faults") Closes: https://lore.kernel.org/all/240017f656631c7dd4017aa93d91f41f653788ea.camel@siemens.com/ Signed-off-by: Steven Rostedt (Google) commit 02670deede2288d8e4e3d800477b27c091080fae Author: Andrii Nakryiko Date: Fri Jun 6 13:21:34 2025 -0700 libbpf: Handle unsupported mmap-based /sys/kernel/btf/vmlinux correctly libbpf_err_ptr() helpers are meant to return NULL and set errno, if there is an error. But btf_parse_raw_mmap() is meant to be used internally and is expected to return ERR_PTR() values. Because of this mismatch, when libbpf tries to mmap /sys/kernel/btf/vmlinux, we don't detect the error correctly with IS_ERR() check, and never fallback to old non-mmap-based way of loading vmlinux BTF. Fix this by using proper ERR_PTR() returns internally. Reported-by: Arnaldo Carvalho de Melo Reviewed-by: Arnaldo Carvalho de Melo Tested-by: Arnaldo Carvalho de Melo Fixes: 3c0421c93ce4 ("libbpf: Use mmap to parse vmlinux BTF from sysfs") Cc: Lorenz Bauer Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20250606202134.2738910-1-andrii@kernel.org Signed-off-by: Alexei Starovoitov commit 7a912d04415b372324e5a8dfad3360d993d0c23a Merge: d7582bb0a4f549 57cf46cd1fe351 Author: Linus Torvalds Date: Fri Jun 6 13:22:31 2025 -0700 Merge tag 'spi-v6.16-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull more spi updates from Mark Brown: "A small set of updates that came in during the merge window, we've got: - Some small fixes for the Broadcom and spi-pci1xxxx drivers - A change to the QPIC SNAND driver to flag that the error correction features are less useful than people might be expecting - A new device ID for the SOPHGO SG2042 - The addition of Yang Shen as a Huawei maintainer" * tag 'spi-v6.16-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: spi-qpic-snand: document the limited bit error reporting capability spi: bcm63xx-hsspi: fix shared reset spi: bcm63xx-spi: fix shared reset MAINTAINERS: Update HiSilicon SFC driver maintainer MAINTAINERS: Update HiSilicon SPI Controller driver maintainer spi: dt-bindings: spi-sg2044-nor: Add SOPHGO SG2042 spi: spi-pci1xxxx: Fix Probe failure with Dual SPI instance with INTx interrupts commit d7582bb0a4f54979cef625df35ff9fd845400769 Merge: 8a2ba6f8ee7dd7 65271f868cb1dc Author: Linus Torvalds Date: Fri Jun 6 13:20:26 2025 -0700 Merge tag 'regulator-fix-v6.16-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "A very minor fix that came in during the merge window, checking for I/O errors in the MAX14577 driver" * tag 'regulator-fix-v6.16-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: max14577: Add error check for max14577_read_reg() commit 8a2ba6f8ee7dd764ffec4484e4f4d5ad377f9a69 Merge: 6d8854216ebb60 a8841dc3dfbf12 Author: Linus Torvalds Date: Fri Jun 6 13:16:50 2025 -0700 Merge tag 'pwm/for-6.16-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux Pull pwm fixes from Uwe Kleine-König: "axi-pwmgen: Fix handling of external clock The pwm-axi-pwmgen device is backed by an FPGA and can be synthesized in different ways. Relevant here is that it can use one or two external clock signals. These fix clock handling for the two clocks case" * tag 'pwm/for-6.16-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux: pwm: axi-pwmgen: fix missing separate external clock dt-bindings: pwm: adi,axi-pwmgen: Fix clocks commit 6d8854216ebb60959ddb6f4ea4123bd449ba6cf6 Merge: 794a5492078116 6f65947a1e684d Author: Linus Torvalds Date: Fri Jun 6 13:12:50 2025 -0700 Merge tag 'block-6.16-20250606' of git://git.kernel.dk/linux Pull more block updates from Jens Axboe: - NVMe pull request via Christoph: - TCP error handling fix (Shin'ichiro Kawasaki) - TCP I/O stall handling fixes (Hannes Reinecke) - fix command limits status code (Keith Busch) - support vectored buffers also for passthrough (Pavel Begunkov) - spelling fixes (Yi Zhang) - MD pull request via Yu: - fix REQ_RAHEAD and REQ_NOWAIT IO err handling for raid1/10 - fix max_write_behind setting for dm-raid - some minor cleanups - Integrity data direction fix and cleanup - bcache NULL pointer fix - Fix for loop missing write start/end handling - Decouple hardware queues and IO threads in ublk - Slew of ublk selftests additions and updates * tag 'block-6.16-20250606' of git://git.kernel.dk/linux: (29 commits) nvme: spelling fixes nvme-tcp: fix I/O stalls on congested sockets nvme-tcp: sanitize request list handling nvme-tcp: remove tag set when second admin queue config fails nvme: enable vectored registered bufs for passthrough cmds nvme: fix implicit bool to flags conversion nvme: fix command limits status code selftests: ublk: kublk: improve behavior on init failure block: flip iter directions in blk_rq_integrity_map_user() block: drop direction param from bio_integrity_copy_user() selftests: ublk: cover PER_IO_DAEMON in more stress tests Documentation: ublk: document UBLK_F_PER_IO_DAEMON selftests: ublk: add stress test for per io daemons selftests: ublk: add functional test for per io daemons selftests: ublk: kublk: decouple ublk_queues from ublk server threads selftests: ublk: kublk: move per-thread data out of ublk_queue selftests: ublk: kublk: lift queue initialization out of thread selftests: ublk: kublk: tie sqe allocation to io instead of queue selftests: ublk: kublk: plumb q_id in io_uring user_data ublk: have a per-io daemon instead of a per-queue daemon ... commit 794a54920781162c4503acea62d88e725726e319 Merge: c0c9379f235df3 079afb081c4288 Author: Linus Torvalds Date: Fri Jun 6 13:09:03 2025 -0700 Merge tag 'io_uring-6.16-20250606' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: - Fix for a regression introduced in this merge window, where the 'id' passed to xa_find() for ifq lookup is uninitialized - Fix for zcrx release on registration failure. From 6.15, going to stable - Tweak for recv bundles, where msg_inq should be > 1 before being used to gate a retry event - Pavel doesnt want to be a maintainer anymore, remove him from the MAINTAINERS entry - Limit legacy kbuf registrations to 64k, which is the size of the buffer ID field anyway. Hence it's nonsensical to support more than that, and the only purpose that serves is to have syzbot trigger long exit delays for heavily configured debug kernels - Fix for the io_uring futex handling, which got broken for FUTEX2_PRIVATE by a generic futex commit adding private hashes * tag 'io_uring-6.16-20250606' of git://git.kernel.dk/linux: io_uring/futex: mark wait requests as inflight io_uring/futex: get rid of struct io_futex addr union io_uring/kbuf: limit legacy provided buffer lists to USHRT_MAX MAINTAINERS: remove myself from io_uring io_uring/net: only consider msg_inq if larger than 1 io_uring/zcrx: fix area release on registration failure io_uring/zcrx: init id for xa_find commit c0c9379f235df33a12ceae94370ad80c5278324d Merge: 378ec25aec5a84 882826f58b2c48 Author: Linus Torvalds Date: Fri Jun 6 12:45:35 2025 -0700 Merge tag 'usb-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt updates from Greg KH: "Here is the big set of USB and Thunderbolt changes for 6.16-rc1. Included in here are the following: - USB offload support for audio devices. I think this takes the record for the most number of patch series (30+) over the longest period of time (2+ years) to get merged properly. Many props go to Wesley Cheng for seeing this effort through, they took a major out-of-tree hacked-up-monstrosity that was created by multiple vendors for their specific devices, got it all merged into a semi-coherent set of changes, and got all of the different major subsystems to agree on how this should be implemented both with changes to their code as well as userspace apis, AND wrangled the hardware companies into agreeing to go forward with this, despite making them all redo work they had already done in their private device trees. This feature offers major power savings on embedded devices where a USB audio stream can continue to flow while the rest of the system is sleeping, something that devices running on battery power really care about. There are still some more small tweaks left to be done here, and those patches are still out for review and arguing among the different hardware companies, but this is a major step forward and a great example of how to do upstream development well. - small number of thunderbolt fixes and updates, things seem to be slowing down here (famous last words...) - xhci refactors and reworking to try to handle some rough corner cases in some hardware implementations where things don't always work properly - typec driver updates - USB3 power management reworking and updates - Removal of some old and orphaned UDC gadget drivers that had not been used in a very long time, dropping over 11 thousand lines from the tree, always a nice thing, making up for the 12k lines added for the USB offload feature. - lots of little updates and fixes in different drivers All of these have been in linux-next for over 2 weeks, the USB offload logic has been in there for 8 weeks now, with no reported issues" * tag 'usb-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (172 commits) ALSA: usb-audio: qcom: fix USB_XHCI dependency ASoC: qdsp6: fix compile-testing without CONFIG_OF usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n usb: typec: tipd: fix typo in TPS_STATUS_HIGH_VOLAGE_WARNING macro USB: typec: fix const issue in typec_match() USB: gadget: udc: fix const issue in gadget_match_driver() USB: gadget: fix up const issue with struct usb_function_instance USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB USB: serial: bus: fix const issue in usb_serial_device_match() usb: usbtmc: Fix timeout value in get_stb usb: usbtmc: Fix read_stb function and get_stb ioctl ALSA: qc_audio_offload: try to reduce address space confusion ALSA: qc_audio_offload: avoid leaking xfer_buf allocation ALSA: qc_audio_offload: rename dma/iova/va/cpu/phys variables ALSA: usb-audio: qcom: Fix an error handling path in qc_usb_audio_probe() usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence dt-bindings: usb: ti,usb8041: Add binding for TI USB8044 hub controller usb: misc: onboard_usb_dev: Add support for TI TUSB8044 hub usb: gadget: lpc32xx_udc: Use USB API functions rather than constants usb: gadget: epautoconf: Use USB API functions rather than constants ... commit 378ec25aec5a8444879f8696d580c94950a1f1df Merge: c26f4fbd58375b b495021a973e24 Author: Linus Torvalds Date: Fri Jun 6 12:32:02 2025 -0700 Merge tag 'tty-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial updates from Greg KH: "Here is the big set of tty and serial driver changes for 6.16-rc1. A little more churn than normal in this portion of the kernel for this development cycle, Jiri and Nicholas were busy with cleanups and reviews and fixes for the vt unicode handling logic which composed most of the overall work in here. Major changes are: - vt unicode changes/reverts/changes from Nicholas. This should help out a lot with screen readers and others that rely on vt console support - lock guard additions to the core tty/serial code to clean up lots of error handling logic - 8250 driver updates and fixes - device tree conversions to yaml - sh-sci driver updates - other small cleanups and updates for serial drivers and tty core portions All of these have been in linux-next for 2 weeks with no reported issues" * tag 'tty-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (105 commits) tty: serial: 8250_omap: fix TX with DMA for am33xx vt: add VT_GETCONSIZECSRPOS to retrieve console size and cursor position vt: bracketed paste support vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() vt: process the full-width ASCII fallback range programmatically vt: make use of ucs_get_fallback() when glyph is unavailable vt: add ucs_get_fallback() vt: create ucs_fallback_table.h_shipped with gen_ucs_fallback_table.py vt: introduce gen_ucs_fallback_table.py to create ucs_fallback_table.h vt: move glyph determination to a separate function vt: make sure displayed double-width characters are remembered as such vt: ucs.c: fix misappropriate in_range() usage serial: max3100: Replace open-coded parity calculation with parity8() dt-bindings: serial: 8250_omap: Drop redundant properties dt-bindings: serial: Convert socionext,milbeaut-usio-uart to DT schema dt-bindings: serial: Convert microchip,pic32mzda-uart to DT schema dt-bindings: serial: Convert arm,sbsa-uart to DT schema dt-bindings: serial: Convert snps,arc-uart to DT schema dt-bindings: serial: Convert marvell,armada-3700-uart to DT schema dt-bindings: serial: Convert lantiq,asc to DT schema ... commit c26f4fbd58375bd6ef74f95eb73d61762ad97c59 Merge: a100922a3855eb 9857af0fcff385 Author: Linus Torvalds Date: Fri Jun 6 11:50:47 2025 -0700 Merge tag 'char-misc-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char / misc / iio driver updates from Greg KH: "Here is the big char/misc/iio and other small driver subsystem pull request for 6.16-rc1. Overall, a lot of individual changes, but nothing major, just the normal constant forward progress of new device support and cleanups to existing subsystems. Highlights in here are: - Large IIO driver updates and additions and device tree changes - Android binder bugfixes and logfile fixes - mhi driver updates - comedi driver updates - counter driver updates and additions - coresight driver updates and additions - echo driver removal as there are no in-kernel users of it - nvmem driver updates - spmi driver updates - new amd-sbi driver "subsystem" and drivers added - rust miscdriver binding documentation fix - other small driver fixes and updates (uio, w1, acrn, hpet, xillybus, cardreader drivers, fastrpc and others) All of these have been in linux-next for quite a while with no reported problems" * tag 'char-misc-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (390 commits) binder: fix yet another UAF in binder_devices counter: microchip-tcb-capture: Add watch validation support dt-bindings: iio: adc: Add ROHM BD79100G iio: adc: add support for Nuvoton NCT7201 dt-bindings: iio: adc: add NCT7201 ADCs iio: chemical: Add driver for SEN0322 dt-bindings: trivial-devices: Document SEN0322 iio: adc: ad7768-1: reorganize driver headers iio: bmp280: zero-init buffer iio: ssp_sensors: optimalize -> optimize HID: sensor-hub: Fix typo and improve documentation iio: admv1013: replace redundant ternary operator with just len iio: chemical: mhz19b: Fix error code in probe() iio: adc: at91-sama5d2: use IIO_DECLARE_BUFFER_WITH_TS iio: accel: sca3300: use IIO_DECLARE_BUFFER_WITH_TS iio: adc: ad7380: use IIO_DECLARE_DMA_BUFFER_WITH_TS iio: adc: ad4695: rename AD4695_MAX_VIN_CHANNELS iio: adc: ad4695: use IIO_DECLARE_DMA_BUFFER_WITH_TS iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros iio: make IIO_DMA_MINALIGN minimum of 8 bytes ... commit a100922a3855eb35ecd465f1d558546b1e144445 Merge: 5fc6c6f258b34f a481f0ebf213e0 Author: Linus Torvalds Date: Fri Jun 6 11:23:37 2025 -0700 Merge tag 'staging-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver updates from Greg KH: "Here is the "big" set of staging driver changes for 6.16-rc1. Included in here are: - gpib driver cleanups and updates. This subsystem is _almost_ ready to be merged into the main portion of the kernel tree. Hopefully should happen in the next kernel merge cycle if all goes well. - sm750fb driver cleanups - rtl8723bs driver cleanups - other small driver cleanups for coding style issues All of these have been in for over 2 weeks with no reported issues" * tag 'staging-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (203 commits) staging: rtl8723bs: remove unnecessary braces for single statement blocks staging: rtl8723bs: Removed multiple blank lines of rtw_pwrctrl.c staging: sm750fb: rename `hw_sm750le_setBLANK` staging: sm750fb: rename `hw_sm750_setBLANK` staging: sm750fb: rename `hw_sm750_setColReg` staging: sm750fb: rename `hw_sm750_crtc_setMode` staging: sm750fb: rename `hw_sm750_crtc_checkMode` staging: sm750fb: rename `hw_sm750_output_setMode` staging: sm750fb: rename `hw_sm750le_deWait` staging: sm750fb: rename `hw_sm750_deWait` staging: sm750fb: rename `hw_sm750_initAccel` staging: gpib: switch to kmalloc(sizeof(*status)) staging: gpib: Fix secondary address restriction staging: gpib: Fix uapi include header guard name staging: gpib: Avoid unused variable warning staging: gpib: Declare driver entry points static staging: gpib: Fix PCMCIA config identifier staging: gpib: Avoid unused variable warnings staging: gpib: Fix lpvo request_system_control staging: sm750fb: rename sm750_hw_cursor_setData2 ... commit 5fc6c6f258b34fd0d2ff2a63b8a407a4dcbca750 Merge: e332935a540eb7 6f7e234f74caf5 Author: Linus Torvalds Date: Fri Jun 6 09:26:47 2025 -0700 Merge tag 'drm-fixes-2025-06-06' of https://gitlab.freedesktop.org/drm/kernel Pull more drm fixes from Simona Vetter: "Another small batch of drm fixes, this time with a different baseline and hence separate. Drivers: - ivpu: - dma_resv locking - warning fixes - reset failure handling - improve logging - update fw file names - fix cmdqueue unregister - panel-simple: add Evervision VGG644804 Core Changes: - sysfb: screen_info type check - video: screen_info for relocated pci fb - drm/sched: signal fence of killed job - dummycon: deferred takeover fix" * tag 'drm-fixes-2025-06-06' of https://gitlab.freedesktop.org/drm/kernel: sysfb: Fix screen_info type check for VGA video: screen_info: Relocate framebuffers behind PCI bridges accel/ivpu: Fix warning in ivpu_gem_bo_free() accel/ivpu: Trigger device recovery on engine reset/resume failure accel/ivpu: Use dma_resv_lock() instead of a custom mutex drm/panel-simple: fix the warnings for the Evervision VGG644804 accel/ivpu: Reorder Doorbell Unregister and Command Queue Destruction accel/ivpu: Use firmware names from upstream repo accel/ivpu: Improve buffer object logging dummycon: Trigger redraw when switching consoles with deferred takeover drm/scheduler: signal scheduled fence when kill job commit c0f691388992c708436ab5f6e810865be6ddf5c6 Author: Rafael J. Wysocki Date: Thu Jun 5 17:04:11 2025 +0200 intel_idle: Use subsys_initcall_sync() for initialization It is not necessary to wait until the device_initcall() stage with intel_idle initialization. All of its dependencies are met after all subsys_initcall()s have run, so subsys_initcall_sync() can be used for initializing it. It is also better to ensure that intel_idle will always initialize before the ACPI processor driver that uses module_init() for its initialization. Signed-off-by: Rafael J. Wysocki Tested-by: Artem Bityutskiy Link: https://patch.msgid.link/2994397.e9J7NaK4W3@rjwysocki.net commit e332935a540eb76dd656663ca908eb0544d96757 Merge: 67faad74352d1c 04c8970771b4f1 Author: Linus Torvalds Date: Fri Jun 6 08:09:56 2025 -0700 Merge tag 'drm-next-2025-06-06' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "This is pretty much two weeks worth of fixes, plus one thing that might be considered next: amdkfd is now able to be enabled on risc-v platforms. Otherwise, amdgpu and xe with the majority of fixes, and then a smattering all over. panel: - nt37801: fix IS_ERR - nt37801: fix KConfig connector: - Fix null deref in HDMI audio helper. bridge: - analogix_dp: fixup clk-disable removal nouveau: - minor typo fix (',' vs ';') msm: - mailmap updates i915: - Fix the enabling/disabling of DP audio SDP splitting - Fix PSR register definitions for ALPM - Fix u32 overflow in SNPS PHY HDMI PLL setup - Fix GuC pending message underflow when submit fails - Fix GuC wakeref underflow race during reset xe: - Two documentation fixes - A couple of vm init fixes - Hwmon fixes - Drop reduntant conversion to bool - Fix CONFIG_INTEL_VSEC dependency - Rework eviction rejection of bound external bos - Stop re-submitting signalled jobs - A couple of pxp fixes - Add back a fix that got lost in a merge - Create LRC bo without VM - Fix for the above fix amdgpu: - UserQ fixes - SMU 13.x fixes - VCN fixes - JPEG fixes - Misc cleanups - runtime pm fix - DCN 4.0.1 fixes - Misc display fixes - ISP fix - VRAM manager fix - RAS fixes - IP discovery fix - Cleaner shader fix for GC 10.1.x - OD fix - Non-OLED panel fix - Misc display fixes - Brightness fixes amdkfd: - Enable CONFIG_HSA_AMD on RISCV - SVM fix - Misc cleanups - Ref leak fix - WPTR BO fix radeon: - Misc cleanups" * tag 'drm-next-2025-06-06' of https://gitlab.freedesktop.org/drm/kernel: (105 commits) drm/nouveau/vfn/r535: Convert comma to semicolon drm/xe: remove unmatched xe_vm_unlock() from __xe_exec_queue_init() drm/xe: Create LRC BO without VM drm/xe/guc_submit: add back fix drm/xe/pxp: Clarify PXP queue creation behavior if PXP is not ready drm/xe/pxp: Use the correct define in the set_property_funcs array drm/xe/sched: stop re-submitting signalled jobs drm/xe: Rework eviction rejection of bound external bos drm/xe/vsec: fix CONFIG_INTEL_VSEC dependency drm/xe: drop redundant conversion to bool drm/xe/hwmon: Move card reactive critical power under channel card drm/xe/hwmon: Add support to manage power limits though mailbox drm/xe/vm: move xe_svm_init() earlier drm/xe/vm: move rebind_work init earlier MAINTAINERS: .mailmap: update Rob Clark's email address mailmap: Update entry for Akhil P Oommen MAINTAINERS: update my email address MAINTAINERS: drop myself as maintainer drm/i915/display: Fix u32 overflow in SNPS PHY HDMI PLL setup drm/amd/display: Fix default DC and AC levels ... commit 67faad74352d1ce0c1f411f92fdb1e0c0f3c9380 Merge: e271ed52b344ac 5a0c749125c001 Author: Linus Torvalds Date: Fri Jun 6 07:56:36 2025 -0700 Merge tag 'mips_6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS updates from Thomas Bogendoerfer: - Added support for EcoNet platform - Added support for parallel CPU bring up on EyeQ - Other cleanups and fixes * tag 'mips_6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (23 commits) MIPS: loongson2ef: lemote-2f: add missing function prototypes MIPS: loongson2ef: cs5536: add missing function prototypes MIPS: SMP: Move the AP sync point before the calibration delay mips: econet: Fix incorrect Kconfig dependencies MAINTAINERS: Add entry for newly added EcoNet platform. mips: dts: Add EcoNet DTS with EN751221 and SmartFiber XP8421-B board dt-bindings: vendor-prefixes: Add SmartFiber mips: Add EcoNet MIPS platform support dt-bindings: mips: Add EcoNet platform binding MIPS: bcm63xx: nvram: avoid inefficient use of crc32_le_combine() mips: dts: pic32: pic32mzda: Rename the sdhci nodename to match with common mmc-controller binding MIPS: SMP: Move the AP sync point before the non-parallel aware functions MIPS: Replace strcpy() with strscpy() in vpe_elfload() MIPS: BCM63XX: Replace strcpy() with strscpy() in board_prom_init() mips: ptrace: Improve code formatting and indentation MIPS: SMP: Implement parallel CPU bring up for EyeQ mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a mips: dts: realtek: Add MDIO controller MIPS: txx9: gpio: use new line value setter callbacks ... commit 11fcf368506d347088e613edf6cd2604d70c454f Author: Thomas Weißschuh Date: Fri Jun 6 10:23:57 2025 +0200 uapi: bitops: use UAPI-safe variant of BITS_PER_LONG again Commit 1e7933a575ed ("uapi: Revert "bitops: avoid integer overflow in GENMASK(_ULL)"") did not take in account that the usage of BITS_PER_LONG in __GENMASK() was changed to __BITS_PER_LONG for UAPI-safety in commit 3c7a8e190bc5 ("uapi: introduce uapi-friendly macros for GENMASK"). BITS_PER_LONG can not be used in UAPI headers as it derives from the kernel configuration and not from the current compiler invocation. When building compat userspace code or a compat vDSO its value will be incorrect. Switch back to __BITS_PER_LONG. Fixes: 1e7933a575ed ("uapi: Revert "bitops: avoid integer overflow in GENMASK(_ULL)"") Cc: stable@vger.kernel.org Signed-off-by: Thomas Weißschuh Signed-off-by: Yury Norov [NVIDIA] commit 6f7e234f74caf5f8863bbca51b1b135d0736b0b3 Merge: 3c4c39cbde6aab f670b50ef5e4a6 Author: Simona Vetter Date: Fri Jun 6 14:38:50 2025 +0200 Merge tag 'drm-misc-fixes-2025-06-06' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: ivpu: - gem: Use dma-resv lock - gem. Fix a warning - Trigger recovery on device engine reset/resume failure panel: - panel-simple: Fix settings for Evervision VGG644804 sysfb: - Fix screen_info type check video: - Update screen_info for relocated PCI framebuffers Signed-off-by: Simona Vetter From: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20250606072853.GA13099@linux.fritz.box commit 82cbd06f327f3c2ccdee990bd356c9303ae168f9 Author: Wei Fang Date: Thu Jun 5 14:08:36 2025 +0800 net: enetc: fix the netc-lib driver build dependency The kernel robot reported the following errors when the netc-lib driver was compiled as a loadable module and the enetc-core driver was built-in. ld.lld: error: undefined symbol: ntmp_init_cbdr referenced by enetc_cbdr.c:88 (drivers/net/ethernet/freescale/enetc/enetc_cbdr.c:88) ld.lld: error: undefined symbol: ntmp_free_cbdr referenced by enetc_cbdr.c:96 (drivers/net/ethernet/freescale/enetc/enetc_cbdr.c:96) Simply changing "tristate" to "bool" can fix this issue, but considering that the netc-lib driver needs to support being compiled as a loadable module and LS1028 does not need the netc-lib driver. Therefore, we add a boolean symbol 'NXP_NTMP' to enable 'NXP_NETC_LIB' as needed. And when adding NETC switch driver support in the future, there is no need to modify the dependency, just select "NXP_NTMP" and "NXP_NETC_LIB" at the same time. Reported-by: Arnd Bergmann Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202505220734.x6TF6oHR-lkp@intel.com/ Fixes: 4701073c3deb ("net: enetc: add initial netc-lib driver to support NTMP") Suggested-by: Arnd Bergmann Signed-off-by: Wei Fang Reviewed-by: Vladimir Oltean Signed-off-by: David S. Miller commit 1205088fd0393bd9eae96b62bf1e4b9eb1b73edf Author: Yao Zi Date: Thu Jun 5 20:34:46 2025 +0800 platform/loongarch: laptop: Get brightness setting from EC on probe Previously during driver probe, 1 is unconditionally taken as current brightness value and set to props.brightness, which will be considered as the brightness before suspend and restored to EC on resume. Since a brightness value of 1 almost never matches EC's state on coldboot (my laptop's EC defaults to 80), this causes surprising changes of screen brightness on the first time of resume after coldboot. Let's get brightness from EC and take it as the current brightness on probe of the laptop driver to avoid the surprising behavior. Tested on TongFang L860-T2 Loongson-3A5000 laptop. Cc: stable@vger.kernel.org Fixes: 6246ed09111f ("LoongArch: Add ACPI-based generic laptop driver") Signed-off-by: Yao Zi Signed-off-by: Huacai Chen commit 1cf806006574b0e874fb39a18b1b26559770fb1c Author: Binbin Zhou Date: Thu Jun 5 20:34:34 2025 +0800 LoongArch: dts: Add PWM support to Loongson-2K2000 The module is supported, enable it. Reviewed-by: Yanteng Si Signed-off-by: Binbin Zhou Signed-off-by: Huacai Chen commit abd000dbaee45fa620ddaeb13757b9a8985ce50f Author: Binbin Zhou Date: Thu Jun 5 20:34:34 2025 +0800 LoongArch: dts: Add PWM support to Loongson-2K1000 The module is supported, enable it. Also, add the pwm-fan and cooling-maps associated with it. Reviewed-by: Yanteng Si Signed-off-by: Binbin Zhou Signed-off-by: Huacai Chen commit 07aeb50e6c74e59c268ad6460c6b51411bea1759 Author: Binbin Zhou Date: Thu Jun 5 20:34:34 2025 +0800 LoongArch: dts: Add PWM support to Loongson-2K0500 The module is supported, enable it. Reviewed-by: Yanteng Si Signed-off-by: Binbin Zhou Signed-off-by: Huacai Chen commit e242bbbb6d7ac7556aa1e358294dc7e3c82cc902 Author: Thomas Weißschuh Date: Thu Jun 5 20:34:18 2025 +0800 LoongArch: vDSO: Correctly use asm parameters in syscall wrappers The syscall wrappers use the "a0" register for two different register variables, both the first argument and the return value. Here the "ret" variable is used as both input and output while the argument register is only used as input. Clang treats the conflicting input parameters as an undefined behaviour and optimizes away the argument assignment. The code seems to work by chance for the most part today but that may change in the future. Specifically clock_gettime_fallback() fails with clockids from 16 to 23, as implemented by the upcoming auxiliary clocks. Switch the "ret" register variable to a pure output, similar to the other architectures' vDSO code. This works in both clang and GCC. Link: https://lore.kernel.org/lkml/20250602102825-42aa84f0-23f1-4d10-89fc-e8bbaffd291a@linutronix.de/ Link: https://lore.kernel.org/lkml/20250519082042.742926976@linutronix.de/ Fixes: c6b99bed6b8f ("LoongArch: Add VDSO and VSYSCALL support") Fixes: 18efd0b10e0f ("LoongArch: vDSO: Wire up getrandom() vDSO implementation") Cc: stable@vger.kernel.org Reviewed-by: Nathan Chancellor Reviewed-by: Yanteng Si Reviewed-by: WANG Xuerui Reviewed-by: Xi Ruoyao Signed-off-by: Thomas Weißschuh Signed-off-by: Huacai Chen commit b828b4bf29d10a3e505a76a39c4daea969e19dc9 Author: Viacheslav Dubeyko Date: Mon Jun 2 11:49:56 2025 -0700 ceph: fix variable dereferenced before check in ceph_umount_begin() smatch warnings: fs/ceph/super.c:1042 ceph_umount_begin() warn: variable dereferenced before check 'fsc' (see line 1041) vim +/fsc +1042 fs/ceph/super.c void ceph_umount_begin(struct super_block *sb) { struct ceph_fs_client *fsc = ceph_sb_to_fs_client(sb); doutc(fsc->client, "starting forced umount\n"); ^^^^^^^^^^^ Dereferenced if (!fsc) ^^^^ Checked too late. return; fsc->mount_state = CEPH_MOUNT_SHUTDOWN; __ceph_umount_begin(fsc); } The VFS guarantees that the superblock is still alive when it calls into ceph via ->umount_begin(). Finally, we don't need to check the fsc and it should be valid. This patch simply removes the fsc check. Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202503280852.YDB3pxUY-lkp@intel.com/ Signed-off-by: Viacheslav Dubeyko Reviewed by: Alex Markuze Signed-off-by: Ilya Dryomov commit 800d0b9b6a8b1b354637b4194cc167ad1ce2bdd3 Author: Stephen Smalley Date: Thu Jun 5 12:51:16 2025 -0400 fs/xattr.c: fix simple_xattr_list() commit 8b0ba61df5a1 ("fs/xattr.c: fix simple_xattr_list to always include security.* xattrs") failed to reset err after the call to security_inode_listsecurity(), which returns the length of the returned xattr name. This results in simple_xattr_list() incorrectly returning this length even if a POSIX acl is also set on the inode. Reported-by: Collin Funk Closes: https://lore.kernel.org/selinux/8734ceal7q.fsf@gmail.com/ Reported-by: Paul Eggert Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2369561 Fixes: 8b0ba61df5a1 ("fs/xattr.c: fix simple_xattr_list to always include security.* xattrs") Signed-off-by: Stephen Smalley Link: https://lore.kernel.org/20250605165116.2063-1-stephen.smalley.work@gmail.com Signed-off-by: Christian Brauner commit 3c4c39cbde6aab4b77bcb12b7879ab5e121f4ca4 Merge: 0ff41df1cb268f 4557cc834712ec Author: Simona Vetter Date: Fri Jun 6 08:21:45 2025 +0200 Merge tag 'drm-misc-fixes-2025-05-28' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: drm-scheduler: - signal scheduled fence when killing job dummycon: - trigger deferred takeover when switching consoles ivpu: - improve logging - update firmware filenames - reorder steps in command-queue unregistering Signed-off-by: Simona Vetter From: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20250528153550.GA21050@linux.fritz.box commit 2da20fd904f87f7bb31b79719bc3dda4093f8cdb Author: Max Kellermann Date: Sun May 4 20:08:31 2025 +0200 kernel/rcu/tree_stall: add /sys/kernel/rcu_stall_count Expose a simple counter to userspace for monitoring tools. (akpm: 2536c5c7d6ae added the documentation but the code changes were lost) Link: https://lkml.kernel.org/r/20250504180831.4190860-3-max.kellermann@ionos.com Fixes: 2536c5c7d6ae ("kernel/rcu/tree_stall: add /sys/kernel/rcu_stall_count") Signed-off-by: Max Kellermann Cc: Core Minyard Cc: Doug Anderson Cc: Joel Granados Cc: Max Kellermann Cc: Song Liu Cc: Sourabh Jain Signed-off-by: Andrew Morton commit 7266f590ca1fab3adf7c2546894dc418f2d86ba6 Author: Lorenzo Stoakes Date: Wed Jun 4 17:31:39 2025 +0100 MAINTAINERS: add mm swap section In furtherance of ongoing efforts to ensure people are aware of who de-facto maintains/has an interest in specific parts of mm, as well trying to avoid get_maintainers.pl listing only Andrew and the mailing list for mm files - establish a swap memory management section and add relevant maintainers/reviewers. Link: https://lkml.kernel.org/r/20250604163139.126630-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: Chris Li Acked-by: Kairui Song Acked-by: Kemeng Shi Acked-by: Baoquan He Acked-by: Barry Song Acked-by: Nhat Pham Signed-off-by: Andrew Morton commit ffa74d44f4b95a97b36a038c66f53e4edeaffb99 Author: Arnd Bergmann Date: Tue Jun 3 09:53:07 2025 +0200 kmsan: test: add module description Every module should have a description, and kbuild now warns for those that don't. WARNING: modpost: missing MODULE_DESCRIPTION() in mm/kmsan/kmsan_test.o Link: https://lkml.kernel.org/r/20250603075323.1839608-1-arnd@kernel.org Signed-off-by: Arnd Bergmann Reviewed-by: Alexander Potapenko Cc: Andrey Konovalov Cc: Arnd Bergmann Cc: Dmitriy Vyukov Cc: Macro Elver Cc: Sabyrzhan Tasbolatov Signed-off-by: Andrew Morton commit 1b11a28308923a67fc76b8f7be06e1b2d80d07ca Author: Tal Zussman Date: Tue Jun 3 18:50:17 2025 -0400 MAINTAINERS: add tlb trace events to MMU GATHER AND TLB INVALIDATION The MMU GATHER AND TLB INVALIDATION entry lists other TLB-related files. Add the tlb.h tracepoint file there as well. Link: https://lore.kernel.org/linux-mm/ce048e11-f79d-44a6-bacc-46e1ebc34b24@redhat.com/ Link: https://lkml.kernel.org/r/20250603-tlb-maintainers-v1-1-726d193c6693@columbia.edu Signed-off-by: Tal Zussman Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Cc: "Aneesh Kumar K.V" Cc: Nicholas Piggin Cc: Peter Zijlstra Cc: Will Deacon Signed-off-by: Andrew Morton commit 1013af4f585fccc4d3e5c5824d174de2257f7d6d Author: Jann Horn Date: Tue May 27 23:23:54 2025 +0200 mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race huge_pmd_unshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a normal page table used in another process in which unrelated VMAs can afterwards be installed. If this happens in the middle of a concurrent gup_fast(), gup_fast() could end up walking the page tables of another process. While I don't see any way in which that immediately leads to kernel memory corruption, it is really weird and unexpected. Fix it with an explicit broadcast IPI through tlb_remove_table_sync_one(), just like we do in khugepaged when removing page tables for a THP collapse. Link: https://lkml.kernel.org/r/20250528-hugetlb-fixes-splitrace-v2-2-1329349bad1a@google.com Link: https://lkml.kernel.org/r/20250527-hugetlb-fixes-splitrace-v1-2-f4136f5ec58a@google.com Fixes: 39dde65c9940 ("[PATCH] shared page table for hugetlb page") Signed-off-by: Jann Horn Reviewed-by: Lorenzo Stoakes Cc: Liam Howlett Cc: Muchun Song Cc: Oscar Salvador Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit 081056dc00a27bccb55ccc3c6f230a3d5fd3f7e0 Author: Jann Horn Date: Tue May 27 23:23:53 2025 +0200 mm/hugetlb: unshare page tables during VMA split, not before Currently, __split_vma() triggers hugetlb page table unsharing through vm_ops->may_split(). This happens before the VMA lock and rmap locks are taken - which is too early, it allows racing VMA-locked page faults in our process and racing rmap walks from other processes to cause page tables to be shared again before we actually perform the split. Fix it by explicitly calling into the hugetlb unshare logic from __split_vma() in the same place where THP splitting also happens. At that point, both the VMA and the rmap(s) are write-locked. An annoying detail is that we can now call into the helper hugetlb_unshare_pmds() from two different locking contexts: 1. from hugetlb_split(), holding: - mmap lock (exclusively) - VMA lock - file rmap lock (exclusively) 2. hugetlb_unshare_all_pmds(), which I think is designed to be able to call us with only the mmap lock held (in shared mode), but currently only runs while holding mmap lock (exclusively) and VMA lock Backporting note: This commit fixes a racy protection that was introduced in commit b30c14cd6102 ("hugetlb: unshare some PMDs when splitting VMAs"); that commit claimed to fix an issue introduced in 5.13, but it should actually also go all the way back. [jannh@google.com: v2] Link: https://lkml.kernel.org/r/20250528-hugetlb-fixes-splitrace-v2-1-1329349bad1a@google.com Link: https://lkml.kernel.org/r/20250528-hugetlb-fixes-splitrace-v2-0-1329349bad1a@google.com Link: https://lkml.kernel.org/r/20250527-hugetlb-fixes-splitrace-v1-1-f4136f5ec58a@google.com Fixes: 39dde65c9940 ("[PATCH] shared page table for hugetlb page") Signed-off-by: Jann Horn Cc: Liam Howlett Reviewed-by: Lorenzo Stoakes Reviewed-by: Oscar Salvador Cc: Lorenzo Stoakes Cc: Vlastimil Babka Cc: [b30c14cd6102: hugetlb: unshare some PMDs when splitting VMAs] Cc: Signed-off-by: Andrew Morton commit a2946fb271b1e01f49df35042e338cca1bd28095 Author: Alistair Popple Date: Fri May 30 11:49:17 2025 +1000 MAINTAINERS: add Alistair as reviewer of mm memory policy I'm particularly familiar with mm/migrate.c and especially mm/migrate_device.c so add myself to MAINTAINERS. Link: https://lkml.kernel.org/r/20250530014917.2946940-1-apopple@nvidia.com Signed-off-by: Alistair Popple Acked-by: Lorenzo Stoakes Acked-by: Matthew Brost Acked-by: David Hildenbrand Cc: Joshua Hahn Cc: Rakie Kim Cc: Zi Yan Signed-off-by: Andrew Morton commit 334d7c4fb60cf21e0abac134d92fe49e9b04377e Author: Nitesh Shetty Date: Mon Apr 28 15:28:48 2025 +0530 iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec If iov_offset is non-zero, then we need to consider iov_offset in length calculation, otherwise we might pass smaller IOs such as 512 bytes, in below scenario [1]. This issue is reproducible using lib-uring test/fixed-seg.c application with fixed buffer on a 512 LBA formatted device. [1] At present we pass the alignment check, for 512 LBA formatted devices, len_mask = 511 when IO is smaller, i->count = 512 has an offset, i->io_offset = 3584 with bvec values, bvec->bv_offset = 256, bvec->bv_len = 3840. In short, the first 256 bytes are in the current page, next 256 bytes are in the another page. Ideally we expect to fail the IO. I can think of 2 userspace scenarios where we experience this. a: From userspace, we observe a different behaviour when device LBA size is 512 vs 4096 bytes. For 4096 LBA formatted device, I see the same liburing test [2] failing, whereas 512 the test passes without this. This is reproducible everytime. [2] https://github.com/axboe/liburing/ b: Although I was not able to reproduce the below condition, but I suspect below case should be possible from user space for devices with 512 LBA formatted device. Lets say from userspace while allocating a virtually single chunk of memory, if we get 2 physical chunk of memory, and IO happens to be at the boundary of first physical chunk with length crossing first chunk, then we allow IOs to proceed and hence we might map wrong physical address length and proceed with IO rather than failing. : --- a/test/fixed-seg.c : +++ b/test/fixed-seg.c : @@ -64,7 +64,7 @@ static int test(struct io_uring *ring, int fd, int : vec_off) : return T_EXIT_FAIL; : } : : - ret = read_it(ring, fd, 4096, vec_off); : + ret = read_it(ring, fd, 4096, 7*512 + 256); : if (ret) { : fprintf(stderr, "4096 0 failed\n"); : return T_EXIT_FAIL; Effectively this is a write crossing the page boundary. Link: https://lkml.kernel.org/r/20250428095849.11709-1-nj.shetty@samsung.com Fixes: 2263639f96f2 ("iov_iter: streamline iovec/bvec alignment iteration") Reviewed-by: Jens Axboe Reviewed-by: Anuj Gupta Signed-off-by: Nitesh Shetty Cc: Al Viro Cc: Christian Brauner Cc: Keith Busch Signed-off-by: Andrew Morton commit 41ffaa0ea76206e4fb7589a5a499e6752c33188a Author: Joshua Hahn Date: Mon Jun 2 09:23:39 2025 -0700 mm/mempolicy: fix incorrect freeing of wi_kobj We should not free wi_group->wi_kobj here. In the error path of add_weighted_interleave_group() where this snippet is called from, kobj_{del, put} is immediately called right after this section. Thus, it is not only unnecessary but also incorrect to free it here. Link: https://lkml.kernel.org/r/20250602162345.2595696-1-joshua.hahnjy@gmail.com Fixes: e341f9c3c841 ("mm/mempolicy: Weighted Interleave Auto-tuning") Signed-off-by: Joshua Hahn Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506011545.Fduxqxqj-lkp@intel.com/ Cc: Alistair Popple Cc: Byungchul Park Cc: David Hildenbrand Cc: Gregory Price Cc: "Huang, Ying" Cc: Mathew Brost Cc: Rakie Kim Cc: Zi Yan Signed-off-by: Andrew Morton commit 044d2aee6c575231ed4a24fb3d119bad0937488b Author: Suren Baghdasaryan Date: Wed May 21 09:06:02 2025 -0700 alloc_tag: handle module codetag load errors as module load failures Failures inside codetag_load_module() are currently ignored. As a result an error there would not cause a module load failure and freeing of the associated resources. Correct this behavior by propagating the error code to the caller and handling possible errors. With this change, error to allocate percpu counters, which happens at this stage, will not be ignored and will cause a module load failure and freeing of resources. With this change we also do not need to disable memory allocation profiling when this error happens, instead we fail to load the module. Link: https://lkml.kernel.org/r/20250521160602.1940771-1-surenb@google.com Fixes: 10075262888b ("alloc_tag: allocate percpu counters for module tags dynamically") Signed-off-by: Suren Baghdasaryan Reported-by: Casey Chen Closes: https://lore.kernel.org/all/20250520231620.15259-1-cachen@purestorage.com/ Cc: Daniel Gomez Cc: David Wang <00107082@163.com> Cc: Kent Overstreet Cc: Luis Chamberalin Cc: Petr Pavlu Cc: Sami Tolvanen Cc: Signed-off-by: Andrew Morton commit 9c49e5d09f076001e05537734d7df002162eb2b5 Author: SeongJae Park Date: Mon Jun 2 10:49:26 2025 -0700 mm/madvise: handle madvise_lock() failure during race unwinding When unwinding race on -ERESTARTNOINTR handling of process_madvise(), madvise_lock() failure is ignored. Check the failure and abort remaining works in the case. Link: https://lkml.kernel.org/r/20250602174926.1074-1-sj@kernel.org Fixes: 4000e3d0a367 ("mm/madvise: remove redundant mmap_lock operations from process_madvise()") Signed-off-by: SeongJae Park Reported-by: Barry Song <21cnbao@gmail.com> Closes: https://lore.kernel.org/CAGsJ_4xJXXO0G+4BizhohSZ4yDteziPw43_uF8nPXPWxUVChzw@mail.gmail.com Reviewed-by: Jann Horn Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Reviewed-by: Shakeel Butt Reviewed-by: Barry Song Cc: Liam Howlett Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit 684088173b1852e5f5891a7b2a124b7974cb827d Author: Kirill A. Shutemov Date: Thu May 29 13:38:32 2025 +0300 mm: fix vmstat after removing NR_BOUNCE Hongyu noticed that the nr_unaccepted counter kept growing even in the absence of unaccepted memory on the machine. This happens due to a commit that removed NR_BOUNCE: it removed the counter from the enum zone_stat_item, but left it in the vmstat_text array. As a result, all counters below nr_bounce in /proc/vmstat are shifted by one line, causing the numa_hit counter to be labeled as nr_unaccepted. To fix this issue, remove nr_bounce from the vmstat_text array. Link: https://lkml.kernel.org/r/20250529103832.2937460-1-kirill.shutemov@linux.intel.com Fixes: 194df9f66db8 ("mm: remove NR_BOUNCE zone stat") Signed-off-by: Kirill A. Shutemov Reported-by: Hongyu Ning Reviewed-by: Jens Axboe Reviewed-by: Vlastimil Babka Acked-by: Michal Hocko Reviewed-by: Shakeel Butt Cc: Christoph Hellwig Cc: Hannes Reinecke Cc: Johannes Thumshirn Cc: Jens Axboe Signed-off-by: Andrew Morton commit 15ac613f124e51a6623975efad9657b1f3ee47e7 Author: Lorenzo Stoakes Date: Mon May 19 15:56:57 2025 +0100 KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY The enum type prot_type declared in arch/s390/kvm/gaccess.c declares an unfortunate identifier within it - PROT_NONE. This clashes with the protection bit define from the uapi for mmap() declared in include/uapi/asm-generic/mman-common.h, which is indeed what those casually reading this code would assume this to refer to. This means that any changes which subsequently alter headers in any way which results in the uapi header being imported here will cause build errors. Resolve the issue by renaming PROT_NONE to PROT_TYPE_DUMMY. Link: https://lkml.kernel.org/r/20250519145657.178365-1-lorenzo.stoakes@oracle.com Fixes: b3cefd6bf16e ("KVM: s390: Pass initialized arg even if unused") Signed-off-by: Lorenzo Stoakes Suggested-by: Ignacio Moreno Gonzalez Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202505140943.IgHDa9s7-lkp@intel.com/ Acked-by: Christian Borntraeger Acked-by: Ignacio Moreno Gonzalez Acked-by: Yang Shi Reviewed-by: David Hildenbrand Acked-by: Liam R. Howlett Reviewed-by: Oscar Salvador Reviewed-by: Claudio Imbrenda Cc: Cc: Alexander Gordeev Cc: Heiko Carstens Cc: James Houghton Cc: Janosch Frank Cc: Matthew Wilcox (Oracle) Cc: Paolo Bonzini Cc: Sven Schnelle Cc: Vasily Gorbik Signed-off-by: Andrew Morton commit efe99fabeb11b030c89a7dc5a5e7a7558d0dc7ec Author: Pu Lehui Date: Thu May 29 15:56:50 2025 +0000 selftests/mm: add test about uprobe pte be orphan during vma merge Add test about uprobe pte be orphan during vma merge. [akpm@linux-foundation.org: include sys/syscall.h, per Lorenzo] Link: https://lkml.kernel.org/r/20250529155650.4017699-5-pulehui@huaweicloud.com Signed-off-by: Pu Lehui Cc: Jann Horn Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: "Masami Hiramatsu (Google)" Cc: Oleg Nesterov Cc: Peter Zijlstra Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 6fb6223347d5d9512875120267c117e7437f0db6 Author: Pu Lehui Date: Thu May 29 15:56:49 2025 +0000 selftests/mm: extract read_sysfs and write_sysfs into vm_util Extract read_sysfs and write_sysfs into vm_util. Meanwhile, rename the function in thuge-gen that has the same name as read_sysfs. Link: https://lkml.kernel.org/r/20250529155650.4017699-4-pulehui@huaweicloud.com Signed-off-by: Pu Lehui Reviewed-by: Lorenzo Stoakes Cc: Jann Horn Cc: Liam Howlett Cc: "Masami Hiramatsu (Google)" Cc: Oleg Nesterov Cc: Peter Zijlstra Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit b36b701bbcd9f7b24c0d98499c28895b55fdde81 Author: Pu Lehui Date: Thu May 29 15:56:48 2025 +0000 mm: expose abnormal new_pte during move_ptes When executing move_ptes, the new_pte must be NULL, otherwise it will be overwritten by the old_pte, and cause the abnormal new_pte to be leaked. In order to make this problem to be more explicit, let's add WARN_ON_ONCE when new_pte is not NULL. [akpm@linux-foundation.org: s/WARN_ON_ONCE/VM_WARN_ON_ONCE/] Link: https://lkml.kernel.org/r/20250529155650.4017699-3-pulehui@huaweicloud.com Suggested-by: Oleg Nesterov Signed-off-by: Pu Lehui Reviewed-by: Lorenzo Stoakes Cc: Jann Horn Cc: Liam Howlett Cc: "Masami Hiramatsu (Google)" Cc: Peter Zijlstra Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 2b12d06c37fd3a394376f42f026a7478d826ed63 Author: Pu Lehui Date: Thu May 29 15:56:47 2025 +0000 mm: fix uprobe pte be overwritten when expanding vma Patch series "Fix uprobe pte be overwritten when expanding vma". This patch (of 4): We encountered a BUG alert triggered by Syzkaller as follows: BUG: Bad rss-counter state mm:00000000b4a60fca type:MM_ANONPAGES val:1 And we can reproduce it with the following steps: 1. register uprobe on file at zero offset 2. mmap the file at zero offset: addr1 = mmap(NULL, 2 * 4096, PROT_NONE, MAP_PRIVATE, fd, 0); 3. mremap part of vma1 to new vma2: addr2 = mremap(addr1, 4096, 2 * 4096, MREMAP_MAYMOVE); 4. mremap back to orig addr1: mremap(addr2, 4096, 4096, MREMAP_MAYMOVE | MREMAP_FIXED, addr1); In step 3, the vma1 range [addr1, addr1 + 4096] will be remap to new vma2 with range [addr2, addr2 + 8192], and remap uprobe anon page from the vma1 to vma2, then unmap the vma1 range [addr1, addr1 + 4096]. In step 4, the vma2 range [addr2, addr2 + 4096] will be remap back to the addr range [addr1, addr1 + 4096]. Since the addr range [addr1 + 4096, addr1 + 8192] still maps the file, it will take vma_merge_new_range to expand the range, and then do uprobe_mmap in vma_complete. Since the merged vma pgoff is also zero offset, it will install uprobe anon page to the merged vma. However, the upcomming move_page_tables step, which use set_pte_at to remap the vma2 uprobe pte to the merged vma, will overwrite the newly uprobe pte in the merged vma, and lead that pte to be orphan. Since the uprobe pte will be remapped to the merged vma, we can remove the unnecessary uprobe_mmap upon merged vma. This problem was first found in linux-6.6.y and also exists in the community syzkaller: https://lore.kernel.org/all/000000000000ada39605a5e71711@google.com/T/ Link: https://lkml.kernel.org/r/20250529155650.4017699-1-pulehui@huaweicloud.com Link: https://lkml.kernel.org/r/20250529155650.4017699-2-pulehui@huaweicloud.com Fixes: 2b1444983508 ("uprobes, mm, x86: Add the ability to install and remove uprobes breakpoints") Signed-off-by: Pu Lehui Suggested-by: Lorenzo Stoakes Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Cc: Jann Horn Cc: Liam Howlett Cc: "Masami Hiramatsu (Google)" Cc: Oleg Nesterov Cc: Peter Zijlstra Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit ea68ea9091d3d3c297a4c40efd837e0d9e12c88b Author: Enze Li Date: Fri May 30 13:31:15 2025 +0800 mm/damon: s/primitives/code/ on comments The word 'primitive' is not explicit. To make the code more easily understood, this commit renames 'primitives' to 'code' in header comments of some source files. Link: https://lkml.kernel.org/r/20250530053115.153238-1-lienze@kylinos.cn Signed-off-by: Enze Li Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit 04c8970771b4f1f39bb8453a2eeb188c4d5edbd6 Author: Chen Ni Date: Tue Jun 3 14:10:27 2025 +0800 drm/nouveau/vfn/r535: Convert comma to semicolon Replace comma between expressions with semicolons. Using a ',' in place of a ';' can have unintended side effects. Although that is not the case here, it is seems best to use ';' unless ',' is intended. Found by inspection. No functional change intended. Compile tested only. Signed-off-by: Chen Ni Fixes: cd3c62282b61 ("drm/nouveau/gsp: add usermode class id to gpu hal") Signed-off-by: Dave Airlie Link: https://lore.kernel.org/r/20250603061027.1310267-1-nichen@iscas.ac.cn commit a9062ece98d8d811958022763e573a17f6c1bfa8 Merge: 4f577bed5ca7bc 8b5f3a229a70d2 Author: Dave Airlie Date: Fri Jun 6 13:23:04 2025 +1000 Merge tag 'amd-drm-fixes-6.16-2025-06-05' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-fixes-6.16-2025-06-05: amdgpu: - IP discovery fix - Cleaner shader fix for GC 10.1.x - OD fix - UserQ fixes - Non-OLED panel fix - Misc display fixes - Brightness fixes amdkfd: - Enable CONFIG_HSA_AMD on RISCV Signed-off-by: Dave Airlie From: Alex Deucher Link: https://lore.kernel.org/r/20250606015932.835829-1-alexander.deucher@amd.com commit 4f577bed5ca7bc8f16da7e422faa688e7e2f8524 Merge: 27bba8864480cd 7c7c5cb5b5bf9d Author: Dave Airlie Date: Fri Jun 6 11:37:01 2025 +1000 Merge tag 'drm-xe-next-fixes-2025-06-05' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next Driver Changes: - A couple of vm init fixes (Matt Auld) - Hwmon fixes (Karthik) - Drop reduntant conversion to bool (Raag) - Fix CONFIG_INTEL_VSEC dependency (Arnd) - Rework eviction rejection of bound external bos (Thomas) - Stop re-submitting signalled jobs (Matt Auld) - A couple of pxp fixes (Daniele) - Add back a fix that got lost in a merge (Matt Auld) - Create LRC bo without VM (Niranjana) - Fix for the above fix (Maciej) Signed-off-by: Dave Airlie From: Thomas Hellstrom Link: https://lore.kernel.org/r/aEHq44uIAZwfK-mG@fedora commit 27bba8864480cd1633e3702594823036ca1f9cd1 Merge: df9d4941827182 fd03f82a026cc0 Author: Dave Airlie Date: Fri Jun 6 11:32:13 2025 +1000 Merge tag 'drm-misc-next-fixes-2025-06-05' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-fixes for v6.16-rc1: - Fixes for nt37801 panel - Fix null deref in HDMI audio helper. - Fixes for analogix_dp. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://lore.kernel.org/r/14c2eff8-701d-4699-b187-08862715e1ac@linux.intel.com commit 87f7ce260a3c838b49e1dc1ceedf1006795157a2 Author: Jeongjun Park Date: Wed May 21 01:07:17 2025 +0900 ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use() There is no disagreement that we should check both ptp->is_virtual_clock and ptp->n_vclocks to check if the ptp virtual clock is in use. However, when we acquire ptp->n_vclocks_mux to read ptp->n_vclocks in ptp_vclock_in_use(), we observe a recursive lock in the call trace starting from n_vclocks_store(). ============================================ WARNING: possible recursive locking detected 6.15.0-rc6 #1 Not tainted -------------------------------------------- syz.0.1540/13807 is trying to acquire lock: ffff888035a24868 (&ptp->n_vclocks_mux){+.+.}-{4:4}, at: ptp_vclock_in_use drivers/ptp/ptp_private.h:103 [inline] ffff888035a24868 (&ptp->n_vclocks_mux){+.+.}-{4:4}, at: ptp_clock_unregister+0x21/0x250 drivers/ptp/ptp_clock.c:415 but task is already holding lock: ffff888030704868 (&ptp->n_vclocks_mux){+.+.}-{4:4}, at: n_vclocks_store+0xf1/0x6d0 drivers/ptp/ptp_sysfs.c:215 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&ptp->n_vclocks_mux); lock(&ptp->n_vclocks_mux); *** DEADLOCK *** .... ============================================ The best way to solve this is to remove the logic that checks ptp->n_vclocks in ptp_vclock_in_use(). The reason why this is appropriate is that any path that uses ptp->n_vclocks must unconditionally check if ptp->n_vclocks is greater than 0 before unregistering vclocks, and all functions are already written this way. And in the function that uses ptp->n_vclocks, we already get ptp->n_vclocks_mux before unregistering vclocks. Therefore, we need to remove the redundant check for ptp->n_vclocks in ptp_vclock_in_use() to prevent recursive locking. Fixes: 73f37068d540 ("ptp: support ptp physical/virtual clocks conversion") Signed-off-by: Jeongjun Park Acked-by: Richard Cochran Link: https://patch.msgid.link/20250520160717.7350-1-aha310510@gmail.com Signed-off-by: Jakub Kicinski commit 692eb9f8a5b71d852e873375d20cf5da7a046ea6 Author: Jonas Gorski Date: Mon Jun 2 21:49:14 2025 +0200 net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0 When Linux sends out untagged traffic from a port, it will enter the CPU port without any VLAN tag, even if the port is a member of a vlan filtering bridge with a PVID egress untagged VLAN. This makes the CPU port's PVID take effect, and the PVID's VLAN table entry controls if the packet will be tagged on egress. Since commit 45e9d59d3950 ("net: dsa: b53: do not allow to configure VLAN 0") we remove bridged ports from VLAN 0 when joining or leaving a VLAN aware bridge. But we also clear the untagged bit, causing untagged traffic from the controller to become tagged with VID 0 (and priority 0). Fix this by not touching the untagged map of VLAN 0. Additionally, always keep the CPU port as a member, as the untag map is only effective as long as there is at least one member, and we would remove it when bridging all ports and leaving no standalone ports. Since Linux (and the switch) treats VLAN 0 tagged traffic like untagged, the actual impact of this is rather low, but this also prevented earlier detection of the issue. Fixes: 45e9d59d3950 ("net: dsa: b53: do not allow to configure VLAN 0") Signed-off-by: Jonas Gorski Reviewed-by: Florian Fainelli Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20250602194914.1011890-1-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit df9d49418271826bb35eb85f43cbcc6160f7002f Merge: 61a4b7d7d56cdb 791d76005de0ab Author: Dave Airlie Date: Fri Jun 6 09:08:29 2025 +1000 Merge tag 'drm-intel-next-fixes-2025-06-05' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next - Fix PSR register definitions for ALPM - Fix u32 overflow in SNPS PHY HDMI PLL setup - Fix GuC pending message underflow when submit fails - Fix GuC wakeref underflow race during reset Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://lore.kernel.org/r/aEFW1wGnt1kTVNGF@jlahtine-mobl commit 400123bd0107175e92a9780b97f7a5934eb0a991 Author: Andrej Picej Date: Thu May 29 07:36:53 2025 +0200 dt-bindings: drm/bridge: ti-sn65dsi83: drop $ref to fix lvds-vod* warnings The kernel test robot reported a warning related to the use of "$ref" type definitions for custom endpoint properties - "ti,lvds-vod-swing-clock-microvolt" and - "ti,lvds-vod-swing-data-microvolt". Using "$ref" with "uint32-array" is not correctly handled in this context. Removing "$ref" and relying solely on "maxItems: 2" enforces the intended requirement of specifying exactly two values, without triggering a schema validation warning. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202505021937.efnQPPqx-lkp@intel.com/ Signed-off-by: Andrej Picej Link: https://lore.kernel.org/r/20250529053654.1754926-1-andrej.picej@norik.com Signed-off-by: Rob Herring (Arm) commit 51f1b16367dfde89a4ef5bee2270f6a4d523ef3b Merge: a921f0753a4c15 7977448bf374f6 Author: Palmer Dabbelt Date: Thu Jun 5 11:42:35 2025 -0700 Merge patch series "riscv: add SBI FWFT misaligned exception delegation support" Clément Léger says: The SBI Firmware Feature extension allows the S-mode to request some specific features (either hardware or software) to be enabled. This series uses this extension to request misaligned access exception delegation to S-mode in order to let the kernel handle it. It also adds support for the KVM FWFT SBI extension based on the misaligned access handling infrastructure. FWFT SBI extension is part of the SBI V3.0 specifications [1]. It can be tested using the qemu provided at [2] which contains the series from [3]. Upstream kvm-unit-tests can be used inside kvm to tests the correct delegation of misaligned exceptions. Upstream OpenSBI can be used. The tests can be run using the kselftest from series [4]. $ qemu-system-riscv64 \ -cpu rv64,trap-misaligned-access=true,v=true \ -M virt \ -m 1024M \ -bios fw_dynamic.bin \ -kernel Image ... # ./misaligned TAP version 13 1..23 # Starting 23 tests from 1 test cases. # RUN global.gp_load_lh ... # OK global.gp_load_lh ok 1 global.gp_load_lh # RUN global.gp_load_lhu ... # OK global.gp_load_lhu ok 2 global.gp_load_lhu # RUN global.gp_load_lw ... # OK global.gp_load_lw ok 3 global.gp_load_lw # RUN global.gp_load_lwu ... # OK global.gp_load_lwu ok 4 global.gp_load_lwu # RUN global.gp_load_ld ... # OK global.gp_load_ld ok 5 global.gp_load_ld # RUN global.gp_load_c_lw ... # OK global.gp_load_c_lw ok 6 global.gp_load_c_lw # RUN global.gp_load_c_ld ... # OK global.gp_load_c_ld ok 7 global.gp_load_c_ld # RUN global.gp_load_c_ldsp ... # OK global.gp_load_c_ldsp ok 8 global.gp_load_c_ldsp # RUN global.gp_load_sh ... # OK global.gp_load_sh ok 9 global.gp_load_sh # RUN global.gp_load_sw ... # OK global.gp_load_sw ok 10 global.gp_load_sw # RUN global.gp_load_sd ... # OK global.gp_load_sd ok 11 global.gp_load_sd # RUN global.gp_load_c_sw ... # OK global.gp_load_c_sw ok 12 global.gp_load_c_sw # RUN global.gp_load_c_sd ... # OK global.gp_load_c_sd ok 13 global.gp_load_c_sd # RUN global.gp_load_c_sdsp ... # OK global.gp_load_c_sdsp ok 14 global.gp_load_c_sdsp # RUN global.fpu_load_flw ... # OK global.fpu_load_flw ok 15 global.fpu_load_flw # RUN global.fpu_load_fld ... # OK global.fpu_load_fld ok 16 global.fpu_load_fld # RUN global.fpu_load_c_fld ... # OK global.fpu_load_c_fld ok 17 global.fpu_load_c_fld # RUN global.fpu_load_c_fldsp ... # OK global.fpu_load_c_fldsp ok 18 global.fpu_load_c_fldsp # RUN global.fpu_store_fsw ... # OK global.fpu_store_fsw ok 19 global.fpu_store_fsw # RUN global.fpu_store_fsd ... # OK global.fpu_store_fsd ok 20 global.fpu_store_fsd # RUN global.fpu_store_c_fsd ... # OK global.fpu_store_c_fsd ok 21 global.fpu_store_c_fsd # RUN global.fpu_store_c_fsdsp ... # OK global.fpu_store_c_fsdsp ok 22 global.fpu_store_c_fsdsp # RUN global.gen_sigbus ... [12797.988647] misaligned[618]: unhandled signal 7 code 0x1 at 0x0000000000014dc0 in misaligned[4dc0,10000+76000] [12797.988990] CPU: 0 UID: 0 PID: 618 Comm: misaligned Not tainted 6.13.0-rc6-00008-g4ec4468967c9-dirty #51 [12797.989169] Hardware name: riscv-virtio,qemu (DT) [12797.989264] epc : 0000000000014dc0 ra : 0000000000014d00 sp : 00007fffe165d100 [12797.989407] gp : 000000000008f6e8 tp : 0000000000095760 t0 : 0000000000000008 [12797.989544] t1 : 00000000000965d8 t2 : 000000000008e830 s0 : 00007fffe165d160 [12797.989692] s1 : 000000000000001a a0 : 0000000000000000 a1 : 0000000000000002 [12797.989831] a2 : 0000000000000000 a3 : 0000000000000000 a4 : ffffffffdeadbeef [12797.989964] a5 : 000000000008ef61 a6 : 626769735f6e0000 a7 : fffffffffffff000 [12797.990094] s2 : 0000000000000001 s3 : 00007fffe165d838 s4 : 00007fffe165d848 [12797.990238] s5 : 000000000000001a s6 : 0000000000010442 s7 : 0000000000010200 [12797.990391] s8 : 000000000000003a s9 : 0000000000094508 s10: 0000000000000000 [12797.990526] s11: 0000555567460668 t3 : 00007fffe165d070 t4 : 00000000000965d0 [12797.990656] t5 : fefefefefefefeff t6 : 0000000000000073 [12797.990756] status: 0000000200004020 badaddr: 000000000008ef61 cause: 0000000000000006 [12797.990911] Code: 8793 8791 3423 fcf4 3783 fc84 c737 dead 0713 eef7 (c398) 0001 # OK global.gen_sigbus ok 23 global.gen_sigbus # PASSED: 23 / 23 tests passed. # Totals: pass:23 fail:0 xfail:0 xpass:0 skip:0 error:0 With kvm-tools: # lkvm run -k sbi.flat -m 128 Info: # lkvm run -k sbi.flat -m 128 -c 1 --name guest-97 Info: Removed ghost socket file "/root/.lkvm//guest-97.sock". ########################################################################## # kvm-unit-tests ########################################################################## ... [test messages elided] PASS: sbi: fwft: FWFT extension probing no error PASS: sbi: fwft: get/set reserved feature 0x6 error == SBI_ERR_DENIED PASS: sbi: fwft: get/set reserved feature 0x3fffffff error == SBI_ERR_DENIED PASS: sbi: fwft: get/set reserved feature 0x80000000 error == SBI_ERR_DENIED PASS: sbi: fwft: get/set reserved feature 0xbfffffff error == SBI_ERR_DENIED PASS: sbi: fwft: misaligned_deleg: Get misaligned deleg feature no error PASS: sbi: fwft: misaligned_deleg: Set misaligned deleg feature invalid value error PASS: sbi: fwft: misaligned_deleg: Set misaligned deleg feature invalid value error PASS: sbi: fwft: misaligned_deleg: Set misaligned deleg feature value no error PASS: sbi: fwft: misaligned_deleg: Set misaligned deleg feature value 0 PASS: sbi: fwft: misaligned_deleg: Set misaligned deleg feature value no error PASS: sbi: fwft: misaligned_deleg: Set misaligned deleg feature value 1 PASS: sbi: fwft: misaligned_deleg: Verify misaligned load exception trap in supervisor SUMMARY: 50 tests, 2 unexpected failures, 12 skipped This series is available at [5]. [Palmer: slighyt commit text modification, as SBI-3.0 is merged now. Also drop the KVM patches, as they're too late.] * b4-shazam-merge: riscv: misaligned: add a function to check misalign trap delegability riscv: misaligned: move emulated access uniformity check in a function riscv: misaligned: declare misaligned_access_speed under CONFIG_RISCV_MISALIGNED riscv: misaligned: use on_each_cpu() for scalar misaligned access probing riscv: misaligned: request misaligned exception from SBI riscv: sbi: add SBI FWFT extension calls riscv: sbi: add FWFT extension interface riscv: sbi: add new SBI error mappings riscv: sbi: remove useless parenthesis riscv: sbi: add Firmware Feature (FWFT) SBI extensions definitions Link: https://lore.kernel.org/r/20250523101932.1594077-1-cleger@rivosinc.com Signed-off-by: Palmer Dabbelt commit a921f0753a4c152ba6ebb215b224dd1d04420d26 Merge: 265d6aba165c50 ca1a66cdd68503 Author: Palmer Dabbelt Date: Thu Jun 5 11:39:22 2025 -0700 Merge patch series "riscv: misaligned: fix misaligned accesses handling in put/get_user()" Clément Léger says: While debugging a few problems with the misaligned access kselftest, Alexandre discovered some crash with the current code. Indeed, some misaligned access was done by the kernel using put_user(). This was resulting in trap and a kernel crash since. The path was the following: user -> kernel -> access to user memory -> misaligned trap -> trap -> kernel -> misaligned handling -> memcpy -> crash due to failed page fault while in interrupt disabled section. Last discussion about kernel misaligned handling and interrupt reenabling were actually not to reenable interrupt when handling misaligned access being done by kernel. The best solution being not to do any misaligned accesses to userspace memory, we considered a few options: - Remove any call to put/get_user() potentially doing misaligned accesses - Do not do any misaligned accesses in put/get_user() itself The second solution was the one chosen as there are too many callsites to put/get_user() that could potentially do misaligned accesses. We tried two approaches for that, either split access in two aligned accesses (and do RMW for put_user()) or call copy_from/to_user() which does not do any misaligned accesses. The later one was the simpler to implement (although the performances are probably lower than split aligned accesses but still way better than doing misaligned access emulation) and allows to support what we wanted. These commits are based on top of Alex dev/alex/get_user_misaligned_v1 branch. [Palmer: No idea what that branch is, so I'm basing it on the uaccess optimizations patch series which is the last thing to touch these.] * b4-shazam-merge riscv: uaccess: do not do misaligned accesses in get/put_user() riscv: process: use unsigned int instead of unsigned long for put_user() riscv: make unsafe user copy routines use existing assembly routines Link: https://lore.kernel.org/r/20250602193918.868962-1-cleger@rivosinc.com Signed-off-by: Palmer Dabbelt commit 265d6aba165c500389c80d394ac247460c443ef5 Author: Cyril Bur Date: Mon Jun 2 12:15:43 2025 +0000 riscv: uaccess: Only restore the CSR_STATUS SUM bit During switch to csrs will OR the value of the register into the corresponding csr. In this case we're only interested in restoring the SUM bit not the entire register. Signed-off-by: Cyril Bur Link: https://lore.kernel.org/r/20250522160954.429333-1-cyrilbur@tenstorrent.com Co-developed-by: Alexandre Ghiti Signed-off-by: Alexandre Ghiti Fixes: 788aa64c01f1 ("riscv: save the SR_SUM status over switches") Link: https://lore.kernel.org/r/20250602121543.1544278-1-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt commit 2670a39b1ea68fb0b9175e26e299f3fe974e0332 Merge: 7bc76fb3883aab ee0d03053e7009 Author: Palmer Dabbelt Date: Thu Jun 5 11:23:07 2025 -0700 Merge tag 'riscv-mw2-6.16-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/alexghiti/linux into for-next riscv patches for 6.16-rc1, part 2 * Performance improvements - Add support for vdso getrandom - Implement raid6 calculations using vectors - Introduce svinval tlb invalidation * Cleanup - A bunch of deduplication of the macros we use for manipulating instructions * Misc - Introduce a kunit test for kprobes - Add support for mseal as riscv fits the requirements (thanks to Lorenzo for making sure of that :)) [Palmer: There was a rebase between part 1 and part 2, so I've had to do some more git surgery here... at least two rounds of surgery...] * alex-pr-2: (866 commits) RISC-V: vDSO: Wire up getrandom() vDSO implementation riscv: enable mseal sysmap for RV64 raid6: Add RISC-V SIMD syndrome and recovery calculations riscv: mm: Add support for Svinval extension riscv: Add kprobes KUnit test riscv: kprobes: Remove duplication of RV_EXTRACT_ITYPE_IMM riscv: kprobes: Remove duplication of RV_EXTRACT_UTYPE_IMM riscv: kprobes: Remove duplication of RV_EXTRACT_RD_REG riscv: kprobes: Remove duplication of RVC_EXTRACT_BTYPE_IMM riscv: kprobes: Remove duplication of RVC_EXTRACT_C2_RS1_REG riscv: kproves: Remove duplication of RVC_EXTRACT_JTYPE_IMM riscv: kprobes: Remove duplication of RV_EXTRACT_BTYPE_IMM riscv: kprobes: Remove duplication of RV_EXTRACT_RS1_REG riscv: kprobes: Remove duplication of RV_EXTRACT_JTYPE_IMM riscv: kprobes: Move branch_funct3 to insn.h riscv: kprobes: Move branch_rs2_idx to insn.h Linux 6.15-rc6 Input: xpad - fix xpad_device sorting Input: xpad - add support for several more controllers Input: xpad - fix Share button on Xbox One controllers ... commit ee0d03053e7009a3a3532fb37f6c94bfa0a8cca3 Author: Xi Ruoyao Date: Fri Apr 11 10:46:00 2025 +0800 RISC-V: vDSO: Wire up getrandom() vDSO implementation Hook up the generic vDSO implementation to the generic vDSO getrandom implementation by providing the required __arch_chacha20_blocks_nostack and getrandom_syscall implementations. Also wire up the selftests. The benchmark result: vdso: 25000000 times in 2.466341333 seconds libc: 25000000 times in 41.447720005 seconds syscall: 25000000 times in 41.043926672 seconds vdso: 25000000 x 256 times in 162.286219353 seconds libc: 25000000 x 256 times in 2953.855018685 seconds syscall: 25000000 x 256 times in 2796.268546000 seconds [ alex: - Fix dynamic relocation - Squash Nathan's fix https://lore.kernel.org/all/20250423-riscv-fix-compat_vdso-lld-v2-1-b7bbbc244501@kernel.org/ - Add comment from Loongarch ] Signed-off-by: Xi Ruoyao Link: https://lore.kernel.org/r/20250411024600.16045-1-xry111@xry111.site Tested-by: Alexandre Ghiti Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit a869b8c29f864b9530a6473a30c09546333b571a Author: Jisheng Zhang Date: Sat Apr 26 21:59:54 2025 +0800 riscv: enable mseal sysmap for RV64 Provide support for CONFIG_MSEAL_SYSTEM_MAPPINGS for RV64, covering the vdso, vvar. Passed sysmap_is_sealed and mseal_test self tests. Passed booting a buildroot rootfs image and a cli debian rootfs image. Signed-off-by: Jisheng Zhang Cc: Jeff Xu Link: https://lore.kernel.org/r/20250426135954.5614-1-jszhang@kernel.org Tested-by: Alexandre Ghiti Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit 6093faaf9593fca92f96f165c95ff4b53353b1f4 Author: Chunyan Zhang Date: Wed Mar 5 16:37:06 2025 +0800 raid6: Add RISC-V SIMD syndrome and recovery calculations The assembly is originally based on the ARM NEON and int.uc, but uses RISC-V vector instructions to implement the RAID6 syndrome and recovery calculations. The functions are tested on QEMU running with the option "-icount shift=0": raid6: rvvx1 gen() 1008 MB/s raid6: rvvx2 gen() 1395 MB/s raid6: rvvx4 gen() 1584 MB/s raid6: rvvx8 gen() 1694 MB/s raid6: int64x8 gen() 113 MB/s raid6: int64x4 gen() 116 MB/s raid6: int64x2 gen() 272 MB/s raid6: int64x1 gen() 229 MB/s raid6: using algorithm rvvx8 gen() 1694 MB/s raid6: .... xor() 1000 MB/s, rmw enabled raid6: using rvv recovery algorithm [Charlie: - Fixup vector options] Signed-off-by: Charlie Jenkins Signed-off-by: Chunyan Zhang Reviewed-by: Charlie Jenkins Tested-by: Charlie Jenkins Link: https://lore.kernel.org/r/20250305083707.74218-1-zhangchunyan@iscas.ac.cn Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit a56972698810089d8f1bdc296cd709726db7176b Author: Mayuresh Chitale Date: Tue Jul 2 15:56:37 2024 +0530 riscv: mm: Add support for Svinval extension The Svinval extension splits SFENCE.VMA instruction into finer-grained invalidation and ordering operations and is mandatory for RVA23S64 profile. When Svinval is enabled the local_flush_tlb_range_threshold_asid function should use the following sequence to optimize the tlb flushes instead of a simple sfence.vma: sfence.w.inval svinval.vma . . svinval.vma sfence.inval.ir The maximum number of consecutive svinval.vma instructions that can be executed in local_flush_tlb_range_threshold_asid function is limited to 64. This is required to avoid soft lockups and the approach is similar to that used in arm64. Signed-off-by: Mayuresh Chitale Reviewed-by: Andrew Jones Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20240702102637.9074-1-mchitale@ventanamicro.com Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit 481d5c31e14347aef33ab715f79831873a60c6e2 Author: Masahiro Yamada Date: Tue Jun 3 03:11:41 2025 +0900 efi/libstub: use 'targets' instead of extra-y in Makefile These objects are built as prerequisites of %.stub.o files. There is no need to use extra-y, which is planned for deprecation. Acked-by: Ard Biesheuvel Signed-off-by: Masahiro Yamada commit 8c21c4111128365f81a88573eeb2844fa696b299 Author: Masahiro Yamada Date: Mon Jun 2 19:55:36 2025 +0900 module: make __mod_device_table__* symbols static The __mod_device_table__* symbols are only parsed by modpost to generate MODULE_ALIAS() entries from MODULE_DEVICE_TABLE(). Therefore, these symbols do not need to be globally visible, or globally unique. If they are in the global scope, we would worry about the symbol uniqueness, but modpost is fine with parsing multiple symbols with the same name. Signed-off-by: Masahiro Yamada Reviewed-by: Petr Pavlu commit 7d95680d64ac8e836c35fd56efe77eac4e9cc26b Author: Masahiro Yamada Date: Sun Jun 1 22:31:30 2025 +0900 scripts/misc-check: check unnecessary #include when W=1 Another issue with is that it is sometimes included even when EXPORT_SYMBOL() is not used at all. Some headers (e.g. include/linux/linkage.h>) cannot be fixed for now for the reason described in the previous commit. This commit adds a warning for *.c files that include but do not use EXPORT_SYMBOL() when the kernel is built with W=1. Signed-off-by: Masahiro Yamada commit a934a57a42f64a40705202f84144b1a29b29f910 Author: Masahiro Yamada Date: Sun Jun 1 22:31:29 2025 +0900 scripts/misc-check: check missing #include when W=1 The problem was described in commit 5b20755b7780 ("init: move THIS_MODULE from to "). To summarize it again here: is included by most C files, even though only some of them actually export symbols. This is because some headers, such as include/linux/{module.h,linkage}, needlessly include . I have added a more detailed explanation in the comments of scripts/misc-check. This problem will be fixed in two steps: 1. Add #include directly to C files that use EXPORT_SYMBOL() 2. Remove #include from header files that do not use EXPORT_SYMBOL() This commit addresses step 1; scripts/misc-check will warn about *.[ch] files that use EXPORT_SYMBOL() but do not include . This check is only triggered when the kernel is built with W=1. We need to fix 4000+ files. I hope others will help with this effort. Signed-off-by: Masahiro Yamada commit 3a44052b728e5d96ea425f908e71926364a12f11 Author: Masahiro Yamada Date: Sun Jun 1 22:31:28 2025 +0900 scripts/misc-check: add double-quotes to satisfy shellcheck In scripts/misc-check line 8: git -C ${srctree:-.} ls-files -i -c --exclude-per-directory=.gitignore 2>/dev/null | ^-----------^ SC2086 (info): Double quote to prevent globbing and word splitting. Signed-off-by: Masahiro Yamada commit 89e7fecf5ce2e85a323e58f09aa808218a37079a Author: Masahiro Yamada Date: Sun Jun 1 22:31:27 2025 +0900 kbuild: move W=1 check for scripts/misc-check to top-level Makefile This script is executed only when ${KBUILD_EXTRA_WARN} contains 1. Move this check to the top-level Makefile to allow more checks to be easily added to this script. Signed-off-by: Masahiro Yamada Reviewed-by: Nathan Chancellor commit a503a313108e26402151f25c1f2628ec91bda605 Author: Masatake YAMATO Date: Fri May 30 04:46:33 2025 +0900 scripts/tags.sh: allow to use alternative ctags implementation Some ctags implementations are available. With this change, You can specify your favorite one with CTAGS environment variable. Signed-off-by: Masatake YAMATO Signed-off-by: Masahiro Yamada commit 0f57c75973bedc08a865b06ce1b73ae5b54477c0 Author: Masahiro Yamada Date: Wed May 28 02:56:15 2025 +0900 kconfig: introduce menu type enum Currently, menu->prompt->type is checked to distinguish "comment" (P_COMMENT) and "menu" (P_MENU) entries from regular "config" entries. This is odd because P_COMMENT and P_MENU are not properties. This commit introduces menu type enum to distinguish menu types more naturally. Signed-off-by: Masahiro Yamada commit 94145ffb07601674091aadbdca9ce004b1736df4 Author: Khaled Elnaggar Date: Tue May 27 00:10:39 2025 +0300 docs: symbol-namespaces: fix reST warning with literal block Use a literal block for the EXPORT_SYMBOL_GPL_FOR_MODULES() example to avoid a Docutils warning about unmatched '*'. This ensures correct rendering and keeps the source readable. Warning: Documentation/core-api/symbol-namespaces.rst:90: WARNING: Inline emphasis start-string without end-string. [docutils] Signed-off-by: Khaled Elnaggar Reviewed-by: Bagas Sanjaya Signed-off-by: Masahiro Yamada commit 41a77d43f36d3b897755a223b264c45131546b8b Author: Masahiro Yamada Date: Mon May 26 18:07:52 2025 +0900 kbuild: link lib-y objects to vmlinux forcibly even when CONFIG_MODULES=n Since commit 7273ad2b08f8 ("kbuild: link lib-y objects to vmlinux forcibly when CONFIG_MODULES=y"), all objects from lib-y have been forcibly linked to vmlinux when CONFIG_MODULES=y. To simplify future changes, this commit makes all objects from lib-y be linked regardless of the CONFIG_MODULES setting. Most use cases (CONFIG_MODULES=y) are not affected by this change. The vmlinux size with ARCH=arm allnoconfig, where CONFIG_MODULES=n, increases as follows: text data bss dec hex filename 1368644 835104 206288 2410036 24c634 vmlinux.before 1379440 837064 206288 2422792 24f808 vmlinux.after We no longer benefit from using static libraries, but the impact is mitigated by supporting CONFIG_LD_DEAD_CODE_DATA_ELIMINATION. For example, the size of vmlinux remains almost the same with ARCH=arm tinyconfig, where CONFIG_MODULES=n and CONFIG_LD_DEAD_CODE_DATA_ELIMINATION=y. text data bss dec hex filename 455316 93404 15472 564192 89be0 vmlinux.before 455312 93404 15472 564188 89bdc vmlinux.after Signed-off-by: Masahiro Yamada commit 81a93bf93f0e5963d8695a3596ac50b5ceea87c3 Author: Masahiro Yamada Date: Mon May 26 18:07:51 2025 +0900 tinyconfig: enable CONFIG_LD_DEAD_CODE_DATA_ELIMINATION This CONFIG option, if supported by the architecture, helps reduce the size of vmlinux. For example, the size of vmlinux with ARCH=arm tinyconfig decreases as follows: text data bss dec hex filename 631684 104500 18176 754360 b82b8 vmlinux.before 455316 93404 15472 564192 89be0 vmlinux.after Signed-off-by: Masahiro Yamada commit e271ed52b344ac02d4581286961d0c40acc54c03 Merge: 2c7e4a2663a1ab 8887abccf8aa16 Author: Linus Torvalds Date: Thu Jun 5 12:47:12 2025 -0700 Merge tag 'pm-6.16-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "Fix three issues introduced into device suspend/resume error paths in the PM core by some of the recent updates. First off, replace list_splice() with list_splice_init() in three places in device suspend error paths to avoid attempting to use an uninitialized list head going forward. Second, rearrange device_resume() to avoid leaking the power.is_suspended device PM flag to the next system suspend/resume cycle where it can confuse rolling back after an error or early wakeup. Finally, add synchronization to dpm_async_resume_children() to avoid resetting the async state mistakenly for devices whose resume callbacks have already been queued up for asynchronous execution in the given device resume phase, which fortunately can happen only if the preceding system suspend transition has been aborted" * tag 'pm-6.16-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM: sleep: Add locking to dpm_async_resume_children() PM: sleep: Fix power.is_suspended cleanup for direct-complete devices PM: sleep: Fix list splicing in device suspend error paths commit 2c7e4a2663a1ab5a740c59c31991579b6b865a26 Merge: 71052a800371c6 3cae906e1a6184 Author: Linus Torvalds Date: Thu Jun 5 12:34:55 2025 -0700 Merge tag 'net-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from CAN, wireless, Bluetooth, and Netfilter. Current release - regressions: - Revert "kunit: configs: Enable CONFIG_INIT_STACK_ALL_PATTERN in all_tests", makes kunit error out if compiler is old - wifi: iwlwifi: mvm: fix assert on suspend - rxrpc: fix return from none_validate_challenge() Current release - new code bugs: - ovpn: couple of fixes for socket cleanup and UDP-tunnel teardown - can: kvaser_pciefd: refine error prone echo_skb_max handling logic - fix net_devmem_bind_dmabuf() stub when DEVMEM not compiled - eth: airoha: fixes for config / accel in bridge mode Previous releases - regressions: - Bluetooth: hci_qca: move the SoC type check to the right place, fix GPIO integration - prevent a NULL deref in rtnl_create_link() after locking changes - fix udp gso skb_segment after pull from frag_list - hv_netvsc: fix potential deadlock in netvsc_vf_setxdp() Previous releases - always broken: - netfilter: - nf_nat: also check reverse tuple to obtain clashing entry - nf_set_pipapo_avx2: fix initial map fill (zeroing) - fix the helper for incremental update of packet checksums after modifying the IP address, used by ILA and BPF - eth: - stmmac: prevent div by 0 when clock rate is misconfigured - ice: fix Tx scheduler handling of XDP and changing queue count - eth: fix support for the RGMII interface when delays configured" * tag 'net-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (76 commits) calipso: unlock rcu before returning -EAFNOSUPPORT seg6: Fix validation of nexthop addresses net: prevent a NULL deref in rtnl_create_link() net: annotate data-races around cleanup_net_task selftests: drv-net: tso: make bkg() wait for socat to quit selftests: drv-net: tso: fix the GRE device name selftests: drv-net: add configs for the TSO test wireguard: device: enable threaded NAPI netlink: specs: rt-link: decode ip6gre netlink: specs: rt-link: add missing byte-order properties net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements net: dsa: b53: do not touch DLL_IQQD on bcm53115 net: dsa: b53: allow RGMII for bcm63xx RGMII ports net: dsa: b53: do not configure bcm63xx's IMP port interface net: dsa: b53: do not enable RGMII delay on bcm63xx net: dsa: b53: do not enable EEE on bcm63xx net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces. selftests: netfilter: nft_nat.sh: add test for reverse clash with nat netfilter: nf_nat: also check reverse tuple to obtain clashing entry ... commit 7bc76fb3883aaba56b16dc4009ba8a490b8dc6ab Author: Palmer Dabbelt Date: Tue Jun 3 10:28:57 2025 -0700 RISC-V: Documentation: Add enough title underlines to CMODX This reports as a warning in linux-next along the lines of Documentation/arch/riscv/cmodx.rst:14: WARNING: Title underline too short. CMODX in the Kernel Space --------------------- [docutils] Documentation/arch/riscv/cmodx.rst:43: WARNING: Title underline too short. CMODX in the User Space --------------------- [docutils] Documentation/arch/riscv/cmodx.rst:43: WARNING: Title underline too short. CMODX in the User Space --------------------- [docutils] Link: https://lore.kernel.org/all/20250603154544.1602a8b5@canb.auug.org.au/ Fixes: 0e07200b2af6 ("riscv: Documentation: add a description about dynamic ftrace") Reviewed-by: Charlie Jenkins Link: https://lore.kernel.org/r/20250603172856.49925-1-palmer@dabbelt.com Signed-off-by: Palmer Dabbelt commit 9d3da7827536b8e41e4188185622816a105b46f7 Merge: 2f956db8b3b022 c39d53750ff96b Author: Palmer Dabbelt Date: Thu Jun 5 11:11:21 2025 -0700 Merge tag 'riscv-mw1-6.16-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/alexghiti/linux into for-next riscv patches for 6.16-rc1 * Implement atomic patching support for ftrace which finally allows to get rid of stop_machine(). * Support for kexec_file_load() syscall * Improve module loading time by changing the algorithm that counts the number of plt/got entries in a module. * Zicbop is now used in the kernel to prefetch instructions [Palmer: There's been two rounds of surgery on this one, so as a result it's a bit different than the PR.] * alex-pr: (734 commits) riscv: Improve Kconfig help for RISCV_ISA_V_PREEMPTIVE MAINTAINERS: Update Atish's email address riscv: hwprobe: export Zabha extension riscv: Make regs_irqs_disabled() more clear perf symbols: Ignore mapping symbols on riscv RISC-V: Kconfig: Fix help text of CMDLINE_EXTEND riscv: module: Optimize PLT/GOT entry counting riscv: Add support for PUD THP riscv: xchg: Prefetch the destination word for sc.w riscv: Add ARCH_HAS_PREFETCH[W] support with Zicbop riscv: Add support for Zicbop riscv: Introduce Zicbop instructions riscv/kexec_file: Fix comment in purgatory relocator riscv: kexec_file: Support loading Image binary file riscv: kexec_file: Split the loading of kernel and others riscv: Documentation: add a description about dynamic ftrace riscv: ftrace: support direct call using call_ops riscv: Implement HAVE_DYNAMIC_FTRACE_WITH_CALL_OPS riscv: ftrace: support PREEMPT riscv: add a data fence for CMODX in the kernel mode ... Signed-off-by: Palmer Dabbelt commit c39d53750ff96b282c869a0184a7c3ecfd298ca8 Author: Miquel Sabaté Solà Date: Thu May 1 15:03:09 2025 +0200 riscv: Improve Kconfig help for RISCV_ISA_V_PREEMPTIVE Fix a couple of spelling issues plus some minor details on the grammar. Signed-off-by: Miquel Sabaté Solà Link: https://lore.kernel.org/r/20250501130309.14803-1-mikisabate@gmail.com Reviewed-by: Alexandre Ghiti Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit 9811c864f5d72effcaf476a80645f0ad3de4469d Author: Atish Patra Date: Mon May 5 14:27:38 2025 -0700 MAINTAINERS: Update Atish's email address My personal upstream email account was previously based on gmail which has become difficult to manage upstream activities lately. Update it to the more reliable linux.dev account. Signed-off-by: Atish Patra Link: https://lore.kernel.org/r/20250505-update_email_address-v1-1-1c24db506fdb@rivosinc.com Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit 847689d2a0c4b4778459c387ec561465e521d963 Merge: 415a8c81da3dab eb87e56d651d0a Author: Alexandre Ghiti Date: Tue May 6 08:19:57 2025 +0000 Merge patch series "riscv: Add Zicbop & prefetchw support" Alexandre Ghiti says: I found this lost series developed by Guo so here is a respin with the comments on v2 applied. This patch series adds Zicbop support and then enables the Linux prefetch features. * patches from https://lore.kernel.org/r/20250421142441.395849-1-alexghiti@rivosinc.com: riscv: xchg: Prefetch the destination word for sc.w riscv: Add ARCH_HAS_PREFETCH[W] support with Zicbop riscv: Add support for Zicbop riscv: Introduce Zicbop instructions Link: https://lore.kernel.org/r/20250421142441.395849-1-alexghiti@rivosinc.com Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit 71052a800371c64b4546a1d7f69ad515a779316f Author: Eric Biggers Date: Thu Jun 5 10:11:56 2025 -0700 MAINTAINERS: add entry for crypto library I am volunteering to maintain the kernel's crypto library code. [ And Jason and Ard piped up too - Linus ] Signed-off-by: Eric Biggers Acked-by: Jason A. Donenfeld Acked-by: Ard Biesheuvel Signed-off-by: Linus Torvalds commit 6fe26f694c824b8a4dbf50c635bee1302e3f099c Author: Luiz Augusto von Dentz Date: Tue May 20 15:42:21 2025 -0400 Bluetooth: MGMT: Protect mgmt_pending list with its own lock This uses a mutex to protect from concurrent access of mgmt_pending list which can cause crashes like: ================================================================== BUG: KASAN: slab-use-after-free in hci_sock_get_channel+0x60/0x68 net/bluetooth/hci_sock.c:91 Read of size 2 at addr ffff0000c48885b2 by task syz.4.334/7318 CPU: 0 UID: 0 PID: 7318 Comm: syz.4.334 Not tainted 6.15.0-rc7-syzkaller-g187899f4124a #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 print_address_description+0xa8/0x254 mm/kasan/report.c:408 print_report+0x68/0x84 mm/kasan/report.c:521 kasan_report+0xb0/0x110 mm/kasan/report.c:634 __asan_report_load2_noabort+0x20/0x2c mm/kasan/report_generic.c:379 hci_sock_get_channel+0x60/0x68 net/bluetooth/hci_sock.c:91 mgmt_pending_find+0x7c/0x140 net/bluetooth/mgmt_util.c:223 pending_find net/bluetooth/mgmt.c:947 [inline] remove_adv_monitor+0x44/0x1a4 net/bluetooth/mgmt.c:5445 hci_mgmt_cmd+0x780/0xc00 net/bluetooth/hci_sock.c:1712 hci_sock_sendmsg+0x544/0xbb0 net/bluetooth/hci_sock.c:1832 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg net/socket.c:727 [inline] sock_write_iter+0x25c/0x378 net/socket.c:1131 new_sync_write fs/read_write.c:591 [inline] vfs_write+0x62c/0x97c fs/read_write.c:684 ksys_write+0x120/0x210 fs/read_write.c:736 __do_sys_write fs/read_write.c:747 [inline] __se_sys_write fs/read_write.c:744 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:744 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 Allocated by task 7037: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:68 kasan_save_alloc_info+0x44/0x54 mm/kasan/generic.c:562 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4327 [inline] __kmalloc_noprof+0x2fc/0x4c8 mm/slub.c:4339 kmalloc_noprof include/linux/slab.h:909 [inline] sk_prot_alloc+0xc4/0x1f0 net/core/sock.c:2198 sk_alloc+0x44/0x3ac net/core/sock.c:2254 bt_sock_alloc+0x4c/0x300 net/bluetooth/af_bluetooth.c:148 hci_sock_create+0xa8/0x194 net/bluetooth/hci_sock.c:2202 bt_sock_create+0x14c/0x24c net/bluetooth/af_bluetooth.c:132 __sock_create+0x43c/0x91c net/socket.c:1541 sock_create net/socket.c:1599 [inline] __sys_socket_create net/socket.c:1636 [inline] __sys_socket+0xd4/0x1c0 net/socket.c:1683 __do_sys_socket net/socket.c:1697 [inline] __se_sys_socket net/socket.c:1695 [inline] __arm64_sys_socket+0x7c/0x94 net/socket.c:1695 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 Freed by task 6607: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:68 kasan_save_free_info+0x58/0x70 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x68/0x88 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2380 [inline] slab_free mm/slub.c:4642 [inline] kfree+0x17c/0x474 mm/slub.c:4841 sk_prot_free net/core/sock.c:2237 [inline] __sk_destruct+0x4f4/0x760 net/core/sock.c:2332 sk_destruct net/core/sock.c:2360 [inline] __sk_free+0x320/0x430 net/core/sock.c:2371 sk_free+0x60/0xc8 net/core/sock.c:2382 sock_put include/net/sock.h:1944 [inline] mgmt_pending_free+0x88/0x118 net/bluetooth/mgmt_util.c:290 mgmt_pending_remove+0xec/0x104 net/bluetooth/mgmt_util.c:298 mgmt_set_powered_complete+0x418/0x5cc net/bluetooth/mgmt.c:1355 hci_cmd_sync_work+0x204/0x33c net/bluetooth/hci_sync.c:334 process_one_work+0x7e8/0x156c kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x958/0xed8 kernel/workqueue.c:3400 kthread+0x5fc/0x75c kernel/kthread.c:464 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:847 Fixes: a380b6cff1a2 ("Bluetooth: Add generic mgmt helper API") Closes: https://syzkaller.appspot.com/bug?extid=0a7039d5d9986ff4ecec Closes: https://syzkaller.appspot.com/bug?extid=cc0cc52e7f43dc9e6df1 Reported-by: syzbot+0a7039d5d9986ff4ecec@syzkaller.appspotmail.com Tested-by: syzbot+0a7039d5d9986ff4ecec@syzkaller.appspotmail.com Tested-by: syzbot+cc0cc52e7f43dc9e6df1@syzkaller.appspotmail.com Signed-off-by: Dmitry Antipov Signed-off-by: Luiz Augusto von Dentz commit e6ed54e86aae9e4f7286ce8d5c73780f91b48d1c Author: Luiz Augusto von Dentz Date: Tue Jun 3 16:12:39 2025 -0400 Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete This reworks MGMT_OP_REMOVE_ADV_MONITOR to not use mgmt_pending_add to avoid crashes like bellow: ================================================================== BUG: KASAN: slab-use-after-free in mgmt_remove_adv_monitor_complete+0xe5/0x540 net/bluetooth/mgmt.c:5406 Read of size 8 at addr ffff88801c53f318 by task kworker/u5:5/5341 CPU: 0 UID: 0 PID: 5341 Comm: kworker/u5:5 Not tainted 6.15.0-syzkaller-10402-g4cb6c8af8591 #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Workqueue: hci0 hci_cmd_sync_work Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xd2/0x2b0 mm/kasan/report.c:521 kasan_report+0x118/0x150 mm/kasan/report.c:634 mgmt_remove_adv_monitor_complete+0xe5/0x540 net/bluetooth/mgmt.c:5406 hci_cmd_sync_work+0x261/0x3a0 net/bluetooth/hci_sync.c:334 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3321 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402 kthread+0x711/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 5987: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4358 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1039 [inline] mgmt_pending_new+0x65/0x240 net/bluetooth/mgmt_util.c:252 mgmt_pending_add+0x34/0x120 net/bluetooth/mgmt_util.c:279 remove_adv_monitor+0x103/0x1b0 net/bluetooth/mgmt.c:5454 hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:727 sock_write_iter+0x258/0x330 net/socket.c:1131 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x548/0xa90 fs/read_write.c:686 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5989: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2380 [inline] slab_free mm/slub.c:4642 [inline] kfree+0x18e/0x440 mm/slub.c:4841 mgmt_pending_foreach+0xc9/0x120 net/bluetooth/mgmt_util.c:242 mgmt_index_removed+0x10d/0x2f0 net/bluetooth/mgmt.c:9366 hci_sock_bind+0xbe9/0x1000 net/bluetooth/hci_sock.c:1314 __sys_bind_socket net/socket.c:1810 [inline] __sys_bind+0x2c3/0x3e0 net/socket.c:1841 __do_sys_bind net/socket.c:1846 [inline] __se_sys_bind net/socket.c:1844 [inline] __x64_sys_bind+0x7a/0x90 net/socket.c:1844 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: 66bd095ab5d4 ("Bluetooth: advmon offload MSFT remove monitor") Closes: https://syzkaller.appspot.com/bug?extid=feb0dc579bbe30a13190 Reported-by: syzbot+feb0dc579bbe30a13190@syzkaller.appspotmail.com Tested-by: syzbot+feb0dc579bbe30a13190@syzkaller.appspotmail.com Signed-off-by: Luiz Augusto von Dentz commit bf2ffc4d14db29cab781549912d2dc69127f4d3e Author: Chandrashekar Devegowda Date: Tue Jun 3 15:34:40 2025 +0530 Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition Modify the driver to post 3 fewer buffers than the maximum rx buffers (64) allowed for the firmware. This change mitigates a hardware issue causing a race condition in the firmware, improving stability and data handling. Signed-off-by: Chandrashekar Devegowda Signed-off-by: Kiran K Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for PCIe transport") Signed-off-by: Luiz Augusto von Dentz commit 2dd711102ce69ae41f65d09c012441227d4aa983 Author: Chandrashekar Devegowda Date: Tue Jun 3 15:34:39 2025 +0530 Bluetooth: btintel_pcie: Increase the tx and rx descriptor count This change addresses latency issues observed in HID use cases where events arrive in bursts. By increasing the Rx descriptor count to 64, the firmware can handle bursty data more effectively, reducing latency and preventing buffer overflows. Signed-off-by: Chandrashekar Devegowda Signed-off-by: Kiran K Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for PCIe transport") Signed-off-by: Luiz Augusto von Dentz commit daabd276985055250528da97e9ce6d277d7009c2 Author: Kiran K Date: Tue Jun 3 15:34:38 2025 +0530 Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers The driver was posting only 6 rx buffers, despite the maximum rx buffers being defined as 16. Having fewer RX buffers caused firmware exceptions in HID use cases when events arrived in bursts. Exception seen on android 6.12 kernel. E Bluetooth: hci0: Received hw exception interrupt E Bluetooth: hci0: Received gp1 mailbox interrupt D Bluetooth: hci0: 00000000: ff 3e 87 80 03 01 01 01 03 01 0c 0d 02 1c 10 0e D Bluetooth: hci0: 00000010: 01 00 05 14 66 b0 28 b0 c0 b0 28 b0 ac af 28 b0 D Bluetooth: hci0: 00000020: 14 f1 28 b0 00 00 00 00 fa 04 00 00 00 00 40 10 D Bluetooth: hci0: 00000030: 08 00 00 00 7a 7a 7a 7a 47 00 fb a0 10 00 00 00 D Bluetooth: hci0: 00000000: 10 01 0a E Bluetooth: hci0: ---- Dump of debug registers — E Bluetooth: hci0: boot stage: 0xe0fb0047 E Bluetooth: hci0: ipc status: 0x00000004 E Bluetooth: hci0: ipc control: 0x00000000 E Bluetooth: hci0: ipc sleep control: 0x00000000 E Bluetooth: hci0: mbox_1: 0x00badbad E Bluetooth: hci0: mbox_2: 0x0000101c E Bluetooth: hci0: mbox_3: 0x00000008 E Bluetooth: hci0: mbox_4: 0x7a7a7a7a Signed-off-by: Chandrashekar Devegowda Signed-off-by: Kiran K Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for PCIe transport") Signed-off-by: Luiz Augusto von Dentz commit 308a3a8ce8ea41b26c46169f3263e50f5997c28e Author: Pauli Virtanen Date: Sat May 31 18:24:58 2025 +0300 Bluetooth: hci_core: fix list_for_each_entry_rcu usage Releasing + re-acquiring RCU lock inside list_for_each_entry_rcu() loop body is not correct. Fix by taking the update-side hdev->lock instead. Fixes: c7eaf80bfb0c ("Bluetooth: Fix hci_link_tx_to RCU lock usage") Signed-off-by: Pauli Virtanen Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz commit cfc4ca8986bb1f6182da6cd7bb57f228590b4643 Merge: e9e668cd2756c1 e56a50ff7c1298 Author: Linus Torvalds Date: Thu Jun 5 11:45:33 2025 -0700 Merge tag 'uml-for-linux-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux Pull UML updates from Johannes Berg: "The only really new thing is the long-standing seccomp work (originally from 2021!). Wven if it still isn't enabled by default due to security concerns it can still be used e.g. for tests. - remove obsolete network transports - remove PCI IO port support - start adding seccomp-based process handling instead of ptrace" * tag 'uml-for-linux-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux: (29 commits) um: remove "extern" from implementation of sigchld_handler um: fix unused variable warning um: fix SECCOMP 32bit xstate register restore um: pass FD for memory operations when needed um: Add SECCOMP support detection and initialization um: Implement kernel side of SECCOMP based process handling um: Track userspace children dying in SECCOMP mode um: Add helper functions to get/set state for SECCOMP um: Add stub side of SECCOMP/futex based process handling um: Move faultinfo extraction into userspace routine um: vector: Use mac_pton() for MAC address parsing um: vector: Clean up and modernize log messages um: chan_kern: use raw spinlock for irqs_to_free_lock MAINTAINERS: remove obsolete file entry in TUN/TAP DRIVER um: Fix tgkill compile error on old host OSes um: stop using PCI port I/O um: Remove legacy network transport infrastructure um: vector: Eliminate the dependency on uml_net um: Remove obsolete legacy network transports um/asm: Replace "REP; NOP" with PAUSE mnemonic ... commit ca1a66cdd685030738cf077e3955fdedfe39fbb9 Author: Clément Léger Date: Mon Jun 2 21:39:16 2025 +0200 riscv: uaccess: do not do misaligned accesses in get/put_user() Doing misaligned access to userspace memory would make a trap on platform where it is emulated. Latest fixes removed the kernel capability to do unaligned accesses to userspace memory safely since interrupts are kept disabled at all time during that. Thus doing so would crash the kernel. Such behavior was detected with GET_UNALIGN_CTL() that was doing a put_user() with an unsigned long* address that should have been an unsigned int*. Reenabling kernel misaligned access emulation is a bit risky and it would also degrade performances. Rather than doing that, we will try to avoid any misaligned accessed by using copy_from/to_user() which does not do any misaligned accesses. This can be done only for !CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS and thus allows to only generate a bit more code for this config. Signed-off-by: Clément Léger Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20250602193918.868962-4-cleger@rivosinc.com Signed-off-by: Palmer Dabbelt commit e9e668cd2756c1300f3bf84eba1d6711b886b531 Merge: aef7457540e040 10f885d63a0efd Author: Linus Torvalds Date: Thu Jun 5 11:39:17 2025 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "We've got a couple of build fixes when using LLD, a missing TLB invalidation and a workaround for broken firmware on SoCs with CPUs that implement MPAM: - Disable problematic linker assertions for broken versions of LLD - Work around sporadic link failure with LLD and various randconfig builds - Fix missing invalidation in the TLB batching code when reclaim races with mprotect() and friends - Add a command-line override for MPAM to allow booting on systems with broken firmware" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: Add override for MPAM arm64/mm: Close theoretical race where stale TLB entry remains valid arm64: Work around convergence issue with LLD linker arm64: Disable LLD linker ASSERT()s for the time being commit 020667d661f9be65167174d28a6eda7102f7293f Author: Clément Léger Date: Mon Jun 2 21:39:15 2025 +0200 riscv: process: use unsigned int instead of unsigned long for put_user() The specification of prctl() for GET_UNALIGN_CTL states that the value is returned in an unsigned int * address passed as an unsigned long. Change the type to match that and avoid an unaligned access as well. Signed-off-by: Clément Léger Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20250602193918.868962-3-cleger@rivosinc.com Signed-off-by: Palmer Dabbelt commit a4348546332c9fae12b29acb514535e0a52b9b3c Author: Alexandre Ghiti Date: Mon Jun 2 21:39:14 2025 +0200 riscv: make unsafe user copy routines use existing assembly routines The current implementation is underperforming and in addition, it triggers misaligned access traps on platforms which do not handle misaligned accesses in hardware. Use the existing assembly routines to solve both problems at once. Signed-off-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20250602193918.868962-2-cleger@rivosinc.com Signed-off-by: Palmer Dabbelt commit aef7457540e0407c66a93491cffccd2a6979987c Merge: 7fdaba912981e6 293bb049380e14 Author: Linus Torvalds Date: Thu Jun 5 11:33:09 2025 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux Pull ARM fixes from Russell King: - Fix arch_memremap_can_ram_remap() which incorrectly passed a PFN to memblock_is_map_memory rather than the actual address. - Disallow kernel mode NEON when IRQs are disabled Explanation: "To avoid having to preserve/restore kernel mode NEON state when such a softirq is taken softirqs are now disabled when using the NEON from task context." should explain that it's nested kernel mode. In other words, softirqs from user mode are fine, because the context will be preserved. softirqs from kernel mode may be from a context that has already saved the user NEON state, and thus we would need to preserve the NEON state for the parent kernel mode context, and this we don't allow. The problem occurs when the kernel context disables hard IRQs, and then uses NEON. When it's finished, and restores the userspace NEON state, we call local_bh_enable() with hard IRQs disabled, which causes a warning. This commit addresses that by disallowing the use of NEON with hard IRQs disabled. https://lore.kernel.org/all/20250516231858.27899-4-ebiggers@kernel.org/T/#m104841b6e9346b1814c8b0fb9f2340551b0cd3e8 has some further context * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux: ARM: 9446/1: Disallow kernel mode NEON when IRQs are disabled ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() commit 415a8c81da3dab0a585bd4f8d505a11ad5a171a7 Author: Alexandre Ghiti Date: Mon Apr 21 16:14:13 2025 +0200 riscv: hwprobe: export Zabha extension Export Zabha through the hwprobe syscall. Reviewed-by: Clément Léger Link: https://lore.kernel.org/r/20250421141413.394444-1-alexghiti@rivosinc.com Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit d7e0cce103663a60b14c52a0bcad62c7e8c0e6e8 Author: Tiezhu Yang Date: Tue Apr 22 19:31:56 2025 +0800 riscv: Make regs_irqs_disabled() more clear The return value of regs_irqs_disabled() is true or false, so change its type to reflect that and also make it always inline. Suggested-by: Huacai Chen Signed-off-by: Tiezhu Yang Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20250422113156.25742-1-yangtiezhu@loongson.cn Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit 4d6319289e8661a1845dde5d05859afc21ec3ed9 Author: Haibo Xu Date: Wed Apr 9 10:51:56 2025 +0800 perf symbols: Ignore mapping symbols on riscv RISCV ELF use mapping symbols with special names $x, $d to identify regions of RISCV code or code with different ISAs[1]. These symbols don't identify functions, so will confuse the perf output. The patch filters out these symbols at load time, similar to "4886f2ca perf symbols: Ignore mapping symbols on aarch64". [1] https://github.com/riscv-non-isa/riscv-elf-psabi-doc/blob/ master/riscv-elf.adoc#mapping-symbol Signed-off-by: Haibo Xu Acked-by: Namhyung Kim Link: https://lore.kernel.org/r/20250409025202.201046-1-haibo1.xu@intel.com Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit 9eb9ea31fff0f66e5d41b6fe62c4119dc1e580ba Merge: 48d9aabf2dc5d9 809a11eea8e8c8 Author: Palmer Dabbelt Date: Tue May 27 17:22:40 2025 -0700 Merge patch series "riscv: kexec_file: Support loading Image binary file" Björn Töpel says: From: Björn Töpel Hi! For over a year ago, Daniel and I was testing the V2 of Song's series. I also promised to take the V2, that had been sitting on the lists for too long, to rebase it on a new kernel, and re-test it. One year later, here's the V3! ;-) There are no changes from V2 other, than some simple checkpatch cleanups. Song's original cover: | This series makes the kexec_file_load() syscall support to load | Image binary file. At the same time, corresponding support for | kexec-tools had been pushed to my repo[2]. | | Now, we can leverage that kexec-tools and this series to use the | kexec_load() or kexec_file_load() syscall to boot both vmlinux and | Image file, as seen in these combo tests: | | ``` | 1. kexec -l vmlinux | 2. kexec -l Image | 3. kexec -s -l vmlinux | 4. kexec -s -l Image | ``` Notably, kexec-tools has still not made it upstream. I've prepared a branch on my GH [3], that I indend to post ASAP. That branch is a collection of fixes/features, including Song's userland Image loading. The V2 is here [2], and V1 [1]. I've tested the kexec-file/Image on qemu-rv64, with following combinations: * ACPI/UEFI * DT/UEFI * DT both "regular" kexec (-s + -e), and crashkernels (-p). Note that there are two purgatory patches that has to be present (part of -rc1, so all good): commit 28093cfef5dd ("riscv/kexec_file: Handle R_RISCV_64 in purgatory relocator") commit 3f7023171df4 ("riscv/purgatory: 4B align purgatory_start") [1] https://lore.kernel.org/linux-riscv/20230914020044.1397356-1-songshuaishuai@tinylab.org/ [2] https://lore.kernel.org/linux-riscv/20231016092006.3347632-1-songshuaishuai@tinylab.org/ [3] https://github.com/bjoto/kexec-tools/tree/rv-on-master * patches from https://lore.kernel.org/r/20250409193004.643839-1-bjorn@kernel.org: riscv: kexec_file: Support loading Image binary file riscv: kexec_file: Split the loading of kernel and others Link: https://lore.kernel.org/r/20250409193004.643839-1-bjorn@kernel.org Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit 48d9aabf2dc5d93b402ce55e3187e95698f2b9e9 Author: 谢致邦 (XIE Zhibang) Date: Fri Mar 28 10:14:22 2025 +0000 RISC-V: Kconfig: Fix help text of CMDLINE_EXTEND It is the built-in command line appended to the bootloader command line, not the bootloader command line appended to the built-in command line. Fixes: 3aed8c43267e ("RISC-V: Update Kconfig to better handle CMDLINE") Signed-off-by: 谢致邦 (XIE Zhibang) Link: https://lore.kernel.org/r/tencent_A93C7FB46BFD20054AD2FEF4645913FF550A@qq.com Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit be17c0df67959fe4f88dac75dc26ed9252d4b133 Author: Samuel Holland Date: Wed Apr 9 10:14:51 2025 -0700 riscv: module: Optimize PLT/GOT entry counting perf reports that 99.63% of the cycles from `modprobe amdgpu` are spent inside module_frob_arch_sections(). This is because amdgpu.ko contains about 300000 relocations in its .rela.text section, and the algorithm in count_max_entries() takes quadratic time. Apply two optimizations from the arm64 code, which together reduce the total execution time by 99.58%. First, sort the relocations so duplicate entries are adjacent. Second, reduce the number of relocations that must be sorted by filtering to only relocations that need PLT/GOT entries, as done in commit d4e0340919fb ("arm64/module: Optimize module load time by optimizing PLT counting"). Unlike the arm64 code, here the filtering and sorting is done in a scratch buffer, because the HI20 relocation search optimization in apply_relocate_add() depends on the original order of the relocations. This allows accumulating PLT/GOT relocations across sections so sorting and counting is only done once per module. Signed-off-by: Samuel Holland Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20250409171526.862481-3-samuel.holland@sifive.com Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit 881dadf0792c02d7d156e0665dc5eaf18701cd5a Merge: c3cc2a4a3a23fa d8ac85dad407f4 Author: Alexandre Ghiti Date: Tue Apr 22 12:43:31 2025 +0000 Merge patch series "riscv: ftrace: atmoic patching and preempt improvements" Andy Chiu says: This series makes atomic code patching in ftrace possible and eliminates the need of the stop_machine dance. The major difference of this version is that we merge the CALL_OPS support from Puranjay [1] and make direct calls available for practical uses such as BPF. Thanks for the time reviewing the series and suggestions, we hope this version gets a step closer to happening in the upstream. Please reference the link to v3 below for more introductory view of the implementation [2] Added patch: 2, 4, 10, 11, 12 Modified patch: 5, 6 Unchanged patch: 1, 3, 7, 8, 9 (1, 8 has commit msg modified) Special thanks to Björn for his efforts on testing and guiding the series! [1]: https://lore.kernel.org/lkml/20240306165904.108141-1-puranjay12@gmail.com/ [2]: https://lore.kernel.org/linux-riscv/20241127172908.17149-1-andybnac@gmail.com/ * patches from https://lore.kernel.org/r/20250407180838.42877-1-andybnac@gmail.com: riscv: Documentation: add a description about dynamic ftrace riscv: ftrace: support direct call using call_ops riscv: Implement HAVE_DYNAMIC_FTRACE_WITH_CALL_OPS riscv: ftrace: support PREEMPT riscv: add a data fence for CMODX in the kernel mode riscv: vector: Support calling schedule() for preemptible Vector riscv: ftrace: do not use stop_machine to update code riscv: ftrace: prepare ftrace for atomic code patching kernel: ftrace: export ftrace_sync_ipi riscv: ftrace: align patchable functions to 4 Byte boundary riscv: ftrace factor out code defined by !WITH_ARG riscv: ftrace: support fastcc in Clang for WITH_ARGS Link: https://lore.kernel.org/r/20250407180838.42877-1-andybnac@gmail.com Signed-off-by: Alexandre Ghiti commit c3cc2a4a3a23faf6b88459471c1c16ab3837cc2f Author: Alexandre Ghiti Date: Fri Mar 21 13:39:54 2025 +0100 riscv: Add support for PUD THP Add the necessary page table functions to deal with PUD THP, this enables the use of PUD pfnmap. Link: https://lore.kernel.org/r/20250321123954.225097-1-alexghiti@rivosinc.com Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit eb87e56d651d0a72009842bc0d8eeae7b605c97d Author: Guo Ren Date: Mon Apr 21 16:24:41 2025 +0200 riscv: xchg: Prefetch the destination word for sc.w The cost of changing a cacheline from shared to exclusive state can be significant, especially when this is triggered by an exclusive store, since it may result in having to retry the transaction. This patch makes use of prefetch.w to prefetch cachelines for write prior to lr/sc loops when using the xchg_small atomic routine. This patch is inspired by commit 0ea366f5e1b6 ("arm64: atomics: prefetch the destination word for write prior to stxr"). Signed-off-by: Guo Ren Signed-off-by: Guo Ren Link: https://lore.kernel.org/r/20231231082955.16516-4-guoren@kernel.org Tested-by: Andrea Parri Link: https://lore.kernel.org/r/20250421142441.395849-5-alexghiti@rivosinc.com Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit a5f947c73115efb6fb0d9579e71ce1ee5cf706aa Author: Guo Ren Date: Mon Apr 21 16:24:40 2025 +0200 riscv: Add ARCH_HAS_PREFETCH[W] support with Zicbop Enable Linux prefetch and prefetchw primitives using Zicbop. Signed-off-by: Guo Ren Signed-off-by: Guo Ren Link: https://lore.kernel.org/r/20231231082955.16516-3-guoren@kernel.org Tested-by: Andrea Parri Link: https://lore.kernel.org/r/20250421142441.395849-4-alexghiti@rivosinc.com Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit 8d496b5a989120c1bce1ad8eb48ebae0350722d7 Author: Alexandre Ghiti Date: Mon Apr 21 16:24:39 2025 +0200 riscv: Add support for Zicbop Zicbop introduces cache blocks prefetching instructions, add the necessary support for the kernel to use it in the coming commits. Co-developed-by: Guo Ren Signed-off-by: Guo Ren Tested-by: Andrea Parri Link: https://lore.kernel.org/r/20250421142441.395849-3-alexghiti@rivosinc.com Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit f0f4e64b9e3527c11dc6dcb005e577d661eb9ab5 Author: Alexandre Ghiti Date: Mon Apr 21 16:24:38 2025 +0200 riscv: Introduce Zicbop instructions The S-type instructions are first introduced and then used to define the encoding of the Zicbop prefetching instructions. Co-developed-by: Guo Ren Signed-off-by: Guo Ren Tested-by: Andrea Parri Link: https://lore.kernel.org/r/20250421142441.395849-2-alexghiti@rivosinc.com Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit 850d7b14c8f77407b7d2a1edeb83d3e36c46e7a8 Author: Yao Zi Date: Wed Mar 26 07:34:51 2025 +0000 riscv/kexec_file: Fix comment in purgatory relocator Apparently sec_base doesn't mean relocated symbol value, which seems a copy-pasting error in the comment. Assigned with the address of section indexed by sym->st_shndx, it should represent base address of the relevant section. Let's fix the comment to avoid possible confusion. Fixes: 838b3e28488f ("RISC-V: Load purgatory in kexec_file") Signed-off-by: Yao Zi Reviewed-by: Björn Töpel Link: https://lore.kernel.org/r/20250326073450.57648-2-ziyao@disroot.org Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit 809a11eea8e8c80491e3ba3a286af25409c072d5 Author: Song Shuai Date: Wed Apr 9 21:29:59 2025 +0200 riscv: kexec_file: Support loading Image binary file This patch creates image_kexec_ops to load Image binary file for kexec_file_load() syscall. Signed-off-by: Song Shuai Signed-off-by: Björn Töpel Link: https://lore.kernel.org/r/20250409193004.643839-3-bjorn@kernel.org Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit 1df45f8a9fea5a7513bd1bad98604ce1fbefcaaf Author: Song Shuai Date: Wed Apr 9 21:29:58 2025 +0200 riscv: kexec_file: Split the loading of kernel and others This is the preparative patch for kexec_file_load Image support. It separates the elf_kexec_load() as two parts: - the first part loads the vmlinux (or Image) - the second part loads other segments (e.g. initrd,fdt,purgatory) And the second part is exported as the load_extra_segments() function which would be used in both kexec-elf.c and kexec-image.c. No functional change intended. Signed-off-by: Song Shuai Signed-off-by: Björn Töpel Link: https://lore.kernel.org/r/20250409193004.643839-2-bjorn@kernel.org Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit d8ac85dad407f4cea65a970e9ba42201cb49686a Author: Andy Chiu Date: Tue Apr 8 02:08:36 2025 +0800 riscv: Documentation: add a description about dynamic ftrace Add a section in cmodx to describe how dynamic ftrace works on riscv, limitations, and assumptions. Signed-off-by: Andy Chiu Link: https://lore.kernel.org/r/20250407180838.42877-12-andybnac@gmail.com Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit b21cdb9523e5561b97fd534dbb75d132c5c938ff Author: Andy Chiu Date: Tue Apr 8 02:08:35 2025 +0800 riscv: ftrace: support direct call using call_ops jump to FTRACE_ADDR if distance is out of reach Co-developed-by: Björn Töpel Signed-off-by: Björn Töpel Signed-off-by: Andy Chiu Link: https://lore.kernel.org/r/20250407180838.42877-11-andybnac@gmail.com Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit c217157bcd1df434fdeaeb24b7c25ec31e15cf4a Author: Puranjay Mohan Date: Tue Apr 8 02:08:34 2025 +0800 riscv: Implement HAVE_DYNAMIC_FTRACE_WITH_CALL_OPS This patch enables support for DYNAMIC_FTRACE_WITH_CALL_OPS on RISC-V. This allows each ftrace callsite to provide an ftrace_ops to the common ftrace trampoline, allowing each callsite to invoke distinct tracer functions without the need to fall back to list processing or to allocate custom trampolines for each callsite. This significantly speeds up cases where multiple distinct trace functions are used and callsites are mostly traced by a single tracer. The idea and most of the implementation is taken from the ARM64's implementation of the same feature. The idea is to place a pointer to the ftrace_ops as a literal at a fixed offset from the function entry point, which can be recovered by the common ftrace trampoline. We use -fpatchable-function-entry to reserve 8 bytes above the function entry by emitting 2 4 byte or 4 2 byte nops depending on the presence of CONFIG_RISCV_ISA_C. These 8 bytes are patched at runtime with a pointer to the associated ftrace_ops for that callsite. Functions are aligned to 8 bytes to make sure that the accesses to this literal are atomic. This approach allows for directly invoking ftrace_ops::func even for ftrace_ops which are dynamically-allocated (or part of a module), without going via ftrace_ops_list_func. We've benchamrked this with the ftrace_ops sample module on Spacemit K1 Jupiter: Without this patch: baseline (Linux rivos 6.14.0-09584-g7d06015d936c #3 SMP Sat Mar 29 +-----------------------+-----------------+----------------------------+ | Number of tracers | Total time (ns) | Per-call average time | |-----------------------+-----------------+----------------------------| | Relevant | Irrelevant | 100000 calls | Total (ns) | Overhead (ns) | |----------+------------+-----------------+------------+---------------| | 0 | 0 | 1357958 | 13 | - | | 0 | 1 | 1302375 | 13 | - | | 0 | 2 | 1302375 | 13 | - | | 0 | 10 | 1379084 | 13 | - | | 0 | 100 | 1302458 | 13 | - | | 0 | 200 | 1302333 | 13 | - | |----------+------------+-----------------+------------+---------------| | 1 | 0 | 13677833 | 136 | 123 | | 1 | 1 | 18500916 | 185 | 172 | | 1 | 2 | 22856459 | 228 | 215 | | 1 | 10 | 58824709 | 588 | 575 | | 1 | 100 | 505141584 | 5051 | 5038 | | 1 | 200 | 1580473126 | 15804 | 15791 | |----------+------------+-----------------+------------+---------------| | 1 | 0 | 13561000 | 135 | 122 | | 2 | 0 | 19707292 | 197 | 184 | | 10 | 0 | 67774750 | 677 | 664 | | 100 | 0 | 714123125 | 7141 | 7128 | | 200 | 0 | 1918065668 | 19180 | 19167 | +----------+------------+-----------------+------------+---------------+ Note: per-call overhead is estimated relative to the baseline case with 0 relevant tracers and 0 irrelevant tracers. With this patch: v4-rc4 (Linux rivos 6.14.0-09598-gd75747611c93 #4 SMP Sat Mar 29 +-----------------------+-----------------+----------------------------+ | Number of tracers | Total time (ns) | Per-call average time | |-----------------------+-----------------+----------------------------| | Relevant | Irrelevant | 100000 calls | Total (ns) | Overhead (ns) | |----------+------------+-----------------+------------+---------------| | 0 | 0 | 1459917 | 14 | - | | 0 | 1 | 1408000 | 14 | - | | 0 | 2 | 1383792 | 13 | - | | 0 | 10 | 1430709 | 14 | - | | 0 | 100 | 1383791 | 13 | - | | 0 | 200 | 1383750 | 13 | - | |----------+------------+-----------------+------------+---------------| | 1 | 0 | 5238041 | 52 | 38 | | 1 | 1 | 5228542 | 52 | 38 | | 1 | 2 | 5325917 | 53 | 40 | | 1 | 10 | 5299667 | 52 | 38 | | 1 | 100 | 5245250 | 52 | 39 | | 1 | 200 | 5238459 | 52 | 39 | |----------+------------+-----------------+------------+---------------| | 1 | 0 | 5239083 | 52 | 38 | | 2 | 0 | 19449417 | 194 | 181 | | 10 | 0 | 67718584 | 677 | 663 | | 100 | 0 | 709840708 | 7098 | 7085 | | 200 | 0 | 2203580626 | 22035 | 22022 | +----------+------------+-----------------+------------+---------------+ Note: per-call overhead is estimated relative to the baseline case with 0 relevant tracers and 0 irrelevant tracers. As can be seen from the above: a) Whenever there is a single relevant tracer function associated with a tracee, the overhead of invoking the tracer is constant, and does not scale with the number of tracers which are *not* associated with that tracee. b) The overhead for a single relevant tracer has dropped to ~1/3 of the overhead prior to this series (from 122ns to 38ns). This is largely due to permitting calls to dynamically-allocated ftrace_ops without going through ftrace_ops_list_func. Signed-off-by: Puranjay Mohan [update kconfig, asm, refactor] Signed-off-by: Andy Chiu Tested-by: Björn Töpel Link: https://lore.kernel.org/r/20250407180838.42877-10-andybnac@gmail.com Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit d0262e907e2991ae09ca476281fc8cae3ec57850 Author: Andy Chiu Date: Tue Apr 8 02:08:33 2025 +0800 riscv: ftrace: support PREEMPT Now, we can safely enable dynamic ftrace with kernel preemption. Signed-off-by: Andy Chiu Reviewed-by: Björn Töpel Link: https://lore.kernel.org/r/20250407180838.42877-9-andybnac@gmail.com Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit ca358692de41b273468e625f96926fa53e13bd8c Author: Andy Chiu Date: Tue Apr 8 02:08:32 2025 +0800 riscv: add a data fence for CMODX in the kernel mode RISC-V spec explicitly calls out that a local fence.i is not enough for the code modification to be visble from a remote hart. In fact, it states: To make a store to instruction memory visible to all RISC-V harts, the writing hart also has to execute a data FENCE before requesting that all remote RISC-V harts execute a FENCE.I. Although current riscv drivers for IPI use ordered MMIO when sending IPIs in order to synchronize the action between previous csd writes, riscv does not restrict itself to any particular flavor of IPI. Any driver or firmware implementation that does not order data writes before the IPI may pose a risk for code-modifying race. Thus, add a fence here to order data writes before making the IPI. Signed-off-by: Andy Chiu Reviewed-by: Björn Töpel Link: https://lore.kernel.org/r/20250407180838.42877-8-andybnac@gmail.com Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit d1049fc0de81bca3abbb35e8d4b8794170498b78 Author: Andy Chiu Date: Tue Apr 8 02:08:31 2025 +0800 riscv: vector: Support calling schedule() for preemptible Vector Each function entry implies a call to ftrace infrastructure. And it may call into schedule in some cases. So, it is possible for preemptible kernel-mode Vector to implicitly call into schedule. Since all V-regs are caller-saved, it is possible to drop all V context when a thread voluntarily call schedule(). Besides, we currently don't pass argument through vector register, so we don't have to save/restore V-regs in ftrace trampoline. Signed-off-by: Andy Chiu Link: https://lore.kernel.org/r/20250407180838.42877-7-andybnac@gmail.com Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit 5aa4ef95588456df5a5563dd23892827f97fb14f Author: Andy Chiu Date: Tue Apr 8 02:08:30 2025 +0800 riscv: ftrace: do not use stop_machine to update code Now it is safe to remove dependency from stop_machine() for us to patch code in ftrace. Signed-off-by: Andy Chiu Link: https://lore.kernel.org/r/20250407180838.42877-6-andybnac@gmail.com Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit b2137c3b6d7a45622967aac78b46a4bd2cff6c42 Author: Andy Chiu Date: Tue Apr 8 02:08:29 2025 +0800 riscv: ftrace: prepare ftrace for atomic code patching We use an AUIPC+JALR pair to jump into a ftrace trampoline. Since instruction fetch can break down to 4 byte at a time, it is impossible to update two instructions without a race. In order to mitigate it, we initialize the patchable entry to AUIPC + NOP4. Then, the run-time code patching can change NOP4 to JALR to eable/disable ftrcae from a function. This limits the reach of each ftrace entry to +-2KB displacing from ftrace_caller. Starting from the trampoline, we add a level of indirection for it to reach ftrace caller target. Now, it loads the target address from a memory location, then perform the jump. This enable the kernel to update the target atomically. The new don't-stop-the-world text patching on change only one RISC-V instruction: | -8: &ftrace_ops of the associated tracer function. | : | 0: auipc t0, hi(ftrace_caller) | 4: jalr t0, lo(ftrace_caller) | | -8: &ftrace_nop_ops | : | 0: auipc t0, hi(ftrace_caller) | 4: nop This means that f+0x0 is fixed, and should not be claimed by ftrace, e.g. kprobe should be able to put a probe in f+0x0. Thus, we adjust the offset and MCOUNT_INSN_SIZE accordingly. [ alex: Fix build errors with !CONFIG_DYNAMIC_FTRACE ] Co-developed-by: Björn Töpel Signed-off-by: Björn Töpel Signed-off-by: Andy Chiu Link: https://lore.kernel.org/r/20250407180838.42877-5-andybnac@gmail.com Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit 500e626c4a5bf2fa7cc6f1cd6dd86c77b5b127f2 Author: Andy Chiu Date: Tue Apr 8 02:08:28 2025 +0800 kernel: ftrace: export ftrace_sync_ipi The following ftrace patch for riscv uses a data store to update ftrace function. Therefore, a romote fence is required to order it against function_trace_op updates. The mechanism is similar to the fence between function_trace_op and update_ftrace_func in the generic ftrace, so we leverage the same ftrace_sync_ipi function. [ alex: Fix build warning when !CONFIG_DYNAMIC_FTRACE ] Signed-off-by: Andy Chiu Link: https://lore.kernel.org/r/20250407180838.42877-4-andybnac@gmail.com Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit c41bf4326c7b0af3f7004235ac91551833ec95c6 Author: Andy Chiu Date: Tue Apr 8 02:08:27 2025 +0800 riscv: ftrace: align patchable functions to 4 Byte boundary We are changing ftrace code patching in order to remove dependency from stop_machine() and enable kernel preemption. This requires us to align functions entry at a 4-B align address. However, -falign-functions on older versions of GCC alone was not strong enoungh to align all functions. In fact, cold functions are not aligned after turning on optimizations. We consider this is a bug in GCC and turn off guess-branch-probility as a workaround to align all functions. GCC bug id: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88345 The option -fmin-function-alignment is able to align all functions properly on newer versions of gcc. So, we add a cc-option to test if the toolchain supports it. Suggested-by: Evgenii Shatokhin Signed-off-by: Andy Chiu Reviewed-by: Björn Töpel Link: https://lore.kernel.org/r/20250407180838.42877-3-andybnac@gmail.com Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit 54ecbc8d857122b32a98fe204cb61a06aabc063d Author: Andy Chiu Date: Tue Apr 8 02:08:26 2025 +0800 riscv: ftrace factor out code defined by !WITH_ARG DYNAMIC_FTRACE selects DYNAMIC_FTRACE_WITH_ARGS and mcount-dyn.S in riscv, so we can remove ifdef jargons of WITH_ARG when it is known that DYNAMIC_FTRACE is true. Signed-off-by: Andy Chiu Link: https://lore.kernel.org/r/20250407180838.42877-2-andybnac@gmail.com Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit f8693f6dffcd1865da7f5f4c3df1de445e519bec Author: Andy Chiu Date: Tue Apr 8 02:08:25 2025 +0800 riscv: ftrace: support fastcc in Clang for WITH_ARGS Some caller-saved registers which are not defined as function arguments in the ABI can still be passed as arguments when the kernel is compiled with Clang. As a result, we must save and restore those registers to prevent ftrace from clobbering them. - [1]: https://reviews.llvm.org/D68559 Reported-by: Evgenii Shatokhin Closes: https://lore.kernel.org/linux-riscv/7e7c7914-445d-426d-89a0-59a9199c45b1@yadro.com/ Fixes: 7caa9765465f ("ftrace: riscv: move from REGS to ARGS") Acked-by: Nathan Chancellor Reviewed-by: Björn Töpel Signed-off-by: Andy Chiu Tested-by: Björn Töpel Link: https://lore.kernel.org/r/20250407180838.42877-1-andybnac@gmail.com Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit 7c7c5cb5b5bf9d8ccc6a51b28687c9e7ff7f1890 Author: Maciej Patelczyk Date: Fri May 30 15:56:27 2025 +0200 drm/xe: remove unmatched xe_vm_unlock() from __xe_exec_queue_init() There is unmatched xe_vm_unlock() in the __xe_exec_queue_init(). Leftover from commit fbeaad071a98 ("drm/xe: Create LRC BO without VM") Fixes: 2b0a0ce0c20b ("drm/xe: Create LRC BO without VM") Signed-off-by: Maciej Patelczyk Reviewed-by: Jonathan Cavitt Reviewed-by: Matthew Brost Signed-off-by: Niranjana Vishwanathapura Link: https://lore.kernel.org/r/20250530135627.2821612-1-maciej.patelczyk@intel.com (cherry picked from commit 28b996ce73982a44fa86736ca0e3684cb1ae8b24) Signed-off-by: Thomas Hellström commit 2b0a0ce0c20bbedf83f78ba5926f6cae7470cd38 Author: Niranjana Vishwanathapura Date: Wed May 28 22:20:32 2025 -0700 drm/xe: Create LRC BO without VM Specifying VM during lrc->bo creation requires VM's reference to be held for the lifetime of lrc->bo as it will use VM's dma reservation object. Using VM's dma reservation object for lrc->bo doesn't provide any advantage. Hence do not pass VM while creating lrc->bo. v2: Use xe_bo_unpin_map_no_vm (Matthew Brost) Fixes: 264eecdba211 ("drm/xe: Decouple xe_exec_queue and xe_lrc") Signed-off-by: Niranjana Vishwanathapura Reviewed-by: Matthew Brost Reviewed-by: Maarten Lankhorst Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250529052031.2429120-2-niranjana.vishwanathapura@intel.com (cherry picked from commit fbeaad071a98fef87deccee81d564de1c8e8e16d) Signed-off-by: Thomas Hellström commit 2e824747cfbdf1fba88df5e5800d284b2602ae8f Author: Matthew Auld Date: Tue Jun 3 18:42:14 2025 +0100 drm/xe/guc_submit: add back fix Daniele noticed that the fix in commit 2d2be279f1ca ("drm/xe: fix UAF around queue destruction") looks to have been unintentionally removed as part of handling a conflict in some past merge commit. Add it back. Fixes: ac44ff7cec33 ("Merge tag 'drm-xe-fixes-2024-10-10' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes") Reported-by: Daniele Ceraolo Spurio Signed-off-by: Matthew Auld Cc: Matthew Brost Cc: # v6.12+ Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250603174213.1543579-2-matthew.auld@intel.com (cherry picked from commit 9d9fca62dc49d96f97045b6d8e7402a95f8cf92a) Signed-off-by: Thomas Hellström commit 69a58ef4fa77759b0e0c2f79834fa51b00a50c0b Author: Daniele Ceraolo Spurio Date: Thu May 22 15:54:04 2025 -0700 drm/xe/pxp: Clarify PXP queue creation behavior if PXP is not ready The expected flow of operations when using PXP is to query the PXP status and wait for it to transition to "ready" before attempting to create an exec_queue. This flow is followed by the Mesa driver, but there is no guarantee that an incorrectly coded (or malicious) app will not attempt to create the queue first without querying the status. Therefore, we need to clarify what the expected behavior of the queue creation ioctl is in this scenario. Currently, the ioctl always fails with an -EBUSY code no matter the error, but for consistency it is better to distinguish between "failed to init" (-EIO) and "not ready" (-EBUSY), the same way the query ioctl does. Note that, while this is a change in the return code of an ioctl, the behavior of the ioctl in this particular corner case was not clearly spec'd, so no one should have been relying on it (and we know that Mesa, which is the only known userspace for this, didn't). v2: Minor rework of the doc (Rodrigo) Fixes: 72d479601d67 ("drm/xe/pxp/uapi: Add userspace and LRC support for PXP-using queues") Signed-off-by: Daniele Ceraolo Spurio Cc: John Harrison Cc: José Roberto de Souza Reviewed-by: José Roberto de Souza Reviewed-by: John Harrison Acked-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250522225401.3953243-7-daniele.ceraolospurio@intel.com (cherry picked from commit 21784ca96025b62d95b670b7639ad70ddafa69b8) Signed-off-by: Thomas Hellström commit 6bf4d5649230ca65725ec4793333fb5eba18d646 Author: Daniele Ceraolo Spurio Date: Thu May 22 15:54:03 2025 -0700 drm/xe/pxp: Use the correct define in the set_property_funcs array The define of the extension type was accidentally used instead of the one of the property itself. They're both zero, so no functional issue, but we should use the correct define for code correctness. Fixes: 41a97c4a1294 ("drm/xe/pxp/uapi: Add API to mark a BO as using PXP") Signed-off-by: Daniele Ceraolo Spurio Cc: John Harrison Reviewed-by: John Harrison Link: https://lore.kernel.org/r/20250522225401.3953243-6-daniele.ceraolospurio@intel.com (cherry picked from commit 1d891ee820fd0fbb4101eacb0d922b5050a24933) Signed-off-by: Thomas Hellström commit 0ee54d5cacc0276ec631ac149825a24b59c51c38 Author: Matthew Auld Date: Wed May 28 12:33:29 2025 +0100 drm/xe/sched: stop re-submitting signalled jobs Customer is reporting a really subtle issue where we get random DMAR faults, hangs and other nasties for kernel migration jobs when stressing stuff like s2idle/s3/s4. The explosions seems to happen somewhere after resuming the system with splats looking something like: PM: suspend exit rfkill: input handler disabled xe 0000:00:02.0: [drm] GT0: Engine reset: engine_class=bcs, logical_mask: 0x2, guc_id=0 xe 0000:00:02.0: [drm] GT0: Timedout job: seqno=24496, lrc_seqno=24496, guc_id=0, flags=0x13 in no process [-1] xe 0000:00:02.0: [drm] GT0: Kernel-submitted job timed out The likely cause appears to be a race between suspend cancelling the worker that processes the free_job()'s, such that we still have pending jobs to be freed after the cancel. Following from this, on resume the pending_list will now contain at least one already complete job, but it looks like we call drm_sched_resubmit_jobs(), which will then call run_job() on everything still on the pending_list. But if the job was already complete, then all the resources tied to the job, like the bb itself, any memory that is being accessed, the iommu mappings etc. might be long gone since those are usually tied to the fence signalling. This scenario can be seen in ftrace when running a slightly modified xe_pm IGT (kernel was only modified to inject artificial latency into free_job to make the race easier to hit): xe_sched_job_run: dev=0000:00:02.0, fence=0xffff888276cc8540, seqno=0, lrc_seqno=0, gt=0, guc_id=0, batch_addr=0x000000146910 ... xe_exec_queue_stop: dev=0000:00:02.0, 3:0x2, gt=0, width=1, guc_id=0, guc_state=0x0, flags=0x13 xe_exec_queue_stop: dev=0000:00:02.0, 3:0x2, gt=0, width=1, guc_id=1, guc_state=0x0, flags=0x4 xe_exec_queue_stop: dev=0000:00:02.0, 4:0x1, gt=1, width=1, guc_id=0, guc_state=0x0, flags=0x3 xe_exec_queue_stop: dev=0000:00:02.0, 1:0x1, gt=1, width=1, guc_id=1, guc_state=0x0, flags=0x3 xe_exec_queue_stop: dev=0000:00:02.0, 4:0x1, gt=1, width=1, guc_id=2, guc_state=0x0, flags=0x3 xe_exec_queue_resubmit: dev=0000:00:02.0, 3:0x2, gt=0, width=1, guc_id=0, guc_state=0x0, flags=0x13 xe_sched_job_run: dev=0000:00:02.0, fence=0xffff888276cc8540, seqno=0, lrc_seqno=0, gt=0, guc_id=0, batch_addr=0x000000146910 ... ..... xe_exec_queue_memory_cat_error: dev=0000:00:02.0, 3:0x2, gt=0, width=1, guc_id=0, guc_state=0x3, flags=0x13 So the job_run() is clearly triggered twice for the same job, even though the first must have already signalled to completion during suspend. We can also see a CAT error after the re-submit. To prevent this only resubmit jobs on the pending_list that have not yet signalled. v2: - Make sure to re-arm the fence callbacks with sched_start(). v3 (Matt B): - Stop using drm_sched_resubmit_jobs(), which appears to be deprecated and just open-code a simple loop such that we skip calling run_job() on anything already signalled. Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4856 Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Matthew Auld Cc: Thomas Hellström Cc: Matthew Brost Cc: William Tseng Cc: # v6.8+ Reviewed-by: Matthew Brost Reviewed-by: Tejas Upadhyay Link: https://lore.kernel.org/r/20250528113328.289392-2-matthew.auld@intel.com (cherry picked from commit 38fafa9f392f3110d2de431432d43f4eef99cd1b) Signed-off-by: Thomas Hellström commit 5cc3325584c425069c1c3355c775314d64bf8770 Author: Thomas Hellström Date: Wed May 28 18:41:05 2025 +0200 drm/xe: Rework eviction rejection of bound external bos For preempt_fence mode VM's we're rejecting eviction of shared bos during VM_BIND. However, since we do this in the move() callback, we're getting an eviction failure warning from TTM. The TTM callback intended for these things is eviction_valuable(). However, the latter doesn't pass in the struct ttm_operation_ctx needed to determine whether the caller needs this. Instead, attach the needed information to the vm under the vm->resv, until we've been able to update TTM to provide the needed information. And add sufficient lockdep checks to prevent misuse and races. v2: - Fix a copy-paste error in xe_vm_clear_validating() v3: - Fix kerneldoc errors. Signed-off-by: Thomas Hellström Fixes: 0af944f0e308 ("drm/xe: Reject BO eviction if BO is bound to current VM") Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250528164105.234718-1-thomas.hellstrom@linux.intel.com (cherry picked from commit 9d5558649f68e2e84a87a909631b30e15ca0f8ec) Signed-off-by: Thomas Hellström commit 2182f358fb138f81a586ffdddd510f2a4fc61702 Author: Arnd Bergmann Date: Thu May 29 10:23:56 2025 -0700 drm/xe/vsec: fix CONFIG_INTEL_VSEC dependency The XE driver can be built with or without VSEC support, but fails to link as built-in if vsec is in a loadable module: x86_64-linux-ld: vmlinux.o: in function `xe_vsec_init': (.text+0x1e83e16): undefined reference to `intel_vsec_register' The normal fix for this is to add a 'depends on INTEL_VSEC || !INTEL_VSEC', forcing XE to be a loadable module as well, but that causes a circular dependency: symbol DRM_XE depends on INTEL_VSEC symbol INTEL_VSEC depends on X86_PLATFORM_DEVICES symbol X86_PLATFORM_DEVICES is selected by DRM_XE The problem here is selecting a symbol from another subsystem, so change that as well and rephrase the 'select' into the corresponding dependency. Since X86_PLATFORM_DEVICES is 'default y', there is no change to defconfig builds here. Fixes: 0c45e76fcc62 ("drm/xe/vsec: Support BMG devices") Signed-off-by: Arnd Bergmann Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250529172355.2395634-2-lucas.demarchi@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit e4931f8be347ec5f19df4d6d33aea37145378c42) Signed-off-by: Thomas Hellström commit 94110827925a2512e480176b3002e08105f98d66 Author: Raag Jadav Date: Thu May 29 21:39:37 2025 +0530 drm/xe: drop redundant conversion to bool The result of integer comparison already evaluates to bool. No need for explicit conversion. No functional impact. Fixes: 0e414bf7ad01 ("drm/xe: Expose PCIe link downgrade attributes") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202505292205.MoljmkjQ-lkp@intel.com/ Signed-off-by: Raag Jadav Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250529160937.490147-1-raag.jadav@intel.com Signed-off-by: Rodrigo Vivi (cherry picked from commit 61761a6b57f2818983466d24aab60baab471ba21) Signed-off-by: Thomas Hellström commit b885ae2e9db3dba8e9b3bc4df36744f22455d889 Author: Karthik Poosa Date: Thu May 29 22:04:54 2025 +0530 drm/xe/hwmon: Move card reactive critical power under channel card Move power2/curr2_crit to channel 1 i.e power1/curr1_crit as this represents the entire card critical power/current. v2: Update the date of curr1_crit also in hwmon documentation. Signed-off-by: Karthik Poosa Fixes: 345dadc4f68b ("drm/xe/hwmon: Add infra to support card power and energy attributes") Reviewed-by: Badal Nilawar Link: https://lore.kernel.org/r/20250529163458.2354509-3-karthik.poosa@intel.com Signed-off-by: Rodrigo Vivi (cherry picked from commit 25e963a09e059ffdb15c09cc79cfded855b43668) Signed-off-by: Thomas Hellström commit 25a2aa779fc39c4559a5bde0f841d2cd4cbc4d66 Author: Karthik Poosa Date: Thu May 29 22:04:53 2025 +0530 drm/xe/hwmon: Add support to manage power limits though mailbox Add support to manage power limits using pcode mailbox commands for supported platforms. v2: - Address review comments. (Badal) - Use mailbox commands instead of registers to manage power limits for BMG. - Clamp the maximum power limit to GPU firmware default value. v3: - Clamp power limit in write also for platforms with mailbox support. v4: - Remove unnecessary debug prints. (Badal) v5: - Update description of variable pl1_on_boot to fix kernel-doc error. v6: - Improve commit message, refer to BIOS as GPU firmware. - Change macro READ_PL_FROM_BIOS to READ_PL_FROM_FW. - Rectify drm_warn to drm_info. Signed-off-by: Karthik Poosa Fixes: e90f7a58e659 ("drm/xe/hwmon: Add HWMON support for BMG") Reviewed-by: Badal Nilawar Link: https://lore.kernel.org/r/20250529163458.2354509-2-karthik.poosa@intel.com Signed-off-by: Rodrigo Vivi (cherry picked from commit 7596d839f6228757fe17a810da2d1c5f3305078c) Signed-off-by: Thomas Hellström commit 8cf8cde41ad01150afbd1327ad1942387787f7fd Author: Matthew Auld Date: Wed May 14 16:24:26 2025 +0100 drm/xe/vm: move xe_svm_init() earlier In xe_vm_close_and_put() we need to be able to call xe_svm_fini(), however during vm creation we can call this on the error path, before having actually initialised the svm state, leading to various splats followed by a fatal NPD. Fixes: 6fd979c2f331 ("drm/xe: Add SVM init / close / fini to faulting VMs") Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4967 Signed-off-by: Matthew Auld Cc: Matthew Brost Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250514152424.149591-4-matthew.auld@intel.com (cherry picked from commit 4f296d77cf49fcb5f90b4674123ad7f3a0676165) Signed-off-by: Thomas Hellström commit a63e99b4d6d3a0353ef47146dd5bd562f08e1786 Author: Matthew Auld Date: Wed May 14 16:24:25 2025 +0100 drm/xe/vm: move rebind_work init earlier In xe_vm_close_and_put() we need to be able to call flush_work(rebind_work), however during vm creation we can call this on the error path, before having actually set up the worker, leading to a splat from flush_work(). It looks like we can simply move the worker init step earlier to fix this. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Matthew Auld Cc: Matthew Brost Cc: # v6.8+ Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250514152424.149591-3-matthew.auld@intel.com (cherry picked from commit 96af397aa1a2d1032a6e28ff3f4bc0ab4be40e1d) Signed-off-by: Thomas Hellström commit 7fdaba912981e6fe7585517ccf3b5da59e17592e Merge: bfdf35c5dc6267 3d8b44b104fb5f Author: Linus Torvalds Date: Thu Jun 5 08:54:47 2025 -0700 Merge tag 'rtc-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC updates from Alexandre Belloni: "There are two new drivers this cycle. There is also support for a negative offset for RTCs that have been shipped with a date set using an epoch that is before 1970. This unfortunately happens with some products that ship with a vendor kernel and an out of tree driver. Core: - support negative offsets for RTCs that have shipped with an epoch earlier than 1970 New drivers: - NXP S32G2/S32G3 - Sophgo CV1800 Drivers: - loongson: fix missing alarm notifications for ACPI - m41t80: kickstart ocillator upon failure - mt6359: mt6357 support - pcf8563: fix wrong alarm register - sh: cleanups" * tag 'rtc-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (39 commits) rtc: mt6359: Add mt6357 support rtc: test: Test date conversion for dates starting in 1900 rtc: test: Also test time and wday outcome of rtc_time64_to_tm() rtc: test: Emit the seconds-since-1970 value instead of days-since-1970 rtc: Fix offset calculation for .start_secs < 0 rtc: Make rtc_time64_to_tm() support dates before 1970 rtc: pcf8563: fix wrong alarm register rtc: rzn1: support input frequencies other than 32768Hz rtc: rzn1: Disable controller before initialization dt-bindings: rtc: rzn1: add optional second clock rtc: m41t80: reduce verbosity rtc: m41t80: kickstart ocillator upon failure rtc: s32g: add NXP S32G2/S32G3 SoC support dt-bindings: rtc: add schema for NXP S32G2/S32G3 SoCs dt-bindings: at91rm9260-rtt: add microchip,sama7d65-rtt dt-bindings: rtc: at91rm9200: add microchip,sama7d65-rtc rtc: loongson: Add missing alarm notifications for ACPI RTC events rtc: sophgo: add rtc support for Sophgo CV1800 SoC rtc: stm32: drop unused module alias rtc: s3c: drop unused module alias ... commit f670b50ef5e4a69bf4d2ec5ac6a9228d93b13a7a Author: Thomas Zimmermann Date: Tue Jun 3 17:48:20 2025 +0200 sysfb: Fix screen_info type check for VGA Use the helper screen_info_video_type() to get the framebuffer type from struct screen_info. Handle supported values in sorted switch statement. Reading orig_video_isVGA is unreliable. On most systems it is a VIDEO_TYPE_ constant. On some systems with VGA it is simply set to 1 to signal the presence of a VGA output. See vga_probe() for an example. Retrieving the screen_info type with the helper screen_info_video_type() detects these cases and returns the appropriate VIDEO_TYPE_ constant. For VGA, sysfb creates a device named "vga-framebuffer". The sysfb code has been taken from vga16fb, where it likely didn't work correctly either. With this bugfix applied, vga16fb loads for compatible vga-framebuffer devices. Fixes: 0db5b61e0dc0 ("fbdev/vga16fb: Create EGA/VGA devices in sysfb code") Cc: Thomas Zimmermann Cc: Javier Martinez Canillas Cc: Alex Deucher Cc: Tzung-Bi Shih Cc: Helge Deller Cc: "Uwe Kleine-König" Cc: Zsolt Kajtar Cc: # v6.1+ Signed-off-by: Thomas Zimmermann Reviewed-by: Tzung-Bi Shih Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20250603154838.401882-1-tzimmermann@suse.de commit 2f29b5c231011b94007d2c8a6d793992f2275db1 Author: Thomas Zimmermann Date: Wed May 28 10:02:08 2025 +0200 video: screen_info: Relocate framebuffers behind PCI bridges Apply PCI host-bridge window offsets to screen_info framebuffers. Fixes invalid access to I/O memory. Resources behind a PCI host bridge can be relocated by a certain offset in the kernel's CPU address range used for I/O. The framebuffer memory range stored in screen_info refers to the CPU addresses as seen during boot (where the offset is 0). During boot up, firmware may assign a different memory offset to the PCI host bridge and thereby relocating the framebuffer address of the PCI graphics device as seen by the kernel. The information in screen_info must be updated as well. The helper pcibios_bus_to_resource() performs the relocation of the screen_info's framebuffer resource (given in PCI bus addresses). The result matches the I/O-memory resource of the PCI graphics device (given in CPU addresses). As before, we store away the information necessary to later update the information in screen_info itself. Commit 78aa89d1dfba ("firmware/sysfb: Update screen_info for relocated EFI framebuffers") added the code for updating screen_info. It is based on similar functionality that pre-existed in efifb. Efifb uses a pointer to the PCI resource, while the newer code does a memcpy of the region. Hence efifb sees any updates to the PCI resource and avoids the issue. v3: - Only use struct pci_bus_region for PCI bus addresses (Bjorn) - Clarify address semantics in commit messages and comments (Bjorn) v2: - Fixed tags (Takashi, Ivan) - Updated information on efifb Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Reported-by: "Ivan T. Ivanov" Closes: https://bugzilla.suse.com/show_bug.cgi?id=1240696 Tested-by: "Ivan T. Ivanov" Fixes: 78aa89d1dfba ("firmware/sysfb: Update screen_info for relocated EFI framebuffers") Cc: dri-devel@lists.freedesktop.org Cc: # v6.9+ Link: https://lore.kernel.org/r/20250528080234.7380-1-tzimmermann@suse.de commit bfdf35c5dc6267f70f76abddfacface4dd3b9ac0 Merge: d12ed2b7e1fe5c 3c018bf5a0ee3a Author: Linus Torvalds Date: Thu Jun 5 08:49:30 2025 -0700 Merge tag 'dmaengine-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine updates from Vinod Koul: "A fairly small update for the dmaengine subsystem. This has a new ARM dmaengine driver and couple of new device support and few driver changes: New support: - Renesas RZ/V2H(P) dma support for r9a09g057 - Arm DMA-350 driver - Tegra Tegra264 ADMA support Updates: - AMD ptdma driver code removal and optimizations - Freescale edma error interrupt handler support" * tag 'dmaengine-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (27 commits) dmaengine: idxd: Remove unused pointer and macro arm64: dts: renesas: r9a09g057: Add DMAC nodes dmaengine: sh: rz-dmac: Add RZ/V2H(P) support dmaengine: sh: rz-dmac: Allow for multiple DMACs irqchip/renesas-rzv2h: Add rzv2h_icu_register_dma_req() dt-bindings: dma: rz-dmac: Document RZ/V2H(P) family of SoCs dt-bindings: dma: rz-dmac: Restrict properties for RZ/A1H dmaengine: idxd: Narrow the restriction on BATCH to ver. 1 only dmaengine: ti: Add NULL check in udma_probe() fsldma: Set correct dma_mask based on hw capability dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using dmaengine: xilinx_dma: Set dma_device directions dmaengine: tegra210-adma: Add Tegra264 support dt-bindings: Document Tegra264 ADMA support dmaengine: dw-edma: Add HDMA NATIVE map check dmaegnine: fsl-edma: add edma error interrupt handler dt-bindings: dma: fsl-edma: increase maxItems of interrupts and interrupt-names dmaengine: ARM_DMA350 should depend on ARM/ARM64 dt-bindings: dma: qcom,bam: Document dma-coherent property dmaengine: Add Arm DMA-350 driver ... commit 8e9d6efccdd728fb1193e4faada45dff03773608 Author: Steve French Date: Tue Jun 3 23:21:09 2025 -0500 cifs: update internal version number to 2.55 Signed-off-by: Steve French commit e889a450a661281847517ee64ef8219b05972347 Author: Paulo Alcantara Date: Thu Jun 5 10:22:16 2025 -0300 MAINTAINERS, mailmap: Update Paulo Alcantara's email address Update my email address in MAINTAINERS and .mailmap files. Signed-off-by: Paulo Alcantara Signed-off-by: Steve French commit 1c6bbc45d856ac86be9c18194a8c5b7c56e41ebd Author: Meetakshi Setiya Date: Tue Jun 3 00:06:28 2025 -0400 cifs: add documentation for smbdirect setup Document steps to use SMB over RDMA using the linux SMB client and KSMBD server Signed-off-by: Meetakshi Setiya Signed-off-by: Steve French commit d12ed2b7e1fe5c9e4a372a95fb7635a7f81eff6a Merge: a479ebb269bc0c 0c22287319741b Author: Linus Torvalds Date: Thu Jun 5 08:20:21 2025 -0700 Merge tag 'phy-for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy Pull phy updates from Vinod Koul: "As usual featuring couple of new driver and bunch of new device support and some driver changes to Freescale, rockchip driver along with couple of yaml binding conversions. New Support: - Qualcomm IPQ5424 qusb2 support, IPQ5018 uniphy-pcie driver - Rockchip usb2 support for RK3562, RK3036 usb2 phy support - Samsung exynos2200 eusb2 phy support and driver refactoring for this support, exynos7870 USBDRD support - Mediatek MT7988 xs-phy support - Broadcom BCM74110 usb phy support - Renesas RZ/V2H(P) usb2 phy support Updates: - Freescale phy rate claculation updates, i.MX95 tuning support - Better error handling for amlogic pcie phy - Rockchip color depth configuration and management support - Yaml binding conversion for RK3399 Type-C and PCIe Phy" * tag 'phy-for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: (77 commits) phy: tegra: p2u: Broaden architecture dependency phy: rockchip: inno-usb2: Add usb2 phy support for rk3562 dt-bindings: phy: rockchip,inno-usb2phy: add rk3562 phy: rockchip: inno-usb2: add phy definition for rk3036 dt-bindings: phy: rockchip,inno-usb2phy: add rk3036 compatible phy: freescale: fsl-samsung-hdmi: Improve LUT search for best clock phy: freescale: fsl-samsung-hdmi: Refactor finding PHY settings phy: freescale: fsl-samsung-hdmi: Rename phy_clk_round_rate phy: renesas: phy-rcar-gen3-usb2: Add USB2.0 PHY support for RZ/V2H(P) phy: renesas: phy-rcar-gen3-usb2: Sort compatible entries by SoC part number dt-bindings: phy: renesas,usb2-phy: Document RZ/V2H(P) SoC dt-bindings: phy: renesas,usb2-phy: Add clock constraint for RZ/G2L family phy: exynos5-usbdrd: support Exynos USBDRD 3.2 4nm controller phy: phy-snps-eusb2: add support for exynos2200 phy: phy-snps-eusb2: refactor reference clock init phy: phy-snps-eusb2: make reset control optional phy: phy-snps-eusb2: make repeater optional phy: phy-snps-eusb2: split phy init code phy: phy-snps-eusb2: refactor constructs names phy: move phy-qcom-snps-eusb2 out of its vendor sub-directory ... commit a479ebb269bc0c4d286f0413b92f92808e053b79 Merge: ec7714e4947909 62ada17a6217a5 Author: Linus Torvalds Date: Thu Jun 5 08:07:24 2025 -0700 Merge tag 'soundwire-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire Pull soundwire updates from Vinod Koul: "A couple of small core changes and an Intel driver change: - sdw_assign_device_num() logic simplification, using internal slave id for irqs and optimizing computing of port params in specific stream states - Intel driver updates for ACE3+ microphone privacy status reporting and enabling the status in HDA Intel driver" * tag 'soundwire-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: soundwire: only compute port params in specific stream states ASoC: SOF: Intel: hda: Set the mic_privacy flag for soundwire with ACE3+ soundwire: intel: Add awareness of ACE3+ microphone privacy soundwire: bus: Add internal slave ID and use for IRQs soundwire: bus: Simplify sdw_assign_device_num() commit 3cae906e1a6184cdc9e4d260e4dbdf9a118d94ad Author: Eric Dumazet Date: Wed Jun 4 13:38:26 2025 +0000 calipso: unlock rcu before returning -EAFNOSUPPORT syzbot reported that a recent patch forgot to unlock rcu in the error path. Adopt the convention that netlbl_conn_setattr() is already using. Fixes: 6e9f2df1c550 ("calipso: Don't call calipso functions for AF_INET sk.") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Kuniyuki Iwashima Acked-by: Paul Moore Link: https://patch.msgid.link/20250604133826.1667664-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 7632fedb266d93ed0ed9f487133e6c6314a9b2d1 Author: Ido Schimmel Date: Wed Jun 4 14:32:52 2025 +0300 seg6: Fix validation of nexthop addresses The kernel currently validates that the length of the provided nexthop address does not exceed the specified length. This can lead to the kernel reading uninitialized memory if user space provided a shorter length than the specified one. Fix by validating that the provided length exactly matches the specified one. Fixes: d1df6fd8a1d2 ("ipv6: sr: define core operations for seg6local lightweight tunnel") Reviewed-by: Petr Machata Signed-off-by: Ido Schimmel Reviewed-by: David Ahern Link: https://patch.msgid.link/20250604113252.371528-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit feafc73f3e6ae73371777a037d41d2e31c929636 Author: Eric Dumazet Date: Wed Jun 4 10:58:15 2025 +0000 net: prevent a NULL deref in rtnl_create_link() At the time rtnl_create_link() is running, dev->netdev_ops is NULL, we must not use netdev_lock_ops() or risk a NULL deref if CONFIG_NET_SHAPER is defined. Use netif_set_group() instead of dev_set_group(). RIP: 0010:netdev_need_ops_lock include/net/netdev_lock.h:33 [inline] RIP: 0010:netdev_lock_ops include/net/netdev_lock.h:41 [inline] RIP: 0010:dev_set_group+0xc0/0x230 net/core/dev_api.c:82 Call Trace: rtnl_create_link+0x748/0xd10 net/core/rtnetlink.c:3674 rtnl_newlink_create+0x25c/0xb00 net/core/rtnetlink.c:3813 __rtnl_newlink net/core/rtnetlink.c:3940 [inline] rtnl_newlink+0x16d6/0x1c70 net/core/rtnetlink.c:4055 rtnetlink_rcv_msg+0x7cf/0xb70 net/core/rtnetlink.c:6944 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2534 netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] netlink_unicast+0x75b/0x8d0 net/netlink/af_netlink.c:1339 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1883 sock_sendmsg_nosec net/socket.c:712 [inline] Reported-by: syzbot+9fc858ba0312b42b577e@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6840265f.a00a0220.d4325.0009.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Fixes: 7e4d784f5810 ("net: hold netdev instance lock during rtnetlink operations") Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250604105815.1516973-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 535caaca921c653b1f9838fbd5c4e9494cafc3d9 Author: Eric Dumazet Date: Wed Jun 4 09:39:28 2025 +0000 net: annotate data-races around cleanup_net_task from_cleanup_net() reads cleanup_net_task locklessly. Add READ_ONCE()/WRITE_ONCE() annotations to avoid a potential KCSAN warning, even if the race is harmless. Fixes: 0734d7c3d93c ("net: expedite synchronize_net() for cleanup_net()") Signed-off-by: Eric Dumazet Reviewed-by: Jason Xing Link: https://patch.msgid.link/20250604093928.1323333-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit e6854be4d80ea266a7be64a65a0322bcdfa72807 Author: Jakub Kicinski Date: Tue Jun 3 18:20:55 2025 -0700 selftests: drv-net: tso: make bkg() wait for socat to quit Commit 846742f7e32f ("selftests: drv-net: add a warning for bkg + shell + terminate") added a warning for bkg() used with terminate=True. The tso test was missed as we didn't have it running anywhere in NIPA. Add exit_wait=True, to avoid: # Warning: combining shell and terminate is risky! # SIGTERM may not reach the child on zsh/ksh! getting printed twice for every variant. Fixes: 0d0f4174f6c8 ("selftests: drv-net: add a simple TSO test") Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250604012055.891431-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit c68804c934e3197e34560744854c57cf88dff8e7 Author: Jakub Kicinski Date: Tue Jun 3 18:20:31 2025 -0700 selftests: drv-net: tso: fix the GRE device name The device type for IPv4 GRE is "gre" not "ipgre", unlike for IPv6 which uses "ip6gre". Not sure how I missed this when writing the test, perhaps because all HW I have access to is on an IPv6-only network. Fixes: 0d0f4174f6c8 ("selftests: drv-net: add a simple TSO test") Reviewed-by: Simon Horman Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250604012031.891242-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 7eb6b63aa3c3b406512db15943ce9eb114095b51 Author: Jakub Kicinski Date: Tue Jun 3 17:16:52 2025 -0700 selftests: drv-net: add configs for the TSO test Add missing config options for the tso.py test, specifically to make sure the kernel is built with vxlan and gre tunnels. I noticed this while adding a TSO-capable device QEMU to the CI. Previously we only run virtio tests and it doesn't report LSO stats on the QEMU we have. Fixes: 0d0f4174f6c8 ("selftests: drv-net: add a simple TSO test") Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250604001653.853008-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 4bbe2e570f454ca1765d4e45b9b8266c4e65c581 Merge: db9ae3b6b43c79 120f28a6f314fe Author: Jakub Kicinski Date: Thu Jun 5 07:59:31 2025 -0700 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== iavf: get rid of the crit lock Przemek Kitszel says: Fix some deadlocks in iavf, and make it less error prone for the future. Patch 1 is simple and independent from the rest. Patches 2, 3, 4 are strictly a refactor, but it enables the last patch to be much smaller. (Technically Jake given his RB tags not knowing I will send it to -net). Patch 5 just adds annotations, this also helps prove last patch to be correct. Patch 6 removes the crit lock, with its unusual try_lock()s. I have more refactoring for scheduling done for -next, to be sent soon. There is a simple test: add VF; decrease number of queueus; remove VF that was way too hard to pass without this series :) * '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: iavf: get rid of the crit lock iavf: sprinkle netdev_assert_locked() annotations iavf: extract iavf_watchdog_step() out of iavf_watchdog_task() iavf: simplify watchdog_task in terms of adminq task scheduling iavf: centralize watchdog requeueing itself iavf: iavf_suspend(): take RTNL before netdev_lock() ==================== Link: https://patch.msgid.link/20250603171710.2336151-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit db9ae3b6b43c79b1ba87eea849fd65efa05b4b2e Author: Mirco Barone Date: Thu Jun 5 14:06:16 2025 +0200 wireguard: device: enable threaded NAPI Enable threaded NAPI by default for WireGuard devices in response to low performance behavior that we observed when multiple tunnels (and thus multiple wg devices) are deployed on a single host. This affects any kind of multi-tunnel deployment, regardless of whether the tunnels share the same endpoints or not (i.e., a VPN concentrator type of gateway would also be affected). The problem is caused by the fact that, in case of a traffic surge that involves multiple tunnels at the same time, the polling of the NAPI instance of all these wg devices tends to converge onto the same core, causing underutilization of the CPU and bottlenecking performance. This happens because NAPI polling is hosted by default in softirq context, but the WireGuard driver only raises this softirq after the rx peer queue has been drained, which doesn't happen during high traffic. In this case, the softirq already active on a core is reused instead of raising a new one. As a result, once two or more tunnel softirqs have been scheduled on the same core, they remain pinned there until the surge ends. In our experiments, this almost always leads to all tunnel NAPIs being handled on a single core shortly after a surge begins, limiting scalability to less than 3× the performance of a single tunnel, despite plenty of unused CPU cores being available. The proposed mitigation is to enable threaded NAPI for all WireGuard devices. This moves the NAPI polling context to a dedicated per-device kernel thread, allowing the scheduler to balance the load across all available cores. On our 32-core gateways, enabling threaded NAPI yields a ~4× performance improvement with 16 tunnels, increasing throughput from ~13 Gbps to ~48 Gbps. Meanwhile, CPU usage on the receiver (which is the bottleneck) jumps from 20% to 100%. We have found no performance regressions in any scenario we tested. Single-tunnel throughput remains unchanged. More details are available in our Netdev paper. Link: https://netdevconf.info/0x18/docs/netdev-0x18-paper23-talk-paper.pdf Signed-off-by: Mirco Barone Fixes: e7096c131e51 ("net: WireGuard secure network tunnel") Signed-off-by: Jason A. Donenfeld Link: https://patch.msgid.link/20250605120616.2808744-1-Jason@zx2c4.com Signed-off-by: Jakub Kicinski commit 6f65947a1e684db28b9407ea51927ed5157caf41 Merge: a2f4c1ae163b81 44e479d7202070 Author: Jens Axboe Date: Thu Jun 5 07:40:38 2025 -0600 Merge tag 'nvme-6.16-2025-06-05' of git://git.infradead.org/nvme into block-6.16 Pull NVMe updates and fixes from Christoph: "nvme updates for Linux 6.16 - TCP error handling fix (Shin'ichiro Kawasaki) - TCP I/O stall handling fixes (Hannes Reinecke) - fix command limits status code (Keith Busch) - support vectored buffers also for passthrough (Pavel Begunkov) - spelling fixes (Yi Zhang)" * tag 'nvme-6.16-2025-06-05' of git://git.infradead.org/nvme: nvme: spelling fixes nvme-tcp: fix I/O stalls on congested sockets nvme-tcp: sanitize request list handling nvme-tcp: remove tag set when second admin queue config fails nvme: enable vectored registered bufs for passthrough cmds nvme: fix implicit bool to flags conversion nvme: fix command limits status code commit fad4cf944839da7f5c3376243aa353295c88f588 Author: Sebastian Ott Date: Thu Jun 5 12:36:13 2025 +0200 KVM: arm64: selftests: Determine effective counter width in arch_timer_edge_cases arch_timer_edge_cases uses ~0 as the maximum counter value, however there's no architectural guarantee that this is valid. Figure out the effective counter width based on the effective frequency like it's done by the kernel. This also serves as a workaround for AC03_CPU_14 that led to the following assertion failure on ampere-one machines: ==== Test Assertion Failure ==== arm64/arch_timer_edge_cases.c:169: timer_condition == istatus pid=11236 tid=11236 errno=4 - Interrupted system call 1 0x0000000000404ce7: test_run at arch_timer_edge_cases.c:938 2 0x0000000000401ebb: main at arch_timer_edge_cases.c:1053 3 0x0000ffff9fa8625b: ?? ??:0 4 0x0000ffff9fa8633b: ?? ??:0 5 0x0000000000401fef: _start at ??:? 0x1 != 0x0 (timer_condition != istatus) Note that the following subtest only worked since the counter initialized with CVAL_MAX would instantly overflow (which is no longer the case): test_set_cnt_after_cval_no_irq(timer, 0, DEF_CNT, CVAL_MAX, sm); To fix this we could swap CVAL_MAX for 0 here but since that is already done by test_move_counters_behind_timers() let's remove that subtest. Link: https://lore.kernel.org/kvmarm/ac1de1d2-ef2b-d439-dc48-8615e121b07b@redhat.com Link: https://amperecomputing.com/assets/AmpereOne_Developer_ER_v0_80_20240823_28945022f4.pdf Signed-off-by: Sebastian Ott Link: https://lore.kernel.org/r/20250605103613.14544-5-sebott@redhat.com Signed-off-by: Marc Zyngier commit 05ce38d489dbc96eb1dd700b287f949cb8cc0610 Author: Sebastian Ott Date: Thu Jun 5 12:36:12 2025 +0200 KVM: arm64: selftests: Fix xVAL init in arch_timer_edge_cases arch_timer_edge_cases hits the following assertion in < 10% of the test runs: ==== Test Assertion Failure ==== arm64/arch_timer_edge_cases.c:490: timer_get_cntct(timer) >= DEF_CNT + (timer_get_cntfrq() * (uint64_t)(delta_2_ms) / 1000) pid=17110 tid=17110 errno=4 - Interrupted system call 1 0x0000000000404ec7: test_run at arch_timer_edge_cases.c:945 2 0x0000000000401fa3: main at arch_timer_edge_cases.c:1074 3 0x0000ffffa774b587: ?? ??:0 4 0x0000ffffa774b65f: ?? ??:0 5 0x000000000040206f: _start at ??:? timer_get_cntct(timer) >= DEF_CNT + msec_to_cycles(delta_2_ms) Enabling the timer without proper xval initialization in set_tval_irq() resulted in an early interrupt during timer reprogramming. Make sure to set the xval before setting the enable bit. Signed-off-by: Sebastian Ott Link: https://lore.kernel.org/r/20250605103613.14544-4-sebott@redhat.com Signed-off-by: Marc Zyngier commit 050632ae6571d0f148fa0d4b90b6409a12645461 Author: Sebastian Ott Date: Thu Jun 5 12:36:11 2025 +0200 KVM: arm64: selftests: Fix thread migration in arch_timer_edge_cases arch_timer_edge_cases tries to migrate itself across host cpus. Before the first test, it migrates to cpu 0 by setting up an affinity mask with only bit 0 set. After that it looks for the next possible cpu in the current affinity mask which still has only bit 0 set. So there is no migration at all. Fix this by reading the default mask at start and use this to find the next cpu in each iteration. Signed-off-by: Sebastian Ott Link: https://lore.kernel.org/r/20250605103613.14544-3-sebott@redhat.com Signed-off-by: Marc Zyngier commit 9a9864fd09c7e52440c05e70609bf5ee8da425d0 Author: Sebastian Ott Date: Thu Jun 5 12:36:10 2025 +0200 KVM: arm64: selftests: Fix help text for arch_timer_edge_cases Fix the help text for arch_timer_edge_cases to show the correct option for setting the wait time. Signed-off-by: Sebastian Ott Link: https://lore.kernel.org/r/20250605103613.14544-2-sebott@redhat.com Signed-off-by: Marc Zyngier commit 4d401c5534ab132a44f9afbf18a6d861b1320c98 Merge: edafd348a0548b 787fe16b435668 Author: Paolo Abeni Date: Thu Jun 5 15:19:33 2025 +0200 Merge tag 'wireless-2025-06-05' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Couple of quick fixes: - iwlwifi/iwlmld crash on certain error paths - iwlwifi/iwlmld regulatory data mixup - iwlwifi/iwlmld suspend/resume fix - iwlwifi MSI (without -X) fix - cfg80211/mac80211 S1G parsing fixes * tag 'wireless-2025-06-05' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements wifi: iwlwifi: mld: Move regulatory domain initialization wifi: iwlwifi: pcie: fix non-MSIX handshake register wifi: iwlwifi: mld: avoid panic on init failure wifi: iwlwifi: mvm: fix assert on suspend ==================== Link: https://patch.msgid.link/20250605095443.17874-6-johannes@sipsolutions.net Signed-off-by: Paolo Abeni commit b5fa1f91e11fdf74ad4e2ac6dae246a57cbd2d95 Author: Marc Zyngier Date: Tue Jun 3 08:08:24 2025 +0100 KVM: arm64: Make __vcpu_sys_reg() a pure rvalue operand Now that we don't have any use of __vcpu_sys_reg() as a lvalue, remove the in-place update, and directly return the sanitised value. Reviewed-by: Miguel Luis Reviewed-by: Oliver Upton Link: https://lore.kernel.org/r/20250603070824.1192795-5-maz@kernel.org Signed-off-by: Marc Zyngier commit b61fae4ee120f337b8700dff43b2fd639f3bf6a5 Author: Marc Zyngier Date: Tue Jun 3 08:08:23 2025 +0100 KVM: arm64: Don't use __vcpu_sys_reg() to get the address of a sysreg We are about to prevent the use of __vcpu_sys_reg() as a lvalue, and getting the address of a rvalue is not a thing. Update the couple of places where we do this to use the __ctxt_sys_reg() accessor, which return the address of a register. Reviewed-by: Miguel Luis Reviewed-by: Oliver Upton Link: https://lore.kernel.org/r/20250603070824.1192795-4-maz@kernel.org Signed-off-by: Marc Zyngier commit 8800b7c4bbede3cd40831726d3f98e8080baf4df Author: Marc Zyngier Date: Tue Jun 3 08:08:22 2025 +0100 KVM: arm64: Add RMW specific sysreg accessor In a number of cases, we perform a Read-Modify-Write operation on a system register, meaning that we would apply the RESx masks twice. Instead, provide a new accessor that performs this RMW operation, allowing the masks to be applied exactly once per operation. Reviewed-by: Miguel Luis Reviewed-by: Oliver Upton Link: https://lore.kernel.org/r/20250603070824.1192795-3-maz@kernel.org Signed-off-by: Marc Zyngier commit 6678791ee3da0b78c28fe7d77814097f53cbb8df Author: Marc Zyngier Date: Tue Jun 3 08:08:21 2025 +0100 KVM: arm64: Add assignment-specific sysreg accessor Assigning a value to a system register doesn't do what it is supposed to be doing if that register is one that has RESx bits. The main problem is that we use __vcpu_sys_reg(), which can be used both as a lvalue and rvalue. When used as a lvalue, the bit masking occurs *before* the new value is assigned, meaning that we (1) do pointless work on the old cvalue, and (2) potentially assign an invalid value as we fail to apply the masks to it. Fix this by providing a new __vcpu_assign_sys_reg() that does what it says on the tin, and sanitises the *new* value instead of the old one. This comes with a significant amount of churn. Reviewed-by: Miguel Luis Reviewed-by: Oliver Upton Link: https://lore.kernel.org/r/20250603070824.1192795-2-maz@kernel.org Signed-off-by: Marc Zyngier commit 91274fd4ed9ba110b02c53d71d2778b7d13b49ac Author: Jacek Lawrynowicz Date: Wed May 28 19:12:20 2025 +0200 accel/ivpu: Fix warning in ivpu_gem_bo_free() Don't WARN if imported buffers are in use in ivpu_gem_bo_free() as they can be indeed used in the original context/driver. Fixes: 647371a6609d ("accel/ivpu: Add GEM buffer object management") Cc: stable@vger.kernel.org # v6.3 Reviewed-by: Jeff Hugo Reviewed-by: Lizhi Hou Signed-off-by: Jacek Lawrynowicz Link: https://lore.kernel.org/r/20250528171220.513225-1-jacek.lawrynowicz@linux.intel.com commit 8337204c58899fe422db765b481711eb2d95eb0b Author: Peter Zijlstra Date: Wed May 28 10:55:21 2025 +0200 futex: Handle invalid node numbers supplied by user syzbot used a negative node number which was not rejected early and led to invalid memory access in node_possible(). Reject negative node numbers except for FUTEX_NO_NODE. [bigeasy: Keep the FUTEX_NO_NODE check] Closes: https://lore.kernel.org/all/6835bfe3.a70a0220.253bc2.00b5.GAE@google.com/ Fixes: cec199c5e39bd ("futex: Implement FUTEX2_NUMA") Signed-off-by: Peter Zijlstra (Intel) Reported-by: syzbot+9afaf6749e3a7aa1bdf3@syzkaller.appspotmail.com Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20250528085521.1938355-4-bigeasy@linutronix.de commit 0ecb4232fc65e659ca7020f8bb2e0fc347acfb7d Author: Sebastian Andrzej Siewior Date: Wed May 28 10:55:20 2025 +0200 selftests/futex: Set the home_node in futex_numa_mpol The test fails at the MPOL step if multiple nodes are available. The reason is that mbind() sets the policy but the home_node, which is retrieved by the futex code, is not set. This causes to retrieve the current node and with multiple nodes it fails on one of the iterations. Use numa_set_mempolicy_home_node() to set the expected node. Use ksft_exit_fail_msg() to fail and exit in order not to confuse ktap. Fixes: 3163369407baf ("selftests/futex: Add futex_numa_mpol") Suggested-by: Vlastimil Babka Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20250528085521.1938355-3-bigeasy@linutronix.de commit 1a9dcf69c7a97e733aa2fc026db22f22928ca7b7 Author: Sebastian Andrzej Siewior Date: Wed May 28 10:55:19 2025 +0200 selftests/futex: getopt() requires int as return value. Mark reported that futex_priv_hash fails on ARM64. It turns out that the command line parsing does not terminate properly and ends in the default case assuming an invalid option was passed. Use an int as the return type for getopt(). Closes: https://lore.kernel.org/all/31869a69-063f-44a3-a079-ba71b2506cce@sirena.org.uk/ Fixes: 3163369407baf ("selftests/futex: Add futex_numa_mpol") Fixes: cda95faef7bcf ("selftests/futex: Add futex_priv_hash") Reported-by: Mark Brown Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20250528085521.1938355-2-bigeasy@linutronix.de commit 49b393af3130c7712c7e8f215f4126c9a8060fa6 Author: Peter Zijlstra Date: Wed Jun 4 10:21:38 2025 +0200 perf: Add comment to enum perf_event_state Better describe the event states. Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Leo Yan Link: https://lkml.kernel.org/r/20250604135801.GK38114@noisy.programming.kicks-ass.net commit 3172fb986666dfb71bf483b6d3539e1e587fa197 Author: Luo Gengkun Date: Wed Jun 4 03:39:24 2025 +0000 perf/core: Fix WARN in perf_cgroup_switch() There may be concurrency between perf_cgroup_switch and perf_cgroup_event_disable. Consider the following scenario: after a new perf cgroup event is created on CPU0, the new event may not trigger a reprogramming, causing ctx->is_active to be 0. In this case, when CPU1 disables this perf event, it executes __perf_remove_from_context-> list _del_event->perf_cgroup_event_disable on CPU1, which causes a race with perf_cgroup_switch running on CPU0. The following describes the details of this concurrency scenario: CPU0 CPU1 perf_cgroup_switch: ... # cpuctx->cgrp is not NULL here if (READ_ONCE(cpuctx->cgrp) == NULL) return; perf_remove_from_context: ... raw_spin_lock_irq(&ctx->lock); ... # ctx->is_active == 0 because reprogramm is not # tigger, so CPU1 can do __perf_remove_from_context # for CPU0 __perf_remove_from_context: perf_cgroup_event_disable: ... if (--ctx->nr_cgroups) ... # this warning will happened because CPU1 changed # ctx.nr_cgroups to 0. WARN_ON_ONCE(cpuctx->ctx.nr_cgroups == 0); [peterz: use guard instead of goto unlock] Fixes: db4a835601b7 ("perf/core: Set cgroup in CPU contexts for new cgroup events") Signed-off-by: Luo Gengkun Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20250604033924.3914647-3-luogengkun@huaweicloud.com commit 3b7a34aebbdf2a4b7295205bf0c654294283ec82 Author: Yeoreum Yun Date: Mon Jun 2 19:40:49 2025 +0100 perf: Fix dangling cgroup pointer in cpuctx Commit a3c3c6667("perf/core: Fix child_total_time_enabled accounting bug at task exit") moves the event->state update to before list_del_event(). This makes the event->state test in list_del_event() always false; never calling perf_cgroup_event_disable(). As a result, cpuctx->cgrp won't be cleared properly; causing havoc. Fixes: a3c3c6667("perf/core: Fix child_total_time_enabled accounting bug at task exit") Signed-off-by: Yeoreum Yun Signed-off-by: Peter Zijlstra (Intel) Tested-by: David Wang <00107082@163.com> Link: https://lore.kernel.org/all/aD2TspKH%2F7yvfYoO@e129823.arm.com/ commit 61988e36dc5457cdff7ae7927e8d9ad1419ee998 Author: Peter Zijlstra Date: Thu Jun 5 12:37:11 2025 +0200 perf: Fix cgroup state vs ERROR While chasing down a missing perf_cgroup_event_disable() elsewhere, Leo Yan found that both perf_put_aux_event() and perf_remove_sibling_event() were also missing one. Specifically, the rule is that events that switch to OFF,ERROR need to call perf_cgroup_event_disable(). Unify the disable paths to ensure this. Fixes: ab43762ef010 ("perf: Allow normal events to output AUX data") Fixes: 9f0c4fa111dc ("perf/core: Add a new PERF_EV_CAP_SIBLING event capability") Reported-by: Leo Yan Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20250605123343.GD35970@noisy.programming.kicks-ass.net commit 4f6fc782128355931527cefe3eb45338abd8ab39 Author: Peter Zijlstra Date: Thu Jun 5 12:31:45 2025 +0200 perf: Fix sample vs do_exit() Baisheng Gao reported an ARM64 crash, which Mark decoded as being a synchronous external abort -- most likely due to trying to access MMIO in bad ways. The crash further shows perf trying to do a user stack sample while in exit_mmap()'s tlb_finish_mmu() -- i.e. while tearing down the address space it is trying to access. It turns out that we stop perf after we tear down the userspace mm; a receipie for disaster, since perf likes to access userspace for various reasons. Flip this order by moving up where we stop perf in do_exit(). Additionally, harden PERF_SAMPLE_CALLCHAIN and PERF_SAMPLE_STACK_USER to abort when the current task does not have an mm (exit_mm() makes sure to set current->mm = NULL; before commencing with the actual teardown). Such that CPU wide events don't trip on this same problem. Fixes: c5ebcedb566e ("perf: Add ability to attach user stack dump to sample") Reported-by: Baisheng Gao Suggested-by: Mark Rutland Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20250605110815.GQ39944@noisy.programming.kicks-ass.net commit a47e36dc5d90dc664cac87304c17d50f1595d634 Author: Karol Wachowski Date: Wed May 28 17:42:53 2025 +0200 accel/ivpu: Trigger device recovery on engine reset/resume failure Trigger full device recovery when the driver fails to restore device state via engine reset and resume operations. This is necessary because, even if submissions from a faulty context are blocked, the NPU may still process previously submitted faulty jobs if the engine reset fails to abort them. Such jobs can continue to generate faults and occupy device resources. When engine reset is ineffective, the only way to recover is to perform a full device recovery. Fixes: dad945c27a42 ("accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW") Cc: stable@vger.kernel.org # v6.15+ Signed-off-by: Karol Wachowski Reviewed-by: Lizhi Hou Signed-off-by: Jacek Lawrynowicz Link: https://lore.kernel.org/r/20250528154253.500556-1-jacek.lawrynowicz@linux.intel.com commit 98d3f772ca7d6822bdfc8c960f5f909574db97c9 Author: Jacek Lawrynowicz Date: Wed May 28 17:43:25 2025 +0200 accel/ivpu: Use dma_resv_lock() instead of a custom mutex This fixes a potential race conditions in: - ivpu_bo_unbind_locked() where we modified the shmem->sgt without holding the dma_resv_lock(). - ivpu_bo_print_info() where we read the shmem->pages without holding the dma_resv_lock(). Using dma_resv_lock() also protects against future syncronisation issues that may arise when accessing drm_gem_shmem_object or drm_gem_object members. Fixes: 42328003ecb6 ("accel/ivpu: Refactor BO creation functions") Cc: stable@vger.kernel.org # v6.9+ Reviewed-by: Lizhi Hou Signed-off-by: Jacek Lawrynowicz Link: https://lore.kernel.org/r/20250528154325.500684-1-jacek.lawrynowicz@linux.intel.com commit edafd348a0548b6945c3cf77273f0a88a181362a Merge: 8e59d9e24df468 3c3c3248496a3a Author: Paolo Abeni Date: Thu Jun 5 13:37:02 2025 +0200 Merge tag 'nf-25-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Zero out the remainder in nft_pipapo AVX2 implementation, otherwise next lookup could bogusly report a mismatch. This is followed by two patches to update nft_pipapo selftests to cover for the previous bug. From Florian Westphal. 2) Check for reverse tuple too in case of esoteric NAT collisions for UDP traffic and extend selftest coverage. Also from Florian. netfilter pull request 25-06-05 * tag 'nf-25-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: selftests: netfilter: nft_nat.sh: add test for reverse clash with nat netfilter: nf_nat: also check reverse tuple to obtain clashing entry selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing netfilter: nf_set_pipapo_avx2: fix initial map fill ==================== Link: https://patch.msgid.link/20250605085735.52205-1-pablo@netfilter.org Signed-off-by: Paolo Abeni commit 714d02b41939d2720379e11ef25227aec4e5bec9 Author: Amir Goldstein Date: Thu Jun 5 12:15:30 2025 +0200 ovl: fix regression caused by lookup helpers API changes The lookup helpers API was changed by merge of vfs-6.16-rc1.async.dir to pass a non-const qstr pointer argument to lookup_one*() helpers. All of the callers of this API were changed to pass a pointer to temp copy of qstr, except overlays that was passing a const pointer to dentry->d_name that was changed to pass a non-const copy instead when doing a lookup in lower layer which is not the fs of said dentry. This wrong use of the API caused a regression in fstest overlay/012. Fix the regression by making a non-const copy of dentry->d_name prior to calling the lookup API, but the API should be fixed to not allow this class of bugs. Cc: NeilBrown Fixes: 5741909697a3 ("VFS: improve interface for lookup_one functions") Fixes: 390e34bc1490 ("VFS: change lookup_one_common and lookup_noperm_common to take a qstr") Signed-off-by: Amir Goldstein Link: https://lore.kernel.org/20250605101530.2336320-1-amir73il@gmail.com Signed-off-by: Christian Brauner commit 8e59d9e24df4688b6a5ea79c84d0b26d1499d4d5 Merge: ec6a328b2e68ad 8af7a919c52f02 Author: Paolo Abeni Date: Thu Jun 5 12:50:12 2025 +0200 Merge branch 'netlink-specs-rt-link-decode-ip6gre' Jakub Kicinski says: ==================== netlink: specs: rt-link: decode ip6gre Adding GRE tunnels to the .config for driver tests caused some unhappiness in YNL, as it can't decode all the link attrs on the system. Add ip6gre support to fix the tests. This is similar to commit 6ffdbb93a59c ("netlink: specs: rt_link: decode ip6tnl, vti and vti6 link attrs"). ==================== Link: https://patch.msgid.link/20250603135357.502626-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit 8af7a919c52f02514a145f995cbdf0deadb8075a Author: Jakub Kicinski Date: Tue Jun 3 06:53:57 2025 -0700 netlink: specs: rt-link: decode ip6gre Driver tests now require GRE tunnels, while we don't configure them with YNL, YNL will complain when it sees link types it doesn't recognize. Teach it decoding ip6gre tunnels. The attrs are largely the same as IPv4 GRE. Correct the type of encap-limit, but note that this attr is only used in ip6gre, so the mistake didn't matter until now. Fixes: 0d0f4174f6c8 ("selftests: drv-net: add a simple TSO test") Signed-off-by: Jakub Kicinski Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250603135357.502626-3-kuba@kernel.org Signed-off-by: Paolo Abeni commit de92258e3b22bd4ce920715cc91f09d788e5badf Author: Jakub Kicinski Date: Tue Jun 3 06:53:56 2025 -0700 netlink: specs: rt-link: add missing byte-order properties A number of fields in the ip tunnels are lacking the big-endian designation. I suspect this is not intentional, as decoding the ports with the right endian seems objectively beneficial. Fixes: 6ffdbb93a59c ("netlink: specs: rt_link: decode ip6tnl, vti and vti6 link attrs") Fixes: 077b6022d24b ("doc/netlink/specs: Add sub-message type to rt_link family") Signed-off-by: Jakub Kicinski Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250603135357.502626-2-kuba@kernel.org Signed-off-by: Paolo Abeni commit ec6a328b2e68adfaa322b633519b72ab6cd33e3a Merge: 501fe52aa908c9 9c7e8b31da035f Author: Paolo Abeni Date: Thu Jun 5 12:37:10 2025 +0200 Merge tag 'ovpn-net-20250603' of https://github.com/OpenVPN/ovpn-net-next Antonio Quartulli says: ==================== In this batch you can find the following bug fixes: Patch 1: when releasing a UDP socket we were wrongly invoking setup_udp_tunnel_sock() with an empty config. This was not properly shutting down the UDP encap state. With this patch we simply undo what was done during setup. Patch 2: ovpn was holding a reference to a 'struct socket' without increasing its reference counter. This was intended and worked as expected until we hit a race condition where user space tries to close the socket while kernel space is also releasing it. In this case the (struct socket *)->sk member would disappear under our feet leading to a null-ptr-deref. This patch fixes this issue by having struct ovpn_socket hold a reference directly to the sk member while also increasing its reference counter. Patch 3: in case of errors along the TCP RX path (softirq) we want to immediately delete the peer, but this operation may sleep. With this patch we move the peer deletion to a scheduled worker. Patch 4 and 5 are instead fixing minor issues in the ovpn kselftests. * tag 'ovpn-net-20250603' of https://github.com/OpenVPN/ovpn-net-next: selftest/net/ovpn: fix missing file selftest/net/ovpn: fix TCP socket creation ovpn: avoid sleep in atomic context in TCP RX error path ovpn: ensure sk is still valid during cleanup ovpn: properly deconfigure UDP-tunnel ==================== Link: https://patch.msgid.link/20250603111110.4575-1-antonio@openvpn.net/ Signed-off-by: Paolo Abeni commit 11709abccf93b08adde95ef313c300b0d4bc28f1 Author: Heiko Carstens Date: Tue Jun 3 15:49:36 2025 +0200 s390/mm: Fix in_atomic() handling in do_secure_storage_access() Kernel user spaces accesses to not exported pages in atomic context incorrectly try to resolve the page fault. With debug options enabled call traces like this can be seen: BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1523 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 419074, name: qemu-system-s39 preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 INFO: lockdep is turned off. Preemption disabled at: [<00000383ea47cfa2>] copy_page_from_iter_atomic+0xa2/0x8a0 CPU: 12 UID: 0 PID: 419074 Comm: qemu-system-s39 Tainted: G W 6.16.0-20250531.rc0.git0.69b3a602feac.63.fc42.s390x+debug #1 PREEMPT Tainted: [W]=WARN Hardware name: IBM 3931 A01 703 (LPAR) Call Trace: [<00000383e990d282>] dump_stack_lvl+0xa2/0xe8 [<00000383e99bf152>] __might_resched+0x292/0x2d0 [<00000383eaa7c374>] down_read+0x34/0x2d0 [<00000383e99432f8>] do_secure_storage_access+0x108/0x360 [<00000383eaa724b0>] __do_pgm_check+0x130/0x220 [<00000383eaa842e4>] pgm_check_handler+0x114/0x160 [<00000383ea47d028>] copy_page_from_iter_atomic+0x128/0x8a0 ([<00000383ea47d016>] copy_page_from_iter_atomic+0x116/0x8a0) [<00000383e9c45eae>] generic_perform_write+0x16e/0x310 [<00000383e9eb87f4>] ext4_buffered_write_iter+0x84/0x160 [<00000383e9da0de4>] vfs_write+0x1c4/0x460 [<00000383e9da123c>] ksys_write+0x7c/0x100 [<00000383eaa7284e>] __do_syscall+0x15e/0x280 [<00000383eaa8417e>] system_call+0x6e/0x90 INFO: lockdep is turned off. It is not allowed to take the mmap_lock while in atomic context. Therefore handle such a secure storage access fault as if the accessed page is not mapped: the uaccess function will return -EFAULT, and the caller has to deal with this. Usually this means that the access is retried in process context, which allows to resolve the page fault (or in this case export the page). Reviewed-by: Claudio Imbrenda Acked-by: Alexander Gordeev Acked-by: Christian Borntraeger Link: https://lore.kernel.org/r/20250603134936.1314139-1-hca@linux.ibm.com Signed-off-by: Heiko Carstens commit 501fe52aa908c96f2c9b8d54767938a1a5960354 Author: Daniele Palmas Date: Tue Jun 3 11:12:04 2025 +0200 net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing Recent Qualcomm chipsets like SDX72/75 require MBIM sessionId mapping to muxId in the range (0x70-0x8F) for the PCIe tethered use. This has been partially addressed by the referenced commit, mapping the default data call to muxId = 112, but the multiplexed data calls scenario was not properly considered, mapping sessionId = 1 to muxId 1, while it should have been 113. Fix this by moving the session_id assignment logic to mhi_mbim_newlink, in order to map sessionId = n to muxId = n + WDS_BIND_MUX_DATA_PORT_MUX_ID. Fixes: 65bc58c3dcad ("net: wwan: mhi: make default data link id configurable") Signed-off-by: Daniele Palmas Reviewed-by: Loic Poulain Link: https://patch.msgid.link/20250603091204.2802840-1-dnlplm@gmail.com Signed-off-by: Paolo Abeni commit 787fe16b435668205fba19aaa7387972b7575991 Merge: 1e1f706fc2ce90 f81aa834bfa91c Author: Johannes Berg Date: Thu Jun 5 11:33:07 2025 +0200 Merge tag 'iwlwifi-fixes-2025-06-04' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next Miri Korenblit says: ==================== iwlwifi fixes ==================== Signed-off-by: Johannes Berg commit 1e1f706fc2ce90eaaf3480b3d5f27885960d751c Author: Lachlan Hodges Date: Tue Jun 3 15:35:38 2025 +1000 wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements S1G beacons are not traditional beacons but a type of extension frame. Extension frames contain the frame control and duration fields, followed by zero or more optional fields before the frame body. These optional fields are distinct from the variable length elements. The presence of optional fields is indicated in the frame control field. To correctly locate the elements offset, the frame control must be parsed to identify which optional fields are present. Currently, mac80211 parses S1G beacons based on fixed assumptions about the frame layout, without inspecting the frame control field. This can result in incorrect offsets to the "variable" portion of the frame. Properly parse S1G beacon frames by using the field lengths defined in IEEE 802.11-2024, section 9.3.4.3, ensuring that the elements offset is calculated accurately. Fixes: 9eaffe5078ca ("cfg80211: convert S1G beacon to scan results") Fixes: cd418ba63f0c ("mac80211: convert S1G beacon to scan results") Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20250603053538.468562-1-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg commit e56a50ff7c12983aba710bd02a2c2ad401379e91 Author: Benjamin Berg Date: Thu Jun 5 07:03:25 2025 +0200 um: remove "extern" from implementation of sigchld_handler There is no need to mark the function as extern in the implementation. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506051226.X8r7X5aa-lkp@intel.com/ Fixes: 8420e08fe3a5 ("um: Track userspace children dying in SECCOMP mode") Signed-off-by: Benjamin Berg Link: https://patch.msgid.link/20250605050325.1077208-2-benjamin@sipsolutions.net Signed-off-by: Johannes Berg commit 27a041040f2c6cfbbc24053bce9acb2e801e4e71 Author: Benjamin Berg Date: Thu Jun 5 07:03:24 2025 +0200 um: fix unused variable warning The code was updated to access the PID of the userspace stub process in a different way, making the local cpu variable obsolete. Remove it. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506050008.AwXLNxQX-lkp@intel.com/ Fixes: 406d17c6c370 ("um: Implement kernel side of SECCOMP based process handling") Signed-off-by: Benjamin Berg Link: https://patch.msgid.link/20250605050325.1077208-1-benjamin@sipsolutions.net Signed-off-by: Johannes Berg commit 2862da49dd15d709141acae3f6d81399654420a0 Merge: 919d763d609428 bc1a65eb81a21e Author: Paolo Abeni Date: Thu Jun 5 11:07:36 2025 +0200 Merge branch 'net-dsa-b53-fix-rgmii-ports' Jonas Gorski says: ==================== net: dsa: b53: fix RGMII ports RGMII ports on BCM63xx were not really working, especially with PHYs that support EEE and are capable of configuring their own RGMII delays. So let's make them work, and fix additional minor rgmii related issues found while working on it. With a BCM96328BU-P300: Before: [ 3.580000] b53-switch 10700000.switch GbE3 (uninitialized): validation of rgmii with support 0000000,00000000,00000000,000062ff and advertisement 0000000,00000000,00000000,000062ff failed: -EINVAL [ 3.600000] b53-switch 10700000.switch GbE3 (uninitialized): failed to connect to PHY: -EINVAL [ 3.610000] b53-switch 10700000.switch GbE3 (uninitialized): error -22 setting up PHY for tree 0, switch 0, port 4 [ 3.620000] b53-switch 10700000.switch GbE1 (uninitialized): validation of rgmii with support 0000000,00000000,00000000,000062ff and advertisement 0000000,00000000,00000000,000062ff failed: -EINVAL [ 3.640000] b53-switch 10700000.switch GbE1 (uninitialized): failed to connect to PHY: -EINVAL [ 3.650000] b53-switch 10700000.switch GbE1 (uninitialized): error -22 setting up PHY for tree 0, switch 0, port 5 [ 3.660000] b53-switch 10700000.switch GbE4 (uninitialized): validation of rgmii with support 0000000,00000000,00000000,000062ff and advertisement 0000000,00000000,00000000,000062ff failed: -EINVAL [ 3.680000] b53-switch 10700000.switch GbE4 (uninitialized): failed to connect to PHY: -EINVAL [ 3.690000] b53-switch 10700000.switch GbE4 (uninitialized): error -22 setting up PHY for tree 0, switch 0, port 6 [ 3.700000] b53-switch 10700000.switch GbE5 (uninitialized): validation of rgmii with support 0000000,00000000,00000000,000062ff and advertisement 0000000,00000000,00000000,000062ff failed: -EINVAL [ 3.720000] b53-switch 10700000.switch GbE5 (uninitialized): failed to connect to PHY: -EINVAL [ 3.730000] b53-switch 10700000.switch GbE5 (uninitialized): error -22 setting up PHY for tree 0, switch 0, port 7 After: [ 3.700000] b53-switch 10700000.switch GbE3 (uninitialized): PHY [mdio_mux-0.1:00] driver [Broadcom BCM54612E] (irq=POLL) [ 3.770000] b53-switch 10700000.switch GbE1 (uninitialized): PHY [mdio_mux-0.1:01] driver [Broadcom BCM54612E] (irq=POLL) [ 3.850000] b53-switch 10700000.switch GbE4 (uninitialized): PHY [mdio_mux-0.1:18] driver [Broadcom BCM54612E] (irq=POLL) [ 3.920000] b53-switch 10700000.switch GbE5 (uninitialized): PHY [mdio_mux-0.1:19] driver [Broadcom BCM54612E] (irq=POLL) ==================== Link: https://patch.msgid.link/20250602193953.1010487-1-jonas.gorski@gmail.com Signed-off-by: Paolo Abeni commit bc1a65eb81a21e2aa3c3dca058ee8adf687b6ef5 Author: Jonas Gorski Date: Mon Jun 2 21:39:53 2025 +0200 net: dsa: b53: do not touch DLL_IQQD on bcm53115 According to OpenMDK, bit 2 of the RGMII register has a different meaning for BCM53115 [1]: "DLL_IQQD 1: In the IDDQ mode, power is down0: Normal function mode" Configuring RGMII delay works without setting this bit, so let's keep it at the default. For other chips, we always set it, so not clearing it is not an issue. One would assume BCM53118 works the same, but OpenMDK is not quite sure what this bit actually means [2]: "BYPASS_IMP_2NS_DEL #1: In the IDDQ mode, power is down#0: Normal function mode1: Bypass dll65_2ns_del IP0: Use dll65_2ns_del IP" So lets keep setting it for now. [1] https://github.com/Broadcom-Network-Switching-Software/OpenMDK/blob/master/cdk/PKG/chip/bcm53115/bcm53115_a0_defs.h#L19871 [2] https://github.com/Broadcom-Network-Switching-Software/OpenMDK/blob/master/cdk/PKG/chip/bcm53118/bcm53118_a0_defs.h#L14392 Fixes: 967dd82ffc52 ("net: dsa: b53: Add support for Broadcom RoboSwitch") Signed-off-by: Jonas Gorski Link: https://patch.msgid.link/20250602193953.1010487-6-jonas.gorski@gmail.com Signed-off-by: Paolo Abeni commit 5ea0d42c1980e6d10e5cb56a78021db5bfcebaaf Author: Jonas Gorski Date: Mon Jun 2 21:39:52 2025 +0200 net: dsa: b53: allow RGMII for bcm63xx RGMII ports Add RGMII to supported interfaces for BCM63xx RGMII ports so they can be actually used in RGMII mode. Without this, phylink will fail to configure them: [ 3.580000] b53-switch 10700000.switch GbE3 (uninitialized): validation of rgmii with support 0000000,00000000,00000000,000062ff and advertisement 0000000,00000000,00000000,000062ff failed: -EINVAL [ 3.600000] b53-switch 10700000.switch GbE3 (uninitialized): failed to connect to PHY: -EINVAL [ 3.610000] b53-switch 10700000.switch GbE3 (uninitialized): error -22 setting up PHY for tree 0, switch 0, port 4 Fixes: ce3bf94871f7 ("net: dsa: b53: add support for BCM63xx RGMIIs") Reviewed-by: Florian Fainelli Signed-off-by: Jonas Gorski Link: https://patch.msgid.link/20250602193953.1010487-5-jonas.gorski@gmail.com Signed-off-by: Paolo Abeni commit 75f4f7b2b13008803f84768ff90396f9d7553221 Author: Jonas Gorski Date: Mon Jun 2 21:39:51 2025 +0200 net: dsa: b53: do not configure bcm63xx's IMP port interface The IMP port is not a valid RGMII interface, but hard wired to internal, so we shouldn't touch the undefined register B53_RGMII_CTRL_IMP. While this does not seem to have any side effects, let's not touch it at all, so limit RGMII configuration on bcm63xx to the actual RGMII ports. Fixes: ce3bf94871f7 ("net: dsa: b53: add support for BCM63xx RGMIIs") Signed-off-by: Jonas Gorski Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20250602193953.1010487-4-jonas.gorski@gmail.com Signed-off-by: Paolo Abeni commit 4af523551d876ab8b8057d1e5303a860fd736fcb Author: Jonas Gorski Date: Mon Jun 2 21:39:50 2025 +0200 net: dsa: b53: do not enable RGMII delay on bcm63xx bcm63xx's RGMII ports are always in MAC mode, never in PHY mode, so we shouldn't enable any delays and let the PHY handle any delays as necessary. This fixes using RGMII ports with normal PHYs like BCM54612E, which will handle the delay in the PHY. Fixes: ce3bf94871f7 ("net: dsa: b53: add support for BCM63xx RGMIIs") Signed-off-by: Jonas Gorski Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20250602193953.1010487-3-jonas.gorski@gmail.com Signed-off-by: Paolo Abeni commit 1237c2d4a8db79dfd4369bff6930b0e385ed7d5c Author: Jonas Gorski Date: Mon Jun 2 21:39:49 2025 +0200 net: dsa: b53: do not enable EEE on bcm63xx BCM63xx internal switches do not support EEE, but provide multiple RGMII ports where external PHYs may be connected. If one of these PHYs are EEE capable, we may try to enable EEE for the MACs, which then hangs the system on access of the (non-existent) EEE registers. Fix this by checking if the switch actually supports EEE before attempting to configure it. Fixes: 22256b0afb12 ("net: dsa: b53: Move EEE functions to b53") Reviewed-by: Florian Fainelli Tested-by: Álvaro Fernández Rojas Signed-off-by: Jonas Gorski Link: https://patch.msgid.link/20250602193953.1010487-2-jonas.gorski@gmail.com Signed-off-by: Paolo Abeni commit 919d763d609428c2680ec8159257d9655f002f89 Author: Meghana Malladi Date: Tue Jun 3 10:59:04 2025 +0530 net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces. In MII mode, Tx lines are swapped for port0 and port1, which means Tx port0 receives data from PRU1 and the Tx port1 receives data from PRU0. This is an expected hardware behavior and reading the Tx stats needs to be handled accordingly in the driver. Update the driver to read Tx stats from the PRU1 for port0 and PRU0 for port1. Fixes: c1e10d5dc7a1 ("net: ti: icssg-prueth: Add ICSSG Stats") Signed-off-by: Meghana Malladi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250603052904.431203-1-m-malladi@ti.com Signed-off-by: Paolo Abeni commit 3c3c3248496a3a1848ec5d923f2eee0edf60226e Author: Florian Westphal Date: Fri May 30 12:34:03 2025 +0200 selftests: netfilter: nft_nat.sh: add test for reverse clash with nat This will fail without the previous bug fix because we erronously believe that the clashing entry went way. However, the clash exists in the opposite direction due to an existing nat mapping: PASS: IP statless for ns2-LgTIuS ERROR: failed to test udp ns1-x4iyOW to ns2-LgTIuS with dnat rule step 2, result: "" This is partially adapted from test instructions from the below ubuntu tracker. Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2109889 Signed-off-by: Florian Westphal Tested-by: Shaun Brady Signed-off-by: Pablo Neira Ayuso commit 50d9ce9679dd50df2dc51ada717fa875bc248fad Author: Florian Westphal Date: Fri May 30 12:34:02 2025 +0200 netfilter: nf_nat: also check reverse tuple to obtain clashing entry The logic added in the blamed commit was supposed to only omit nat source port allocation if neither the existing nor the new entry are subject to NAT. However, its not enough to lookup the conntrack based on the proposed tuple, we must also check the reverse direction. Otherwise there are esoteric cases where the collision is in the reverse direction because that colliding connection has a port rewrite, but the new entry doesn't. In this case, we only check the new entry and then erronously conclude that no clash exists anymore. The existing (udp) tuple is: a:p -> b:P, with nat translation to s:P, i.e. pure daddr rewrite, reverse tuple in conntrack table is s:P -> a:p. When another UDP packet is sent directly to s, i.e. a:p->s:P, this is correctly detected as a colliding entry: tuple is taken by existing reply tuple in reverse direction. But the colliding conntrack is only searched for with unreversed direction, and we can't find such entry matching a:p->s:P. The incorrect conclusion is that the clashing entry has timed out and that no port address translation is required. Such conntrack will then be discarded at nf_confirm time because the proposed reverse direction clashes with an existing mapping in the conntrack table. Search for the reverse tuple too, this will then check the NAT bits of the colliding entry and triggers port reallocation. Followp patch extends nft_nat.sh selftest to cover this scenario. The IPS_SEQ_ADJUST change is also a bug fix: Instead of checking for SEQ_ADJ this tested for SEEN_REPLY and ASSURED by accident -- _BIT is only for use with the test_bit() API. This bug has little consequence in practice, because the sequence number adjustments are only useful for TCP which doesn't support clash resolution. The existing test case (conntrack_reverse_clash.sh) exercise a race condition path (parallel conntrack creation on different CPUs), so the colliding entries have neither SEEN_REPLY nor ASSURED set. Thanks to Yafang Shao and Shaun Brady for an initial investigation of this bug. Fixes: d8f84a9bc7c4 ("netfilter: nf_nat: don't try nat source port reallocation for reverse dir clash") Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1795 Reported-by: Yafang Shao Reported-by: Shaun Brady Signed-off-by: Florian Westphal Tested-by: Yafang Shao Signed-off-by: Pablo Neira Ayuso commit 38399f2b0fe4d44226bfb7eba9e137251c8b2571 Author: Florian Westphal Date: Fri May 23 14:20:46 2025 +0200 selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug commit 0935ee6032df ("selftests: netfilter: add test case for recent mismatch bug") added a regression check for incorrect initial fill of the result map that was fixed with 791a615b7ad2 ("netfilter: nf_set_pipapo: fix initial map fill"). The test used 'nft get element', i.e., control plane checks for match/nomatch results. The control plane however doesn't use avx2 version, so we need to send+match packets. As the additional packet match/nomatch is slow, don't do this for every element added/removed: add and use maybe_send_(no)match helpers and use them. Signed-off-by: Florian Westphal Reviewed-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso commit febe7eda74d105437c7532b4a76ff14eb6007828 Author: Florian Westphal Date: Fri May 23 14:20:45 2025 +0200 selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing The selftest uses following rule: ... @test counter name "test" Then sends a packet, then checks if the named counter did increment or not. This is fine for the 'no-match' test case: If anything matches the counter increments and the test fails as expected. But for the 'should match' test cases this isn't optimal. Consider buggy matching, where the packet matches entry x, but it should have matched entry y. In that case the test would erronously pass. Rework the selftest to use per-element counters to avoid this. After sending packet that should have matched entry x, query the relevant element via 'nft reset element' and check that its counter had incremented. The 'nomatch' case isn't altered, no entry should match so the named counter must be 0, changing it to the per-element counter would then pass if another entry matches. The downside of this change is a slight increase in test run-time by a few seconds. Signed-off-by: Florian Westphal Reviewed-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso commit ea77c397bff8b6d59f6d83dae1425b08f465e8b5 Author: Florian Westphal Date: Fri May 23 14:20:44 2025 +0200 netfilter: nf_set_pipapo_avx2: fix initial map fill If the first field doesn't cover the entire start map, then we must zero out the remainder, else we leak those bits into the next match round map. The early fix was incomplete and did only fix up the generic C implementation. A followup patch adds a test case to nft_concat_range.sh. Fixes: 791a615b7ad2 ("netfilter: nf_set_pipapo: fix initial map fill") Signed-off-by: Florian Westphal Reviewed-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso commit 10db95285240743e7b288272ede140aabce5e631 Merge: 6a3439a417b910 b7188a1c0d2d7b Author: Takashi Iwai Date: Thu Jun 5 09:35:24 2025 +0200 Merge tag 'asoc-fix-v6.16-merge-window' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.16 A bunch of fixes, including a big batch for the Intel AVS driver, and one new device ID. It's all device specific. commit 5dc1ea903588a73fb03b3a3e5a041a7c63a4bccd Author: Michael Walle Date: Tue May 20 09:41:10 2025 +0200 drm/panel-simple: fix the warnings for the Evervision VGG644804 The panel lacked the connector type which causes a warning. Adding the connector type reveals wrong bus_flags and bits per pixel. Fix all of it. Fixes: 1319f2178bdf ("drm/panel-simple: add Evervision VGG644804 panel entry") Signed-off-by: Michael Walle Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250520074110.655114-1-mwalle@kernel.org commit ec7714e4947909190ffb3041a03311a975350fe0 Merge: 64980441d26995 7a17bbc1d95205 Author: Linus Torvalds Date: Wed Jun 4 21:18:37 2025 -0700 Merge tag 'rust-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux Pull Rust updates from Miguel Ojeda: "Toolchain and infrastructure: - KUnit '#[test]'s: - Support KUnit-mapped 'assert!' macros. The support that landed last cycle was very basic, and the 'assert!' macros panicked since they were the standard library ones. Now, they are mapped to the KUnit ones in a similar way to how is done for doctests, reusing the infrastructure there. With this, a failing test like: #[test] fn my_first_test() { assert_eq!(42, 43); } will report: # my_first_test: ASSERTION FAILED at rust/kernel/lib.rs:251 Expected 42 == 43 to be true, but is false # my_first_test.speed: normal not ok 1 my_first_test - Support tests with checked 'Result' return types. The return value of test functions that return a 'Result' will be checked, thus one can now easily catch errors when e.g. using the '?' operator in tests. With this, a failing test like: #[test] fn my_test() -> Result { f()?; Ok(()) } will report: # my_test: ASSERTION FAILED at rust/kernel/lib.rs:321 Expected is_test_result_ok(my_test()) to be true, but is false # my_test.speed: normal not ok 1 my_test - Add 'kunit_tests' to the prelude. - Clarify the remaining language unstable features in use. - Compile 'core' with edition 2024 for Rust >= 1.87. - Workaround 'bindgen' issue with forward references to 'enum' types. - objtool: relax slice condition to cover more 'noreturn' functions. - Use absolute paths in macros referencing 'core' and 'kernel' crates. - Skip '-mno-fdpic' flag for bindgen in GCC 32-bit arm builds. - Clean some 'doc_markdown' lint hits -- we may enable it later on. 'kernel' crate: - 'alloc' module: - 'Box': support for type coercion, e.g. 'Box' to 'Box' if 'T' implements 'U'. - 'Vec': implement new methods (prerequisites for nova-core and binder): 'truncate', 'resize', 'clear', 'pop', 'push_within_capacity' (with new error type 'PushError'), 'drain_all', 'retain', 'remove' (with new error type 'RemoveError'), insert_within_capacity' (with new error type 'InsertError'). In addition, simplify 'push' using 'spare_capacity_mut', split 'set_len' into 'inc_len' and 'dec_len', add type invariant 'len <= capacity' and simplify 'truncate' using 'dec_len'. - 'time' module: - Morph the Rust hrtimer subsystem into the Rust timekeeping subsystem, covering delay, sleep, timekeeping, timers. This new subsystem has all the relevant timekeeping C maintainers listed in the entry. - Replace 'Ktime' with 'Delta' and 'Instant' types to represent a duration of time and a point in time. - Temporarily add 'Ktime' to 'hrtimer' module to allow 'hrtimer' to delay converting to 'Instant' and 'Delta'. - 'xarray' module: - Add a Rust abstraction for the 'xarray' data structure. This abstraction allows Rust code to leverage the 'xarray' to store types that implement 'ForeignOwnable'. This support is a dependency for memory backing feature of the Rust null block driver, which is waiting to be merged. - Set up an entry in 'MAINTAINERS' for the XArray Rust support. Patches will go to the new Rust XArray tree and then via the Rust subsystem tree for now. - Allow 'ForeignOwnable' to carry information about the pointed-to type. This helps asserting alignment requirements for the pointer passed to the foreign language. - 'container_of!': retain pointer mut-ness and add a compile-time check of the type of the first parameter ('$field_ptr'). - Support optional message in 'static_assert!'. - Add C FFI types (e.g. 'c_int') to the prelude. - 'str' module: simplify KUnit tests 'format!' macro, convert 'rusttest' tests into KUnit, take advantage of the '-> Result' support in KUnit '#[test]'s. - 'list' module: add examples for 'List', fix path of 'assert_pinned!' (so far unused macro rule). - 'workqueue' module: remove 'HasWork::OFFSET'. - 'page' module: add 'inline' attribute. 'macros' crate: - 'module' macro: place 'cleanup_module()' in '.exit.text' section. 'pin-init' crate: - Add 'Wrapper' trait for creating pin-initializers for wrapper structs with a structurally pinned value such as 'UnsafeCell' or 'MaybeUninit'. - Add 'MaybeZeroable' derive macro to try to derive 'Zeroable', but not error if not all fields implement it. This is needed to derive 'Zeroable' for all bindgen-generated structs. - Add 'unsafe fn cast_[pin_]init()' functions to unsafely change the initialized type of an initializer. These are utilized by the 'Wrapper' implementations. - Add support for visibility in 'Zeroable' derive macro. - Add support for 'union's in 'Zeroable' derive macro. - Upstream dev news: streamline CI, fix some bugs. Add new workflows to check if the user-space version and the one in the kernel tree have diverged. Use the issues tab [1] to track them, which should help folks report and diagnose issues w.r.t. 'pin-init' better. [1] https://github.com/rust-for-linux/pin-init/issues Documentation: - Testing: add docs on the new KUnit '#[test]' tests. - Coding guidelines: explain that '///' vs. '//' applies to private items too. Add section on C FFI types. - Quick Start guide: update Ubuntu instructions and split them into "25.04" and "24.04 LTS and older". And a few other cleanups and improvements" * tag 'rust-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: (78 commits) rust: list: Fix typo `much` in arc.rs rust: check type of `$ptr` in `container_of!` rust: workqueue: remove HasWork::OFFSET rust: retain pointer mut-ness in `container_of!` Documentation: rust: testing: add docs on the new KUnit `#[test]` tests Documentation: rust: rename `#[test]`s to "`rusttest` host tests" rust: str: take advantage of the `-> Result` support in KUnit `#[test]`'s rust: str: simplify KUnit tests `format!` macro rust: str: convert `rusttest` tests into KUnit rust: add `kunit_tests` to the prelude rust: kunit: support checked `-> Result`s in KUnit `#[test]`s rust: kunit: support KUnit-mapped `assert!` macros in `#[test]`s rust: make section names plural rust: list: fix path of `assert_pinned!` rust: compile libcore with edition 2024 for 1.87+ rust: dma: add missing Markdown code span rust: task: add missing Markdown code spans and intra-doc links rust: pci: fix docs related to missing Markdown code spans rust: alloc: add missing Markdown code span rust: alloc: add missing Markdown code spans ... commit 64980441d26995ea5599958740dbf6d791e81e27 Merge: d2fec01e894477 baa39c169dd526 Author: Linus Torvalds Date: Wed Jun 4 19:46:22 2025 -0700 Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: "Two small fixes to selftests" * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: Fix selftest btf_tag/btf_type_tag_percpu_vmlinux_helper failure selftests/bpf: Fix bpf selftest build error commit 61a4b7d7d56cdbe5eefbf11ba3ed64bdd49f178b Merge: 1c1df79ccf5615 ee11d953fd230b Author: Dave Airlie Date: Thu Jun 5 12:39:08 2025 +1000 Merge tag 'drm-msm-fixes-2025-06-04' of https://gitlab.freedesktop.org/drm/msm into drm-next Just some mailmap/MAINTAINER email address updates Signed-off-by: Dave Airlie From: Rob Clark Link: https://lore.kernel.org/r/CAF6AEGuW1kpUijxzLCc4TKph72-PfXvHTttNu214_1GB-R8qwg@mail.gmail.com commit d2fec01e89447729c7b9d722a8e7ef9d1184c7be Merge: ff0905bbf991f4 dc3e0f17f74558 Author: Linus Torvalds Date: Wed Jun 4 19:23:37 2025 -0700 Merge tag '6.16-rc-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull smb server updates from Steve French: "Four smb3 server fixes: - Fix for special character handling when mounting with "posix" - Fix for mounts from Mac for fs that don't provide unique inode numbers - Two cleanup patches (e.g. for crypto calls)" * tag '6.16-rc-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension ksmbd: provide zero as a unique ID to the Mac client ksmbd: remove unnecessary softdep on crc32 ksmbd: use SHA-256 library API instead of crypto_shash API commit ff0905bbf991f4337b5ebc19c0d43525ebb0d96b Merge: 16b70698aa3ae7 3d11125ff624b5 Author: Linus Torvalds Date: Wed Jun 4 19:14:24 2025 -0700 Merge tag 'bcachefs-2025-06-04' of git://evilpiepirate.org/bcachefs Pull more bcachefs updates from Kent Overstreet: "More bcachefs updates: - More stack usage improvements (~600 bytes) - Define CLASS()es for some commonly used types, and convert most rcu_read_lock() uses to the new lock guards - New introspection: - Superblock error counters are now available in sysfs: previously, they were only visible with 'show-super', which doesn't provide a live view - New tracepoint, error_throw(), which is called any time we return an error and start to unwind - Repair - check_fix_ptrs() can now repair btree node roots - We can now repair when we've somehow ended up with the journal using a superblock bucket - Revert some leftovers from the aborted directory i_size feature, and add repair code: some userspace programs (e.g. sshfs) were getting confused It seems in 6.15 there's a bug where i_nlink on the vfs inode has been getting incorrectly set to 0, with some unfortunate results; list_journal analysis showed bch2_inode_rm() being called (by bch2_evict_inode()) when it clearly should not have been. - bch2_inode_rm() now runs "should we be deleting this inode?" checks that were previously only run when deleting unlinked inodes in recovery - check_subvol() was treating a dangling subvol (pointing to a missing root inode) like a dangling dirent, and deleting it. This was the really unfortunate one: check_subvol() will now recreate the root inode if necessary This took longer to debug than it should have, and we lost several filesystems unnecessarily, because users have been ignoring the release notes and blindly running 'fsck -y'. Debugging required reconstructing what happened through analyzing the journal, when ideally someone would have noticed 'hey, fsck is asking me if I want to repair this: it usually doesn't, maybe I should run this in dry run mode and check what's going on?' As a reminder, fsck errors are being marked as autofix once we've verified, in real world usage, that they're working correctly; blindly running 'fsck -y' on an experimental filesystem is playing with fire Up to this incident we've had an excellent track record of not losing data, so let's try to learn from this one This is a community effort, I wouldn't be able to get this done without the help of all the people QAing and providing excellent bug reports and feedback based on real world usage. But please don't ignore advice and expect me to pick up the pieces If an error isn't marked as autofix, and it /is/ happening in the wild, that's also something I need to know about so we can check it out and add it to the autofix list if repair looks good. I haven't been getting those reports, and I should be; since we don't have any sort of telemetry yet I am absolutely dependent on user reports Now I'll be spending the weekend working on new repair code to see if I can get a filesystem back for a user who didn't have backups" * tag 'bcachefs-2025-06-04' of git://evilpiepirate.org/bcachefs: (69 commits) bcachefs: add cond_resched() to handle_overwrites() bcachefs: Make journal read log message a bit quieter bcachefs: Fix subvol to missing root repair bcachefs: Run may_delete_deleted_inode() checks in bch2_inode_rm() bcachefs: delete dead code from may_delete_deleted_inode() bcachefs: Add flags to subvolume_to_text() bcachefs: Fix oops in btree_node_seq_matches() bcachefs: Fix dirent_casefold_mismatch repair bcachefs: Fix bch2_fsck_rename_dirent() for casefold bcachefs: Redo bch2_dirent_init_name() bcachefs: Fix -Wc23-extensions in bch2_check_dirents() bcachefs: Run check_dirents second time if required bcachefs: Run snapshot deletion out of system_long_wq bcachefs: Make check_key_has_snapshot safer bcachefs: BCH_RECOVERY_PASS_NO_RATELIMIT bcachefs: bch2_require_recovery_pass() bcachefs: bch_err_throw() bcachefs: Repair code for directory i_size bcachefs: Kill un-reverted directory i_size code bcachefs: Delete redundant fsck_err() ... commit 7977448bf374f6e9592153838f072a89bd3b5c45 Author: Clément Léger Date: Fri May 23 12:19:27 2025 +0200 riscv: misaligned: add a function to check misalign trap delegability Checking for the delegability of the misaligned access trap is needed for the KVM FWFT extension implementation. Add a function to get the delegability of the misaligned trap exception. Signed-off-by: Clément Léger Reviewed-by: Andrew Jones Reviewed-by: Charlie Jenkins Tested-by: Charlie Jenkins Link: https://lore.kernel.org/r/20250523101932.1594077-11-cleger@rivosinc.com Signed-off-by: Palmer Dabbelt commit 4eaaa65e301208d6ff612ad2244c6174c9d852b8 Author: Clément Léger Date: Fri May 23 12:19:26 2025 +0200 riscv: misaligned: move emulated access uniformity check in a function Split the code that check for the uniformity of misaligned accesses performance on all cpus from check_unaligned_access_emulated_all_cpus() to its own function which will be used for delegation check. No functional changes intended. Signed-off-by: Clément Léger Reviewed-by: Andrew Jones Reviewed-by: Charlie Jenkins Tested-by: Charlie Jenkins Link: https://lore.kernel.org/r/20250523101932.1594077-10-cleger@rivosinc.com Signed-off-by: Palmer Dabbelt commit 1317045a7d6f397904d105f6d40dc9787876a34b Author: Clément Léger Date: Fri May 23 12:19:25 2025 +0200 riscv: misaligned: declare misaligned_access_speed under CONFIG_RISCV_MISALIGNED While misaligned_access_speed was defined in a file compile with CONFIG_RISCV_MISALIGNED, its definition was under CONFIG_RISCV_SCALAR_MISALIGNED. This resulted in compilation problems when using it in a file compiled with CONFIG_RISCV_MISALIGNED. Move the declaration under CONFIG_RISCV_MISALIGNED so that it can be used unconditionnally when compiled with that config and remove the check for that variable in traps_misaligned.c. Signed-off-by: Clément Léger Reviewed-by: Charlie Jenkins Tested-by: Charlie Jenkins Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20250523101932.1594077-9-cleger@rivosinc.com Signed-off-by: Palmer Dabbelt commit 9f9f6fdd1dc6791bcfe251160a96a446199f85ce Author: Clément Léger Date: Fri May 23 12:19:24 2025 +0200 riscv: misaligned: use on_each_cpu() for scalar misaligned access probing schedule_on_each_cpu() was used without any good reason while documented as very slow. This call was in the boot path, so better use on_each_cpu() for scalar misaligned checking. Vector misaligned check still needs to use schedule_on_each_cpu() since it requires irqs to be enabled but that's less of a problem since this code is ran in a kthread. Add a comment to explicit that. Signed-off-by: Clément Léger Reviewed-by: Andrew Jones Reviewed-by: Charlie Jenkins Tested-by: Charlie Jenkins Link: https://lore.kernel.org/r/20250523101932.1594077-8-cleger@rivosinc.com Signed-off-by: Palmer Dabbelt commit cf5a8abc6560f989a880bec3647c614e638a0c9f Author: Clément Léger Date: Fri May 23 12:19:23 2025 +0200 riscv: misaligned: request misaligned exception from SBI Now that the kernel can handle misaligned accesses in S-mode, request misaligned access exception delegation from SBI. This uses the FWFT SBI extension defined in SBI version 3.0. Signed-off-by: Clément Léger Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20250523101932.1594077-7-cleger@rivosinc.com Signed-off-by: Palmer Dabbelt commit c4a50db1e1739a5d4698dee7cd4c6f6430bff7b3 Author: Clément Léger Date: Fri May 23 12:19:22 2025 +0200 riscv: sbi: add SBI FWFT extension calls Add FWFT extension calls. This will be ratified in SBI V3.0 hence, it is provided as a separate commit that can be left out if needed. Signed-off-by: Clément Léger Reviewed-by: Andrew Jones Reviewed-by: Atish Patra Link: https://lore.kernel.org/r/20250523101932.1594077-6-cleger@rivosinc.com Signed-off-by: Palmer Dabbelt commit 6d6d0641dcfa9d1e398d75791283bf6d129135de Author: Clément Léger Date: Fri May 23 12:19:21 2025 +0200 riscv: sbi: add FWFT extension interface This SBI extensions enables supervisor mode to control feature that are under M-mode control (For instance, Svadu menvcfg ADUE bit, Ssdbltrp DTE, etc). Add an interface to set local features for a specific cpu mask as well as for the online cpu mask. Signed-off-by: Clément Léger Reviewed-by: Andrew Jones Reviewed-by: Atish Patra Link: https://lore.kernel.org/r/20250523101932.1594077-5-cleger@rivosinc.com Signed-off-by: Palmer Dabbelt commit 99cf5b7c738733032af9a265a6a5a6bc34b91900 Author: Clément Léger Date: Fri May 23 12:19:20 2025 +0200 riscv: sbi: add new SBI error mappings A few new errors have been added with SBI V3.0, maps them as close as possible to errno values. Signed-off-by: Clément Léger Reviewed-by: Andrew Jones Reviewed-by: Atish Patra Link: https://lore.kernel.org/r/20250523101932.1594077-4-cleger@rivosinc.com Signed-off-by: Palmer Dabbelt commit a7cd450f0e06b4118b2ca8b4e1ef707d5c2c4506 Author: Clément Léger Date: Fri May 23 12:19:19 2025 +0200 riscv: sbi: remove useless parenthesis A few parenthesis in check for SBI version/extension were useless, remove them. Signed-off-by: Clément Léger Reviewed-by: Andrew Jones Reviewed-by: Atish Patra Link: https://lore.kernel.org/r/20250523101932.1594077-3-cleger@rivosinc.com Signed-off-by: Palmer Dabbelt commit cf8651f7319d12a6fd81e1d001afb0958ee2bf28 Author: Clément Léger Date: Fri May 23 12:19:18 2025 +0200 riscv: sbi: add Firmware Feature (FWFT) SBI extensions definitions The Firmware Features extension (FWFT) was added as part of the SBI 3.0 specification. Add SBI definitions to use this extension. Signed-off-by: Clément Léger Reviewed-by: Samuel Holland Tested-by: Samuel Holland Reviewed-by: Deepak Gupta Reviewed-by: Andrew Jones Reviewed-by: Atish Patra Link: https://lore.kernel.org/r/20250523101932.1594077-2-cleger@rivosinc.com Signed-off-by: Palmer Dabbelt commit b55eb6eb2a7427428c59b293a0900131fc849595 Author: Mike Yuan Date: Wed Jun 4 15:03:42 2025 +0000 pidfs: never refuse ppid == 0 in PIDFD_GET_INFO In systemd we spotted an issue after switching to ioctl(PIDFD_GET_INFO) for obtaining pid number the pidfd refers to, that for processes with a parent from outer pidns PIDFD_GET_INFO unexpectedly yields -ESRCH [1]. It turned out that there's an arbitrary check blocking this, which is not really sensible given getppid() happily returns 0 for such processes. Just drop the spurious check and userspace ought to handle ppid == 0 properly everywhere. [1] https://github.com/systemd/systemd/issues/37715 Fixes: cdda1f26e74b ("pidfd: add ioctl to retrieve pid info") Signed-off-by: Mike Yuan Link: https://lore.kernel.org/20250604150238.42664-1-me@yhndnzj.com Cc: Christian Brauner Cc: Luca Boccassi Cc: stable@vger.kernel.org Signed-off-by: Christian Brauner commit 3d11125ff624b540334f7134d98b94f3b980e85d Author: Kent Overstreet Date: Tue Jun 3 11:47:51 2025 -0400 bcachefs: add cond_resched() to handle_overwrites() Fix soft lockup warnings in btree nodes can. Signed-off-by: Kent Overstreet commit a4b0f750505cc4ffdafca3e8e6bd731341c6bb68 Author: Kent Overstreet Date: Tue Jun 3 09:31:58 2025 -0400 bcachefs: Make journal read log message a bit quieter Users seem to be assuming that the 'dropped unflushed entries' message at the end of journal read indicates some sort of problem, when it does not - we expect there to be entries in the journal that weren't commited, it's purely informational so that we can correlate journal sequence numbers elsewhere when debugging. Shorten the log message a bit to hopefully make this clearer. Signed-off-by: Kent Overstreet commit 29cc6fb7c068c773049d3bde14b939033893eff4 Author: Kent Overstreet Date: Mon Jun 2 19:48:27 2025 -0400 bcachefs: Fix subvol to missing root repair We had a bug where the root inode of a subvolume was erronously deleted: bch2_evict_inode() called bch2_inode_rm(), meaning the VFS inode's i_nlink was somehow set to 0 when it shouldn't have - the inode in the btree indicated it clearly was not unlinked. This has been addressed with additional safety checks in bch2_inode_rm() - pulling in the safety checks we already were doing when deleting unlinked inodes in recovery - but the really disastrous bug was in check_subvols(), which on finding a dangling subvol (subvol with a missing root inode) would delete the subvolume. I assume this bug dates from early check_directory_structure() code, which originally handled subvolumes and normal paths - the idea being that still live contents of the subvolume would get reattached somewhere. But that's incorrect, and disastrously so; deleting a subvolume triggers deleting the snapshot ID it points to, deleting the entire contents. The correct way to repair is to recreate the root inode if it's missing; then any contents will get reattached under that subvolume's lost+found. Signed-off-by: Kent Overstreet commit 09fb85ae565645b982e9030dbb2ff6707f2cdddc Author: Kent Overstreet Date: Mon Jun 2 17:43:36 2025 -0400 bcachefs: Run may_delete_deleted_inode() checks in bch2_inode_rm() We had a bug where bch2_evict_inode() incorrectly called bch2_inode_rm() - the journal clearly showed the inode was not unlinked. We've got checks that we use in recovery when cleaning up deleted inodes, lift them to bch2_inode_rm() as well. Signed-off-by: Kent Overstreet commit bb6689bbeebc6fb51f0f120b486bdcc9a38ffcf6 Author: Kent Overstreet Date: Mon Jun 2 18:26:44 2025 -0400 bcachefs: delete dead code from may_delete_deleted_inode() Signed-off-by: Kent Overstreet commit bfaac2c54694f72d08db5cfad0a1fce2a4c7e45e Author: Kent Overstreet Date: Mon Jun 2 17:23:49 2025 -0400 bcachefs: Add flags to subvolume_to_text() Signed-off-by: Kent Overstreet commit 9f2dc5f39431a17d304e5845a3f7e78905473442 Author: Kent Overstreet Date: Mon Jun 2 09:26:20 2025 -0400 bcachefs: Fix oops in btree_node_seq_matches() btree_update_nodes_written() needs to wait on in-flight writes to old nodes before marking them as freed. But it has no reason to pin those old nodes in memory, so some trickyness ensues. The update we're completing deleted references to those nodes from the btree, so we know if they've been evicted they can't be pulled back in. We just have to check if the nodes we have pointers to are still those old nodes, and haven't been reused. To do that we check the node's "sequence number" (actually a random 64 bit cookie), but that lives in the node's data buffer. 'struct btree' can't be freed until filesystem shutdown (as they're quite small), but the data buffers can be freed or swapped around. Commit 1f88c3567495, which was fixing a kmsan warning, assumed that we could safely do this locklessly with just a READ_ONCE() - if we've got a non-null ptr it would be safe to read from. But that's not true if the data buffer is a vmalloc allocation, so we need to restore the locking that commit deleted (or alternatively RCU free those data buffers, but there's no other reason for that). Fixes: 1f88c3567495 ("bcachefs: Fix a KMSAN splat in btree_update_nodes_written()") Signed-off-by: Kent Overstreet commit 2bf380c005adcc653464215a5170afa3367c0b22 Author: Kent Overstreet Date: Sat May 31 00:11:52 2025 -0400 bcachefs: Fix dirent_casefold_mismatch repair Instead of simply recreating a mis-casefolded dirent, use the str_hash repair code, which will rename it if necessary - the dirent might have been created again with the correct casefolding. Factor out out bch2_str_hash_repair key() from __bch2_str_hash_check_key() for the new path to use, and export bch2_dirent_create_key() as well. Signed-off-by: Kent Overstreet commit b938d3c970175b2f3d22865dc077482fc6137828 Author: Kent Overstreet Date: Sat May 31 17:00:00 2025 -0400 bcachefs: Fix bch2_fsck_rename_dirent() for casefold bch2_fsck_renamed_dirent was creating bch_dirent keys open-coded - but we need to use the appropriate helper, if the directory is casefolded. Signed-off-by: Kent Overstreet commit 35c1f131bc5ff9d6fb9599b3ae5a15dd83a27e31 Author: Kent Overstreet Date: Sun Jun 1 18:35:18 2025 -0400 bcachefs: Redo bch2_dirent_init_name() Redo (and simplify somewhat) how casefolded and non casefolded dirents are initialized, and export this to be used by fsck_rename_dirent(). Signed-off-by: Kent Overstreet commit 01d925f7e18360f740e7b75bfad9b6e55fd4dc53 Author: Nathan Chancellor Date: Wed Jun 4 12:38:27 2025 -0700 bcachefs: Fix -Wc23-extensions in bch2_check_dirents() Clang warns (or errors with CONFIG_WERROR=y): fs/bcachefs/fsck.c:2325:2: error: label followed by a declaration is a C23 extension [-Werror,-Wc23-extensions] 2325 | int ret = bch2_trans_run(c, | ^ On clang-17 and older, this is an unconditional error: fs/bcachefs/fsck.c:2325:2: error: expected expression 2325 | int ret = bch2_trans_run(c, | ^ Move the declaration of ret to the top of the function to resolve both ways this issue manifests. Fixes: c72def523799 ("bcachefs: Run check_dirents second time if required") Signed-off-by: Nathan Chancellor Signed-off-by: Kent Overstreet commit ee11d953fd230b4e1c28388913826ca832ae8444 Author: Rob Clark Date: Wed Jun 4 10:55:58 2025 -0700 MAINTAINERS: .mailmap: update Rob Clark's email address Remap historical email addresses to @oss.qualcomm.com. Signed-off-by: Rob Clark Acked-by: Dmitry Baryshkov Reviewed-by: Bjorn Andersson Patchwork: https://patchwork.freedesktop.org/patch/656974/ commit cb4607816835e1bd5c944ca847a43d84e065a330 Author: Akhil P Oommen Date: Tue Jun 3 17:45:06 2025 +0530 mailmap: Update entry for Akhil P Oommen A new policy within qualcomm requires me to use a new email address for all future contributions to Linux kernel. Update the mailmap to map my old email addresses to the new one, ie akhilpo@oss.qualcomm.com Signed-off-by: Akhil P Oommen Signed-off-by: Akhil P Oommen Link: https://lore.kernel.org/lkml/20250603121508.296678-1-quic_akhilpo@quicinc.com Signed-off-by: Rob Clark commit d6984d0c0a561b17ed4ba4f8f20b916402430adc Author: Abhinav Kumar Date: Fri May 23 11:27:27 2025 -0700 MAINTAINERS: update my email address My current email address will stop working soon. Use linux.dev email instead. Signed-off-by: Abhinav Kumar Acked-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/655555/ Signed-off-by: Rob Clark commit 11bb662bfa9761d8d678f3e801554bfc0736c7e8 Author: Abhinav Kumar Date: Fri May 23 11:27:26 2025 -0700 MAINTAINERS: drop myself as maintainer I will no longer regularly work on this platform. Hence will step down from maintainer duties. Also, add Jessica as a reviewer to the MSM DRM subsystem to help out with the reviews. Signed-off-by: Abhinav Kumar Acked-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/655558/ Signed-off-by: Rob Clark commit 16b70698aa3ae7888826d0c84567c72241cf6713 Merge: 3719a04a80caf6 9960be72a54cf0 Author: Linus Torvalds Date: Wed Jun 4 12:07:16 2025 -0700 Merge tag 'sched_ext-for-6.16-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fixes from Tejun Heo: "Two fixes in the built-in idle selection helpers: - Fix prev_cpu handling to guarantee that idle selection never returns a CPU that's not allowed - Skip cross-node search when !NUMA which could lead to infinite looping due to a bug in NUMA iterator" * tag 'sched_ext-for-6.16-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: sched_ext: idle: Skip cross-node search with !CONFIG_NUMA sched_ext: idle: Properly handle invalid prev_cpu during idle selection commit dd2922dcfaa3296846265e113309e5f7f138839f Author: Zeng Heng Date: Tue Jun 3 20:58:28 2025 +0800 fs/resctrl: Restore the rdt_last_cmd_clear() calls after acquiring rdtgroup_mutex A lockdep fix removed two rdt_last_cmd_clear() calls that were used to clear the last_cmd_status buffer but called without holding the required rdtgroup_mutex. The impacted resctrl commands are writing to the cpus or cpus_list files and creating a new monitor or control group. With stale data in the last_cmd_status buffer the impacted resctrl commands report the stale error on success, or append its own failure message to the stale error on failure. Consequently, restore the rdt_last_cmd_clear() calls after acquiring rdtgroup_mutex. Fixes: c8eafe149530 ("x86/resctrl: Fix potential lockdep warning") Signed-off-by: Zeng Heng Signed-off-by: Thomas Gleixner Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/all/20250603125828.1590067-1-zengheng4@huawei.com commit 3719a04a80caf660f899a462cd8f3973bcfa676e Merge: 1af80d00e1e026 3de914864c0d53 Author: Linus Torvalds Date: Wed Jun 4 11:26:17 2025 -0700 Merge tag 'pci-v6.16-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci updates from Bjorn Helgaas: "Enumeration: - Print the actual delay time in pci_bridge_wait_for_secondary_bus() instead of assuming it was 1000ms (Wilfred Mallawa) - Revert 'iommu/amd: Prevent binding other PCI drivers to IOMMU PCI devices', which broke resume from system sleep on AMD platforms and has been fixed by other commits (Lukas Wunner) Resource management: - Remove mtip32xx use of pcim_iounmap_regions(), which is deprecated and unnecessary (Philipp Stanner) - Remove pcim_iounmap_regions() and pcim_request_region_exclusive() and related flags since all uses have been removed (Philipp Stanner) - Rework devres 'request' functions so they are no longer 'hybrid', i.e., their behavior no longer depends on whether pcim_enable_device or pci_enable_device() was used, and remove related code (Philipp Stanner) - Warn (not BUG()) about failure to assign optional resources (Ilpo Järvinen) Error handling: - Log the DPC Error Source ID only when it's actually valid (when ERR_FATAL or ERR_NONFATAL was received from a downstream device) and decode into bus/device/function (Bjorn Helgaas) - Determine AER log level once and save it so all related messages use the same level (Karolina Stolarek) - Use KERN_WARNING, not KERN_ERR, when logging PCIe Correctable Errors (Karolina Stolarek) - Ratelimit PCIe Correctable and Non-Fatal error logging, with sysfs controls on interval and burst count, to avoid flooding logs and RCU stall warnings (Jon Pan-Doh) Power management: - Increment PM usage counter when probing reset methods so we don't try to read config space of a powered-off device (Alex Williamson) - Set all devices to D0 during enumeration to ensure ACPI opregion is connected via _REG (Mario Limonciello) Power control: - Rename pwrctrl Kconfig symbols from 'PWRCTL' to 'PWRCTRL' to match the filename paths. Retain old deprecated symbols for compatibility, except for the pwrctrl slot driver (PCI_PWRCTRL_SLOT) (Johan Hovold) - When unregistering pwrctrl, cancel outstanding rescan work before cleaning up data structures to avoid use-after-free issues (Brian Norris) Bandwidth control: - Simplify link bandwidth controller by replacing the count of Link Bandwidth Management Status (LBMS) events with a PCI_LINK_LBMS_SEEN flag (Ilpo Järvinen) - Update the Link Speed after retraining, since the Link Speed may have changed (Ilpo Järvinen) PCIe native device hotplug: - Ignore Presence Detect Changed caused by DPC. pciehp already ignores Link Down/Up events caused by DPC, but on slots using in-band presence detect, DPC causes a spurious Presence Detect Changed event (Lukas Wunner) - Ignore Link Down/Up caused by Secondary Bus Reset. On hotplug ports using in-band presence detect, the reset causes a Presence Detect Changed event, which mistakenly caused teardown and re-enumeration of the device. Drivers may need to annotate code that resets their device (Lukas Wunner) Virtualization: - Add an ACS quirk for Loongson Root Ports that don't advertise ACS but don't allow peer-to-peer transactions between Root Ports; the quirk allows each Root Port to be in a separate IOMMU group (Huacai Chen) Endpoint framework: - For fixed-size BARs, retain both the actual size and the possibly larger size allocated to accommodate iATU alignment requirements (Jerome Brunet) - Simplify ctrl/SPAD space allocation and avoid allocating more space than needed (Jerome Brunet) - Correct MSI-X PBA offset calculations for DesignWare and Cadence endpoint controllers (Niklas Cassel) - Align the return value (number of interrupts) encoding for pci_epc_get_msi()/pci_epc_ops::get_msi() and pci_epc_get_msix()/pci_epc_ops::get_msix() (Niklas Cassel) - Align the nr_irqs parameter encoding for pci_epc_set_msi()/pci_epc_ops::set_msi() and pci_epc_set_msix()/pci_epc_ops::set_msix() (Niklas Cassel) Common host controller library: - Convert pci-host-common to a library so platforms that don't need native host controller drivers don't need to include these helper functions (Manivannan Sadhasivam) Apple PCIe controller driver: - Extract ECAM bridge creation helper from pci_host_common_probe() to separate driver-specific things like MSI from PCI things (Marc Zyngier) - Dynamically allocate RID-to_SID bitmap to prepare for SoCs with varying capabilities (Marc Zyngier) - Skip ports disabled in DT when setting up ports (Janne Grunau) - Add t6020 compatible string (Alyssa Rosenzweig) - Add T602x PCIe support (Hector Martin) - Directly set/clear INTx mask bits because T602x dropped the accessors that could do this without locking (Marc Zyngier) - Move port PHY registers to their own reg items to accommodate T602x, which moves them around; retain default offsets for existing DTs that lack phy%d entries with the reg offsets (Hector Martin) - Stop polling for core refclk, which doesn't work on T602x and the bootloader has already done anyway (Hector Martin) - Use gpiod_set_value_cansleep() when asserting PERST# in probe because we're allowed to sleep there (Hector Martin) Cadence PCIe controller driver: - Drop a runtime PM 'put' to resolve a runtime atomic count underflow (Hans Zhang) - Make the cadence core buildable as a module (Kishon Vijay Abraham I) - Add cdns_pcie_host_disable() and cdns_pcie_ep_disable() for use by loadable drivers when they are removed (Siddharth Vadapalli) Freescale i.MX6 PCIe controller driver: - Apply link training workaround only on IMX6Q, IMX6SX, IMX6SP (Richard Zhu) - Remove redundant dw_pcie_wait_for_link() from imx_pcie_start_link(); since the DWC core does this, imx6 only needs it when retraining for a faster link speed (Richard Zhu) - Toggle i.MX95 core reset to align with PHY powerup (Richard Zhu) - Set SYS_AUX_PWR_DET to work around i.MX95 ERR051624 erratum: in some cases, the controller can't exit 'L23 Ready' through Beacon or PERST# deassertion (Richard Zhu) - Clear GEN3_ZRXDC_NONCOMPL to work around i.MX95 ERR051586 erratum: controller can't meet 2.5 GT/s ZRX-DC timing when operating at 8 GT/s, causing timeouts in L1 (Richard Zhu) - Wait for i.MX95 PLL lock before enabling controller (Richard Zhu) - Save/restore i.MX95 LUT for suspend/resume (Richard Zhu) Mobiveil PCIe controller driver: - Return bool (not int) for link-up check in mobiveil_pab_ops.link_up() and layerscape-gen4, mobiveil (Hans Zhang) NVIDIA Tegra194 PCIe controller driver: - Create debugfs directory for 'aspm_state_cnt' only when CONFIG_PCIEASPM is enabled, since there are no other entries (Hans Zhang) Qualcomm PCIe controller driver: - Add OF support for parsing DT 'eq-presets-gts' property for lane equalization presets (Krishna Chaitanya Chundru) - Read Maximum Link Width from the Link Capabilities register if DT lacks 'num-lanes' property (Krishna Chaitanya Chundru) - Add Physical Layer 64 GT/s Capability ID and register offsets for 8, 32, and 64 GT/s lane equalization registers (Krishna Chaitanya Chundru) - Add generic dwc support for configuring lane equalization presets (Krishna Chaitanya Chundru) - Add DT and driver support for PCIe on IPQ5018 SoC (Nitheesh Sekar) Renesas R-Car PCIe controller driver: - Describe endpoint BAR 4 as being fixed size (Jerome Brunet) - Document how to obtain R-Car V4H (r8a779g0) controller firmware (Yoshihiro Shimoda) Rockchip PCIe controller driver: - Reorder rockchip_pci_core_rsts because reset_control_bulk_deassert() deasserts in reverse order, to fix a link training regression (Jensen Huang) - Mark RK3399 as being capable of raising INTx interrupts (Niklas Cassel) Rockchip DesignWare PCIe controller driver: - Check only PCIE_LINKUP, not LTSSM status, to determine whether the link is up (Shawn Lin) - Increase N_FTS (used in L0s->L0 transitions) and enable ASPM L0s for Root Complex and Endpoint modes (Shawn Lin) - Hide the broken ATS Capability in rockchip_pcie_ep_init() instead of rockchip_pcie_ep_pre_init() so it stays hidden after PERST# resets non-sticky registers (Shawn Lin) - Call phy_power_off() before phy_exit() in rockchip_pcie_phy_deinit() (Diederik de Haas) Synopsys DesignWare PCIe controller driver: - Set PORT_LOGIC_LINK_WIDTH to one lane to make initial link training more robust; this will not affect the intended link width if all lanes are functional (Wenbin Yao) - Return bool (not int) for link-up check in dw_pcie_ops.link_up() and armada8k, dra7xx, dw-rockchip, exynos, histb, keembay, keystone, kirin, meson, qcom, qcom-ep, rcar_gen4, spear13xx, tegra194, uniphier, visconti (Hans Zhang) - Add debugfs support for exposing DWC device-specific PTM context (Manivannan Sadhasivam) TI J721E PCIe driver: - Make j721e buildable as a loadable and removable module (Siddharth Vadapalli) - Fix j721e host/endpoint dependencies that result in link failures in some configs (Arnd Bergmann) Device tree bindings: - Add qcom DT binding for 'global' interrupt (PCIe controller and link-specific events) for ipq8074, ipq8074-gen3, ipq6018, sa8775p, sc7280, sc8180x sdm845, sm8150, sm8250, sm8350 (Manivannan Sadhasivam) - Add qcom DT binding for 8 MSI SPI interrupts for msm8998, ipq8074, ipq8074-gen3, ipq6018 (Manivannan Sadhasivam) - Add dw rockchip DT binding for rk3576 and rk3562 (Kever Yang) - Correct indentation and style of examples in brcm,stb-pcie, cdns,cdns-pcie-ep, intel,keembay-pcie-ep, intel,keembay-pcie, microchip,pcie-host, rcar-pci-ep, rcar-pci-host, xilinx-versal-cpm (Krzysztof Kozlowski) - Convert Marvell EBU (dove, kirkwood, armada-370, armada-xp) and armada8k from text to schema DT bindings (Rob Herring) - Remove obsolete .txt DT bindings for content that has been moved to schemas (Rob Herring) - Add qcom DT binding for MHI registers in IPQ5332, IPQ6018, IPQ8074 and IPQ9574 (Varadarajan Narayanan) - Convert v3,v360epc-pci from text to DT schema binding (Rob Herring) - Change microchip,pcie-host DT binding to be 'dma-noncoherent' since PolarFire may be configured that way (Conor Dooley) Miscellaneous: - Drop 'pci' suffix from intel_mid_pci.c filename to match similar files (Andy Shevchenko) - All platforms with PCI have an MMU, so add PCI Kconfig dependency on MMU to simplify build testing and avoid inadvertent build regressions (Arnd Bergmann) - Update Krzysztof Wilczyński's email address in MAINTAINERS (Krzysztof Wilczyński) - Update Manivannan Sadhasivam's email address in MAINTAINERS (Manivannan Sadhasivam)" * tag 'pci-v6.16-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: (147 commits) MAINTAINERS: Update Manivannan Sadhasivam email address PCI: j721e: Fix host/endpoint dependencies PCI: j721e: Add support to build as a loadable module PCI: cadence-ep: Introduce cdns_pcie_ep_disable() helper for cleanup PCI: cadence-host: Introduce cdns_pcie_host_disable() helper for cleanup PCI: cadence: Add support to build pcie-cadence library as a kernel module MAINTAINERS: Update Krzysztof Wilczyński email address PCI: Remove unnecessary linesplit in __pci_setup_bridge() PCI: WARN (not BUG()) when we fail to assign optional resources PCI: Remove unused pci_printk() PCI: qcom: Replace PERST# sleep time with proper macro PCI: dw-rockchip: Replace PERST# sleep time with proper macro PCI: host-common: Convert to library for host controller drivers PCI/ERR: Remove misleading TODO regarding kernel panic PCI: cadence: Remove duplicate message code definitions PCI: endpoint: Align pci_epc_set_msix(), pci_epc_ops::set_msix() nr_irqs encoding PCI: endpoint: Align pci_epc_set_msi(), pci_epc_ops::set_msi() nr_irqs encoding PCI: endpoint: Align pci_epc_get_msix(), pci_epc_ops::get_msix() return value encoding PCI: endpoint: Align pci_epc_get_msi(), pci_epc_ops::get_msi() return value encoding PCI: cadence-ep: Correct PBA offset in .set_msix() callback ... commit 079afb081c4288e94d5e4223d3eb6306d853c68b Author: Jens Axboe Date: Wed Jun 4 10:25:42 2025 -0600 io_uring/futex: mark wait requests as inflight Inflight marking is used so that do_exit() -> io_uring_files_cancel() will find requests with files that reference an io_uring instance, so they can get appropriately canceled before the files go away. However, it's also called before the mm goes away. Mark futex/futexv wait requests as being inflight, so that io_uring_files_cancel() will prune them. This ensures that the mm stays alive, which is important as an exiting mm will also free the futex private hash buckets. An io_uring futex request with FUTEX2_PRIVATE set relies on those being alive until the request has completed. A recent commit added these futex private hashes, which get killed when the mm goes away. Fixes: 80367ad01d93 ("futex: Add basic infrastructure for local task local hash") Link: https://lore.kernel.org/io-uring/38053.1749045482@localhost/ Reported-by: Robert Morris Signed-off-by: Jens Axboe commit 6a8118a77eec5fc4dfec69cc6bdc52229943f6ef Author: Jens Axboe Date: Wed Jun 4 08:49:32 2025 -0600 io_uring/futex: get rid of struct io_futex addr union Rather than use a union of a u32 and struct futex_waitv user address, consolidate it into a single void __user pointer instead. This also makes prep easier to use as the store happens to the member that will be used. No functional changes in this patch. Signed-off-by: Jens Axboe commit f81aa834bfa91c827f290b62a245e23c5ad2813c Author: Ilan Peer Date: Wed Jun 4 06:13:21 2025 +0300 wifi: iwlwifi: mld: Move regulatory domain initialization The regulatory domain information was initialized every time the FW was loaded and the device was restarted. This was unnecessary and useless as at this stage the wiphy channels information was not setup yet so while the regulatory domain was set to the wiphy, the channel information was not updated. In case that a specific MCC was configured during FW initialization then following updates with this MCC are ignored, and thus the wiphy channels information is left with information not matching the regulatory domain. This commit moves the regulatory domain initialization to after the operational firmware is started, i.e., after the wiphy channels were configured and the regulatory information is needed. Signed-off-by: Ilan Peer Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250604061200.f138a7382093.I2fd8b3e99be13c2687da483e2cb1311ffb4fbfce@changeid Signed-off-by: Miri Korenblit commit 847a4bf1b4bdcc224196d77714f71e36822fed70 Author: Johannes Berg Date: Wed Jun 4 06:13:20 2025 +0300 wifi: iwlwifi: pcie: fix non-MSIX handshake register When reading the interrupt status after a FW reset handshake timeout, read the actual value not the mask for the non-MSIX case. Fixes: ab606dea80c4 ("wifi: iwlwifi: pcie: add support for the reset handshake in MSI") Signed-off-by: Johannes Berg Reviewed-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250604061200.87a849a55086.I2f8571aafa55aa3b936a30b938de9d260592a584@changeid Signed-off-by: Miri Korenblit commit 960c7e6d388034d219dafffa6da0a5c2ccd5ff30 Author: Miri Korenblit Date: Wed Jun 4 06:13:19 2025 +0300 wifi: iwlwifi: mld: avoid panic on init failure In case of an error during init, in_hw_restart will be set, but it will never get cleared. Instead, we will retry to init again, and then we will act like we are in a restart when we are actually not. This causes (among others) to a NULL pointer dereference when canceling rx_omi::finished_work, that was not even initialized, because we thought that we are in hw_restart. Set in_hw_restart to true only if the fw is running, then we know that FW was loaded successfully and we are not going to the retry loop. Fixes: 7391b2a4f7db ("wifi: iwlwifi: rework firmware error handling") Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250604061200.e0040e0a4b09.Iae469a0abe6bfa3c26d8a88c066bad75c2e8f121@changeid Signed-off-by: Miri Korenblit commit 264c844abb29530b3e16d255f1eb2ccb06316b1f Author: Miri Korenblit Date: Wed Jun 4 06:13:18 2025 +0300 wifi: iwlwifi: mvm: fix assert on suspend After using DEFINE_RAW_FLEX, cmd is a pointer to iwl_rxq_sync_cmd, and not a variable containing both the command and notification. Adjust hcmd->data and hcmd->len assignment as well. Fixes: 7438843df8cf ("wifi: iwlwifi: mvm: Avoid -Wflex-array-member-not-at-end warning") Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250604031321.2277481-2-miriam.rachel.korenblit@intel.com Signed-off-by: Miri Korenblit commit 1af80d00e1e026c317c6ec19b1072f81ba7af64c Merge: f5ebe7bb87e045 354ad60e123dad Author: Linus Torvalds Date: Wed Jun 4 08:59:59 2025 -0700 Merge tag 'slab-for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab updates from Vlastimil Babka: - Make kvmalloc() more suitable for callers that need it to succeed, but without unnecessary overhead by reclaim and compaction to get a physically contiguous allocation. Instead fall back to vmalloc() more easily by default, unless instructed by __GFP_RETRY_MAYFAIL to prefer kmalloc() harder. This should allow the removal of a xfs-specific workaround (Michal Hocko) - Remove potentially excessive warnings due to memory pressure when allocating structures for per-object allocation profiling metadata (Usama Arif) * tag 'slab-for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: mm: slub: only warn once when allocating slab obj extensions fails mm: kvmalloc: make kmalloc fast path real fast path commit f5ebe7bb87e04537b37573f0a2516baa90ee23c0 Merge: 1a576136f8d708 59c11a7a9a138a Author: Linus Torvalds Date: Wed Jun 4 08:57:22 2025 -0700 Merge tag 'spdx-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx Pull LICENSES update from Greg KH: "Here is a single patch to the LICENSES/ directory to add the CC0 license that is currently used in the kcpuid x86 tool for one of their files. This fixes the error that spdxcheck.py currently has with the kcpuid file due to a missing LICENSE file for this specific license" * tag 'spdx-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx: LICENSES: add CC0-1.0 license text commit 3de914864c0d53b7c49aaa94e4ccda9e1dd271d7 Merge: 27b1aac553401d 308f8c7a626ecd Author: Bjorn Helgaas Date: Wed Jun 4 10:50:45 2025 -0500 Merge branch 'pci/misc' - Drop 'pci' suffix from intel_mid_pci.c filename to match similar files (Andy Shevchenko) - All platforms with PCI have an MMU, so add PCI Kconfig dependency on MMU to simplify build testing and avoid inadvertent build regressions (Arnd Bergmann) - Update driver path in PCI NVMe function documentation (Rick Wertenbroek) - Remove unused pci_printk() (Ilpo Järvinen) - Warn (not BUG()) about failure to assign optional resources (Ilpo Järvinen) - Update Krzysztof Wilczyński's email address in MAINTAINERS (Krzysztof Wilczyński) - Update Manivannan Sadhasivam's email address in MAINTAINERS (Manivannan Sadhasivam) * pci/misc: MAINTAINERS: Update Manivannan Sadhasivam email address MAINTAINERS: Update Krzysztof Wilczyński email address PCI: Remove unnecessary linesplit in __pci_setup_bridge() PCI: WARN (not BUG()) when we fail to assign optional resources PCI: Remove unused pci_printk() Documentation: Fix path for NVMe PCI endpoint target driver PCI: Add CONFIG_MMU dependency x86/PCI: Drop 'pci' suffix from intel_mid_pci.c commit 27b1aac553401d1f504c767e7274331c81360b4c Merge: db847adbf99f80 db8266017e0a70 Author: Bjorn Helgaas Date: Wed Jun 4 10:50:45 2025 -0500 Merge branch 'pci/dt-bindings' - Add qcom DT binding for 'global' interrupt (PCIe controller and link-specific events) for ipq8074, ipq8074-gen3, ipq6018, sa8775p, sc7280, sc8180x sdm845, sm8150, sm8250, sm8350 (Manivannan Sadhasivam) - Add qcom DT binding for 8 MSI SPI interrupts for msm8998, ipq8074, ipq8074-gen3, ipq6018 (Manivannan Sadhasivam) - Add dw rockchip DT binding for rk3576 and rk3562 (Kever Yang) - Correct indentation and style of examples in brcm,stb-pcie, cdns,cdns-pcie-ep, intel,keembay-pcie-ep, intel,keembay-pcie, microchip,pcie-host, rcar-pci-ep, rcar-pci-host, xilinx-versal-cpm (Krzysztof Kozlowski) - Fix include placement in sifive,fu740-pcie example (Krzysztof Kozlowski) - Convert Marvell EBU (dove, kirkwood, armada-370, armada-xp) and armada8k from text to schema DT bindings (Rob Herring) - Remove obsolete .txt DT bindings for content that has been moved to schemas (Rob Herring) - Add qcom DT binding for MHI registers in IPQ5332, IPQ6018, IPQ8074 and IPQ9574 (Varadarajan Narayanan) - Convert v3,v360epc-pci from text to DT schema binding (Rob Herring) - Change microchip,pcie-host DT binding to be 'dma-noncoherent' since PolarFire may be configured that way (Conor Dooley) * pci/dt-bindings: dt-bindings: PCI: microchip,pcie-host: Fix DMA coherency property dt-bindings: PCI: Convert v3,v360epc-pci to DT schema dt-bindings: PCI: qcom: Add MHI registers for IPQ9574 dt-bindings: PCI: Remove obsolete .txt docs dt-bindings: PCI: Convert marvell,armada8k-pcie to schema dt-bindings: PCI: Convert Marvell EBU to schema dt-bindings: PCI: sifive,fu740-pcie: Fix include placement in DTS example dt-bindings: PCI: Correct indentation and style in DTS example dt-bindings: PCI: dwc: rockchip: Add rk3562 support dt-bindings: PCI: dw: rockchip: Add rk3576 support dt-bindings: PCI: qcom,pcie-sc8180x: Add 'global' interrupt dt-bindings: PCI: qcom: Allow IPQ6018 to use 8 MSI and one 'global' interrupt dt-bindings: PCI: qcom: Allow IPQ8074 to use 8 MSI and one 'global' interrupt dt-bindings: PCI: qcom: Allow MSM8998 to use 8 MSI and one 'global' interrupt dt-bindings: PCI: qcom: Add 'global' interrupt for SDM845 SoC dt-bindings: PCI: qcom,pcie-sc7280: Add 'global' interrupt dt-bindings: PCI: qcom,pcie-sa8775p: Add 'global' interrupt dt-bindings: PCI: qcom,pcie-sm8350: Add 'global' interrupt dt-bindings: PCI: qcom,pcie-sm8250: Add 'global' interrupt dt-bindings: PCI: qcom,pcie-sm8150: Add 'global' interrupt commit db847adbf99f80088b5e545855c1bc7ea52973d1 Merge: df52b63940e644 5fbfae69e78d24 Author: Bjorn Helgaas Date: Wed Jun 4 10:50:44 2025 -0500 Merge branch 'pci/ptm-debugfs' - Add debugfs support for exposing DWC device-specific PTM context (Manivannan Sadhasivam) * pci/ptm-debugfs: PCI: qcom-ep: Mask PTM_UPDATING interrupt PCI: dwc: Add debugfs support for PTM context PCI: dwc: Pass DWC PCIe mode to dwc_pcie_debugfs_init() PCI: Add debugfs support for exposing PTM context commit df52b63940e64456d47cabcbc5a9c1137a3f0b2e Merge: fd0c51f7eb4b4a ed798ff1c52f6f Author: Bjorn Helgaas Date: Wed Jun 4 10:50:43 2025 -0500 Merge branch 'pci/controller/tegra194' - Create debugfs directory for 'aspm_state_cnt' only when CONFIG_PCIEASPM is enabled, since there are no other entries (Hans Zhang) * pci/controller/tegra194: PCI: tegra194: Create debugfs directory only when CONFIG_PCIEASPM is enabled commit fd0c51f7eb4b4ad9d7ed971757e76ce3fe346c85 Merge: d96c67a57ca60b a7d824b2df0d8b Author: Bjorn Helgaas Date: Wed Jun 4 10:50:43 2025 -0500 Merge branch 'pci/controller/rockchip' - Reorder rockchip_pci_core_rsts because reset_control_bulk_deassert() deasserts in reverse order, to fix a link training regression (Jensen Huang) - Mark RK3399 as being capable of raising INTx interrupts (Niklas Cassel) * pci/controller/rockchip: PCI: rockchip-ep: Mark RK3399 as intx_capable PCI: rockchip: Fix order of rockchip_pci_core_rsts commit d96c67a57ca60ba6535ab5459924fe9bd85f34ff Merge: 05cf00aa05afed 003d15b30f3690 Author: Bjorn Helgaas Date: Wed Jun 4 10:50:42 2025 -0500 Merge branch 'pci/controller/rcar-gen4' - Describe endpoint BAR 4 as being fixed size (Jerome Brunet) - Document how to obtain R-Car V4H (r8a779g0) controller firmware (Yoshihiro Shimoda) * pci/controller/rcar-gen4: PCI: rcar-gen4: Document how to obtain platform firmware PCI: rcar-gen4: set ep BAR4 fixed size commit 05cf00aa05afed0d6808cce6654ef8be457fb6bb Merge: c7b9c591245e32 3e5127469a8d41 Author: Bjorn Helgaas Date: Wed Jun 4 10:50:42 2025 -0500 Merge branch 'pci/controller/qcom' - Add OF support for parsing DT 'eq-presets-gts' property for lane equalization presets (Krishna Chaitanya Chundru) - Read Maximum Link Width from the Link Capabilities register if DT lacks 'num-lanes' property (Krishna Chaitanya Chundru) - Add Physical Layer 64 GT/s Capability ID and register offsets for 8, 32, and 64 GT/s lane equalization registers (Krishna Chaitanya Chundru) - Add generic dwc support for configuring lane equalization presets (Krishna Chaitanya Chundru) - Add DT and driver support for PCIe on IPQ5018 SoC (Nitheesh Sekar) * pci/controller/qcom: PCI: qcom: Add support for IPQ5018 dt-bindings: PCI: qcom: Add IPQ5018 SoC PCI: dwc: Add support for configuring lane equalization presets PCI: Add lane equalization register offsets PCI: dwc: Update pci->num_lanes to maximum supported link width PCI: of: Add of_pci_get_equalization_presets() API commit c7b9c591245e32b5c7b235f48485497e1e8f9e2a Merge: dee6ce5c6f1dc6 5da3d94a23c6c1 Author: Bjorn Helgaas Date: Wed Jun 4 10:50:41 2025 -0500 Merge branch 'pci/controller/mvebu' - Use for_each_of_range() iterator for parsing 'ranges' (Rob Herring) * pci/controller/mvebu: PCI: mvebu: Use for_each_of_range() iterator for parsing "ranges" commit dee6ce5c6f1dc6fe88d268ca6152a157c1086b4c Merge: f4ff0b0ed26c57 5e2664f9e108f6 Author: Bjorn Helgaas Date: Wed Jun 4 10:50:41 2025 -0500 Merge branch 'pci/controller/mobiveil' - Use to_delayed_work() instead of open-coding it (Chen Ni) * pci/controller/mobiveil: PCI: ls-gen4: Use to_delayed_work() commit f4ff0b0ed26c57a1c01c3f27d55d6504fe36a7ff Merge: 20611193be9843 e4d66131caaf18 Author: Bjorn Helgaas Date: Wed Jun 4 10:50:40 2025 -0500 Merge branch 'pci/controller/imx6' - Apply link training workaround only on IMX6Q, IMX6SX, IMX6SP (Richard Zhu) - Remove redundant dw_pcie_wait_for_link() from imx_pcie_start_link(); since the DWC core does this, imx6 only needs it when retraining for a faster link speed (Richard Zhu) - Toggle i.MX95 core reset to align with PHY powerup (Richard Zhu) - Set SYS_AUX_PWR_DET to work around i.MX95 ERR051624 erratum: in some cases, the controller can't exit 'L23 Ready' through Beacon or PERST# deassertion (Richard Zhu) - Clear GEN3_ZRXDC_NONCOMPL to work around i.MX95 ERR051586 erratum: controller can't meet 2.5 GT/s ZRX-DC timing when operating at 8 GT/s, causing timeouts in L1 (Richard Zhu) - Wait for i.MX95 PLL lock before enabling controller (Richard Zhu) - Save/restore i.MX95 LUT for suspend/resume (Richard Zhu) * pci/controller/imx6: PCI: imx6: Save and restore the LUT setting during suspend/resume for i.MX95 SoC PCI: imx6: Add PLL lock check for i.MX95 SoC PCI: imx6: Add workaround for errata ERR051586 PCI: imx6: Add workaround for errata ERR051624 PCI: imx6: Toggle the core reset for i.MX95 PCIe PCI: imx6: Call dw_pcie_wait_for_link() from start_link() callback only when required PCI: imx6: Skip link up workaround for newer platforms commit 20611193be984391b5ec80a372e7f8bbc7c5b07a Merge: 00c78a3c3fc34b af3c6eacce0c46 Author: Bjorn Helgaas Date: Wed Jun 4 10:50:39 2025 -0500 Merge branch 'pci/controller/dwc' - Set PORT_LOGIC_LINK_WIDTH to one lane to make initial link training more robust; this will not affect the intended link width if all lanes are functional (Wenbin Yao) * pci/controller/dwc: PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane commit 00c78a3c3fc34bf9d781f415d4dec41429457fc6 Merge: 20279628bb5e96 1d79596e866137 Author: Bjorn Helgaas Date: Wed Jun 4 10:50:39 2025 -0500 Merge branch 'pci/controller/dwc-ep' - Use FIELD_GET() to simplify extracting register values (Hans Zhang) * pci/controller/dwc-ep: PCI: dwc: ep: Fix errno typo PCI: dwc: ep: Use FIELD_GET() where applicable commit 20279628bb5e96852d417a18e9d85b9bc506e716 Merge: 3f0b36295ea32e ec49e253322bf2 Author: Bjorn Helgaas Date: Wed Jun 4 10:50:38 2025 -0500 Merge branch 'pci/controller/dw-rockchip' - Check only PCIE_LINKUP, not LTSSM status, to determine whether the link is up (Shawn Lin) - Increase N_FTS (used in L0s->L0 transitions) and enable ASPM L0s for Root Complex and Endpoint modes (Shawn Lin) - Hide the broken ATS Capability in rockchip_pcie_ep_init() instead of rockchip_pcie_ep_pre_init() so it stays hidden after PERST# resets non-sticky registers (Shawn Lin) - Remove unused PCIE_CLIENT_GENERAL_DEBUG definition (Hans Zhang) - Organize register and bitfield definitions logically (Hans Zhang) - Use rockchip_pcie_link_up() to check link up instead of open coding, and use GENMASK() and FIELD_GET() when possible (Hans Zhang) - Call phy_power_off() before phy_exit() in rockchip_pcie_phy_deinit() (Diederik de Haas) - Return bool (not int) for link-up check in dw_pcie_ops.link_up() and armada8k, dra7xx, dw-rockchip, exynos, histb, keembay, keystone, kirin, meson, qcom, qcom-ep, rcar_gen4, spear13xx, tegra194, uniphier, visconti (Hans Zhang) - Return bool (not int) for link-up check in mobiveil_pab_ops.link_up() and layerscape-gen4, mobiveil (Hans Zhang) - Simplify j721e link-up check (Hans Zhang) - Convert pci-host-common to a library so platforms that don't need native host controller drivers don't need to include these helper functions (Manivannan Sadhasivam) * pci/controller/dw-rockchip: PCI: qcom: Replace PERST# sleep time with proper macro PCI: dw-rockchip: Replace PERST# sleep time with proper macro PCI: host-common: Convert to library for host controller drivers PCI: cadence: Simplify J721e link status check PCI: mobiveil: Return bool from link up check PCI: dwc: Return bool from link up check PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() PCI: dw-rockchip: Use rockchip_pcie_link_up() to check link up instead of open coding PCI: dw-rockchip: Reorganize register and bitfield definitions PCI: dw-rockchip: Remove unused PCIE_CLIENT_GENERAL_DEBUG definition PCI: dw-rockchip: Move rockchip_pcie_ep_hide_broken_ats_cap_rk3588() to dw_pcie_ep_ops::init() PCI: dw-rockchip: Enable ASPM L0s capability for both RC and EP modes PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up() # Conflicts: # drivers/pci/controller/pcie-apple.c # include/linux/pci-ecam.h commit 3f0b36295ea32ec115a54810f078a4cc7aaffa50 Merge: c3b2f9dccba5c9 3c05e88413f7b7 Author: Bjorn Helgaas Date: Wed Jun 4 10:50:04 2025 -0500 Merge branch 'pci/controller/cadence' - Drop a runtime PM 'put' to resolve a runtime atomic count underflow (Hans Zhang) - Use shared PCIE_MSG_CODE_* definitions and remove duplicate cdns_pcie_msg_code definitions (Hans Zhang) - Make the cadence core buildable as a module (Kishon Vijay Abraham I) - Add cdns_pcie_host_disable() and cdns_pcie_ep_disable() for use by loadable drivers when they are removed (Siddharth Vadapalli) - Make j721e buildable as a loadable and removable module (Siddharth Vadapalli) - Fix j721e host/endpoint dependencies that result in link failures in some configs (Arnd Bergmann) * pci/controller/cadence: PCI: j721e: Fix host/endpoint dependencies PCI: j721e: Add support to build as a loadable module PCI: cadence-ep: Introduce cdns_pcie_ep_disable() helper for cleanup PCI: cadence-host: Introduce cdns_pcie_host_disable() helper for cleanup PCI: cadence: Add support to build pcie-cadence library as a kernel module PCI: cadence: Remove duplicate message code definitions PCI: cadence: Fix runtime atomic count underflow commit c3b2f9dccba5c94bb1b37b4a401440f78d8293be Merge: 2ce738726adf93 4e639f11d6e06d Author: Bjorn Helgaas Date: Wed Jun 4 10:50:04 2025 -0500 Merge branch 'pci/controller/apple' - Skip ports disabled in DT when setting up ports (Janne Grunau) - Add t6020 compatible string (Alyssa Rosenzweig) - Extract ECAM bridge creation helper from pci_host_common_probe() to separate driver-specific things like MSI from PCI things (Marc Zyngier) - Dynamically allocate RID-to_SID bitmap to prepare for SoCs with varying capabilities (Marc Zyngier) - Directly set/clear INTx mask bits because T602x dropped the accessors that could do this without locking (Marc Zyngier) - Move port PHY registers to their own reg items to accommodate T602x, which moves them around; retain default offsets for existing DTs that lack phy%d entries with the reg offsets (Hector Martin) - Stop polling for core refclk, which doesn't work on T602x and the bootloader has already done anyway (Hector Martin) - Use gpiod_set_value_cansleep() when asserting PERST# in probe because we're allowed to sleep there (Hector Martin) - Move register offsets into SoC-specific structure (Hector Martin) - Add T602x PCIe support (Hector Martin) * pci/controller/apple: PCI: apple: Add T602x PCIe support PCI: apple: Abstract register offsets via a SoC-specific structure PCI: apple: Use gpiod_set_value_cansleep in probe flow PCI: apple: Drop poll for CORE_RC_PHYIF_STAT_REFCLK PCI: apple: Move port PHY registers to their own reg items PCI: apple: Fix missing OF node reference in apple_pcie_setup_port PCI: apple: Move away from INTMSK{SET,CLR} for INTx and private interrupts PCI: apple: Dynamically allocate RID-to_SID bitmap PCI: apple: Move over to standalone probing PCI: ecam: Allow cfg->priv to be pre-populated from the root port device PCI: host-generic: Extract an ECAM bridge creation helper from pci_host_common_probe() dt-bindings: pci: apple,pcie: Add t6020 compatible string PCI: apple: Set only available ports up commit 2ce738726adf934e272b3726de2df5843bc2e70c Merge: 014dbfe0e402fe de0321bcc5fdd8 Author: Bjorn Helgaas Date: Wed Jun 4 10:50:03 2025 -0500 Merge branch 'pci/endpoint' - For fixed-size BARs, retain both the actual size and the possibly larger size allocated to accommodate iATU alignment requirements (Jerome Brunet) - Simplify ctrl/SPAD space allocation and avoid allocating more space than needed (Jerome Brunet) - Correct MSI-X PBA offset calculations for DesignWare and Cadence endpoint controllers (Niklas Cassel) - Align the return value (number of interrupts) encoding for pci_epc_get_msi()/pci_epc_ops::get_msi() and pci_epc_get_msix()/pci_epc_ops::get_msix() (Niklas Cassel) - Align the nr_irqs parameter encoding for pci_epc_set_msi()/pci_epc_ops::set_msi() and pci_epc_set_msix()/pci_epc_ops::set_msix() (Niklas Cassel) * pci/endpoint: PCI: endpoint: Align pci_epc_set_msix(), pci_epc_ops::set_msix() nr_irqs encoding PCI: endpoint: Align pci_epc_set_msi(), pci_epc_ops::set_msi() nr_irqs encoding PCI: endpoint: Align pci_epc_get_msix(), pci_epc_ops::get_msix() return value encoding PCI: endpoint: Align pci_epc_get_msi(), pci_epc_ops::get_msi() return value encoding PCI: cadence-ep: Correct PBA offset in .set_msix() callback PCI: dwc: ep: Correct PBA offset in .set_msix() callback PCI: endpoint: pci-epf-vntb: Simplify ctrl/SPAD space allocation PCI: endpoint: Retain fixed-size BAR size as well as aligned size commit 014dbfe0e402fe76cf2e4a0b21648c72c6ac4f8c Merge: df11586119066c 1f3303aa92e15f Author: Bjorn Helgaas Date: Wed Jun 4 10:50:03 2025 -0500 Merge branch 'pci/virtualization' - Add an ACS quirk for Loongson Root Ports that don't advertise ACS but don't allow peer-to-peer transactions between Root Ports; the quirk allows each Root Port to be in a separate IOMMU group (Huacai Chen) * pci/virtualization: PCI: Add ACS quirk for Loongson PCIe commit df11586119066c0c37c4324c3866416fe72c3f1a Merge: 4dac48e8a755c0 f3efb9569b4a21 Author: Bjorn Helgaas Date: Wed Jun 4 10:50:02 2025 -0500 Merge branch 'pci/reset' - Fix locking issue in the slot reset path (Ilpo Järvinen) * pci/reset: PCI: Fix lock symmetry in pci_slot_unlock() commit 4dac48e8a755c03f07d3cb10ae605f620eaee4d3 Merge: f377d9cb257984 46bc169f6f07ec Author: Bjorn Helgaas Date: Wed Jun 4 10:50:02 2025 -0500 Merge branch 'pci/pwrctrl' - Rename pwrctrl Kconfig symbols from 'PWRCTL' to 'PWRCTRL' to match the filename paths. Retain old deprecated symbols for compatibility, except for the pwrctrl slot driver (PCI_PWRCTRL_SLOT) (Johan Hovold) - When unregistering pwrctrl, cancel outstanding rescan work before cleaning up data structures to avoid use-after-free issues (Brian Norris) * pci/pwrctrl: arm64: Kconfig: switch to HAVE_PWRCTRL wifi: ath12k: switch to PCI_PWRCTRL_PWRSEQ wifi: ath11k: switch to PCI_PWRCTRL_PWRSEQ PCI/pwrctrl: Rename pwrctrl Kconfig symbols and slot module PCI/pwrctrl: Cancel outstanding rescan work when unregistering commit f377d9cb2579843219f9f1c4a74ed1c3d1967859 Merge: 80fe18d1de6b90 4d4c10f763d780 Author: Bjorn Helgaas Date: Wed Jun 4 10:50:01 2025 -0500 Merge branch 'pci/pm' - Add pm_runtime_put() cleanup helper for use with __free() to automatically drop the device usage count when a pointer goes out of scope (Alex Williamson) - Increment PM usage counter when probing reset methods so we don't try to read config space of a powered-off device (Alex Williamson) - Set all devices to D0 during enumeration to ensure ACPI opregion is connected via _REG (Mario Limonciello) * pci/pm: PCI: Explicitly put devices into D0 when initializing PCI: Increment PM usage counter when probing reset methods PM: runtime: Define pm_runtime_put cleanup helper commit 80fe18d1de6b90351834fbe06314602120ee646a Merge: 3ebd1305c1d243 631b2af2f35737 Author: Bjorn Helgaas Date: Wed Jun 4 10:50:00 2025 -0500 Merge branch 'pci/pci-acpi' - Fix pci_acpi_scan_root() memory leak when we fail to create a PCI bus (Zhe Qiao) * pci/pci-acpi: PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root() commit 3ebd1305c1d243f287409096a39d1c7103a6bce0 Merge: bb5c909e6a5e37 fdc348121f2465 Author: Bjorn Helgaas Date: Wed Jun 4 10:50:00 2025 -0500 Merge branch 'pci/irq' - Use of_fwnode_handle() so of_node_to_fwnode() can be removed (Jiri Slaby) * pci/irq: irqdomain: pci: Switch to of_fwnode_handle() commit bb5c909e6a5e37417e988147c705e4df64278b52 Merge: 68d0370e4e80ac d46b3918fac499 Author: Bjorn Helgaas Date: Wed Jun 4 10:49:59 2025 -0500 Merge branch 'pci/hotplug' - Ignore Presence Detect Changed caused by DPC. pciehp already ignores Link Down/Up events caused by DPC, but on slots using in-band presence detect, DPC causes a spurious Presence Detect Changed event (Lukas Wunner) - Ignore Link Down/Up caused by Secondary Bus Reset. On hotplug ports using in-band presence detect, the reset causes a Presence Detect Changed event, which mistakenly caused teardown and re-enumeration of the device. Drivers may need to annotate code that resets their device (Lukas Wunner) * pci/hotplug: PCI: hotplug: Drop superfluous #include directives PCI: pciehp: Ignore Link Down/Up caused by Secondary Bus Reset PCI: pciehp: Ignore Presence Detect Changed caused by DPC # Conflicts: # drivers/pci/pci.h commit 68d0370e4e80ac6ab9043813f7ade3c810648679 Merge: f56278a46d8611 ce45dc4bb22e96 Author: Bjorn Helgaas Date: Wed Jun 4 10:49:56 2025 -0500 Merge branch 'pci/enumeration' - Remove pci_fixup_cardbus(), which has no users left (Heiner Kallweit) - Print the actual delay time in pci_bridge_wait_for_secondary_bus() instead of assuming it was 1000ms (Wilfred Mallawa) - Revert 'iommu/amd: Prevent binding other PCI drivers to IOMMU PCI devices', which broke resume from system sleep on AMD platforms and has been fixed by other commits (Lukas Wunner) - Restrict visibility of pci_dev.match_driver since it's no longer used outside the PCI core (Lukas Wunner) * pci/enumeration: PCI: Limit visibility of match_driver flag to PCI core Revert "iommu/amd: Prevent binding other PCI drivers to IOMMU PCI devices" PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus() PCI: Use PCI_STD_NUM_BARS instead of 6 PCI: Remove pci_fixup_cardbus() # Conflicts: # drivers/pci/pci.h commit f56278a46d8611278c2b6764ad370fe2a4987430 Merge: 1acf6a5e7948cb dfc970ad619731 Author: Bjorn Helgaas Date: Wed Jun 4 10:49:50 2025 -0500 Merge branch 'pci/devres' - Remove mtip32xx use of pcim_iounmap_regions(), which is deprecated and unnecessary (Philipp Stanner) - Remove pcim_iounmap_regions() and pcim_request_region_exclusive() and related flags since all uses have been removed (Philipp Stanner) - Rework devres 'request' functions so they are no longer 'hybrid', i.e., their behavior no longer depends on whether pcim_enable_device or pci_enable_device() was used, and remove related code (Philipp Stanner) * pci/devres: PCI: Remove function pcim_intx() prototype from pci.h PCI: Remove hybrid-devres usage warnings from kernel-doc PCI: Remove redundant set of request functions PCI: Remove exclusive requests flags from _pcim_request_region() PCI: Remove pcim_request_region_exclusive() Documentation/driver-api: Update pcim_enable_device() PCI: Remove hybrid devres nature from request functions PCI: Remove pcim_iounmap_regions() mtip32xx: Remove unnecessary pcim_iounmap_regions() calls commit 1acf6a5e7948cb6f7d5a8cda349532f67f346b4d Merge: f5b6c76e552da4 6ade6e81f898f7 Author: Bjorn Helgaas Date: Wed Jun 4 10:49:49 2025 -0500 Merge branch 'pci/bwctrl' - Simplify link bandwidth controller by replacing the count of Link Bandwidth Management Status (LBMS) events with a PCI_LINK_LBMS_SEEN flag (Ilpo Järvinen) - Update the Link Speed after retraining, since the Link Speed may have changed (Ilpo Järvinen) * pci/bwctrl: PCI: Update Link Speed after retraining PCI/bwctrl: Replace lbms_count with PCI_LINK_LBMS_SEEN flag commit f5b6c76e552da4dd23de2e23a73ead04aa2285d2 Merge: 0af2f6be1b4281 b06d125e628060 Author: Bjorn Helgaas Date: Wed Jun 4 10:49:49 2025 -0500 Merge branch 'pci/aer' - Initialize struct aer_err_info before using it to avoid depending on stack garbage (Bjorn Helgaas) - Log the DPC Error Source ID only when it's actually valid (when ERR_FATAL or ERR_NONFATAL was received from a downstream device) and decode into bus/device/function (Bjorn Helgaas) - Consolidate AER Error Source ID in one place for message consistency (Bjorn Helgaas) - Update statistics and emit trace events early in AER logging paths, before any potential ratelimiting (Bjorn Helgaas) - Determine AER log level once and save it so all related messages use the same level (Karolina Stolarek) - Use KERN_WARNING, not KERN_ERR, when logging PCIe Correctable Errors. - Ratelimit PCIe Correctable and Non-Fatal error logging, with sysfs controls on interval and burst count, to avoid flooding logs and RCU stall warnings (Jon Pan-Doh) * pci/aer: PCI/ERR: Remove misleading TODO regarding kernel panic PCI/AER: Add sysfs attributes for log ratelimits PCI/AER: Add ratelimits to PCI AER Documentation PCI/AER: Ratelimit correctable and non-fatal error logging PCI/AER: Simplify add_error_device() PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index PCI/AER: Rename struct aer_stats to aer_info PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING PCI/ERR: Add printk level to pcie_print_tlp_log() PCI/AER: Check log level once and remember it PCI/AER: Trace error event before ratelimiting PCI/AER: Update statistics before ratelimiting PCI/AER: Simplify pci_print_aer() PCI/AER: Initialize aer_err_info before using it PCI/AER: Move aer_print_source() earlier in file PCI/AER: Rename aer_print_port_info() to aer_print_source() PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() PCI/DPC: Log Error Source ID only when valid PCI/DPC: Initialize aer_err_info before using it commit 1a576136f8d7089ef7f427dee8aa919a6edaef69 Author: Steven Rostedt Date: Wed Jun 4 08:51:21 2025 -0400 drm/ttm: Fix compile error when CONFIG_SHMEM is not set When CONFIG_SHMEM is not set, the following compiler error occurs: ld: vmlinux.o: in function `ttm_backup_backup_page': (.text+0x10363bc): undefined reference to `shmem_writeout' make[3]: *** [/work/build/trace/nobackup/linux.git/scripts/Makefile.vmlinux:91: vmlinux.unstripped] Error 1 This is due to the replacement of writepage and calling swap_writeout() and shmem_writeout() directly. The issue is that when CONFIG_SHMEM is not defined, shmem_writeout() is also not defined. The function ttm_backup_backup_page() called mapping->a_ops->writepage() which was then changed to call shmem_writeout() directly. Even before commit 84798514db50 ("mm: Remove swap_writepage() and shmem_writepage()"), it didn't make sense to call anything other than shmem_writeout() as the ttm_backup deals only with shmem folios. Have DRM_TTM config option select SHMEM to guarantee that shmem_writeout() is available. Link: https://lore.kernel.org/all/20250602170500.48713a2b@gandalf.local.home/ Suggested-by: Hugh Dickins Fixes: 84798514db50 ("mm: Remove swap_writepage() and shmem_writepage()") Signed-off-by: Steven Rostedt (Google) Reviewed-by: Thomas Hellström Signed-off-by: Linus Torvalds commit 791d76005de0ab556b590473eb4cbfede727fce0 Author: Dibin Moolakadan Subrahmanian Date: Wed May 28 12:15:56 2025 +0530 drm/i915/display: Fix u32 overflow in SNPS PHY HDMI PLL setup When configuring the HDMI PLL, calculations use DIV_ROUND_UP_ULL and DIV_ROUND_DOWN_ULL macros, which internally rely on do_div. However, do_div expects a 32-bit (u32) divisor, and at higher data rates, the divisor can exceed this limit. This leads to incorrect division results and ultimately misconfigured PLL values. This fix replaces do_div calls with div64_base64 calls where diviser can exceed u32 limit. Fixes: 5947642004bf ("drm/i915/display: Add support for SNPS PHY HDMI PLL algorithm for DG2") Cc: Ankit Nautiyal Cc: Suraj Kandpal Cc: Jani Nikula Signed-off-by: Dibin Moolakadan Subrahmanian Reviewed-by: Ankit Nautiyal Signed-off-by: Ankit Nautiyal Link: https://lore.kernel.org/r/20250528064557.4172149-1-dibin.moolakadan.subrahmanian@intel.com (cherry picked from commit ce924116e43ffbfa544d82976c4b9d11bcde9334) Signed-off-by: Joonas Lahtinen commit 308f8c7a626ecd5b9be67181ae67660e165a29b5 Author: Manivannan Sadhasivam Date: Wed Jun 4 17:38:30 2025 +0530 MAINTAINERS: Update Manivannan Sadhasivam email address My Linaro email is going to bounce soon, so switch to the kernel.org alias and add relevant .mailmap entry. [bhelgaas: squash https://patch.msgid.link/20250604120833.32791-3-manivannan.sadhasivam@linaro.org] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Acked-by: Neil Armstrong Link: https://patch.msgid.link/20250604120833.32791-2-manivannan.sadhasivam@linaro.org commit 12c331b29c7397ac3b03584e12902990693bc248 Author: Alok Tiwari Date: Mon Jun 2 03:34:29 2025 -0700 gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO gve_alloc_pending_packet() can return NULL, but gve_tx_add_skb_dqo() did not check for this case before dereferencing the returned pointer. Add a missing NULL check to prevent a potential NULL pointer dereference when allocation fails. This improves robustness in low-memory scenarios. Fixes: a57e5de476be ("gve: DQO: Add TX path") Signed-off-by: Alok Tiwari Reviewed-by: Mina Almasry Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 942349413a49670e8bed246e2185fd3a053227be Author: Benjamin Berg Date: Wed Jun 4 10:17:05 2025 +0200 um: fix SECCOMP 32bit xstate register restore There was a typo that caused the extended FP state to be copied into the wrong location on 32 bit. On 32 bit we only store the xstate internally as that already contains everything. However, for compatibility, the mcontext on 32 bit first contains the legacy FP state and then the xstate. The code copied the xstate on top of the legacy FP state instead of using the correct offset. This offset was already calculated in the xstate_* variables, so simply switch to those to fix the problem. With this SECCOMP mode works on 32 bit, so lift the restriction. Fixes: b1e1bd2e6943 ("um: Add helper functions to get/set state for SECCOMP") Signed-off-by: Benjamin Berg Link: https://patch.msgid.link/20250604081705.934112-1-benjamin@sipsolutions.net Signed-off-by: Johannes Berg commit 434d7f9b0e24e1f0166d05f10881a8ab386845b7 Author: Herbert Xu Date: Fri May 30 16:30:11 2025 +0800 timens: Add struct seq_file forward declaration Add forward declaration of struct seq_file before using it in a function prototype. Fixes: 04a8682a71be ("fs/proc: Introduce /proc/pid/timens_offsets") Signed-off-by: Herbert Xu Signed-off-by: Thomas Gleixner Acked-by: Andrei Vagin Link: https://lore.kernel.org/all/aDlskzKIAULMlwPj@gondor.apana.org.au commit 9cc82d99b13c1ad04e3dff9182b7953a8dba10b6 Author: Marc Zyngier Date: Tue Jun 3 15:18:01 2025 +0100 PCI/MSI: Size device MSI domain with the maximum number of vectors Zenghui reports that since 1396e89e09f0 ("genirq/msi: Move prepare() call to per-device allocation"), his Multi-MSI capable device isn't working anymore. This is a consequence of 15c72f824b32 ("PCI/MSI: Add support for per device MSI[X] domains"), which always creates a MSI domain of size 1, even in the presence of Multi-MSI. While this was somehow working until then, moving the .prepare() call ends up sizing the ITS table with a tiny value for this device, and making the endpoint driver unhappy. Instead, always create the domain and call the .prepare() helper with the maximum expected size. Fixes: 1396e89e09f0 ("genirq/msi: Move prepare() call to per-device allocation") Fixes: 15c72f824b32 ("PCI/MSI: Add support for per device MSI[X] domains") Reported-by: Zenghui Yu Signed-off-by: Marc Zyngier Signed-off-by: Thomas Gleixner Tested-by: Zenghui Yu Reviewed-by: Lorenzo Pieralisi Link: https://lore.kernel.org/all/20250603141801.915305-1-maz@kernel.org Closes: https://lore.kernel.org/r/0b1d7aec-1eac-a9cd-502a-339e216e08a1@huawei.com commit 44e479d7202070c3bc7f084a4951ee8689769f71 Author: Yi Zhang Date: Fri Apr 25 06:01:07 2025 -0400 nvme: spelling fixes Fix various spelling errors in comments. Signed-off-by: Yi Zhang Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit f42d4796ee100fade86086d1cf98537fb4d326c8 Author: Hannes Reinecke Date: Wed May 28 08:45:34 2025 +0200 nvme-tcp: fix I/O stalls on congested sockets When the socket is busy processing nvme_tcp_try_recv() might return -EAGAIN, but this doesn't automatically imply that the sending side is blocked, too. So check if there are pending requests once nvme_tcp_try_recv() returns -EAGAIN and continue with the sending loop to avoid I/O stalls. Signed-off-by: Hannes Reinecke Acked-by: Chris Leech Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig commit 0bf04c874fcb1ae46a863034296e4b33d8fbd66c Author: Hannes Reinecke Date: Wed May 28 08:45:33 2025 +0200 nvme-tcp: sanitize request list handling Validate the request in nvme_tcp_handle_r2t() to ensure it's not part of any list, otherwise a malicious R2T PDU might inject a loop in request list processing. Signed-off-by: Hannes Reinecke Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig commit e7143706702a209c814ed2c3fc6486c2a7decf6c Author: Shin'ichiro Kawasaki Date: Mon Jun 2 13:35:22 2025 +0900 nvme-tcp: remove tag set when second admin queue config fails Commit 104d0e2f6222 ("nvme-fabrics: reset admin connection for secure concatenation") modified nvme_tcp_setup_ctrl() to call nvme_tcp_configure_admin_queue() twice. The first call prepares for DH-CHAP negotitation, and the second call is required for secure concatenation. However, this change triggered BUG KASAN slab-use-after- free in blk_mq_queue_tag_busy_iter(). This BUG can be recreated by repeating the blktests test case nvme/063 a few times [1]. When the BUG happens, nvme_tcp_create_ctrl() fails in the call chain below: nvme_tcp_create_ctrl() nvme_tcp_alloc_ctrl() new=true ... Alloc nvme_tcp_ctrl and admin_tag_set nvme_tcp_setup_ctrl() new=true nvme_tcp_configure_admin_queue() new=true ... Succeed nvme_alloc_admin_tag_set() ... Alloc the tag set for admin_tag_set nvme_stop_keep_alive() nvme_tcp_teardown_admin_queue() remove=false nvme_tcp_configure_admin_queue() new=false nvme_tcp_alloc_admin_queue() ... Fail, but do not call nvme_remove_admin_tag_set() nvme_uninit_ctrl() nvme_put_ctrl() ... Free up the nvme_tcp_ctrl and admin_tag_set The first call of nvme_tcp_configure_admin_queue() succeeds with new=true argument. The second call fails with new=false argument. This second call does not call nvme_remove_admin_tag_set() on failure, due to the new=false argument. Then the admin tag set is not removed. However, nvme_tcp_create_ctrl() assumes that nvme_tcp_setup_ctrl() would call nvme_remove_admin_tag_set(). Then it frees up struct nvme_tcp_ctrl which has admin_tag_set field. Later on, the timeout handler accesses the admin_tag_set field and causes the BUG KASAN slab-use-after-free. To not leave the admin tag set, call nvme_remove_admin_tag_set() when the second nvme_tcp_configure_admin_queue() call fails. Do not return from nvme_tcp_setup_ctrl() on failure. Instead, jump to "destroy_admin" go-to label to call nvme_tcp_teardown_admin_queue() which calls nvme_remove_admin_tag_set(). Fixes: 104d0e2f6222 ("nvme-fabrics: reset admin connection for secure concatenation") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/linux-nvme/6mhxskdlbo6fk6hotsffvwriauurqky33dfb3s44mqtr5dsxmf@gywwmnyh3twm/ [1] Signed-off-by: Shin'ichiro Kawasaki Reviewed-by: Sagi Grimberg Reviewed-by: Chaitanya Kulkarni Reviewed-by: Hannes Reinecke Signed-off-by: Christoph Hellwig commit 3c12a8939e04749b8c2520c8b1fa2bf171bd8852 Author: Pavel Begunkov Date: Tue May 20 16:22:18 2025 +0100 nvme: enable vectored registered bufs for passthrough cmds nvme already supports registered buffers for non-vectored io_uring passthrough commands, enable it for the vectored mode as well. It takes an iovec, each entry of which should contain a range within the same registered buffer specificied in sqe->buf_index. Signed-off-by: Pavel Begunkov Reviewed-by: Jens Axboe Reviewed-by: Anuj Gupta Reviewed-by: Kanchan Joshi Reviewed-by: Caleb Sander Mateos Signed-off-by: Christoph Hellwig commit c4b680ac2863821e19d360fca62f78b68b1c8ece Author: Pavel Begunkov Date: Tue May 20 16:14:49 2025 +0100 nvme: fix implicit bool to flags conversion nvme_map_user_request() takes flags as the last argument, but nvme_uring_cmd_io() shoves a bool "vec" into it. It behaves as expected because bool is converted to 0/1 and NVME_IOCTL_VEC is defined as 1, but it's better to pass flags explicitly. Fixes: 7b7fdb8e2dbc1 ("nvme: replace the "bool vec" arguments with flags in the ioctl path") Signed-off-by: Pavel Begunkov Reviewed-by: Jens Axboe Reviewed-by: Keith Busch Reviewed-by: Anuj Gupta Reviewed-by: Kanchan Joshi Reviewed-by: Chaitanya Kulkarni Reviewed-by: Caleb Sander Mateos Signed-off-by: Christoph Hellwig commit 10f4a7cd724e34b7a6ff96e57ac49dc0cadececc Author: Keith Busch Date: Tue May 20 13:20:37 2025 -0700 nvme: fix command limits status code The command specific status code, 0x183, was introduced in the NVMe 2.0 specification defined to "Command Size Limits Exceeded" and only ever applied to DSM and Copy commands. Fix the name and, remove the incorrect translation to error codes and special treatment in the target code for it. Fixes: 3b7c33b28a44d4 ("nvme.h: add Write Zeroes definitions") Cc: Chaitanya Kulkarni Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit 805f5bbaa507a7e15333ad7bb34d517251de4eb9 Author: Dmitry Torokhov Date: Tue Jun 3 21:47:36 2025 -0700 Input: psmouse - switch to use scnprintf() to suppress truncation warning Switch the driver to use scnprintf() to avoid warnings about potential truncation of "phys" field which we can tolerate. Reported-by: Andy Shevchenko Signed-off-by: Dmitry Torokhov commit ce098f2aded8d0f6f41bb9ab069c3f3c8ef5fc42 Author: Dmitry Torokhov Date: Tue Jun 3 21:49:21 2025 -0700 Input: lifebook - switch to use scnprintf() to suppress truncation warning Switch the driver to use scnprintf() to avoid warnings about potential truncation of "phys" field which we can tolerate. Reported-by: Andy Shevchenko Signed-off-by: Dmitry Torokhov commit 1babc858cce111d744baf9a015ec65a19aafbbea Author: Dmitry Torokhov Date: Tue Jun 3 21:42:51 2025 -0700 Input: alps - switch to use scnprintf() to suppress truncation warning Switch the driver to use scnprintf() to avoid warnings about potential truncation of "phys" field which we can tolerate. Reported-by: Andy Shevchenko Signed-off-by: Dmitry Torokhov commit 4ecc7317700a0f402e301380300328141b332170 Author: Dmitry Torokhov Date: Tue Jun 3 21:45:44 2025 -0700 Input: atkbd - switch to use scnprintf() to suppress truncation warning Switch the driver to use scnprintf() to avoid warnings about potential truncation of "phys" field which we can tolerate. Reported-by: Andy Shevchenko Signed-off-by: Dmitry Torokhov commit 05286c5d7e72a543a12a62904a221825d72f20e9 Author: Markus Koch Date: Tue Jun 3 21:36:44 2025 -0700 Input: fsia6b - suppress buffer truncation warning for phys Switch the driver to use scnprintf() to avoid warnings about potential truncation of "phys" field which we can tolerate. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202501020303.1WtxWWTu-lkp@intel.com/ Signed-off-by: Markus Koch Link: https://lore.kernel.org/r/20250602175710.61583-4-markus@notsyncing.net Signed-off-by: Dmitry Torokhov commit 1ac9aa41c6af7949a040f87cf1ed4bc4cac296bf Author: Jeff LaBundy Date: Sun Jan 5 12:56:48 2025 -0600 Input: iqs626a - replace snprintf() with scnprintf() W=1 builds warn that the data written to 'tc_name' is truncated for theoretical strings such as "channel-2147483646". Solve this problem by replacing snprintf() with scnprintf() so that the return value corresponds to what was actually written. In practice, the largest string that will be written is "channel-8", and the return value is not actually evaluated. Instead, this patch ultimately removes the warning without unnecessarily increasing the size of 'tc_name' from 10 bytes. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202412221136.0S4kRoCC-lkp@intel.com/ Signed-off-by: Jeff LaBundy Link: https://lore.kernel.org/r/Z3rV8GTHxLyjBQ5I@nixie71 Signed-off-by: Dmitry Torokhov commit a2f4c1ae163b815dc81e3cab97c3149fdc6639e3 Author: Uday Shankar Date: Tue Jun 3 17:38:33 2025 -0600 selftests: ublk: kublk: improve behavior on init failure Some failure modes are handled poorly by kublk. For example, if ublk_drv is built as a module but not currently loaded into the kernel, ./kublk add ... just hangs forever. This happens because in this case (and a few others), the worker process does not notify its parent (via a write to the shared eventfd) that it has tried and failed to initialize, so the parent hangs forever. Fix this by ensuring that we always notify the parent process of any initialization failure, and have the parent print a (not very descriptive) log line when this happens. Signed-off-by: Uday Shankar Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250603-ublk_init_fail-v1-1-87c91486230e@purestorage.com Signed-off-by: Jens Axboe commit 8a3514d348de87a9d5e2ac00fbac4faae0b97996 Author: Sanjeev Yadav Date: Fri May 23 13:14:01 2025 -0700 scsi: core: ufs: Fix a hang in the error handler ufshcd_err_handling_prepare() calls ufshcd_rpm_get_sync(). The latter function can only succeed if UFSHCD_EH_IN_PROGRESS is not set because resuming involves submitting a SCSI command and ufshcd_queuecommand() returns SCSI_MLQUEUE_HOST_BUSY if UFSHCD_EH_IN_PROGRESS is set. Fix this hang by setting UFSHCD_EH_IN_PROGRESS after ufshcd_rpm_get_sync() has been called instead of before. Backtrace: __switch_to+0x174/0x338 __schedule+0x600/0x9e4 schedule+0x7c/0xe8 schedule_timeout+0xa4/0x1c8 io_schedule_timeout+0x48/0x70 wait_for_common_io+0xa8/0x160 //waiting on START_STOP wait_for_completion_io_timeout+0x10/0x20 blk_execute_rq+0xe4/0x1e4 scsi_execute_cmd+0x108/0x244 ufshcd_set_dev_pwr_mode+0xe8/0x250 __ufshcd_wl_resume+0x94/0x354 ufshcd_wl_runtime_resume+0x3c/0x174 scsi_runtime_resume+0x64/0xa4 rpm_resume+0x15c/0xa1c __pm_runtime_resume+0x4c/0x90 // Runtime resume ongoing ufshcd_err_handler+0x1a0/0xd08 process_one_work+0x174/0x808 worker_thread+0x15c/0x490 kthread+0xf4/0x1ec ret_from_fork+0x10/0x20 Signed-off-by: Sanjeev Yadav [ bvanassche: rewrote patch description ] Fixes: 62694735ca95 ("[SCSI] ufs: Add runtime PM support for UFS host controller driver") Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20250523201409.1676055-1-bvanassche@acm.org Reviewed-by: Peter Wang Signed-off-by: Martin K. Petersen commit 42ca547b13a20e7cbb04fbdf8d5f089ac4bb35b7 Author: Shyam Prasad N Date: Mon Jun 2 22:37:17 2025 +0530 cifs: do not disable interface polling on failure When a server has multichannel enabled, we keep polling the server for interfaces periodically. However, when this query fails, we disable the polling. This can be problematic as it takes away the chance for the server to start advertizing again. This change reschedules the delayed work, even if the current call failed. That way, multichannel sessions can recover. Signed-off-by: Shyam Prasad N Cc: stable@vger.kernel.org Signed-off-by: Steve French commit b5e3e6e28cf3853566ba5d816f79aba5be579158 Author: Shyam Prasad N Date: Mon Jun 2 22:37:15 2025 +0530 cifs: serialize other channels when query server interfaces is pending Today, during smb2_reconnect, session_mutex is released as soon as the tcon is reconnected and is in a good state. However, in case multichannel is enabled, there is also a query of server interfaces that follows. We've seen that this query can race with reconnects of other channels, causing them to step on each other with reconnects. This change extends the hold of session_mutex till after the query of server interfaces is complete. In order to avoid recursive smb2_reconnect checks during query ioctl, this change also introduces a session flag for sessions where such a query is in progress. Signed-off-by: Shyam Prasad N Cc: stable@vger.kernel.org Signed-off-by: Steve French commit 66d590b828b1fd9fa337047ae58fe1c4c6f43609 Author: Shyam Prasad N Date: Mon Jun 2 22:37:12 2025 +0530 cifs: deal with the channel loading lag while picking channels Our current approach to select a channel for sending requests is this: 1. iterate all channels to find the min and max queue depth 2. if min and max are not the same, pick the channel with min depth 3. if min and max are same, round robin, as all channels are equally loaded The problem with this approach is that there's a lag between selecting a channel and sending the request (that increases the queue depth on the channel). While these numbers will eventually catch up, there could be a skew in the channel usage, depending on the application's I/O parallelism and the server's speed of handling requests. With sufficient parallelism, this lag can artificially increase the queue depth, thereby impacting the performance negatively. This change will change the step 1 above to start the iteration from the last selected channel. This is to reduce the skew in channel usage even in the presence of this lag. Fixes: ea90708d3cf3 ("cifs: use the least loaded channel for sending requests") Cc: Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit cc55f65dd352bdb7bdf8db1c36fb348c294c3b66 Author: Stefan Metzmacher Date: Wed May 28 18:01:40 2025 +0200 smb: client: make use of common smbdirect_socket_parameters Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: Hyunchul Lee Cc: Meetakshi Setiya Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit dce8047f4725d4469c0813ff50c4115fc2d0b628 Author: Stefan Metzmacher Date: Wed May 28 18:01:39 2025 +0200 smb: smbdirect: introduce smbdirect_socket_parameters This is the next step in the direction of a common smbdirect layer. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: Hyunchul Lee Cc: Meetakshi Setiya Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit c3011b9a7deaaaabdf955815d29eac39c8b75e67 Author: Stefan Metzmacher Date: Wed May 28 18:01:37 2025 +0200 smb: client: make use of common smbdirect_socket This is the next step in the direction of a common smbdirect layer. Currently only structures are shared, but that will change over time until everything is shared. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: Hyunchul Lee Cc: Meetakshi Setiya Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 22234e37d7e97652cb53133009da5e14793d3c10 Author: Stefan Metzmacher Date: Wed May 28 18:01:36 2025 +0200 smb: smbdirect: add smbdirect_socket.h This abstracts the common smbdirect layer. Currently with just a few things in it, but that will change over time until everything is in common. Will be used in client and server in the next commits Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: Hyunchul Lee Cc: Meetakshi Setiya Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 21604ed60864b9ace2e28a1c86411f388f03f94e Author: Stefan Metzmacher Date: Wed May 28 18:01:34 2025 +0200 smb: client: make use of common smbdirect.h Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: Hyunchul Lee Cc: Meetakshi Setiya Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 7e136a718633b2c54764e185f3bfccf0763fc1dd Author: Stefan Metzmacher Date: Wed May 28 18:01:33 2025 +0200 smb: smbdirect: add smbdirect.h with public structures Will be used in client and server in the next commits. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: Hyunchul Lee CC: Meetakshi Setiya Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 64946d5be665ddac6b5bf11f5b5ff319aae0f4c6 Author: Stefan Metzmacher Date: Wed May 28 18:01:31 2025 +0200 smb: client: make use of common smbdirect_pdu.h Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: Hyunchul Lee Cc: Meetakshi Setiya Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 00fab6cf323fa5850e6cbe283b23e605e6e97912 Author: Stefan Metzmacher Date: Wed May 28 18:01:30 2025 +0200 smb: smbdirect: add smbdirect_pdu.h with protocol definitions This is just a start moving into a common smbdirect layer. It will be used in the next commits... Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: Hyunchul Lee Cc: Meetakshi Setiya Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 43a67dd812c5d3de163c0b6971046b4a4b633d3f Author: Caleb Sander Mateos Date: Tue Jun 3 12:47:51 2025 -0600 block: flip iter directions in blk_rq_integrity_map_user() blk_rq_integrity_map_user() creates the ubuf iter with ITER_DEST for write-direction operations and ITER_SOURCE for read-direction ones. This is backwards; writes use the user buffer as a source for metadata and reads use it as a destination. Switch to the rq_data_dir() helper, which maps writes to ITER_SOURCE (WRITE) and reads to ITER_DEST(READ). Signed-off-by: Caleb Sander Mateos Fixes: fe8f4ca7107e ("block: modify bio_integrity_map_user to accept iov_iter as argument") Link: https://lore.kernel.org/r/20250603184752.1185676-1-csander@purestorage.com Signed-off-by: Jens Axboe commit 5abc7438f1e9d62e91ad775cc83c9594c48d2282 Merge: 6d9b5f6b81ace1 e3e3775392f3f0 Author: Linus Torvalds Date: Tue Jun 3 16:13:32 2025 -0700 Merge tag 'nfs-for-6.16-1' of git://git.linux-nfs.org/projects/anna/linux-nfs Pull NFS clent updates from Anna Schumaker: "New Features: - Implement the Sunrpc rfc2203 rpcsec_gss sequence number cache - Add support for FALLOC_FL_ZERO_RANGE on NFS v4.2 - Add a localio sysfs attribute Stable Fixes: - Fix double-unlock bug in nfs_return_empty_folio() - Don't check for OPEN feature support in v4.1 - Always probe for LOCALIO support asynchronously - Prevent hang on NFS mounts with xprtsec=[m]tls Other Bugfixes: - xattr handlers should check for absent nfs filehandles - Fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps are delegated - Fix listxattr to return selinux security labels - Connect to NFSv3 DS using TLS if MDS connection uses TLS - Clear SB_RDONLY before getting a superblock, and ignore when remounting - Fix incorrect handling of NFS error codes in nfs4_do_mkdir() - Various nfs_localio fixes from Neil Brown that include fixing an rcu compilation error found by older gcc versions. - Update stats on flexfiles pNFS DSes when receiving NFS4ERR_DELAY Cleanups: - Add a refcount tracker for struct net in the nfs_client - Allow FREE_STATEID to clean up delegations - Always set NLINK even if the server doesn't support it - Cleanups to the NFS folio writeback code - Remove dead code from xs_tcp_tls_setup_socket()" * tag 'nfs-for-6.16-1' of git://git.linux-nfs.org/projects/anna/linux-nfs: (30 commits) flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes nfs_localio: change nfsd_file_put_local() to take a pointer to __rcu pointer nfs_localio: protect race between nfs_uuid_put() and nfs_close_local_fh() nfs_localio: duplicate nfs_close_local_fh() nfs_localio: simplify interface to nfsd for getting nfsd_file nfs_localio: always hold nfsd net ref with nfsd_file ref nfs_localio: use cmpxchg() to install new nfs_file_localio SUNRPC: Remove dead code from xs_tcp_tls_setup_socket() SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls nfs: fix incorrect handling of large-number NFS errors in nfs4_do_mkdir() nfs: ignore SB_RDONLY when remounting nfs nfs: clear SB_RDONLY before getting superblock NFS: always probe for LOCALIO support asynchronously pnfs/flexfiles: connect to NFSv3 DS using TLS if MDS connection uses TLS NFS: add localio to sysfs nfs: use writeback_iter directly nfs: refactor nfs_do_writepage nfs: don't return AOP_WRITEPAGE_ACTIVATE from nfs_do_writepage nfs: fold nfs_page_async_flush into nfs_do_writepage NFSv4: Always set NLINK even if the server doesn't support it ... commit 6d9b5f6b81ace1b2b0830271ad46628d6fad31bb Merge: 3c727285f1c99b 8a5ebd2be99a1f Author: Linus Torvalds Date: Tue Jun 3 16:04:29 2025 -0700 Merge tag 'v6.16-rc-part1-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client updates from Steve French: - multichannel fixes (mostly reconnect related), and clarification of locking documentation - automount null pointer check fix - fixes to add support for ParentLeaseKey - minor cleanup - smb1/cifs fixes * tag 'v6.16-rc-part1-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: update the lock ordering comments with new mutex cifs: dns resolution is needed only for primary channel cifs: update dstaddr whenever channel iface is updated cifs: reset connections for all channels when reconnect requested smb: client: use ParentLeaseKey in cifs_do_create smb: client: use ParentLeaseKey in open_cached_dir smb: client: add ParentLeaseKey support cifs: Fix cifs_query_path_info() for Windows NT servers cifs: Fix validation of SMB1 query reparse point response cifs: Correctly set SMB1 SessionKey field in Session Setup Request cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode smb: client: add NULL check in automount_fullpath smb: client: Remove an unused function and variable commit 3c727285f1c99b4be5458ba68329748b207584ce Merge: 0939bd2fcf3372 9f2f6316d753fe Author: Linus Torvalds Date: Tue Jun 3 15:54:46 2025 -0700 Merge tag 'for-6.16/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper updates from Mikulas Patocka: - better error handling when reloading a table - use use generic disable_* functions instead of open coding them - lock queue limits when reading them - remove unneeded kvfree from alloc_targets - fix BLK_FEAT_ATOMIC_WRITES - pass through operations on wrapped inline crypto keys - dm-verity: - use softirq context only when !need_resched() - fix a memory leak if some arguments are specified multiple times - dm-mpath: - interface for explicit probing of active paths - replace spin_lock_irqsave with spin_lock_irq - dm-delay: don't busy-wait in kthread - dm-bufio: remove maximum age based eviction - dm-flakey: various fixes - vdo indexer: don't read request structure after enqueuing - dm-zone: Use bdev_*() helper functions where applicable - dm-mirror: fix a tiny race condition - dm-stripe: small code cleanup * tag 'for-6.16/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: (29 commits) dm-stripe: small code cleanup dm-verity: fix a memory leak if some arguments are specified multiple times dm-mirror: fix a tiny race condition dm-table: check BLK_FEAT_ATOMIC_WRITES inside limits_lock dm mpath: replace spin_lock_irqsave with spin_lock_irq dm-mpath: Don't grab work_mutex while probing paths dm-zone: Use bdev_*() helper functions where applicable dm vdo indexer: don't read request structure after enqueuing dm: pass through operations on wrapped inline crypto keys blk-crypto: export wrapped key functions dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits dm mpath: Interface for explicit probing of active paths dm: Allow .prepare_ioctl to handle ioctls directly dm-flakey: make corrupting read bios work dm-flakey: remove useless ERROR_READS check in flakey_end_io dm-flakey: error all IOs when num_features is absent dm-flakey: Clean up parsing messages dm: remove unneeded kvfree from alloc_targets dm-bufio: remove maximum age based eviction dm-verity: use softirq context only when !need_resched() ... commit 0939bd2fcf337243133b0271335a2838857c319f Merge: 70087d2200d4a3 a913ef6fd883c0 Author: Linus Torvalds Date: Tue Jun 3 15:11:44 2025 -0700 Merge tag 'perf-tools-for-v6.16-1-2025-06-03' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools updates from Arnaldo Carvalho de Melo: "perf report/top/annotate TUI: - Accept the left arrow key as a Zoom out if done on the first column - Show if source code toggle status in title, to help spotting bugs with the various disassemblers (capstone, llvm, objdump) - Provide feedback on unhandled hotkeys Build: - Better inform when certain features are not available with warnings in the build process and in 'perf version --build-options' or 'perf -vv' perf record: - Improve the --off-cpu code by synthesizing events for switch-out -> switch-in intervals using a BPF program. This can be fine tuned using a --off-cpu-thresh knob perf report: - Add 'tgid' sort key perf mem/c2c: - Add 'op', 'cache', 'snoop', 'dtlb' output fields - Add support for 'ldlat' on AMD IBS (Instruction Based Sampling) perf ftrace: - Use process/session specific trace settings instead of messing with the global ftrace knobs perf trace: - Implement syscall summary in BPF - Support --summary-mode=cgroup - Always print return value for syscalls returning a pid - The rseq and set_robust_list don't return a pid, just -errno perf lock contention: - Symbolize zone->lock using BTF - Add -J/--inject-delay option to estimate impact on application performance by optimization of kernel locking behavior perf stat: - Improve hybrid support for the NMI watchdog warning Symbol resolution: - Handle 'u' and 'l' symbols in /proc/kallsyms, resolving some Rust symbols - Improve Rust demangler Hardware tracing: Intel PT: - Fix PEBS-via-PT data_src - Do not default to recording all switch events - Fix pattern matching with python3 on the SQL viewer script arm64: - Fixups for the hip08 hha PMU Vendor events: - Update Intel events/metrics files for alderlake, alderlaken, arrowlake, bonnell, broadwell, broadwellde, broadwellx, cascadelakex, clearwaterforest, elkhartlake, emeraldrapids, grandridge, graniterapids, haswell, haswellx, icelake, icelakex, ivybridge, ivytown, jaketown, lunarlake, meteorlake, nehalemep, nehalemex, rocketlake, sandybridge, sapphirerapids, sierraforest, skylake, skylakex, snowridgex, tigerlake, westmereep-dp, westmereep-sp, westmereep-sx python support: - Add support for event counts in the python binding, add a counting.py example perf list: - Display the PMU name associated with a perf metric in JSON perf test: - Hybrid improvements for metric value validation test - Fix LBR test by ignoring idle task - Add AMD IBS sw filter ana d'ldlat' tests - Add 'perf trace --summary-mode=cgroup' test - Add tests for the various language symbol demanglers Miscellaneous: - Allow specifying the cpu an event will be tied using '-e event/cpu=N/' - Sync various headers with the kernel sources - Add annotations to use clang's -Wthread-safety and fix some problems it detected - Make dump_stack() use perf's symbol resolution to provide better backtraces - Intel TPEBS support cleanups and fixes. TPEBS stands for Timed PEBS (Precision Event-Based Sampling), that adds timing info, the retirement latency of instructions - Various memory allocation (some detected by ASAN) and reference counting fixes - Add a 8-byte aligned PERF_RECORD_COMPRESSED2 to replace PERF_RECORD_COMPRESSED - Skip unsupported event types in perf.data files, don't stop when finding one - Improve lookups using hashmaps and binary searches" * tag 'perf-tools-for-v6.16-1-2025-06-03' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: (206 commits) perf callchain: Always populate the addr_location map when adding IP perf lock contention: Reject more than 10ms delays for safety perf trace: Set errpid to false for rseq and set_robust_list perf symbol: Move demangling code out of symbol-elf.c perf trace: Always print return value for syscalls returning a pid perf script: Print PERF_AUX_FLAG_COLLISION flag perf mem: Show absolute percent in mem_stat output perf mem: Display sort order only if it's available perf mem: Describe overhead calculation in brief perf record: Fix incorrect --user-regs comments Revert "perf thread: Ensure comm_lock held for comm_list" perf test trace_summary: Skip --bpf-summary tests if no libbpf perf test intel-pt: Skip jitdump test if no libelf perf intel-tpebs: Avoid race when evlist is being deleted perf test demangle-java: Don't segv if demangling fails perf symbol: Fix use-after-free in filename__read_build_id perf pmu: Avoid segv for missing name/alias_name in wildcarding perf machine: Factor creating a "live" machine out of dwarf-unwind perf test: Add AMD IBS sw filter test perf mem: Count L2 HITM for c2c statistic ... commit 607d09d1a01e9f29e91733e3a08b63ed240aacb2 Author: Jens Axboe Date: Tue Jun 3 07:42:28 2025 -0600 io_uring/kbuf: limit legacy provided buffer lists to USHRT_MAX The buffer ID for a provided buffer is an unsigned short, and hence there can only be 64k added to any given buffer list before having duplicate BIDs. Cap the legacy provided buffers at 64k in the list. This is mostly to prevent silly stall reports from syzbot, which likes to dump tons of buffers into a list and then have kernels with lockdep and kasan churning through them and hitting long wait times for buffer pruning at ring exit time. Signed-off-by: Jens Axboe commit 70087d2200d4a3bd31812ab4578c9ec70ea344af Merge: def5b099a64528 a4a45a9a72f3a9 Author: Linus Torvalds Date: Tue Jun 3 14:21:31 2025 -0700 Merge tag 'trace-v6.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix UAF in module unload in ftrace when there's a bug in the module If a module is buggy and triggers ftrace_disable which is set when an anomaly is detected, when it gets unloaded it doesn't free the hooks into kallsyms, and when a kallsyms lookup is performed it may access the mod->modname field and crash via UAF. Fix this by still freeing the mod_maps that are attached to kallsyms on module unload regardless if ftrace_disable is set or not. - Do not bother allocating mod_maps for kallsyms if ftrace_disable is set - Remove unused trace events When a trace event or tracepoint is created but not used, it still creates the code and data structures needed for that trace event. This just wastes memory. Remove the trace events that are created but not used. This does not remove trace events that are created but are not used due configs not being set. That will be handled later. This only removes events that have no user under any config. * tag 'trace-v6.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: fsdax: Remove unused trace events for dax insert mapping genirq/matrix: Remove unused irq_matrix_alloc_reserved tracepoint xdp: Remove unused mem_return_failed event ftrace: Don't allocate ftrace module map if ftrace is disabled ftrace: Fix UAF when lookup kallsym after ftrace disabled commit def5b099a6452856801da71ad07c601ae2dbf6ef Merge: 29e9359005dd1a c853d18706de8c Author: Linus Torvalds Date: Tue Jun 3 14:12:36 2025 -0700 Merge tag 'cgroup-for-6.16-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fix from Tejun Heo: "The rstat per-subsystem split change skipped per-cpu allocation on UP configs; however even on UP, depending on config options, the size of the percpu struct may not be zero leading to crashes. Fix it by conditionalizing the per-cpu area allocation and usage on the size of the per-cpu struct" * tag 'cgroup-for-6.16-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup: adjust criteria for rstat subsystem cpu lock access commit 29e9359005dd1ac5f9683608891718e6a32a20a3 Merge: a9dfb7db96f7bc 9f153b7fb5ae45 Author: Linus Torvalds Date: Tue Jun 3 13:24:14 2025 -0700 Merge tag 'cxl-for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull Compute Express Link (CXL) updates from Dave Jiang: - Remove always true condition in cxl features code - Add verification of CHBS length for CXL 2.0 - Ignore interleave granularity when interleave ways is 1 - Add update addressing mising MODULE_DESCRIPTION for cxl_test - A series of cleanups/refactor to prep for AMD Zen5 translate code - Clean %pa debug printk in core/hdm.c - Documentation updates: - Update to CXL Maturity Map - Fixes to source linking in CXL documentation - CXL documentation fixes, spelling corrections - A large collection of CXL documentation for the entire CXL subsystem, including documentation on CXL related platform and firmware notes - Remove redundant code of cxlctl_get_supported_features() - Series to support CXL RAS Features - Including "Patrol Scrub Control", "Error Check Scrub", "Performance Maitenance" and "Memory Sparing". The series connects CXL to EDAC. * tag 'cxl-for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: (53 commits) cxl/edac: Add CXL memory device soft PPR control feature cxl/edac: Add CXL memory device memory sparing control feature cxl/edac: Support for finding memory operation attributes from the current boot cxl/edac: Add support for PERFORM_MAINTENANCE command cxl/edac: Add CXL memory device ECS control feature cxl/edac: Add CXL memory device patrol scrub control feature cxl: Update prototype of function get_support_feature_info() EDAC: Update documentation for the CXL memory patrol scrub control feature cxl/features: Remove the inline specifier from to_cxlfs() cxl/feature: Remove redundant code of get supported features docs: ABI: Fix "firwmare" to "firmware" cxl/Documentation: Fix typo in sysfs write_bandwidth attribute path cxl: doc/linux/access-coordinates Update access coordinates calculation methods cxl: docs/platform/acpi/srat Add generic target documentation cxl: docs/platform/cdat reference documentation Documentation: Update the CXL Maturity Map cxl: Sync up the driver-api/cxl documentation cxl: docs - add self-referencing cross-links cxl: docs/allocation/hugepages cxl: docs/allocation/reclaim ... commit 8887abccf8aa16795f23ef3a3b25650cb8aa804c Author: Rafael J. Wysocki Date: Tue Jun 3 18:21:57 2025 +0200 PM: sleep: Add locking to dpm_async_resume_children() Commit 0cbef962ce1f ("PM: sleep: Resume children after resuming the parent") introduced a subtle concurrency issue that may lead to a kernel crash if system suspend is aborted and may also slow down asynchronous device resume otherwise. Namely, the initial list walks in dpm_noirq_resume_devices(), dpm_resume_early(), and dpm_resume() call dpm_clear_async_state() for every device and attempt to asynchronously resume it if it has no children (so it is a "root" device). The asynchronous resume of a root device triggers an attempt to asynchronously resume its children which may take place before calling dpm_clear_async_state() for them due to the lack of synchronization between dpm_async_resume_children() and the code calling dpm_clear_async_state(). If this happens, the dpm_clear_async_state() that comes in late, will clear power.work_in_progress for the given device after it has been set by __dpm_async(), so the suspend callback will be allowed to run once again for the same device during the same transition. This leads to a whole range of interesting breakage. Fortunately, if the suspend transition is not aborted, power.work_in_progress is set by it for all devices, so dpm_async_resume_children() will not schedule asynchronous resume for them until dpm_clear_async_state() clears that flag, but this means missing an opportunity to start the resume of those devices earlier. Address the above issue by adding dpm_list_mtx locking to dpm_async_resume_children(), so it will wait for the entire initial list walk and the invocation of dpm_clear_async_state() for all devices to be completed before scheduling any new asynchronous resume callbacks. Fixes: 0cbef962ce1f ("PM: sleep: Resume children after resuming the parent") Link: https://gitlab.freedesktop.org/drm/amd/-/issues/4280 Reported-and-tested-by: Chris Bainbridge Signed-off-by: Rafael J. Wysocki Reviewed-by: Mario Limonciello Link: https://patch.msgid.link/13779172.uLZWGnKmhe@rjwysocki.net commit d46c4c839c20a599a0eb8d73708ce401f9c7d06d Author: Rafael J. Wysocki Date: Tue Jun 3 18:19:27 2025 +0200 PM: sleep: Fix power.is_suspended cleanup for direct-complete devices Commit 03f1444016b7 ("PM: sleep: Fix handling devices with direct_complete set on errors") caused power.is_suspended to be set for devices with power.direct_complete set, but it forgot to ensure the clearing of that flag for them in device_resume(), so power.is_suspended is still set for them during the next system suspend-resume cycle. If that cycle is aborted in dpm_suspend(), the subsequent invocation of dpm_resume() will trigger a device_resume() call for every device and because power.is_suspended is set for the devices in question, they will not be skipped by device_resume() as expected which causes scary error messages to be logged (as appropriate). To address this issue, move the clearing of power.is_suspended in device_resume() immediately after the power.is_suspended check so it will be always cleared for all devices processed by that function. Fixes: 03f1444016b7 ("PM: sleep: Fix handling devices with direct_complete set on errors") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4280 Reported-and-tested-by: Chris Bainbridge Signed-off-by: Rafael J. Wysocki Reviewed-by: Mario Limonciello Link: https://patch.msgid.link/4990586.GXAFRqVoOG@rjwysocki.net commit 079e8889ad136930617278fbce44b42ef10af9e1 Author: Rafael J. Wysocki Date: Tue Jun 3 18:17:58 2025 +0200 PM: sleep: Fix list splicing in device suspend error paths Commits aa7a9275ab81 ("PM: sleep: Suspend async parents after suspending children") and 443046d1ad66 ("PM: sleep: Make suspend of devices more asynchronous") added list splicing to the error paths of dpm_suspend(), dpm_suspend_late(), and dpm_noirq_suspend_devices(), but they should have used the list_splice_init() variant because the emptied list is used going forward in all of these cases. Replace list_splice() with list_splice_init() in the code in question as appropriate. Fixes: aa7a9275ab81 ("PM: sleep: Suspend async parents after suspending children") Fixes: 443046d1ad66 ("PM: sleep: Make suspend of devices more asynchronous") Link: https://gitlab.freedesktop.org/drm/amd/-/issues/4280 Reported-and-tested-by: Chris Bainbridge Signed-off-by: Rafael J. Wysocki Reviewed-by: Mario Limonciello Link: https://patch.msgid.link/4659282.LvFx2qVVIh@rjwysocki.net commit a9dfb7db96f7bc1f30feae673aab7fdbfbc94e9c Merge: b546608ea2151e e12d3e1624a027 Author: Linus Torvalds Date: Tue Jun 3 12:52:25 2025 -0700 Merge tag 'backlight-next-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight Pull backlight updates from Lee Jones: "Framebuffer Subsystem (fbdev): - The display's blanking status is now tracked in 'struct fb_info' - 'framebuffer_alloc()' initializes the blank state to FB_BLANK_UNBLANK - 'register_framebuffer()' sets the state to 'FB_BLANK_POWERDOWN' if an 'fb_blank' callback exists, ensuring 'FB_EVENT_BLANK' listeners correctly see the display being turned on during the first modeset - The 'FB_EVENT_BLANK' event data now includes both the new and the old blank states - 'fb_blank()' has been reworked to return early on errors, without functional changes, in preparation for further state tracking improvements - Fbdev now calls dedicated functions in the backlight subsystems to notify them of blank state changes, instead of relying on fbdev event notifiers - For LCDs, fbdev also calls a dedicated function to notify of mode changes - Removed the definitions for the unused fbdev event constants 'FB_EVENT_MODE_CHANGE' and 'FB_EVENT_BLANK' from the header file Backlight Subsystem: - Implemented fbdev blank state tracking using the (newly enhanced) blank state information provided directly by 'FB_EVENT_BLANK' - Removed internal blank state tracking fields ('fb_bl_on') from 'struct backlight_device' - Moved the handling of blank-state updates into a separate internal helper function, 'backlight_notify_blank()' - Removed support for fbdev events and replaced it with a dedicated function call interface ('backlight_notify_blank()' and 'backlight_notify_blank_all()') for display drivers to update backlight status LCD Subsystem: - Moved the handling of display updates (blank events and mode changes) from fbdev event notifiers to separate internal helper functions ('lcd_notify_blank', 'lcd_notify_mode_change') - Removed support for fbdev events and replaced it with dedicated function call interfaces ('lcd_notify_blank_all()', 'lcd_notify_mode_change_all()') - The LCD subsystem now maintains its own internal list of LCD devices instead of relying on fbdev notifiers LED Backlight Trigger: - Moved the handling of blank-state updates into a separate internal helper, 'ledtrig_backlight_notify_blank()' - Removed support for fbdev events and replaced it with a dedicated function call, 'ledtrig_backlight_blank()', for fbdev to notify trigger of blank state changes - The LED backlight trigger now maintains its own internal list of triggers instead of relying on fbdev notifiers Qualcomm WLED Backlight: - Added a NULL check after 'devm_kasprintf()' in 'wled_configure()' to prevent a potential NULL pointer dereference if memory allocation fails" * tag 'backlight-next-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight: backlight: pm8941: Add NULL check in wled_configure() fbdev: Remove constants of unused events leds: backlight trigger: Replace fb events with a dedicated function call leds: backlight trigger: Move blank-state handling into helper backlight: lcd: Replace fb events with a dedicated function call backlight: lcd: Move event handling into helpers backlight: Replace fb events with a dedicated function call backlight: Move blank-state handling into helper backlight: Implement fbdev tracking with blank state from event fbdev: Send old blank state in FB_EVENT_BLANK fbdev: Track display blanking state fbdev: Rework fb_blank() commit 8b5f3a229a70d242322b78c8e13744ca00212def Author: Mario Limonciello Date: Wed May 14 16:06:40 2025 -0500 drm/amd/display: Fix default DC and AC levels [Why] DC and AC levels are advertised in a percentage, not a luminance. [How] Scale DC and AC levels to supported values. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4221 Reviewed-by: Alex Hung Signed-off-by: Mario Limonciello Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 4b61b8a390511a1864f26cc42bab72881e93468d Author: Mario Limonciello Date: Wed May 14 16:00:43 2025 -0500 drm/amd/display: Add debugging message for brightness caps [Why] Default BIOS brightness caps are buried in ACPI. [How] Add extra dynamic debug that can show default brightness caps. Reviewed-by: Alex Hung Signed-off-by: Mario Limonciello Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit c73375d918452e58f8903685d30ae21603040709 Author: Cruise Hung Date: Thu May 22 18:02:14 2025 +0800 drm/amd/display: Use DC log instead of using DM error msg [Why & How] It sent an error msg when it failed to read the DP tunneling DPCD field. This should just be a warning msg. Use a DC log instead of a DM error msg. Reviewed-by: Wenjing Liu Signed-off-by: Cruise Hung Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 747bfca45e07b201cf80f3ba7338006f4525aeed Author: Zhongwei Zhang Date: Fri May 16 14:44:21 2025 +0800 drm/amd/display: Avoid calling blank_stream() twice [Why] We've made fix for garbage in dcn31_reset_back_end_for_pipe(), adding blank_stream() before disable_crtc(). And set_dpms_off() will call blank_stream() again. [How] Add flag to avoid calling blank_stream() twice. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Zhongwei Zhang Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 893f07452bca56ff146a6be02b3294a9ea23d18a Author: Zhongwei Zhang Date: Tue May 13 16:45:59 2025 +0800 drm/amd/display: Correct non-OLED pre_T11_delay. [Why] Only OLED panels require non-zero pre_T11_delay defaultly. Others should be controlled by power sequence. [How] For non OLED, pre_T11_delay delay in code should be zero. Also post_T7_delay. Cc: Mario Limonciello Cc: Alex Deucher Cc: stable@vger.kernel.org Reviewed-by: Charlene Liu Signed-off-by: Zhongwei Zhang Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit e34bcf1594b59f9f63c084bf0646b19edf581adc Author: Arunpravin Paneer Selvam Date: Tue May 27 19:13:20 2025 +0530 drm/amdgpu: Add userq fence support to SDMAv7.0 - Add userq fence support to SDMAv7.0. - GFX12's user fence irq src id differs from GFX11's, hence we need create a new irq srcid header file for GFX12. User fence irq src id information- GFX11 and SDMA6.0 - 0x43 GFX12 and SDMA7.0 - 0x46 Signed-off-by: Arunpravin Paneer Selvam Acked-by: Christian König Signed-off-by: Alex Deucher commit 335f1e797c32cbe6f313805125526b35d29280b0 Author: Dan Carpenter Date: Fri May 23 19:09:52 2025 +0300 drm/amdgpu: Fix integer overflow in amdgpu_gem_add_input_fence() The "num_syncobj_handles" is a u32 value that comes from the user via the ioctl. On 32bit systems the "sizeof(uint32_t) * num_syncobj_handles" multiplication can have an integer overflow. Use size_mul() to fix that. Fixes: 38c67ec9aa4b ("drm/amdgpu: Add input fence to sync bo map/unmap") Signed-off-by: Dan Carpenter Signed-off-by: Alex Deucher commit a4a45a9a72f3a9eaa17ec502d6e97c8eaa901825 Author: Steven Rostedt Date: Thu May 29 15:22:11 2025 -0400 fsdax: Remove unused trace events for dax insert mapping When the dax_fault_actor() helper was factored out, it removed the calls to the dax_pmd_insert_mapping and dax_insert_mapping events but never removed the events themselves. As each event created takes up memory (roughly 5K each), this is a waste as it is never used. Remove the unused dax_pmd_insert_mapping and dax_insert_mapping trace events. Link: https://lore.kernel.org/all/20250529130138.544ffec4@gandalf.local.home/ Cc: Shiyang Ruan Cc: "Darrick J. Wong" Cc: Ross Zwisler Cc: Andrew Morton Link: https://lore.kernel.org/20250529152211.688800c9@gandalf.local.home Fixes: c2436190e492 ("fsdax: factor out a dax_fault_actor() helper") Acked-by: Dan Williams Reviewed-by: Alison Schofield Signed-off-by: Steven Rostedt (Google) commit b546608ea2151eebfca515d362bc400645e02d4f Merge: 69352bd52b2667 b338a2ae9b316d Author: Linus Torvalds Date: Tue Jun 3 12:10:31 2025 -0700 Merge tag 'leds-next-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds Pull LED updates from Lee Jones: "LED Triggers: - Allow writing "default" to the sysfs 'trigger' attribute to set an LED to its default trigger - If the default trigger is "none", writing "default" will remove the current trigger - Updated sysfs ABI documentation for the new "default" trigger functionality LED KUnit Testing: - Provide a skeleton KUnit test suite for the LEDs framework - Expand the LED class device registration KUnit test to cover more scenarios, including 'brightness_get' behavior - Add KUnit tests for the LED lookup and get API ('led_add_lookup', 'devm_led_get') LED Flash Class: - Add support for setting flash/strobe duration through a new 'duration_set' op and 'led_set_flash_duration()' function, aligning with 'V4L2_CID_FLASH_DURATION' Texas Instruments TPS6131x: - Add a new driver for the TPS61310/TPS61311 flash LED controllers - The driver supports the device's three constant-current sinks for flash and torch modes LED Core: - Prevent potential 'snprintf()' truncations in LED names by checking for buffer overflows ChromeOS EC LEDs: - Avoid a -Wflex-array-member-not-at-end GCC warning by replacing an on-stack flexible structure definition with a utility function call Multicolor LEDs: - Fix issue where setting multi_intensity while software blinking is active could stop blinking PCA955x LEDs: - Avoid potential buffer overflow when creating default labels by changing a field's type to 'u8' and updating format specifiers PCA995x LEDs: - Fix a typo (stray space) in an 'of_device_id' entry in the 'pca995x_of_match' table Kconfig: - Prevent LED drivers from being enabled by default when 'COMPILE_TEST' is set Device Property API: - Split 'device_get_child_node_count()' into a new helper 'fwnode_get_child_node_count()' that doesn't require a device struct, making the API more symmetrical Driver Modernization (using 'fwnode_get_child_node_count()'): - Update 'leds-pwm-multicolor', 'leds-ncp5623' and 'leds-ncp5623' to use the new 'fwnode_get_child_node_count()' helper, removing their custom implementation - As above in the USB Type-C TCPM driver Driver Modernization (using new GPIO setter callbacks): - Convert 'leds-lgm-sso' to use new GPIO line value setter callbacks which return an integer for error handling - Convert 'leds-pca955x', 'leds-pca9532' and 'leds-tca6507' to use new GPIO setter callbacks Documentation: - Remove the '.rst' extension for 'leds-st1202' in the documentation index for consistency LP8860 LEDs: - Use 'regmap_multi_reg_write()' for EEPROM writes instead of manual looping - Use scoped mutex guards and 'devm_mutex_init()' to simplify function exits and ensure automatic cleanup - Remove default register definitions that are unused when regmap caching is not active - Use 'devm_regulator_get_enable_optional()' to handle the optional regulator, simplifying enabling and removing manual disabling - Refactor 'lp8860_unlock_eeprom()' to only perform the unlock operation, removing the lock part and an unnecessary parameter - Use a 'devm' action to disable the enable-GPIO, simplifying cleanup and error paths, and remove the now-empty '.remove()' function Turris Omnia LEDs: - Drop unnecessary commas in terminator entries of 'struct attribute' and 'struct of_device_id' arrays MT6370 RGB LEDs: - Use the 'LINEAR_RANGE()' for defining 'struct linear_range' entries to improve robustness Texas Instruments TPS6131x: - Add new devicetree bindings for the TI TPS61310/TPS61311 flash LED driver" * tag 'leds-next-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds: (31 commits) leds: tps6131x: Add support for Texas Instruments TPS6131X flash LED driver dt-bindings: leds: Add Texas Instruments TPS6131x flash LED driver leds: flash: Add support for flash/strobe duration leds: rgb: leds-mt6370-rgb: Improve definition of some struct linear_range leds: led-test: Provide tests for the lookup and get infrastructure leds: led-test: Fill out the registration test to cover more test cases leds: led-test: Remove standard error checking after KUNIT_ASSERT_*() leds: pca995x: Fix typo in pca995x_of_match's of_device_id entry leds: Provide skeleton KUnit testing for the LEDs framework leds: tca6507: Use new GPIO line value setter callbacks leds: pca9532: Use new GPIO line value setter callbacks leds: pca955x: Use new GPIO line value setter callbacks leds: lgm-sso: Use new GPIO line value setter callbacks leds: Do not enable by default during compile testing leds: turris-omnia: Drop commas in the terminator entries leds: lp8860: Disable GPIO with devm action leds: lp8860: Only unlock in lp8860_unlock_eeprom() leds: lp8860: Enable regulator using enable_optional helper leds: lp8860: Remove default regs when not caching leds: lp8860: Use new mutex guards to cleanup function exits ... commit 98a46a408998102af5c45adce0871acd7967bb59 Author: Dan Carpenter Date: Fri May 23 19:05:58 2025 +0300 drm/amdgpu: Fix integer overflow issues in amdgpu_userq_fence.c This patch only affects 32bit systems. There are several integer overflows bugs here but only the "sizeof(u32) * num_syncobj" multiplication is a problem at runtime. (The last lines of this patch). These variables are u32 variables that come from the user. The issue is the multiplications can overflow leading to us allocating a smaller buffer than intended. For the first couple integer overflows, the syncobj_handles = memdup_user() allocation is immediately followed by a kmalloc_array(): syncobj = kmalloc_array(num_syncobj_handles, sizeof(*syncobj), GFP_KERNEL); In that situation the kmalloc_array() works as a bounds check and we haven't accessed the syncobj_handlesp[] array yet so the integer overflow is harmless. But the "num_syncobj" multiplication doesn't have that and the integer overflow could lead to an out of bounds access. Fixes: a292fdecd728 ("drm/amdgpu: Implement userqueue signal/wait IOCTL") Signed-off-by: Dan Carpenter Signed-off-by: Alex Deucher commit 5cccf10f652122a17b40df9d672ccf2ed69cd82f Author: Alex Deucher Date: Tue May 27 10:13:31 2025 -0400 drm/amdgpu: disable workload profile switching when OD is enabled Users have reported that they have to reduce the level of undervolting to acheive stability when dynamic workload profiles are enabled on GC 10.3.x. Disable dynamic workload profiles if the user has enabled OD. Fixes: b9467983b774 ("drm/amdgpu: add dynamic workload profile switching for gfx10") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4262 Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.15.x commit d26625d034fb8d596f0488472969493fa02d03f3 Author: Vitaly Prosyak Date: Tue May 6 16:45:33 2025 -0400 drm/amdgpu/gfx10: Refine Cleaner Shader for GFX10.1.10 This patch updates the cleaner shader, which is responsible for initializing GPU resources such as Local Data Share (LDS), Vector General Purpose Registers (VGPRs), and Scalar General Purpose Registers (SGPRs). Changes include adjustments to register clearing and shader configuration. - Updated GPU resource initialization addresses in the cleaner shader from `be803080` to `be803000`. - Simplified the logic in the SGPR clearing section, ensuring all SGPRs are set to zero. Fixes: 25961bad9212 ("drm/amdgpu/gfx10: Add cleaner shader for GFX10.1.10") Cc: Christian König Cc: Alex Deucher Signed-off-by: Manu Rastogi Signed-off-by: Vitaly Prosyak Signed-off-by: Srinivasan Shanmugam Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 719d84f8a812608fc0f7be18a96d7dee96eaf3ba Author: Lijo Lazar Date: Thu May 29 15:57:44 2025 +0530 drm/amdgpu: Add more checks to discovery fetch Add more checks for valid vram size and log error, if any. Signed-off-by: Lijo Lazar Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 4e696906e9a82d4cab75f3083fabd65433c77e20 Author: Xuemei Liu Date: Thu May 29 10:25:11 2025 +0800 drm/amdkfd: enable kfd on RISCV systems KFD has been confirmed that can run on RISCV systems. It's necessary to support CONFIG_HSA_AMD on RISCV. Signed-off-by: Xuemei Liu Signed-off-by: Felix Kuehling Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 69352bd52b2667e5c6e8ebb14143528c28f5e37d Merge: 2043ae9019e0f7 ffb006aa433e81 Author: Linus Torvalds Date: Tue Jun 3 11:53:55 2025 -0700 Merge tag 'mfd-next-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD updates from Lee Jones: "Samsung Exynos ACPM: - Populate child platform devices from device tree data - Introduce a new API, 'devm_acpm_get_by_node()', for child devices to get the ACPM handle ROHM PMICs: - Add support for the ROHM BD96802 scalable companion PMIC to the BD96801 core driver - Add support for controlling the BD96802 using the BD96801 regulator driver - Add support to the BD96805, which is almost identical to the BD96801 - Add support to the BD96806, which is similar to the BD96802 Maxim MAX77759: - Add a core driver for the MAX77759 companion PMIC - Add a GPIO driver for the expander functions on the MAX77759 - Add an NVMEM driver to expose the non-volatile memory on the MAX77759 STMicroelectronics STM32MP25: - Add support for the STM32MP25 SoC to the stm32-lptimer - Add support for the STM32MP25 to the clocksource driver, handling new register access requirements - Add support for the STM32MP25 to the PWM driver, enabling up to two PWM outputs Broadcom BCM590xx: - Add support for the BCM59054 PMU - Parse the PMU ID and revision to support behavioral differences between chip revisions - Add regulator support for the BCM59054 Samsung S2MPG10: - Add support for the S2MPG10 PMIC, which communicates via the Samsung ACPM firmware instead of I2C Exynos ACPM: - Improve timeout detection reliability by using ktime APIs instead of a loop counter assumption - Allow PMIC access during late system shutdown by switching to 'udelay()' instead of a sleeping function - Fix an issue where reading command results longer than 8 bytes would fail - Silence non-error '-EPROBE_DEFER' messages during boot to clean up logs Exynos LPASS: - Fix an error handling path by switching to 'devm_regmap_init_mmio()' to prevent resource leaks - Fix a bug where 'exynos_lpass_disable()' was called twice in the remove function - Fix another resource leak in the probe's error path by using 'devm_add_action_or_reset()' Samsung SEC: - Handle the s2dos05, which does not have IRQ support, explicitly to prevent warnings - Fix the core driver to correctly handle errors from 'sec_irq_init()' instead of ignoring them STMPE-SPI: - Correct an undeclared identifier in the 'MODULE_DEVICE_TABLE' macro MAINTAINERS: - Adjust a file path for the Siemens IPC LED drivers entry to fix a broken reference Maxim Drivers: - Correct the spelling of "Electronics" in Samsung copyright headers across multiple files General: - Fix wakeup source memory leaks on device unbind for 88pm886, as3722, max14577, max77541, max77705, max8925, rt5033, and sprd-sc27xx drivers Samsung SEC Drivers: - Split the driver into a transport-agnostic core ('sec-core') and transport-specific ('sec-i2c', 'sec-acpm') modules to support non-I2C devices - Merge the 'sec-core' and 'sec-irq' modules to reduce memory consumption - Move internal APIs to a private header to clean up the public API - Improve code style by sorting includes, cleaning up headers, sorting device tables, and using helper macros like 'dev_err_probe()', 'MFD_CELL', and 'REGMAP_IRQ_REG' - Make regmap configuration for s2dos05/s2mpu05 explicit to improve clarity - Rework platform data and regmap instantiation to use OF match data instead of a large switch statement ROHM BD96801/2: - Prepare the driver for new models by separating chip-specific data into its own structure - Drop IC name prefix from IRQ resource names in both the MFD and regulator drivers for simplification Broadcom BCM590xx: - Refactor the regulator driver to store descriptions in a table to ease support for new chips - Rename BCM59056-specific data to prepare for the addition of other regulators - Use 'dev_err_probe()' for cleaner error handling Exynos ACPM: - Correct kerneldoc warnings and use the conventional 'np' argument name General MFD: - Convert 'aat2870' and 'tps65010' to use the per-client debugfs directory provided by the I2C core - Convert 'sm501', 'tps65010' and 'ucb1x00' to use the new GPIO line value setter callbacks - Constify 'regmap_irq_chip' and other structures in '88pm886' to move data to read-only sections BCM590xx: - Drop the unused "id" member from the 'bcm590xx' struct in preparation for a replacement Samsung SEC Core: - Remove forward declarations for functions that no longer exist SM501: - Remove the unused 'sm501_find_clock()' function New Compatibles: - Google: Add a PMIC child node to the 'google,gs101-acpm-ipc' binding - ROHM: Add new bindings for 'rohm,bd96802-regulator' and 'rohm,bd96802-pmic', and add compatibles for BD96805 and BD96806 - Maxim: Add new bindings for 'maxim,max77759-gpio', 'maxim,max77759-nvmem', and the top-level 'maxim,max77759' - STM: Add 'stm32mp25' compatible to the 'stm32-lptimer' binding - Broadcom: Add 'bcm59054' compatible - Atmel/Microchip: Add 'microchip,sama7d65-gpbr' and 'microchip,sama7d65-secumod' compatibles - Samsung: Add 's2mpg10' compatible to the 'samsung,s2mps11' MFD binding - MediaTek: Add compatibles for 'mt6893' (scpsys), 'mt7988-topmisc', and 'mt8365-infracfg-nao' - Qualcomm: Add 'qcom,apq8064-mmss-sfpb' and 'qcom,apq8064-sps-sic' syscon compatibles Refactoring & Cleanup: - Convert Broadcom BCM59056 devicetree bindings to YAML and split them into MFD and regulator parts - Convert the Microchip AT91 secumod binding to YAML - Drop unrelated consumer nodes from binding examples to reduce bloat - Correct indentation and style in various DTS examples" * tag 'mfd-next-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (81 commits) mfd: maxim: Correct Samsung "Electronics" spelling in copyright headers mfd: maxim: Correct Samsung "Electronics" spelling in headers mfd: sm501: Remove unused sm501_find_clock mfd: 88pm886: Constify struct regmap_irq_chip and some other structures dt-bindings: mfd: syscon: Add mediatek,mt8365-infracfg-nao mfd: sprd-sc27xx: Fix wakeup source leaks on device unbind mfd: rt5033: Fix wakeup source leaks on device unbind mfd: max8925: Fix wakeup source leaks on device unbind mfd: max77705: Fix wakeup source leaks on device unbind mfd: max77541: Fix wakeup source leaks on device unbind mfd: max14577: Fix wakeup source leaks on device unbind mfd: as3722: Fix wakeup source leaks on device unbind mfd: 88pm886: Fix wakeup source leaks on device unbind dt-bindings: mfd: Correct indentation and style in DTS example dt-bindings: mfd: Drop unrelated nodes from DTS example dt-bindings: mfd: syscon: Add qcom,apq8064-sps-sic dt-bindings: mfd: syscon: Add qcom,apq8064-mmss-sfpb mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE dt-bindings: mfd: syscon: Add mt7988-topmisc mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() ... commit c09a8b00f850d3ca0af998bff1fac4a3f6d11768 Author: Caleb Sander Mateos Date: Tue Jun 3 12:31:32 2025 -0600 block: drop direction param from bio_integrity_copy_user() direction is determined from bio, which is already passed in. Compute op_is_write(bio_op(bio)) directly instead of converting it to an iter direction and back to a bool. Signed-off-by: Caleb Sander Mateos Reviewed-by: Keith Busch Reviewed-by: Anuj Gupta Link: https://lore.kernel.org/r/20250603183133.1178062-1-csander@purestorage.com Signed-off-by: Jens Axboe commit 9960be72a54cf0e4d47abdd4cacd1278835a3bb4 Author: Andrea Righi Date: Tue Jun 3 10:22:01 2025 +0200 sched_ext: idle: Skip cross-node search with !CONFIG_NUMA In the idle CPU selection logic, attempting cross-node searches adds unnecessary complexity when CONFIG_NUMA is disabled. Since there's no meaningful concept of nodes in this case, simplify the logic by restricting the idle CPU search to the current node only. Fixes: 48849271e6611 ("sched_ext: idle: Per-node idle cpumasks") Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit 2043ae9019e0f75c7785048230586c3f3ca0a2a4 Merge: efe19d34f6361c c48228c476ffe3 Author: Linus Torvalds Date: Tue Jun 3 10:34:36 2025 -0700 Merge tag 'hid-for-linus-2025060301' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID updates from Jiri Kosina: - support for Apple Magic Mouse 2 USB-C (Aditya Garg) - power management improvement for multitouch devices (Werner Sembach) - fix for ACPI initialization in intel-thc driver (Wentao Guan) - adaptation of HID drivers to use new gpio_chip's line setter callbacks (Bartosz Golaszewski) - fix potential OOB in usbhid_parse() (Terry Junge) - make it possible to set hid_mouse_ignore_list dynamically (the same way we handle other quirks) (Aditya Garg) - other small assorted fixes and device ID additions * tag 'hid-for-linus-2025060301' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: multitouch: Disable touchpad on firmware level while not in use HID: core: Add functions for HID drivers to react on first open and last close call HID: HID_APPLETB_BL should depend on X86 HID: HID_APPLETB_KBD should depend on X86 HID: appletb-kbd: Use secs_to_jiffies() instead of msecs_to_jiffies() HID: intel-thc-hid: intel-thc: make read-only arrays static const HID: magicmouse: Apple Magic Mouse 2 USB-C support HID: mcp2221: use new line value setter callbacks HID: mcp2200: use new line value setter callbacks HID: cp2112: use new line value setter callbacks HID: cp2112: use lock guards HID: cp2112: hold the lock for the entire direction_output() call HID: cp2112: destroy mutex on driver detach HID: intel-thc-hid: intel-quicki2c: pass correct arguments to acpi_evaluate_object HID: corsair-void: Use to_delayed_work() HID: hid-logitech: use sysfs_emit_at() instead of scnprintf() HID: quirks: Add HID_QUIRK_IGNORE_MOUSE quirk HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() HID: Kysona: Add periodic online check commit 9f2f6316d753fe80c764e924cee475306f38ceb6 Author: Mikulas Patocka Date: Tue Jun 3 18:58:47 2025 +0200 dm-stripe: small code cleanup This commit doesn't fix any bug, it is just code cleanup. Use the function format_dev_t instead of sprintf, because format_dev_t does the same thing. Remove the useless memset call. An unsigned integer can take at most 10 digits, so extend the array size to 22. (note that because the range of minor and major numbers is limited, the size 16 could not be exceeded, thus this function couldn't write beyond string end) Signed-off-by: Mikulas Patocka commit 66be40a14e496689e1f0add50118408e22c96169 Author: Mikulas Patocka Date: Tue Jun 3 18:55:50 2025 +0200 dm-verity: fix a memory leak if some arguments are specified multiple times If some of the arguments "check_at_most_once", "ignore_zero_blocks", "use_fec_from_device", "root_hash_sig_key_desc" were specified more than once on the target line, a memory leak would happen. This commit fixes the memory leak. It also fixes error handling in verity_verify_sig_parse_opt_args. Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org commit 829451beaed6165eb11d7a9fb4e28eb17f489980 Author: Mikulas Patocka Date: Tue Jun 3 18:53:17 2025 +0200 dm-mirror: fix a tiny race condition There's a tiny race condition in dm-mirror. The functions queue_bio and write_callback grab a spinlock, add a bio to the list, drop the spinlock and wake up the mirrord thread that processes bios in the list. It may be possible that the mirrord thread processes the bio just after spin_unlock_irqrestore is called, before wakeup_mirrord. This spurious wake-up is normally harmless, however if the device mapper device is unloaded just after the bio was processed, it may be possible that wakeup_mirrord(ms) uses invalid "ms" pointer. Fix this bug by moving wakeup_mirrord inside the spinlock. Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org commit 120f28a6f314fef7f282c99f196923fe44081cad Author: Przemek Kitszel Date: Fri Apr 4 12:23:21 2025 +0200 iavf: get rid of the crit lock Get rid of the crit lock. That frees us from the error prone logic of try_locks. Thanks to netdev_lock() by Jakub it is now easy, and in most cases we were protected by it already - replace crit lock by netdev lock when it was not the case. Lockdep reports that we should cancel the work under crit_lock [splat1], and that was the scheme we have mostly followed since [1] by Slawomir. But when that is done we still got into deadlocks [splat2]. So instead we should look at the bigger problem, namely "weird locking/scheduling" of the iavf. The first step to fix that is to remove the crit lock. I will followup with a -next series that simplifies scheduling/tasks. Cancel the work without netdev lock (weird unlock+lock scheme), to fix the [splat2] (which would be totally ugly if we would kept the crit lock). Extend protected part of iavf_watchdog_task() to include scheduling more work. Note that the removed comment in iavf_reset_task() was misplaced, it belonged to inside of the removed if condition, so it's gone now. [splat1] - w/o this patch - The deadlock during VF removal: WARNING: possible circular locking dependency detected sh/3825 is trying to acquire lock: ((work_completion)(&(&adapter->watchdog_task)->work)){+.+.}-{0:0}, at: start_flush_work+0x1a1/0x470 but task is already holding lock: (&adapter->crit_lock){+.+.}-{4:4}, at: iavf_remove+0xd1/0x690 [iavf] which lock already depends on the new lock. [splat2] - when cancelling work under crit lock, w/o this series, see [2] for the band aid attempt WARNING: possible circular locking dependency detected sh/3550 is trying to acquire lock: ((wq_completion)iavf){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x26/0x90 but task is already holding lock: (&dev->lock){+.+.}-{4:4}, at: iavf_remove+0xa6/0x6e0 [iavf] which lock already depends on the new lock. [1] fc2e6b3b132a ("iavf: Rework mutexes for better synchronisation") [2] https://github.com/pkitszel/linux/commit/52dddbfc2bb60294083f5711a158a Fixes: d1639a17319b ("iavf: fix a deadlock caused by rtnl and driver's lock circular dependencies") Signed-off-by: Przemek Kitszel Reviewed-by: Aleksandr Loktionov Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit 05702b5c949bd46243181833d4726f4c5e95f5e3 Author: Przemek Kitszel Date: Fri Apr 4 12:23:20 2025 +0200 iavf: sprinkle netdev_assert_locked() annotations Lockdep annotations help in general, but here it is extra good, as next commit will remove crit lock. Reviewed-by: Jacob Keller Signed-off-by: Przemek Kitszel Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit 257a8241ad7f4dc312494f69e3bc79a5598b4514 Author: Przemek Kitszel Date: Fri Apr 4 12:23:19 2025 +0200 iavf: extract iavf_watchdog_step() out of iavf_watchdog_task() Finish up easy refactor of watchdog_task, total for this + prev two commits is: 1 file changed, 47 insertions(+), 82 deletions(-) Signed-off-by: Przemek Kitszel Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit ecb4cd0461accc446d20a7a167f39ed2fd5e9b0e Author: Przemek Kitszel Date: Fri Apr 4 12:23:18 2025 +0200 iavf: simplify watchdog_task in terms of adminq task scheduling Simplify the decision whether to schedule adminq task. The condition is the same, but it is executed in more scenarios. Note that movement of watchdog_done label makes this commit a bit surprising. (Hence not squashing it to anything bigger). Reviewed-by: Jacob Keller Signed-off-by: Przemek Kitszel Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit 099418da91b7d3d46ddcccbb03075cc4f1ba2d44 Author: Przemek Kitszel Date: Fri Apr 4 12:23:17 2025 +0200 iavf: centralize watchdog requeueing itself Centralize the unlock(critlock); unlock(netdev); queue_delayed_work(watchog_task); pattern to one place. Reviewed-by: Jacob Keller Signed-off-by: Przemek Kitszel Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit dba35a4bb4a3da5696f2a179b7d695dc3ea25fb8 Author: Przemek Kitszel Date: Fri Apr 4 12:23:16 2025 +0200 iavf: iavf_suspend(): take RTNL before netdev_lock() Fix an obvious violation of lock ordering. Jakub's [1] added netdev_lock() call that is wrong ordered wrt RTNL, but the Fixes tag points to crit_lock being wrongly placed (by lockdep standards). Actual reason we got it wrong is dated back to critical section managed by pure flag checks, which is with us since the very beginning. [1] afc664987ab3 ("eth: iavf: extend the netdev_lock usage") Fixes: 5ac49f3c2702 ("iavf: use mutexes for locking of critical sections") Reviewed-by: Jacob Keller Signed-off-by: Przemek Kitszel Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit efe19d34f6361c6fc90a2c249796af929db7d4a8 Merge: 76c21d22546978 a374cfbf609017 Author: Linus Torvalds Date: Tue Jun 3 09:42:38 2025 -0700 Merge tag 'ata-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata updates from Damien Le Moal: - Simplify ata_print_version_once() using dev_dbg_once() (Heiner) - Some cleanups of libata-sata code to simplify the sense data fetching code and use BIT() macro for tag bit handling (Niklas) - Fix variable name spelling in the sata_sx4 driver (Colin) - Improve sense data information field handling for passthrough commands (Igor) - Add Rockchip RK3576 SoC compatible to the Designware AHCI DT bindings (Nicolas) - Add a message to indicate if a port is marked as external or not, to help with debugging potential issues with LPM (Niklas) - Convert DT bindings for "ti,dm816-ahci", "apm,xgene-ahci", "cavium,ebt3000-compact-flash", "marvell,orion-sata", and "arasan,cf-spear1340" to DT schema (Rob) - Cleanup and improve the code and related comments for HIPM and DIPM (host initiated and device initiated power managent) handling. In particular, keep DIPM disabled while modifying the allowed LPM states to avoid races with the device initiating power state changes (Niklas) * tag 'ata-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: libata-eh: Keep DIPM disabled while modifying the allowed LPM states ata: libata-eh: Rename no_dipm variable to be more clear ata: libata-eh: Rename hipm and dipm variables ata: libata-eh: Add ata_eh_set_lpm() WARN_ON_ONCE ata: libata-eh: Update DIPM comments to reflect reality dt-bindings: ata: Convert arasan,cf-spear1340 to DT schema dt-bindings: ata: Convert marvell,orion-sata to DT schema dt-bindings: ata: Convert cavium,ebt3000-compact-flash to DT schema dt-bindings: ata: Convert apm,xgene-ahci to DT schema dt-bindings: ata: Convert st,ahci to DT schema dt-bindings: ata: Convert ti,dm816-ahci to DT schema ata: libata: Print if port is external on boot dt-bindings: ata: rockchip-dwc-ahci: add RK3576 compatible ata: libata-scsi: Do not set the INFORMATION field twice for ATA PT ata: sata_sx4: Fix spelling mistake "parttern" -> "pattern" ata: libata-sata: Use BIT() macro to convert tag to bit field ata: libata-sata: Simplify sense_valid fetching ata: libata-core: Simplify ata_print_version_once commit 76c21d225469780a005140037b6248e648f41ae4 Merge: f5164456c604f6 46d40b2479ab64 Author: Linus Torvalds Date: Tue Jun 3 09:11:26 2025 -0700 Merge tag 'hwmon-for-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon updates from Guenter Roeck: "New drivers: - KEBA fan controller - KEBA battery monitoring controller - MAX77705 Support added to existing drivers: - MAXIMUS VI HERO and ROG MAXIMUS Z90 Formula support (asus-ec-sensors) - SQ52206 support (ina238) - lt3074 support (pmbus/lt3074) - ADPM12160 support (pmbus/max34440) - MPM82504 and for MPM3695 family support (pmbus/mpq8785) - Add the Dell OptiPlex 7050 to the DMI whitelist (dell-smm) - Zen5 Ryzen Desktop support (k10temp) Various other minor fixes and improvements" * tag 'hwmon-for-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (48 commits) doc: hwmon: acpi_power_meter: Add information about enabling the power capping feature. hwmon: (isl28022) Fix current reading calculation hwmon: (lm75) Fix I3C transfer buffer pointer for incoming data hwmon: Add KEBA fan controller support hwmon: pmbus: mpq8785: Add support for MPM3695 family hwmon: pmbus: mpq8785: Add support for MPM82504 hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration hwmon: pmbus: mpq8785: Prepare driver for multiple device support dt-bindings: hwmon: Add bindings for mpq8785 driver hwmon: (ina238) Modify the calculation formula to adapt to different chips hwmon: (ina238) Add support for SQ52206 dt-bindings: Add SQ52206 to ina2xx devicetree bindings hwmon: (ina238) Add ina238_config to save configurations for different chips hwmon: (ausus-ec-sensors) add MAXIMUS VI HERO. hwmon: (isl28022, nct7363) Convert to use maple tree register cache hwmon: (asus-ec-sensors) check sensor index in read_string() hwmon: (asus-ec-sensors) add ROG MAXIMUS Z90 Formula. dt-bindings: hwmon: Add Sophgo SG2044 external hardware monitor support hwmon: (max77705) Add initial support hwmon: (tmp102) add vcc regulator support ... commit f5164456c604f6b7cdc5d8ee2cf792b10fba3aa2 Merge: c00b28502470b7 3d6d238851dff5 Author: Linus Torvalds Date: Tue Jun 3 09:05:01 2025 -0700 Merge tag 'xtensa-20250603' of https://github.com/jcmvbkbc/linux-xtensa Pull xtensa updates from Max Filippov: - migrate to the generic rule for built-in DTB - cleanups in code and common_defconfig * tag 'xtensa-20250603' of https://github.com/jcmvbkbc/linux-xtensa: arch: xtensa: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX xtensa: migrate to the generic rule for built-in DTB xtensa: ptrace: Remove zero-length alignment array commit b7188a1c0d2d7b04f4558e10293651d49fcb2398 Author: Amadeusz Sławiński Date: Tue Jun 3 16:52:44 2025 +0200 ASoC: Intel: avs: boards: Fix rt5663 front end name Fix copy paste mistake in board name. Fixes: f1e282c333ac ("ASoC: Intel: avs: boards: Change rt5663 card name") Reviewed-by: Cezary Rojewski Signed-off-by: Amadeusz Sławiński Link: https://patch.msgid.link/20250603145244.871239-1-amadeuszx.slawinski@linux.intel.com Signed-off-by: Mark Brown commit c00b28502470b7677c2f4ee2e9c899205fa78e27 Merge: 04446eee58fcb2 96959283a58d91 Author: Linus Torvalds Date: Tue Jun 3 08:39:20 2025 -0700 Merge tag 'hyperv-next-signed-20250602' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull hyperv updates from Wei Liu: - Support for Virtual Trust Level (VTL) on arm64 (Roman Kisel) - Fixes for Hyper-V UIO driver (Long Li) - Fixes for Hyper-V PCI driver (Michael Kelley) - Select CONFIG_SYSFB for Hyper-V guests (Michael Kelley) - Documentation updates for Hyper-V VMBus (Michael Kelley) - Enhance logging for hv_kvp_daemon (Shradha Gupta) * tag 'hyperv-next-signed-20250602' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: (23 commits) Drivers: hv: Always select CONFIG_SYSFB for Hyper-V guests Drivers: hv: vmbus: Add comments about races with "channels" sysfs dir Documentation: hyperv: Update VMBus doc with new features and info PCI: hv: Remove unnecessary flex array in struct pci_packet Drivers: hv: Remove hv_alloc/free_* helpers Drivers: hv: Use kzalloc for panic page allocation uio_hv_generic: Align ring size to system page uio_hv_generic: Use correct size for interrupt and monitor pages Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary arch/x86: Provide the CPU number in the wakeup AP callback x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() PCI: hv: Get vPCI MSI IRQ domain from DeviceTree ACPI: irq: Introduce acpi_get_gsi_dispatcher() Drivers: hv: vmbus: Introduce hv_get_vmbus_root_device() Drivers: hv: vmbus: Get the IRQ number from DeviceTree dt-bindings: microsoft,vmbus: Add interrupt and DMA coherence properties arm64, x86: hyperv: Report the VTL the system boots in arm64: hyperv: Initialize the Virtual Trust Level field Drivers: hv: Provide arch-neutral implementation of get_vtl() Drivers: hv: Enable VTL mode for arm64 ... commit 04446eee58fcb2a6c9db5abff7f07cc2f38da9d0 Merge: 8b2198f03776c5 b9802b54d41bbe Author: Linus Torvalds Date: Tue Jun 3 08:03:45 2025 -0700 Merge tag 'v6.16-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: "Fix a loongarch header regression and a module name collision on s390" * tag 'v6.16-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: asm-generic: Add sched.h inclusion in simd.h crypto: s390/sha256 - rename module to sha256-s390 commit 8b2198f03776c5c25f0cafe0ba5c0c60807b554b Merge: 546b1c9e93c2bb 895ee6a22e3195 Author: Linus Torvalds Date: Tue Jun 3 07:39:23 2025 -0700 Merge tag 'bitmap-for-6.16-rc1' of https://github.com/norov/linux Pull bitmap updates from Yury Norov: - dead code cleanups for cpumasks and nodemasks (me) - fixed-width flavors of GENMASK() and BIT() (Vincent, Lucas and me) - FIELD_MODIFY() helper (Luo) - for_each_node_with_cpus() optimization (me) - bitmap-str fixes (Andy) * tag 'bitmap-for-6.16-rc1' of https://github.com/norov/linux: topology: make for_each_node_with_cpus() O(N) bitfield: Add FIELD_MODIFY() helper bitmap-str: Add missing header(s) bitmap-str: Get rid of 'extern' for function prototypes build_bug.h: more user friendly error messages in BUILD_BUG_ON_ZERO() test_bits: add tests for BIT_U*() test_bits: add tests for GENMASK_U*() drm/i915: Convert REG_GENMASK*() to fixed-width GENMASK_U*() bits: introduce fixed-type BIT_U*() bits: introduce fixed-type GENMASK_U*() bits: add comments and newlines to #if, #else and #endif directives cpumask: drop cpumask_assign_cpu() riscv: switch set_icache_stale_mask() to using non-atomic assign_cpu() cpumask: add non-atomic __assign_cpu() nodemask: drop nodes_shift commit 8b68e978718f14fdcb080c2a7791c52a0d09bc6d Author: Thomas Gleixner Date: Wed Feb 26 16:01:57 2025 +0100 x86/iopl: Cure TIF_IO_BITMAP inconsistencies io_bitmap_exit() is invoked from exit_thread() when a task exists or when a fork fails. In the latter case the exit_thread() cleans up resources which were allocated during fork(). io_bitmap_exit() invokes task_update_io_bitmap(), which in turn ends up in tss_update_io_bitmap(). tss_update_io_bitmap() operates on the current task. If current has TIF_IO_BITMAP set, but no bitmap installed, tss_update_io_bitmap() crashes with a NULL pointer dereference. There are two issues, which lead to that problem: 1) io_bitmap_exit() should not invoke task_update_io_bitmap() when the task, which is cleaned up, is not the current task. That's a clear indicator for a cleanup after a failed fork(). 2) A task should not have TIF_IO_BITMAP set and neither a bitmap installed nor IOPL emulation level 3 activated. This happens when a kernel thread is created in the context of a user space thread, which has TIF_IO_BITMAP set as the thread flags are copied and the IO bitmap pointer is cleared. Other than in the failed fork() case this has no impact because kernel threads including IO workers never return to user space and therefore never invoke tss_update_io_bitmap(). Cure this by adding the missing cleanups and checks: 1) Prevent io_bitmap_exit() to invoke task_update_io_bitmap() if the to be cleaned up task is not the current task. 2) Clear TIF_IO_BITMAP in copy_thread() unconditionally. For user space forks it is set later, when the IO bitmap is inherited in io_bitmap_share(). For paranoia sake, add a warning into tss_update_io_bitmap() to catch the case, when that code is invoked with inconsistent state. Fixes: ea5f1cd7ab49 ("x86/ioperm: Remove bitmap if all permissions dropped") Reported-by: syzbot+e2b1803445d236442e54@syzkaller.appspotmail.com Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Cc: stable@vger.kernel.org Link: https://lore.kernel.org/87wmdceom2.ffs@tglx commit 7eb11c0ab70777b9e5145a5ba1c0a2312c3980b2 Author: Sabrina Dubroca Date: Fri May 23 17:11:18 2025 +0200 xfrm: state: use a consistent pcpu_id in xfrm_state_find If we get preempted during xfrm_state_find, we could run xfrm_state_look_at using a different pcpu_id than the one xfrm_state_find saw. This could lead to ignoring states that should have matched, and triggering acquires on a CPU that already has a pcpu state. xfrm_state_find starts on CPU1 pcpu_id = 1 lookup starts xfrm_state_look_at pcpu_id = 2 finds a state found: best->pcpu_num != pcpu_id (2 != 1) if (!x && !error && !acquire_in_progress) { ... xfrm_state_alloc xfrm_init_tempstate ... This can be avoided by passing the original pcpu_id down to all xfrm_state_look_at() calls. Also switch to raw_smp_processor_id, disabling preempting just to re-enable it immediately doesn't really make sense. Fixes: 1ddf9916ac09 ("xfrm: Add support for per cpu xfrm state handling.") Signed-off-by: Sabrina Dubroca Reviewed-by: Florian Westphal Signed-off-by: Steffen Klassert commit 94d077c331730510d5611b438640a292097341f0 Author: Sabrina Dubroca Date: Fri May 23 17:11:17 2025 +0200 xfrm: state: initialize state_ptrs earlier in xfrm_state_find In case of preemption, xfrm_state_look_at will find a different pcpu_id and look up states for that other CPU. If we matched a state for CPU2 in the state_cache while the lookup started on CPU1, we will jump to "found", but the "best" state that we got will be ignored and we will enter the "acquire" block. This block uses state_ptrs, which isn't initialized at this point. Let's initialize state_ptrs just after taking rcu_read_lock. This will also prevent a possible misuse in the future, if someone adjusts this function. Reported-by: syzbot+7ed9d47e15e88581dc5b@syzkaller.appspotmail.com Fixes: e952837f3ddb ("xfrm: state: fix out-of-bounds read during lookup") Signed-off-by: Sabrina Dubroca Reviewed-by: Florian Westphal Signed-off-by: Steffen Klassert commit 9c7e8b31da035fe81399891b2630a8e0c4b09137 Author: Antonio Quartulli Date: Thu May 22 15:33:18 2025 +0200 selftest/net/ovpn: fix missing file test-large-mtu.sh is referenced by the Makefile but does not exist. Add it along the other scripts. Fixes: 944f8b6abab6 ("selftest/net/ovpn: extend coverage with more test cases") Signed-off-by: Antonio Quartulli commit fdf4064aaebe4379e6d441141bed83d51b52ad04 Author: Antonio Quartulli Date: Tue May 20 16:42:39 2025 +0200 selftest/net/ovpn: fix TCP socket creation TCP sockets cannot be created with AF_UNSPEC, but one among the supported family must be used. Since commit 944f8b6abab6 ("selftest/net/ovpn: extend coverage with more test cases") the default address family for all tests was changed from AF_INET to AF_UNSPEC, thus breaking all TCP cases. Restore AF_INET as default address family for TCP listeners. Fixes: 944f8b6abab6 ("selftest/net/ovpn: extend coverage with more test cases") Signed-off-by: Antonio Quartulli commit a6a5e87b3ee4cbf9c69a776565378c9b6a91dbfb Author: Antonio Quartulli Date: Wed May 28 00:01:10 2025 +0200 ovpn: avoid sleep in atomic context in TCP RX error path Upon error along the TCP data_ready event path, we have the following chain of calls: strp_data_ready() ovpn_tcp_rcv() ovpn_peer_del() ovpn_socket_release() Since strp_data_ready() may be invoked from softirq context, and ovpn_socket_release() may sleep, the above sequence may cause a sleep in atomic context like the following: BUG: sleeping function called from invalid context at ./ovpn-backports-ovpn-net-next-main-6.15.0-rc5-20250522/drivers/net/ovpn/socket.c:71 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 25, name: ksoftirqd/3 5 locks held by ksoftirqd/3/25: #0: ffffffe000cd0580 (rcu_read_lock){....}-{1:2}, at: netif_receive_skb+0xb8/0x5b0 OpenVPN/ovpn-backports#1: ffffffe000cd0580 (rcu_read_lock){....}-{1:2}, at: netif_receive_skb+0xb8/0x5b0 OpenVPN/ovpn-backports#2: ffffffe000cd0580 (rcu_read_lock){....}-{1:2}, at: ip_local_deliver_finish+0x66/0x1e0 OpenVPN/ovpn-backports#3: ffffffe003ce9818 (slock-AF_INET/1){+.-.}-{2:2}, at: tcp_v4_rcv+0x156e/0x17a0 OpenVPN/ovpn-backports#4: ffffffe000cd0580 (rcu_read_lock){....}-{1:2}, at: ovpn_tcp_data_ready+0x0/0x1b0 [ovpn] CPU: 3 PID: 25 Comm: ksoftirqd/3 Not tainted 5.10.104+ #0 Call Trace: walk_stackframe+0x0/0x1d0 show_stack+0x2e/0x44 dump_stack+0xc2/0x102 ___might_sleep+0x29c/0x2b0 __might_sleep+0x62/0xa0 ovpn_socket_release+0x24/0x2d0 [ovpn] unlock_ovpn+0x6e/0x190 [ovpn] ovpn_peer_del+0x13c/0x390 [ovpn] ovpn_tcp_rcv+0x280/0x560 [ovpn] __strp_recv+0x262/0x940 strp_recv+0x66/0x80 tcp_read_sock+0x122/0x410 strp_data_ready+0x156/0x1f0 ovpn_tcp_data_ready+0x92/0x1b0 [ovpn] tcp_data_ready+0x6c/0x150 tcp_rcv_established+0xb36/0xc50 tcp_v4_do_rcv+0x25e/0x380 tcp_v4_rcv+0x166a/0x17a0 ip_protocol_deliver_rcu+0x8c/0x250 ip_local_deliver_finish+0xf8/0x1e0 ip_local_deliver+0xc2/0x2d0 ip_rcv+0x1f2/0x330 __netif_receive_skb+0xfc/0x290 netif_receive_skb+0x104/0x5b0 br_pass_frame_up+0x190/0x3f0 br_handle_frame_finish+0x3e2/0x7a0 br_handle_frame+0x750/0xab0 __netif_receive_skb_core.constprop.0+0x4c0/0x17f0 __netif_receive_skb+0xc6/0x290 netif_receive_skb+0x104/0x5b0 xgmac_dma_rx+0x962/0xb40 __napi_poll.constprop.0+0x5a/0x350 net_rx_action+0x1fe/0x4b0 __do_softirq+0x1f8/0x85c run_ksoftirqd+0x80/0xd0 smpboot_thread_fn+0x1f0/0x3e0 kthread+0x1e6/0x210 ret_from_kernel_thread+0x8/0xc Fix this issue by postponing the ovpn_peer_del() call to a scheduled worker, as we already do in ovpn_tcp_send_sock() for the very same reason. Fixes: 11851cbd60ea ("ovpn: implement TCP transport") Reported-by: Qingfang Deng Closes: https://github.com/OpenVPN/ovpn-net-next/issues/13 Reviewed-by: Michal Swiatkowski Signed-off-by: Antonio Quartulli commit ba499a07ce1d912e48e225eadd9b3f994b05fd58 Author: Antonio Quartulli Date: Wed Apr 30 02:26:49 2025 +0200 ovpn: ensure sk is still valid during cleanup Removing a peer while userspace attempts to close its transport socket triggers a race condition resulting in the following crash: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000077: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x00000000000003b8-0x00000000000003bf] CPU: 12 UID: 0 PID: 162 Comm: kworker/12:1 Tainted: G O 6.15.0-rc2-00635-g521139ac3840 #272 PREEMPT(full) Tainted: [O]=OOT_MODULE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-20240910_120124-localhost 04/01/2014 Workqueue: events ovpn_peer_keepalive_work [ovpn] RIP: 0010:ovpn_socket_release+0x23c/0x500 [ovpn] Code: ea 03 80 3c 02 00 0f 85 71 02 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 64 24 18 49 8d bc 24 be 03 00 00 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 30 RSP: 0018:ffffc90000c9fb18 EFLAGS: 00010217 RAX: dffffc0000000000 RBX: ffff8881148d7940 RCX: ffffffff817787bb RDX: 0000000000000077 RSI: 0000000000000008 RDI: 00000000000003be RBP: ffffc90000c9fb30 R08: 0000000000000000 R09: fffffbfff0d3e840 R10: ffffffff869f4207 R11: 0000000000000000 R12: 0000000000000000 R13: ffff888115eb9300 R14: ffffc90000c9fbc8 R15: 000000000000000c FS: 0000000000000000(0000) GS:ffff8882b0151000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f37266b6114 CR3: 00000000054a8000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: unlock_ovpn+0x8b/0xe0 [ovpn] ovpn_peer_keepalive_work+0xe3/0x540 [ovpn] ? ovpn_peers_free+0x780/0x780 [ovpn] ? lock_acquire+0x56/0x70 ? process_one_work+0x888/0x1740 process_one_work+0x933/0x1740 ? pwq_dec_nr_in_flight+0x10b0/0x10b0 ? move_linked_works+0x12d/0x2c0 ? assign_work+0x163/0x270 worker_thread+0x4d6/0xd90 ? preempt_count_sub+0x4c/0x70 ? process_one_work+0x1740/0x1740 kthread+0x36c/0x710 ? trace_preempt_on+0x8c/0x1e0 ? kthread_is_per_cpu+0xc0/0xc0 ? preempt_count_sub+0x4c/0x70 ? _raw_spin_unlock_irq+0x36/0x60 ? calculate_sigpending+0x7b/0xa0 ? kthread_is_per_cpu+0xc0/0xc0 ret_from_fork+0x3a/0x80 ? kthread_is_per_cpu+0xc0/0xc0 ret_from_fork_asm+0x11/0x20 Modules linked in: ovpn(O) This happens because the peer deletion operation reaches ovpn_socket_release() while ovpn_sock->sock (struct socket *) and its sk member (struct sock *) are still both valid. Here synchronize_rcu() is invoked, after which ovpn_sock->sock->sk becomes NULL, due to the concurrent socket closing triggered from userspace. After having invoked synchronize_rcu(), ovpn_socket_release() will attempt dereferencing ovpn_sock->sock->sk, triggering the crash reported above. The reason for accessing sk is that we need to retrieve its protocol and continue the cleanup routine accordingly. This crash can be easily produced by running openvpn userspace in client mode with `--keepalive 10 20`, while entirely omitting this option on the server side. After 20 seconds ovpn will assume the peer (server) to be dead, will start removing it and will notify userspace. The latter will receive the notification and close the transport socket, thus triggering the crash. To fix the race condition for good, we need to refactor struct ovpn_socket. Since ovpn is always only interested in the sock->sk member (struct sock *) we can directly hold a reference to it, raher than accessing it via its struct socket container. This means changing "struct socket *ovpn_socket->sock" to "struct sock *ovpn_socket->sk". While acquiring a reference to sk, we can increase its refcounter without affecting the socket close()/destroy() notification (which we rely on when userspace closes a socket we are using). By increasing sk's refcounter we know we can dereference it in ovpn_socket_release() without incurring in any race condition anymore. ovpn_socket_release() will ultimately decrease the reference counter. Cc: Oleksandr Natalenko Fixes: 11851cbd60ea ("ovpn: implement TCP transport") Reported-by: Qingfang Deng Closes: https://github.com/OpenVPN/ovpn-net-next/issues/1 Tested-by: Gert Doering Link: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg31575.html Reviewed-by: Michal Swiatkowski Signed-off-by: Antonio Quartulli commit 930faf1eb8d70226ac804b61e5cd79b17fb3261d Author: Antonio Quartulli Date: Tue May 13 16:43:59 2025 +0200 ovpn: properly deconfigure UDP-tunnel When deconfiguring a UDP-tunnel from a socket, we cannot call setup_udp_tunnel_sock() with an empty config, because this helper is expected to be invoked only during setup. Get rid of the call to setup_udp_tunnel_sock() and just revert what it did during socket initialization.. Note that the global udp_encap_needed_key and the GRO state are left untouched: udp_destroy_socket() will eventually take care of them. Cc: Sabrina Dubroca Cc: Oleksandr Natalenko Fixes: ab66abbc769b ("ovpn: implement basic RX path (UDP)") Reported-by: Paolo Abeni Closes: https://lore.kernel.org/netdev/1a47ce02-fd42-4761-8697-f3f315011cc6@redhat.com Signed-off-by: Antonio Quartulli commit 065a651e2fb35209cbfe6fc5f1ababf92b66d4a4 Author: Cezary Rojewski Date: Fri May 30 16:10:24 2025 +0200 ASoC: Intel: avs: Simplify verification of parse_int_array() result The function return either success or an error code, no need to involve '<' operator. Reviewed-by: Amadeusz Sławiński Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20250530141025.2942936-9-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit b56bbaf8c9ffe02468f6ba8757668e95dda7e62c Merge: d3f2a9587ebe68 c86fac5365d3a0 Author: Paolo Abeni Date: Tue Jun 3 13:04:08 2025 +0200 Merge branch 'net-airoha-fix-ipv6-hw-acceleration' Lorenzo Bianconi says: ==================== net: airoha: Fix IPv6 hw acceleration Fix IPv6 hw acceleration in bridge mode resolving ib2 and airoha_foe_mac_info_common overwrite in airoha_ppe_foe_commit_subflow_entry routine. Introduce UPDMEM source-mac table used to set source mac address for L3 IPv6 hw accelerated traffic. ==================== Link: https://patch.msgid.link/20250602-airoha-flowtable-ipv6-fix-v2-0-3287f8b55214@kernel.org Signed-off-by: Paolo Abeni commit c86fac5365d3a068422beeb508f2741f1a2d734d Author: Lorenzo Bianconi Date: Mon Jun 2 12:55:39 2025 +0200 net: airoha: Fix smac_id configuration in bridge mode Set PPE entry smac_id field to 0xf in airoha_ppe_foe_commit_subflow_entry routine for IPv6 traffic in order to instruct the hw to keep original source mac address for IPv6 hw accelerated traffic in bridge mode. Fixes: cd53f622611f ("net: airoha: Add L2 hw acceleration support") Signed-off-by: Lorenzo Bianconi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250602-airoha-flowtable-ipv6-fix-v2-3-3287f8b55214@kernel.org Signed-off-by: Paolo Abeni commit 504a577c9b000f9e0e99e1b28616fb4eb369e1ef Author: Lorenzo Bianconi Date: Mon Jun 2 12:55:38 2025 +0200 net: airoha: Fix IPv6 hw acceleration in bridge mode ib2 and airoha_foe_mac_info_common have not the same offsets in airoha_foe_bridge and airoha_foe_ipv6 structures. Current codebase does not accelerate IPv6 traffic in bridge mode since ib2 and l2 info are not set properly copying airoha_foe_bridge struct into airoha_foe_ipv6 one in airoha_ppe_foe_commit_subflow_entry routine. Fix IPv6 hw acceleration in bridge mode resolving ib2 and airoha_foe_mac_info_common overwrite in airoha_ppe_foe_commit_subflow_entry() and configuring them with proper values. Fixes: cd53f622611f ("net: airoha: Add L2 hw acceleration support") Signed-off-by: Lorenzo Bianconi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250602-airoha-flowtable-ipv6-fix-v2-2-3287f8b55214@kernel.org Signed-off-by: Paolo Abeni commit a869d3a5eb011a9cf9bd864f31f5cf27362de8c7 Author: Lorenzo Bianconi Date: Mon Jun 2 12:55:37 2025 +0200 net: airoha: Initialize PPE UPDMEM source-mac table UPDMEM source-mac table is a key-value map used to store devices mac addresses according to the port identifier. UPDMEM source mac table is used during IPv6 traffic hw acceleration since PPE entries, for space constraints, do not contain the full source mac address but just the identifier in the UPDMEM source-mac table. Configure UPDMEM source-mac table with device mac addresses and set the source-mac ID field for PPE IPv6 entries in order to select the proper device mac address as source mac for L3 IPv6 hw accelerated traffic. Fixes: 00a7678310fe ("net: airoha: Introduce flowtable offload support") Signed-off-by: Lorenzo Bianconi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250602-airoha-flowtable-ipv6-fix-v2-1-3287f8b55214@kernel.org Signed-off-by: Paolo Abeni commit d3f2a9587ebe68f5067f9ff624f9a83dfb911f60 Author: Bui Quang Minh Date: Sun Jun 1 21:29:13 2025 +0700 selftests: net: build net/lib dependency in all target We have the logic to include net/lib automatically for net related selftests. However, currently, this logic is only in install target which means only `make install` will have net/lib included. This commit adds the logic to all target so that all `make`, `make run_tests` and `make install` will have net/lib included in net related selftests. Signed-off-by: Bui Quang Minh Link: https://patch.msgid.link/20250601142914.13379-1-minhquangbui99@gmail.com Fixes: b86761ff6374 ("selftests: net: add scaffolding for Netlink tests in Python") Signed-off-by: Paolo Abeni commit 982d30c30eaa2ec723df42e3bf526c014c1dbb88 Author: Ronak Doshi Date: Fri May 30 15:27:00 2025 +0000 vmxnet3: correctly report gso type for UDP tunnels Commit 3d010c8031e3 ("udp: do not accept non-tunnel GSO skbs landing in a tunnel") added checks in linux stack to not accept non-tunnel GRO packets landing in a tunnel. This exposed an issue in vmxnet3 which was not correctly reporting GRO packets for tunnel packets. This patch fixes this issue by setting correct GSO type for the tunnel packets. Currently, vmxnet3 does not support reporting inner fields for LRO tunnel packets. The issue is not seen for egress drivers that do not use skb inner fields. The workaround is to enable tnl-segmentation offload on the egress interfaces if the driver supports it. This problem pre-exists this patch fix and can be addressed as a separate future patch. Fixes: dacce2be3312 ("vmxnet3: add geneve and vxlan tunnel offload support") Signed-off-by: Ronak Doshi Acked-by: Guolin Yang Link: https://patch.msgid.link/20250530152701.70354-1-ronak.doshi@broadcom.com [pabeni@redhat.com: dropped the changelog] Signed-off-by: Paolo Abeni commit f6695269dc52d133ecf6468aa7cbfe29987630ed Author: Jakub Kicinski Date: Fri May 30 06:58:00 2025 -0700 Revert "kunit: configs: Enable CONFIG_INIT_STACK_ALL_PATTERN in all_tests" This reverts commit a571a9a1b120264e24b41eddf1ac5140131bfa84. The commit in question breaks kunit for older compilers: $ gcc --version gcc (GCC) 11.5.0 20240719 (Red Hat 11.5.0-5) $ ./tools/testing/kunit/kunit.py run --alltests --json --arch=x86_64 Configuring KUnit Kernel ... Regenerating .config ... Populating config with: $ make ARCH=x86_64 O=.kunit olddefconfig ERROR:root:Not all Kconfig options selected in kunitconfig were in the generated .config. This is probably due to unsatisfied dependencies. Missing: CONFIG_INIT_STACK_ALL_PATTERN=y Link: https://lore.kernel.org/20250529083811.778bc31b@kernel.org Fixes: a571a9a1b120 ("kunit: configs: Enable CONFIG_INIT_STACK_ALL_PATTERN in all_tests") Signed-off-by: Jakub Kicinski Acked-by: Mark Brown Acked-by: Shuah Khan Link: https://patch.msgid.link/20250530135800.13437-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit ffb006aa433e8109ec79320c344fb69947997ba1 Author: Sumanth Gavini Date: Mon May 19 16:20:23 2025 -0700 mfd: maxim: Correct Samsung "Electronics" spelling in copyright headers Fix the misspelling of 'Electronics' in MFD driver copyright headers. Link: https://lore.kernel.org/lkml/3aa30119-60e5-4dcb-b13a-1753966ca775@sirena.org.uk/#t Link: https://lore.kernel.org/r/20250519232025.152769-1-sumanth.gavini@yahoo.com Signed-off-by: Sumanth Gavini Signed-off-by: Lee Jones commit b8628379957d0c8c057782ec1a8512de6d4ba29c Author: Sumanth Gavini Date: Mon May 19 19:08:05 2025 -0700 mfd: maxim: Correct Samsung "Electronics" spelling in headers Fix the misspelling of 'Electronics' in MFD driver headers. Link: https://lore.kernel.org/lkml/3aa30119-60e5-4dcb-b13a-1753966ca775@sirena.org.uk/#t Link: https://lore.kernel.org/r/20250520020808.159586-1-sumanth.gavini@yahoo.com Signed-off-by: Sumanth Gavini Signed-off-by: Lee Jones commit 905fe0845bb27e4eed2ca27ea06e6c4847f1b2b1 Author: Jinjian Song Date: Fri May 30 11:16:48 2025 +0800 net: wwan: t7xx: Fix napi rx poll issue When driver handles the napi rx polling requests, the netdev might have been released by the dellink logic triggered by the disconnect operation on user plane. However, in the logic of processing skb in polling, an invalid netdev is still being used, which causes a panic. BUG: kernel NULL pointer dereference, address: 00000000000000f1 Oops: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:dev_gro_receive+0x3a/0x620 [...] Call Trace: ? __die_body+0x68/0xb0 ? page_fault_oops+0x379/0x3e0 ? exc_page_fault+0x4f/0xa0 ? asm_exc_page_fault+0x22/0x30 ? __pfx_t7xx_ccmni_recv_skb+0x10/0x10 [mtk_t7xx (HASH:1400 7)] ? dev_gro_receive+0x3a/0x620 napi_gro_receive+0xad/0x170 t7xx_ccmni_recv_skb+0x48/0x70 [mtk_t7xx (HASH:1400 7)] t7xx_dpmaif_napi_rx_poll+0x590/0x800 [mtk_t7xx (HASH:1400 7)] net_rx_action+0x103/0x470 irq_exit_rcu+0x13a/0x310 sysvec_apic_timer_interrupt+0x56/0x90 Fixes: 5545b7b9f294 ("net: wwan: t7xx: Add NAPI support") Signed-off-by: Jinjian Song Link: https://patch.msgid.link/20250530031648.5592-1-jinjian.song@fibocom.com Signed-off-by: Paolo Abeni commit c48228c476ffe35ec99af6660af602956ffaa12b Merge: 6920d9625730d2 6a9e76f75c1a8f Author: Jiri Kosina Date: Tue Jun 3 09:32:30 2025 +0200 Merge branch 'for-6.16/core' into for-linus - power management improvement for multitouch devices (Werner Sembach) commit 6920d9625730d260c5f5f517799e25de4ea5e7d7 Merge: 4376fd0f8c5f0b b8d56ef91cc36b Author: Jiri Kosina Date: Tue Jun 3 09:27:46 2025 +0200 Merge branch 'for-6.16/magicmouse' into for-linus - support for Apple Magic Mouse 2 USB-C (Aditya Garg) commit 4376fd0f8c5f0b372f62c3ea82ff8d69d564f1f8 Merge: 1f09ba86b6bffb f58470ce6d26ea Author: Jiri Kosina Date: Tue Jun 3 09:27:32 2025 +0200 Merge branch 'for-6.16/logitech' into for-linus commit 1f09ba86b6bffb784f08596b34639b04be47b3e4 Merge: e6322141f00d03 113521a4d2b0c4 Author: Jiri Kosina Date: Tue Jun 3 09:26:50 2025 +0200 Merge branch 'for-6.16/kysona' into for-linus - power management improvement (Lode Willems) commit e6322141f00d032665be453193e64b0ebae61da4 Merge: 17678759efda17 bbd7a03dc9a221 Author: Jiri Kosina Date: Tue Jun 3 09:26:12 2025 +0200 Merge branch 'for-6.16/intel-thc' into for-linus - fix for ACPI initialization (Wentao Guan) commit 17678759efda1710aecfd38cca6b0c58a2d45df4 Merge: 5b53c0e7df2954 31a78afda1ef7f Author: Jiri Kosina Date: Tue Jun 3 09:25:26 2025 +0200 Merge branch 'for-6.16/hid-gpio-setter-callbacks' into for-linus - adapt HID drivers to use new gpio_chip's line setter callbacks (Bartosz Golaszewski) commit 5b53c0e7df295490a5304f870e35a70d7bb68c1e Merge: 6f96598984a0e4 cc2c611f296009 Author: Jiri Kosina Date: Tue Jun 3 09:24:39 2025 +0200 Merge branch 'for-6.16/corsair' into for-linus commit 6f96598984a0e4ba7d4e92566b25dbf30ab1f387 Merge: ad78d7e364a7f2 a058002358b7aa Author: Jiri Kosina Date: Tue Jun 3 09:23:09 2025 +0200 Merge branch 'for-6.16/core' into for-linus - make it possible to set hid_mouse_ignore_list dynamically (the same way we handle other quirks) (Aditya Garg) - fix potential OOB in usbhid_parse() (Terry Junge) commit ad78d7e364a7f26ceed91d2e3b2b3f6bd19ef557 Merge: 578e1b96fad740 de7ad66b16b4d3 Author: Jiri Kosina Date: Tue Jun 3 09:21:55 2025 +0200 Merge branch 'for-6.16/apple' into for-linus - Kconfig dependency fixes (Geert Uytterhoeven) - time scaling fix for appletb_tb_idle_timeout and appletb_tb_dim_timeout parameters (Thorsten Blum) commit 408da3a0f89d581421ca9bd6ff39c7dd05bc4b2f Merge: 3382a1ed7f778d 9dc63d8ff18215 Author: Jakub Kicinski Date: Mon Jun 2 18:44:37 2025 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2025-05-30 (ice, idpf) For ice: Michal resolves XDP issues related to Tx scheduler configuration with large number of Tx queues. Additional information: https://lore.kernel.org/intel-wired-lan/20250513105529.241745-1-michal.kubiak@intel.com/ For idpf: Brian Vazquez updates netif_subqueue_maybe_stop() condition check to prevent possible races. Emil shuts down virtchannel mailbox during reset to reduce timeout delays as it's unavailable during that time. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: idpf: avoid mailbox timeout delays during reset idpf: fix a race in txq wakeup ice: fix rebuilding the Tx scheduler tree for large queue counts ice: create new Tx scheduler nodes for new queues only ice: fix Tx scheduler error handling in XDP callback ==================== Link: https://patch.msgid.link/20250530211221.2170484-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 546b1c9e93c2bb8cf5ed24e0be1c86bb089b3253 Merge: c8be54240893db d81bab116b4856 Author: Linus Torvalds Date: Mon Jun 2 17:39:24 2025 -0700 Merge tag 'bootconfig-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull bootconfig updates from Masami Hiramatsu: - Allow overriding CFLAGS and LDFLAGS for tools/bootconfig, for example making it a static binary. * tag 'bootconfig-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tools/bootconfig: specify LDFLAGS as an argument to CC tools/bootconfig: allow overriding CFLAGS assignment commit c8be54240893dbf89c294cb6a9e338fdc2f73ead Merge: fd1f8473503e5b a0b018a495a3f6 Author: Linus Torvalds Date: Mon Jun 2 17:35:06 2025 -0700 Merge tag 'modules-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux Pull module updates from Petr Pavlu: - Make .static_call_sites in modules read-only after init The .static_call_sites sections in modules have been made read-only after init to avoid any (non-)accidental modifications, similarly to how they are read-only after init in vmlinux - The rest are minor cleanups * tag 'modules-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux: module: Remove outdated comment about text_size module: Make .static_call_sites read-only after init module: Add a separate function to mark sections as read-only after init module: Constify parameters of module_enforce_rwx_sections() commit fd1f8473503e5bf897bd3e8efe3545c0352954e6 Merge: fe4281644c62ce 0b43b8bc8ef88b Author: Linus Torvalds Date: Mon Jun 2 16:00:26 2025 -0700 Merge tag 'mm-stable-2025-06-01-14-06' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull more MM updates from Andrew Morton: - "zram: support algorithm-specific parameters" from Sergey Senozhatsky adds infrastructure for passing algorithm-specific parameters into zram. A single parameter `winbits' is implemented at this time. - "memcg: nmi-safe kmem charging" from Shakeel Butt makes memcg charging nmi-safe, which is required by BFP, which can operate in NMI context. - "Some random fixes and cleanup to shmem" from Kemeng Shi implements small fixes and cleanups in the shmem code. - "Skip mm selftests instead when kernel features are not present" from Zi Yan fixes some issues in the MM selftest code. - "mm/damon: build-enable essential DAMON components by default" from SeongJae Park reworks DAMON Kconfig to make it easier to enable CONFIG_DAMON. - "sched/numa: add statistics of numa balance task migration" from Libo Chen adds more info into sysfs and procfs files to improve visibility into the NUMA balancer's task migration activity. - "selftests/mm: cow and gup_longterm cleanups" from Mark Brown provides various updates to some of the MM selftests to make them play better with the overall containing framework. * tag 'mm-stable-2025-06-01-14-06' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (43 commits) mm/khugepaged: clean up refcount check using folio_expected_ref_count() selftests/mm: fix test result reporting in gup_longterm selftests/mm: report unique test names for each cow test selftests/mm: add helper for logging test start and results selftests/mm: use standard ksft_finished() in cow and gup_longterm selftests/damon/_damon_sysfs: skip testcases if CONFIG_DAMON_SYSFS is disabled sched/numa: add statistics of numa balance task sched/numa: fix task swap by skipping kernel threads tools/testing: check correct variable in open_procmap() tools/testing/vma: add missing function stub mm/gup: update comment explaining why gup_fast() disables IRQs selftests/mm: two fixes for the pfnmap test mm/khugepaged: fix race with folio split/free using temporary reference mm: add CONFIG_PAGE_BLOCK_ORDER to select page block order mmu_notifiers: remove leftover stub macros selftests/mm: deduplicate test names in madv_populate kcov: rust: add flags for KCOV with Rust mm: rust: make CONFIG_MMU ifdefs more narrow mmu_gather: move tlb flush for VM_PFNMAP/VM_MIXEDMAP vmas into free_pgtables() mm/damon/Kconfig: enable CONFIG_DAMON by default ... commit fe4281644c62ce9385d3b9165e27d6c86ae0a845 Merge: 2619a6d413f4c3 9126d2754c5e5d Author: Linus Torvalds Date: Mon Jun 2 15:53:43 2025 -0700 Merge tag 'gfs2-for-6.16-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 fix from Andreas Gruenbacher: - Fix a NULL pointer dereference reported by syzbot * tag 'gfs2-for-6.16-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add commit 2619a6d413f4c3c4c1eddf63e83ecc345f250d07 Merge: 0fb34422b5c223 dabb9039102879 Author: Linus Torvalds Date: Mon Jun 2 15:31:05 2025 -0700 Merge tag 'fuse-update-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse Pull fuse updates from Miklos Szeredi: - Remove tmp page copying in writeback path (Joanne). This removes ~300 lines and with that a lot of complexity related to avoiding reclaim related deadlock. The old mechanism is replaced with a mapping flag that tells the MM not to block reclaim waiting for writeback to complete. The MM parts have been reviewed/acked by respective maintainers. - Convert more code to handle large folios (Joanne). This still just adds the code to deal with large folios and does not enable them yet. - Allow invalidating all cached lookups atomically (Luis Henriques). This feature is useful for CernVMFS, which currently does this iteratively. - Align write prefaulting in fuse with generic one (Dave Hansen) - Fix race causing invalid data to be cached when setting attributes on different nodes of a distributed fs (Guang Yuan Wu) - Update documentation for passthrough (Chen Linxuan) - Add fdinfo about the device number associated with an opened /dev/fuse instance (Chen Linxuan) - Increase readdir buffer size (Miklos). This depends on a patch to VFS readdir code that was already merged through Christians tree. - Optimize io-uring request expiration (Joanne) - Misc cleanups * tag 'fuse-update-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: (25 commits) fuse: increase readdir buffer size readdir: supply dir_context.count as readdir buffer size hint fuse: don't allow signals to interrupt getdents copying fuse: support large folios for writeback fuse: support large folios for readahead fuse: support large folios for queued writes fuse: support large folios for stores fuse: support large folios for symlinks fuse: support large folios for folio reads fuse: support large folios for writethrough writes fuse: refactor fuse_fill_write_pages() fuse: support large folios for retrieves fuse: support copying large folios fs: fuse: add dev id to /dev/fuse fdinfo docs: filesystems: add fuse-passthrough.rst MAINTAINERS: update filter of FUSE documentation fuse: fix race between concurrent setattrs from multiple nodes fuse: remove tmp folio for writebacks and internal rb tree mm: skip folio reclaim in legacy memcg contexts for deadlockable mappings fuse: optimize over-io-uring request expiration check ... commit 8a5ebd2be99a1f4630d0382f7fdf581561d317cd Author: Shyam Prasad N Date: Tue Apr 29 12:02:36 2025 +0000 cifs: update the lock ordering comments with new mutex The lock ordering rules listed as comments in cifsglob.h were missing some lock details and also the fid_lock. Updated those notes in this commit. Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit 0fb34422b5c2237e0de41980628b023252912108 Merge: fcd0bb8e99f7f5 db26d62d79e406 Author: Linus Torvalds Date: Mon Jun 2 15:04:06 2025 -0700 Merge tag 'vfs-6.16-rc1.netfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull netfs updates from Christian Brauner: - The main API document has been extensively updated/rewritten - Fix an oops in write-retry due to mis-resetting the I/O iterator - Fix the recording of transferred bytes for short DIO reads - Fix a request's work item to not require a reference, thereby avoiding the need to get rid of it in BH/IRQ context - Fix waiting and waking to be consistent about the waitqueue used - Remove NETFS_SREQ_SEEK_DATA_READ, NETFS_INVALID_WRITE, NETFS_ICTX_WRITETHROUGH, NETFS_READ_HOLE_CLEAR, NETFS_RREQ_DONT_UNLOCK_FOLIOS, and NETFS_RREQ_BLOCKED - Reorder structs to eliminate holes - Remove netfs_io_request::ractl - Only provide proc_link field if CONFIG_PROC_FS=y - Remove folio_queue::marks3 - Fix undifferentiation of DIO reads from unbuffered reads * tag 'vfs-6.16-rc1.netfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: netfs: Fix undifferentiation of DIO reads from unbuffered reads netfs: Fix wait/wake to be consistent about the waitqueue used netfs: Fix the request's work item to not require a ref netfs: Fix setting of transferred bytes with short DIO reads netfs: Fix oops in write-retry from mis-resetting the subreq iterator fs/netfs: remove unused flag NETFS_RREQ_BLOCKED fs/netfs: remove unused flag NETFS_RREQ_DONT_UNLOCK_FOLIOS folio_queue: remove unused field `marks3` fs/netfs: declare field `proc_link` only if CONFIG_PROC_FS=y fs/netfs: remove `netfs_io_request.ractl` fs/netfs: reorder struct fields to eliminate holes fs/netfs: remove unused enum choice NETFS_READ_HOLE_CLEAR fs/netfs: remove unused flag NETFS_ICTX_WRITETHROUGH fs/netfs: remove unused source NETFS_INVALID_WRITE fs/netfs: remove unused flag NETFS_SREQ_SEEK_DATA_READ commit 3c05e88413f7b7145795dc1ad56983e75bca07a7 Author: Arnd Bergmann Date: Wed Apr 23 18:25:16 2025 +0200 PCI: j721e: Fix host/endpoint dependencies The j721e driver has a single platform driver that can be built-in or a loadable module, but it calls two separate backend drivers depending on whether it is a host or endpoint. If the two modes are not the same, we can end up with a situation where the built-in pci-j721e driver tries to call the modular host or endpoint driver, which causes a link failure: ld.lld-21: error: undefined symbol: cdns_pcie_ep_setup >>> referenced by pci-j721e.c >>> drivers/pci/controller/cadence/pci-j721e.o:(j721e_pcie_probe) in archive vmlinux.a ld.lld-21: error: undefined symbol: cdns_pcie_host_setup >>> referenced by pci-j721e.c >>> drivers/pci/controller/cadence/pci-j721e.o:(j721e_pcie_probe) in archive vmlinux.a Rework the dependencies so that the 'select' is done by the common Kconfig symbol, based on which of the two are enabled. Effectively this means that having one built-in makes the other either built-in or disabled, but all configurations will now build. Signed-off-by: Arnd Bergmann Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Siddharth Vadapalli Link: https://patch.msgid.link/20250423162523.2060405-1-arnd@kernel.org commit a2790bf81f0f7b0fb683204cd3bef07feecb9958 Author: Siddharth Vadapalli Date: Thu Apr 17 18:14:08 2025 +0530 PCI: j721e: Add support to build as a loadable module The 'pci-j721e.c' driver is the application/glue/wrapper driver for the Cadence PCIe Controllers on TI SoCs. Implement support for building it as a loadable module. Signed-off-by: Siddharth Vadapalli Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250417124408.2752248-5-s-vadapalli@ti.com commit 3a4b05c9bae485d230560278a659e0830f96e28f Author: Siddharth Vadapalli Date: Thu Apr 17 18:14:07 2025 +0530 PCI: cadence-ep: Introduce cdns_pcie_ep_disable() helper for cleanup Introduce the helper function cdns_pcie_ep_disable() which will undo the configuration performed by cdns_pcie_ep_setup(). Also, export it for use by the existing callers of cdns_pcie_ep_setup(), thereby allowing them to cleanup on their exit path. Signed-off-by: Siddharth Vadapalli Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250417124408.2752248-4-s-vadapalli@ti.com commit 47f25da6c5ea55494f4de5ca1ecf6c456b4b3e2a Author: Siddharth Vadapalli Date: Thu Apr 17 18:14:06 2025 +0530 PCI: cadence-host: Introduce cdns_pcie_host_disable() helper for cleanup Introduce the helper function cdns_pcie_host_disable() which will undo the configuration performed by cdns_pcie_host_setup(). Also, export it for use by existing callers of cdns_pcie_host_setup(), thereby allowing them to cleanup on their exit path. Signed-off-by: Siddharth Vadapalli Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250417124408.2752248-3-s-vadapalli@ti.com commit f876904e44360449e64e2d38c428eba3a03d7a47 Author: Kishon Vijay Abraham I Date: Thu Apr 17 18:14:05 2025 +0530 PCI: cadence: Add support to build pcie-cadence library as a kernel module Currently, the Cadence PCIe controller driver can be built as a built-in module only. Since PCIe functionality is not a necessity for booting, add support to build the Cadence PCIe driver as a loadable module as well. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Siddharth Vadapalli Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250417124408.2752248-2-s-vadapalli@ti.com commit ae06c6197c9e53dcb115f1f7aad9e86aa465adae Author: Krzysztof Wilczyński Date: Fri Apr 18 04:52:51 2025 +0000 MAINTAINERS: Update Krzysztof Wilczyński email address Update my e-mail address and add relevant entries to the .mailmap file. [bhelgaas: drop maintainer status change] Signed-off-by: Krzysztof Wilczyński Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250418045251.7434-1-kwilczynski@kernel.org commit 75d7b40becfb9de11f9c2ff7138111eb48e76099 Author: Ilpo Järvinen Date: Fri Apr 4 15:45:47 2025 +0300 PCI: Remove unnecessary linesplit in __pci_setup_bridge() No need to split the line in __pci_setup_bridge() as it is way shorter than the limit. Signed-off-by: Ilpo Järvinen Signed-off-by: Krzysztof Wilczyński Signed-off-by: Bjorn Helgaas Link: https://lore.kernel.org/r/20250404124547.51185-1-ilpo.jarvinen@linux.intel.com commit fcd0bb8e99f7f5fbe6979b8633ed86502d822203 Merge: 7f9039c524a351 5402c4d4d2000a Author: Linus Torvalds Date: Mon Jun 2 12:49:16 2025 -0700 Merge tag 'vfs-6.16-rc2.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - Fix the AT_HANDLE_CONNECTABLE option so filesystems that don't know how to decode a connected non-dir dentry fail the request - Use repr(transparent) to ensure identical layout between the C and Rust implementation of struct file - Add a missing xas_pause() into the dax code employing wait_entry_unlocked_exclusive() - Fix FOP_DONTCACHE which we disabled for v6.15. A folio could get redirtied and/or scheduled for writeback after the initial dropbehind test. Change the test accordingly to handle these cases so we can re-enable FOP_DONTCACHE again * tag 'vfs-6.16-rc2.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: exportfs: require ->fh_to_parent() to encode connectable file handles rust: file: improve safety comments rust: file: mark `LocalFile` as `repr(transparent)` fs/dax: Fix "don't skip locked entries when scanning entries" iomap: don't lose folio dropbehind state for overwrites mm/filemap: unify dropbehind flag testing and clearing mm/filemap: unify read/write dropbehind naming Revert "Disable FOP_DONTCACHE for now due to bugs" mm/filemap: use filemap_end_dropbehind() for read invalidation mm/filemap: gate dropbehind invalidate on folio !dirty && !writeback commit 7f9039c524a351c684149ecf1b3c5145a0dff2fe Merge: df7b9b4f6bfeb1 61374cc145f4a5 Author: Linus Torvalds Date: Mon Jun 2 12:24:58 2025 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull more kvm updates from Paolo Bonzini: Generic: - Clean up locking of all vCPUs for a VM by using the *_nest_lock() family of functions, and move duplicated code to virt/kvm/. kernel/ patches acked by Peter Zijlstra - Add MGLRU support to the access tracking perf test ARM fixes: - Make the irqbypass hooks resilient to changes in the GSI<->MSI routing, avoiding behind stale vLPI mappings being left behind. The fix is to resolve the VGIC IRQ using the host IRQ (which is stable) and nuking the vLPI mapping upon a routing change - Close another VGIC race where vCPU creation races with VGIC creation, leading to in-flight vCPUs entering the kernel w/o private IRQs allocated - Fix a build issue triggered by the recently added workaround for Ampere's AC04_CPU_23 erratum - Correctly sign-extend the VA when emulating a TLBI instruction potentially targeting a VNCR mapping - Avoid dereferencing a NULL pointer in the VGIC debug code, which can happen if the device doesn't have any mapping yet s390: - Fix interaction between some filesystems and Secure Execution - Some cleanups and refactorings, preparing for an upcoming big series x86: - Wait for target vCPU to ack KVM_REQ_UPDATE_PROTECTED_GUEST_STATE to fix a race between AP destroy and VMRUN - Decrypt and dump the VMSA in dump_vmcb() if debugging enabled for the VM - Refine and harden handling of spurious faults - Add support for ALLOWED_SEV_FEATURES - Add #VMGEXIT to the set of handlers special cased for CONFIG_RETPOLINE=y - Treat DEBUGCTL[5:2] as reserved to pave the way for virtualizing features that utilize those bits - Don't account temporary allocations in sev_send_update_data() - Add support for KVM_CAP_X86_BUS_LOCK_EXIT on SVM, via Bus Lock Threshold - Unify virtualization of IBRS on nested VM-Exit, and cross-vCPU IBPB, between SVM and VMX - Advertise support to userspace for WRMSRNS and PREFETCHI - Rescan I/O APIC routes after handling EOI that needed to be intercepted due to the old/previous routing, but not the new/current routing - Add a module param to control and enumerate support for device posted interrupts - Fix a potential overflow with nested virt on Intel systems running 32-bit kernels - Flush shadow VMCSes on emergency reboot - Add support for SNP to the various SEV selftests - Add a selftest to verify fastops instructions via forced emulation - Refine and optimize KVM's software processing of the posted interrupt bitmap, and share the harvesting code between KVM and the kernel's Posted MSI handler" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (93 commits) rtmutex_api: provide correct extern functions KVM: arm64: vgic-debug: Avoid dereferencing NULL ITE pointer KVM: arm64: vgic-init: Plug vCPU vs. VGIC creation race KVM: arm64: Unmap vLPIs affected by changes to GSI routing information KVM: arm64: Resolve vLPI by host IRQ in vgic_v4_unset_forwarding() KVM: arm64: Protect vLPI translation with vgic_irq::irq_lock KVM: arm64: Use lock guard in vgic_v4_set_forwarding() KVM: arm64: Mask out non-VA bits from TLBI VA* on VNCR invalidation arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue KVM: s390: Simplify and move pv code KVM: s390: Refactor and split some gmap helpers KVM: s390: Remove unneeded srcu lock s390: Remove unneeded includes s390/uv: Improve splitting of large folios that cannot be split while dirty s390/uv: Always return 0 from s390_wiggle_split_folio() if successful s390/uv: Don't return 0 from make_hva_secure() if the operation was not successful rust: add helper for mutex_trylock RISC-V: KVM: use kvm_trylock_all_vcpus when locking all vCPUs KVM: arm64: use kvm_trylock_all_vcpus when locking all vCPUs x86: KVM: SVM: use kvm_lock_all_vcpus instead of a custom implementation ... commit df7b9b4f6bfeb1143e7626c536e03bb122e90cc9 Merge: d00a83477e7a8f eb43efd062d10b Author: Linus Torvalds Date: Mon Jun 2 12:16:17 2025 -0700 Merge tag 'm68knommu-for-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu Pull m68knommu updates from Greg Ungerer: - use new gpio line value settings - use strscpy() more * tag 'm68knommu-for-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68k: Replace memcpy() + manual NUL-termination with strscpy() m68k/kernel: replace strncpy() with strscpy() m68k: coldfire: gpio: use new line value setter callbacks commit b4f60a053a2534c3e510ba0c1f8727566adf8317 Author: Shyam Prasad N Date: Mon Jun 2 22:37:16 2025 +0530 cifs: dns resolution is needed only for primary channel When calling cifs_reconnect, before the connection to the server is reestablished, the code today does a DNS resolution and updates server->dstaddr. However, this is not necessary for secondary channels. Secondary channels use the interface list returned by the server to decide which address to connect to. And that happens after tcon is reconnected and server interfaces are requested. Signed-off-by: Shyam Prasad N Cc: stable@vger.kernel.org Signed-off-by: Steve French commit c1846893991f3b4ec8a0cc12219ada153f0814d6 Author: Shyam Prasad N Date: Mon Jun 2 22:37:14 2025 +0530 cifs: update dstaddr whenever channel iface is updated When the server interface info changes (more common in clustered servers like Azure Files), the per-channel iface gets updated. However, this did not update the corresponding dstaddr. As a result these channels will still connect (or try connecting) to older addresses. Fixes: b54034a73baf ("cifs: during reconnect, update interface if necessary") Cc: Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit 1f396b9bfe39aaf55ea74a7005806164b236653d Author: Shyam Prasad N Date: Mon Jun 2 22:37:13 2025 +0530 cifs: reset connections for all channels when reconnect requested cifs_reconnect can be called with a flag to mark the session as needing reconnect too. When this is done, we expect the connections of all channels to be reconnected too, which is not happening today. Without doing this, we have seen bad things happen when primary and secondary channels are connected to different servers (in case of cloud services like Azure Files SMB). This change would force all connections to reconnect as well, not just the sessions and tcons. Cc: Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit d00a83477e7a8f55c9f9d0c6768901f28b1b9d87 Merge: 4c3b7df7844340 4f9786035f9e51 Author: Linus Torvalds Date: Mon Jun 2 11:14:21 2025 -0700 Merge tag 'input-for-v6.16-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - support for game controllers requiring delayed initialization packets, such as ByoWave Proteus, in xpad driver - a change to atkbd driver to not reset the keyboard on Loongson devices - tweaks to gpio-keys and matrix_keypad drivers - fixes to documentation for Amiga joysticks - a fix to ims-pcu driver to better handle malformed firmware * tag 'input-for-v6.16-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: ims-pcu - check record size in ims_pcu_flash_firmware() Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT Input: amijoy - make headings compliant w/ guidelines in documentation Input: amijoy - fix grammar in documentation Input: amijoy - fix Amiga 4-joystick adapter pinout in documentation Input: amijoy - fix broken table formatting in documentation Input: atkbd - do not reset keyboard by default on Loongson Input: xpad - send LED and auth done packets to all Xbox One controllers Input: xpad - add the ByoWave Proteus controller Input: xpad - allow delaying init packets MAINTAINERS: update dlg,da72??.txt to yaml dt-bindings: input: convert dlg,da7280.txt to dt-schema dt-bindings: input: touchscreen: edt-ft5x06: use unevaluatedProperties Input: snvs_pwrkey - support power-off-time-sec dt-bindings: crypto: fsl,sec-v4.0-mon: Add "power-off-time-sec" Input: matrix_keypad - detect change during scan Input: matrix_keypad - add function for reading row state commit 2f956db8b3b02256b21da4d1f26fedc63782adff Author: Palmer Dabbelt Date: Mon Jun 2 10:33:15 2025 -0700 Revert "RISC-V: vDSO: Wire up getrandom() vDSO implementation" This has been on -next for a bit, but it's broken and there's already a v2. So I'm reverting it to avoid more rebasing. This reverts commit 89079520cef65d6da1e864eab4464effe5396e23. Link: https://lore.kernel.org/r/20250602173315.20228-1-palmer@dabbelt.com Signed-off-by: Palmer Dabbelt commit 4c3b7df78443403bff2532299f21eb4cbdf059e2 Merge: b509c16e1d7cba aa702923258f2c Author: Linus Torvalds Date: Mon Jun 2 11:08:17 2025 -0700 Merge tag 'mtd/for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull MTD updates from Miquel Raynal: "A big core MTD change is the introduction of a new class to always register a master device. This is a problem that has been there forever: the "master" device was not always present depending on a number of heuristics such as the presence of fixed partitions and the absence of a Kconfig symbol to force its presence. This was a problem for runtime PM operations which might not have the "master" device available in all situation. The SPI NAND subsystem has seen the introduction of DTR operations (the equivalent of DDR transfers), which involved quite a few preparation patches for clarifying macro names. In the raw NAND subsystem, the brcmnand driver has been "fixed" for old legacy SoCs with an update of the ->exec_op() hook, there has been the introduction of a new controller driver named Loongson-1, and the Qualcomm driver has received quite a few misc fixes as well as a new compatible. Finally, Macornix SPI NOR entries have been cleaned-up and some SFDP table fixups for Macronix MX25L3255E have been merged. Aside from this, there is the usual load of misc improvement, fixes, and yaml conversion" * tag 'mtd/for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (42 commits) mtd: rawnand: brcmnand: legacy exec_op implementation mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk mtd: nand: brcmnand: fix NAND timeout when accessing eMMC mtd: nand: sunxi: Add randomizer configuration before randomizer enable mtd: spinand: esmt: fix id code for F50D1G41LB mtd: rawnand: brcmnand: remove unused parameters mtd: core: always create master device mtd: rawnand: loongson1: Fix inconsistent refcounting in ls1x_nand_chip_init() mtd: rawnand: loongson1: Fix error code in ls1x_nand_dma_transfer() mtd: rawnand: qcom: Fix read len for onfi param page mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() mtd: rawnand: qcom: Pass 18 bit offset from NANDc base to BAM base dt-bindings: mtd: qcom,nandc: Document the SDX75 NAND controller mtd: bcm47xxnflash: Add error handling for bcm47xxnflash_ops_bcm4706_ctl_cmd() mtd: rawnand: Use non-hybrid PCI devres API mtd: nand: ecc-mxic: Fix use of uninitialized variable ret mtd: spinand: winbond: Add support for W35N02JW and W35N04JW chips mtd: spinand: winbond: Add octal support mtd: spinand: winbond: Add support for W35N01JW in single mode mtd: spinand: winbond: Rename DTR variants ... commit b509c16e1d7cba8d0fd3843f6641fcafb3761432 Merge: dcf9ee9ac4d5c0 5de775df336209 Author: Linus Torvalds Date: Mon Jun 2 11:06:44 2025 -0700 Merge tag 'rpmsg-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull rpmsg updates from Bjorn Andersson: - Remove some dead and unused code from core and virtio modules - Improve the error messages from the Qualcomm SMD driver and initialize an uninitialized variable in the send path * tag 'rpmsg-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() rpmsg: qcom_smd: Improve error handling for qcom_smd_parse_edge rpmsg: Remove unused method pointers *send_offchannel rpmsg: virtio: Remove uncallable offchannel functions rpmsg: core: Remove deadcode commit dcf9ee9ac4d5c09c5bc74aba5e93581e93a1ac33 Merge: a0607951116798 5779f6f9a64ffc Author: Linus Torvalds Date: Mon Jun 2 11:04:29 2025 -0700 Merge tag 'rproc-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull remoteproc updates from Bjorn Andersson: - Fix resource cleanup in the remoteproc attach error handling code paths - Refactor the various TI K3 drivers to extract and reuse common code between them - Add support in the i.MX remoteproc driver for determining from the firmware if Linux should wait on a "firmware ready" signal at startup - Improve the Xilinx R5F power down mechanism to handle use cases where this is shared with other entities in the system * tag 'rproc-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: (46 commits) remoteproc: k3: Refactor release_tsp() functions into common driver remoteproc: k3: Refactor reserved_mem_init() functions into common driver remoteproc: k3: Refactor mem_release() functions into common driver remoteproc: k3: Refactor of_get_memories() functions into common driver remoteproc: k3: Refactor .da_to_va rproc ops into common driver remoteproc: k3: Refactor .get_loaded_rsc_table ops into common driver remoteproc: k3: Refactor .detach rproc ops into common driver remoteproc: k3: Refactor .attach rproc ops into common driver remoteproc: k3: Refactor .stop rproc ops into common driver remoteproc: k3: Refactor .start rproc ops into common driver remoteproc: k3: Refactor .unprepare rproc ops into common driver remoteproc: k3: Refactor .prepare rproc ops into common driver remoteproc: k3-dsp: Assert local reset during .prepare callback remoteproc: k3-dsp: Don't override rproc ops in IPC-only mode remoteproc: k3: Refactor rproc_request_mbox() implementations into common driver remoteproc: k3-m4: Ping the mbox while acquiring the channel remoteproc: k3: Refactor rproc_release() implementation into common driver remoteproc: k3-m4: Introduce central function to release rproc from reset remoteproc: k3-dsp: Correct Reset deassert logic for devices w/o lresets remoteproc: k3: Refactor rproc_reset() implementation into common driver ... commit da12597a1d8c1f91ae509520e9e1bf90648feb93 Author: Ming Lei Date: Mon Jun 2 21:21:13 2025 +0800 selftests: ublk: cover PER_IO_DAEMON in more stress tests We have stress_03, stress_04 and stress_05 for checking new feature vs. stress IO & device removal & ublk server crash & recovery, so let the three existing stress tests cover PER_IO_DAEMON. Then stress_06 can be removed, since the same test function is included in stress_03. Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250602132113.1398645-1-ming.lei@redhat.com Reviewed-by: Uday Shankar [axboe: remove test_stress_06.sh from Makefile too] Signed-off-by: Jens Axboe commit a06079511167984f7d25ff09fdfeb2f1582c85dd Merge: cd2e103d57e561 d0b497df02e9b2 Author: Linus Torvalds Date: Mon Jun 2 10:58:00 2025 -0700 Merge tag 'mailbox-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox Pull mailbox updates from Jassi Brar: "Core: - misc cleanup sophgo: - add driver for CV18XX series qcom: - add SM7150 APCS compatible - apcs: added separate clock node imx: - fix tx doorbell send microchip: - misc compile option fix mediatek: - Refine GCE_GCTL_VALUE setting" * tag 'mailbox-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox: mailbox: qcom-apcs-ipc: Assign OF node to clock controller child device dt-bindings: mailbox: qcom,apcs: Add separate node for clock-controller dt-bindings: mailbox: qcom: Add the SM7150 APCS compatible mailbox: sophgo: add mailbox driver for CV18XX series SoC dt-bindings: mailbox: add Sophgo CV18XX series SoC mailbox: Use guard/scoped_guard for spinlock mailbox: Use guard/scoped_guard for con_mutex mailbox: Remove devm_mbox_controller_unregister mailbox: Propagate correct error return value mailbox: Not protect module_put with spin_lock_irqsave mailbox: Use dev_err when there is error mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting mailbox: imx: Fix TXDB_V2 sending mailbox: mchp-ipc-sbi: Fix COMPILE_TEST build error commit 167d7ede0007d320a891494be57b635b4c069995 Author: Steven Rostedt Date: Thu May 29 13:57:39 2025 -0400 genirq/matrix: Remove unused irq_matrix_alloc_reserved tracepoint The tracepoint irq_matrix_alloc_reserved was added but never used. Remove it. Link: https://lore.kernel.org/all/20250529130138.544ffec4@gandalf.local.home/ Cc: Juergen Gross Cc: Mathieu Desnoyers Cc: Masami Hiramatsu Link: https://lore.kernel.org/20250529135739.26e5c075@gandalf.local.home Fixes: ec0f7cd273dc4 ("genirq/matrix: Add tracepoints") Reviewed-by: Thomas Gleixner Signed-off-by: Steven Rostedt (Google) commit e27e43a5cbda77d211757eb83101f11f67788204 Author: Steven Rostedt Date: Thu May 29 16:05:50 2025 -0400 xdp: Remove unused mem_return_failed event The change to allow page_pool to handle its own page destruction instead of relying on XDP removed the trace_mem_return_failed() tracepoint caller, but did not remove the mem_return_failed trace event. As trace events take up memory when they are created regardless of if they are used or not, having this unused event around wastes around 5K of memory. Remove the unused event. Link: https://lore.kernel.org/all/20250529130138.544ffec4@gandalf.local.home/ Cc: netdev Cc: Jonathan Lemon Cc: Mathieu Desnoyers Cc: Masami Hiramatsu Link: https://lore.kernel.org/20250529160550.1f888b15@gandalf.local.home Fixes: c3f812cea0d7 ("page_pool: do not release pool until inflight == 0.") Acked-by: Jesper Dangaard Brouer Acked-by: Jakub Kicinski Signed-off-by: Steven Rostedt (Google) commit 5834a597386c59fedc601a81091028074d6ae9a2 Author: Ye Bin Date: Thu May 29 19:19:55 2025 +0800 ftrace: Don't allocate ftrace module map if ftrace is disabled If ftrace is disabled, it is meaningless to allocate a module map. Add a check in allocate_ftrace_mod_map() to not allocate if ftrace is disabled. Link: https://lore.kernel.org/20250529111955.2349189-3-yebin@huaweicloud.com Signed-off-by: Ye Bin Signed-off-by: Steven Rostedt (Google) commit f914b52c379c12288b7623bb814d0508dbe7481d Author: Ye Bin Date: Thu May 29 19:19:54 2025 +0800 ftrace: Fix UAF when lookup kallsym after ftrace disabled The following issue happens with a buggy module: BUG: unable to handle page fault for address: ffffffffc05d0218 PGD 1bd66f067 P4D 1bd66f067 PUD 1bd671067 PMD 101808067 PTE 0 Oops: Oops: 0000 [#1] SMP KASAN PTI Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS RIP: 0010:sized_strscpy+0x81/0x2f0 RSP: 0018:ffff88812d76fa08 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffffffc0601010 RCX: dffffc0000000000 RDX: 0000000000000038 RSI: dffffc0000000000 RDI: ffff88812608da2d RBP: 8080808080808080 R08: ffff88812608da2d R09: ffff88812608da68 R10: ffff88812608d82d R11: ffff88812608d810 R12: 0000000000000038 R13: ffff88812608da2d R14: ffffffffc05d0218 R15: fefefefefefefeff FS: 00007fef552de740(0000) GS:ffff8884251c7000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffc05d0218 CR3: 00000001146f0000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ftrace_mod_get_kallsym+0x1ac/0x590 update_iter_mod+0x239/0x5b0 s_next+0x5b/0xa0 seq_read_iter+0x8c9/0x1070 seq_read+0x249/0x3b0 proc_reg_read+0x1b0/0x280 vfs_read+0x17f/0x920 ksys_read+0xf3/0x1c0 do_syscall_64+0x5f/0x2e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e The above issue may happen as follows: (1) Add kprobe tracepoint; (2) insmod test.ko; (3) Module triggers ftrace disabled; (4) rmmod test.ko; (5) cat /proc/kallsyms; --> Will trigger UAF as test.ko already removed; ftrace_mod_get_kallsym() ... strscpy(module_name, mod_map->mod->name, MODULE_NAME_LEN); ... The problem is when a module triggers an issue with ftrace and sets ftrace_disable. The ftrace_disable is set when an anomaly is discovered and to prevent any more damage, ftrace stops all text modification. The issue that happened was that the ftrace_disable stops more than just the text modification. When a module is loaded, its init functions can also be traced. Because kallsyms deletes the init functions after a module has loaded, ftrace saves them when the module is loaded and function tracing is enabled. This allows the output of the function trace to show the init function names instead of just their raw memory addresses. When a module is removed, ftrace_release_mod() is called, and if ftrace_disable is set, it just returns without doing anything more. The problem here is that it leaves the mod_list still around and if kallsyms is called, it will call into this code and access the module memory that has already been freed as it will return: strscpy(module_name, mod_map->mod->name, MODULE_NAME_LEN); Where the "mod" no longer exists and triggers a UAF bug. Link: https://lore.kernel.org/all/20250523135452.626d8dcd@gandalf.local.home/ Cc: stable@vger.kernel.org Fixes: aba4b5c22cba ("ftrace: Save module init functions kallsyms symbols for tracing") Link: https://lore.kernel.org/20250529111955.2349189-2-yebin@huaweicloud.com Signed-off-by: Ye Bin Signed-off-by: Steven Rostedt (Google) commit aa702923258f2ce5e259b9cb8e746090bb6bf126 Merge: 73c4699a35e61a 3bfb22cecfe6b6 Author: Miquel Raynal Date: Mon Jun 2 18:39:50 2025 +0200 Merge tag 'nand/for-6.16' into mtd/next The SPI NAND subsystem has seen the introduction of DTR operations (the equivalent of DDR transfers), which involved quite a few preparation patches for clarifying macro names. In the raw NAND subsystem, the brcmnand driver has been "fixed" for old legacy SoCs with an update of the ->exec_op() hook, there has been the introduction of a new controller driver named Loongson-1, and the Qualcomm driver has received quite a few misc fixes as well as a new compatible. Aside from this, there is the usual load of misc improvement and fixes. commit 73c4699a35e61a1fff315a25f4299c0b4074944a Merge: 0aa7b390fc40a8 594c8df92b946c Author: Miquel Raynal Date: Mon Jun 2 18:39:35 2025 +0200 Merge tag 'spi-nor/for-6.16' into mtd/next SPI NOR changes for 6.16 Notable changes: - Cleanup some Macronix flash entries. - Add SFDP table fixups for Macronix MX25L3255E. commit a8841dc3dfbf127a19c3612204bd336ee559b9a1 Author: David Lechner Date: Thu May 29 11:53:20 2025 -0500 pwm: axi-pwmgen: fix missing separate external clock Add proper support for external clock to the AXI PWM generator driver. In most cases, the HDL for this IP block is compiled with the default ASYNC_CLK_EN=1. With this option, there is a separate external clock that drives the PWM output separate from the peripheral clock. So the driver should be enabling the "axi" clock to power the peripheral and the "ext" clock to drive the PWM output. When ASYNC_CLK_EN=0, the "axi" clock is also used to drive the PWM output and there is no "ext" clock. Previously, if there was a separate external clock, users had to specify only the external clock and (incorrectly) omit the AXI clock in order to get the correct operating frequency for the PWM output. The devicetree bindings are updated to fix this shortcoming and this patch changes the driver to match the new bindings. To preserve compatibility with any existing dtbs that specify only one clock, we don't require the clock name on the first clock. Fixes: 41814fe5c782 ("pwm: Add driver for AXI PWM generator") Cc: stable@vger.kernel.org Acked-by: Nuno Sá Reviewed-by: Trevor Gamblin Signed-off-by: David Lechner Link: https://lore.kernel.org/r/20250529-pwm-axi-pwmgen-add-external-clock-v3-3-5d8809a7da91@baylibre.com Signed-off-by: Uwe Kleine-König commit e683131e64f71e957ca77743cb3d313646157329 Author: David Lechner Date: Thu May 29 11:53:19 2025 -0500 dt-bindings: pwm: adi,axi-pwmgen: Fix clocks Fix a shortcoming in the bindings that doesn't allow for a separate external clock. The AXI PWMGEN IP block has a compile option ASYNC_CLK_EN that allows the use of an external clock for the PWM output separate from the AXI clock that runs the peripheral. This was missed in the original bindings and so users were writing dts files where the one and only clock specified would be the external clock, if there was one, incorrectly missing the separate AXI clock. The correct bindings are that the AXI clock is always required and the external clock is optional (must be given only when HDL compile option ASYNC_CLK_EN=1). Fixes: 1edf2c2a2841 ("dt-bindings: pwm: Add AXI PWM generator") Cc: stable@vger.kernel.org Signed-off-by: David Lechner Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250529-pwm-axi-pwmgen-add-external-clock-v3-2-5d8809a7da91@baylibre.com Signed-off-by: Uwe Kleine-König commit c72def523799a0b054fd7cbbed32509e365db55b Author: Kent Overstreet Date: Sat May 31 19:12:25 2025 -0400 bcachefs: Run check_dirents second time if required If we move a key backwards, we'll need a second pass to run the rest of the fsck checks. Signed-off-by: Kent Overstreet commit a4907d7f3380f19c11a6191feac85b563439012a Author: Kent Overstreet Date: Sun Jun 1 18:24:18 2025 -0400 bcachefs: Run snapshot deletion out of system_long_wq We don't want this running out of the same workqueue, and blocking, writes. Signed-off-by: Kent Overstreet commit e49cf9b54bc8b4c41c7aac8f12adb709f2015470 Author: Kent Overstreet Date: Sat May 31 13:10:43 2025 -0400 bcachefs: Make check_key_has_snapshot safer Snapshot deletion v2 added sentinal values for deleted snapshots, so "key for deleted snapshot" - i.e. snapshot deletion missed something - is safe to repair automatically. But if we find a key for a missing snapshot we have no idea what happened, and we shouldn't delete it unless we're very sure that everything else is consistent. So hook it up to the new bch2_require_recovery_pass(), we'll now only delete if snapshots and subvolumes have recenlty been checked. Signed-off-by: Kent Overstreet commit 0942b852d4070e448231d2e204ac82ad47f5920a Author: Kent Overstreet Date: Sat May 31 13:01:44 2025 -0400 bcachefs: BCH_RECOVERY_PASS_NO_RATELIMIT Add a superblock flag to temporarily disable ratelimiting for a recovery pass. This will be used to make check_key_has_snapshot safer: we don't want to delete a key for a missing snapshot unless we know that the snapshots and subvolumes btrees are consistent, i.e. check_snapshots and check_subvols have run recently. Changing those btrees - creating/deleting a subvolume or snapshot - will set the "disable ratelimit" flag, i.e. ensuring that those passes run if check_key_has_snapshot discovers an error. We're only disabling ratelimiting in the snapshot/subvol delete paths, we're not so concerned about the create paths. Signed-off-by: Kent Overstreet commit a2ffab0e659831761443f3ae6341c30e845dce43 Author: Kent Overstreet Date: Sat May 31 12:48:00 2025 -0400 bcachefs: bch2_require_recovery_pass() Add a helper for requiring that a recovery pass has already run: either run it directly, if we're still in recovery, or if we're not in recovery check if it has run recently and schedule it if it hasn't. Signed-off-by: Kent Overstreet commit 09b9c72bd4b77a954123997377665fb30f1d07e1 Author: Kent Overstreet Date: Wed May 28 11:57:50 2025 -0400 bcachefs: bch_err_throw() Add a tracepoint for any time we return an error and unwind. Signed-off-by: Kent Overstreet commit 36a2fdf7c5c1ccae6ca16cd14067567096cebe17 Author: Kent Overstreet Date: Sat May 31 11:58:11 2025 -0400 bcachefs: Repair code for directory i_size We had a bug due due to an incomplete revert of the patch implementing directory i_size (summing up the size of the dirents), leading to completely screwy i_size values that underflow. Most userspace programs don't seem to care (e.g. du ignores it), but it turns out this broke sshfs, so needs to be repaired. Signed-off-by: Kent Overstreet commit 95fafc0f3407a6446082c11849df585bd3246571 Author: Kent Overstreet Date: Sat May 31 18:32:37 2025 -0400 bcachefs: Kill un-reverted directory i_size code Signed-off-by: Kent Overstreet commit d47db3e63679541f4dd4696ce4661b6917cb9684 Author: Kent Overstreet Date: Sat May 31 18:47:49 2025 -0400 bcachefs: Delete redundant fsck_err() 'inode_has_wrong_backpointer'; we have more specific errors for every case afterwards. Signed-off-by: Kent Overstreet commit 165815c296076132f0399bd892fd879fc597ac83 Author: Kent Overstreet Date: Sat May 31 19:20:33 2025 -0400 bcachefs: Convert BUG() to error Signed-off-by: Kent Overstreet commit b3f3ca04ec3f0587b92fcffa4d581e73b335701a Merge: bae071aa7bcd03 38b1befc7a35a4 Author: Mark Brown Date: Mon Jun 2 16:51:02 2025 +0100 ASoC: Intel: avs: Set of functional fixes Merge series from Cezary Rojewski : Medium range of fixes all avs-driver related. The most important fixes lead the way: 1. For ASoC-hda codec driver, existing RPM manipulation in hda_codec_probe_complete()'s error path is superfluous and leads to RPM usage count underflow if the probe exists early e.g.: build-controls operation fails. 2. Resolve deadlock when DSP-recovery is a consequence of SET_D0IX IPC. The procedure handling IPC timeouts and EXCEPTION_CAUGHT notification shall cancel any D0IX work before proceeding with DSP recovery. If SET_D0IX called from delayed_work is the failing IPC the procedure will deadlock. 3. LINK format (PPLCxFMT) calculation is incorrect. HDAudio transfer types utilize SDxFMT for front-end (HOST) and PPLCxFMT for back-end (LINK) side when setting up the stream. BE's substream->runtime duplicates FE runtime so switch to using BE's hw_params to address incorrect format values on the LINK side when FE and BE formats differ. Below three patches address problems found by Coverity static analyzer: ASoC: Intel: avs: Fix possible null-ptr-deref when initing hw ASoC: Intel: avs: Verify kcalloc() status when setting constraints ASoC: Intel: avs: Verify content returned by parse_int_array() While unlikely in runtime, it's good to keep code resilient. The last few patches are readability/cohesiveness improvements. commit 6a3439a417b910e662c666993798e0691bc81147 Author: David Heimann Date: Sun Jun 1 12:41:16 2025 -0400 ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 The RODE AI-1 audio interface requires implicit feedback sync between playback endpoint 0x03 and feedback endpoint 0x84 on interface 3, but doesn't advertise this in its USB descriptors. Without this quirk, the device receives audio data but produces no output. Signed-off-by: David Heimann Cc: Link: https://patch.msgid.link/084dc88c-1193-4a94-a002-5599adff936c@app.fastmail.com Signed-off-by: Takashi Iwai commit 3f100f524e75586537e337b34d18c8d604b398e7 Author: Cezary Rojewski Date: Fri May 30 16:13:09 2025 +0200 ALSA: hda: Ignore unsol events for cards being shut down For the classic snd_hda_intel driver, codec->card and bus->card point to the exact same thing. When snd_card_diconnect() fires, bus->shutdown is set thanks to azx_dev_disconnect(). card->shutdown is already set when that happens but both provide basically the same functionality. For the DSP snd_soc_avs driver where multiple codecs are located on multiple cards, bus->shutdown 'shortcut' is not sufficient. One codec card may be unregistered while other codecs are still operational. Proper check in form of card->shutdown must be used to verify whether the codec's card is being shut down. Reviewed-by: Amadeusz Sławiński Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20250530141309.2943404-1-cezary.rojewski@intel.com Signed-off-by: Takashi Iwai commit ab72bfce7647522e01a181e3600c3d14ff5c143e Author: Vijendar Mukunda Date: Thu May 29 11:08:13 2025 +0530 ALSA: hda: Add new pci id for AMD GPU display HD audio controller Add new pci id for AMD GPU display HD audio controller(device id- 0xab40). Signed-off-by: Vijendar Mukunda Reviewed-by: Alex Deucher Link: https://patch.msgid.link/20250529053838.2350071-1-Vijendar.Mukunda@amd.com Signed-off-by: Takashi Iwai commit 9a4e17b59631e55c79ce0efbfc9f9eb85d377c6a Author: Krzysztof Kozlowski Date: Wed May 28 21:44:03 2025 +0200 ALSA: hda: cs35l41: Constify regmap_irq_chip Static 'struct regmap_irq_chip' is not modified so can be changed to const for more safety. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250528194402.567062-2-krzysztof.kozlowski@linaro.org Signed-off-by: Takashi Iwai commit 4919353c7789b8047e06a9b2b943f775a8f72883 Author: Mario Limonciello Date: Tue May 27 12:26:56 2025 -0500 ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock The audio controller in the Lenovo Thinkpad Thunderbolt 3 dock doesn't support reading the sampling rate. Add a quirk for it. Suggested-by: Takashi Iwai Signed-off-by: Mario Limonciello Link: https://patch.msgid.link/20250527172657.1972565-1-superm1@kernel.org Signed-off-by: Takashi Iwai commit af6e3defb11a1c67cd462485655b43b5d70524b1 Author: Ilpo Järvinen Date: Mon May 12 00:52:23 2025 +0300 PCI: WARN (not BUG()) when we fail to assign optional resources Resource fitting/assignment code checks if there's a remainder in add_list (aka. realloc_head in the inner functions) using BUG_ON(). This problem typically results in a mere PCI device resource assignment failure which does not warrant using BUG_ON(). The machine could well come up usable even if this condition occurs because the realloc_head relates to resources which are optional anyway. Change BUG_ON() to WARN_ON_ONCE() and free the list if it's not empty. [bhelgaas: subject] Reported-by: Tudor Ambarus Signed-off-by: Ilpo Järvinen Signed-off-by: Krzysztof Wilczyński Signed-off-by: Bjorn Helgaas Link: https://lore.kernel.org/linux-pci/5f103643-5e1c-43c6-b8fe-9617d3b5447c@linaro.org Link: https://lore.kernel.org/r/20250511215223.7131-1-ilpo.jarvinen@linux.intel.com commit 1c8a0ed2043c30cee97facd1eb8cff88b6c7ea4a Author: Ilpo Järvinen Date: Mon Apr 7 13:12:14 2025 +0300 PCI: Remove unused pci_printk() include/linux/pci.h provides low-level pci_printk() interface that is not used since the commits fab874e12593 ("PCI/AER: Descope pci_printk() to aer_printk()") and 588021b28642 ("PCI: shpchp: Remove 'shpchp_debug' module parameter"). PCI logging should not use pci_printk() but pci_*() wrappers that follow the usual logging wrapper patterns. Remove pci_printk(). Signed-off-by: Ilpo Järvinen Signed-off-by: Krzysztof Wilczyński Signed-off-by: Bjorn Helgaas Link: https://lore.kernel.org/r/20250407101215.1376-1-ilpo.jarvinen@linux.intel.com commit e92e2552858142b60238b9828d802f128e4acccd Author: Benjamin Berg Date: Mon Jun 2 15:00:52 2025 +0200 um: pass FD for memory operations when needed Instead of always sharing the FDs with the userspace process, only hand over the FDs needed for mmap when required. The idea is that userspace might be able to force the stub into executing an mmap syscall, however, it will not be able to manipulate the control flow sufficiently to have access to an FD that would allow mapping arbitrary memory. Security wise, we need to be sure that only the expected syscalls are executed after the kernel sends FDs through the socket. This is currently not the case, as userspace can trivially jump to the rt_sigreturn syscall instruction to execute any syscall that the stub is permitted to do. With this, it can trick the kernel to send the FD, which in turn allows userspace to freely map any physical memory. As such, this is currently *not* secure. However, in principle the approach should be fine with a more strict SECCOMP filter and a careful review of the stub control flow (as userspace can prepare a stack). With some care, it is likely possible to extend the security model to SMP if desired. Signed-off-by: Benjamin Berg Link: https://patch.msgid.link/20250602130052.545733-8-benjamin@sipsolutions.net Signed-off-by: Johannes Berg commit beddc9fb1cb161e1bf779b180750b648ff9690c7 Author: Benjamin Berg Date: Mon Jun 2 15:00:51 2025 +0200 um: Add SECCOMP support detection and initialization This detects seccomp support, sets the global using_seccomp variable and initilizes the exec registers. The support is only enabled if the seccomp= kernel parameter is set to either "on" or "auto". With "auto" a fallback to ptrace mode will happen if initialization failed. Signed-off-by: Benjamin Berg Signed-off-by: Benjamin Berg Link: https://patch.msgid.link/20250602130052.545733-7-benjamin@sipsolutions.net [extend help with Kconfig text from v2, use exit syscall instead of libc, remove unneeded mctx_offset assignment, disable on 32-bit for now] Signed-off-by: Johannes Berg commit 406d17c6c370a33cfb54067d9e205305293d4604 Author: Benjamin Berg Date: Mon Jun 2 15:00:50 2025 +0200 um: Implement kernel side of SECCOMP based process handling This adds the kernel side of the seccomp based process handling. Co-authored-by: Johannes Berg Signed-off-by: Benjamin Berg Signed-off-by: Benjamin Berg Link: https://patch.msgid.link/20250602130052.545733-6-benjamin@sipsolutions.net Signed-off-by: Johannes Berg commit 8420e08fe3a594b6ffa07705ac270faa2ed452c5 Author: Benjamin Berg Date: Mon Jun 2 15:00:49 2025 +0200 um: Track userspace children dying in SECCOMP mode When in seccomp mode, we would hang forever on the futex if a child has died unexpectedly. In contrast, ptrace mode will notice it and kill the corresponding thread when it fails to run it. Fix this issue using a new IRQ that is fired after a SIGCHLD and keeping an (internal) list of all MMs. In the IRQ handler, find the affected MM and set its PID to -1 as well as the futex variable to FUTEX_IN_KERN. This, together with futex returning -EINTR after the signal is sufficient to implement a race-free detection of a child dying. Note that this also enables IRQ handling while starting a userspace process. This should be safe and SECCOMP requires the IRQ in case the process does not come up properly. Signed-off-by: Benjamin Berg Signed-off-by: Benjamin Berg Link: https://patch.msgid.link/20250602130052.545733-5-benjamin@sipsolutions.net Signed-off-by: Johannes Berg commit b1e1bd2e69430445021394536740352be1b41cd0 Author: Benjamin Berg Date: Mon Jun 2 15:00:48 2025 +0200 um: Add helper functions to get/set state for SECCOMP When not using ptrace, we need to both save and restore registers through the mcontext as provided by the host kernel to our signal handlers. Add corresponding functions to store the state to an mcontext and helpers to access the mcontext of the subprocess through the stub data. Signed-off-by: Benjamin Berg Signed-off-by: Benjamin Berg Link: https://patch.msgid.link/20250602130052.545733-4-benjamin@sipsolutions.net Signed-off-by: Johannes Berg commit dac494bf54f764a114f16621ef04f534dd754ac1 Author: Benjamin Berg Date: Mon Jun 2 15:00:47 2025 +0200 um: Add stub side of SECCOMP/futex based process handling This adds the stub side for the new seccomp process management code. In this case we do register save/restore through the signal handler mcontext. Add special code for handling TLS, which for x86_64 means setting the FS_BASE/GS_BASE registers while for i386 it means calling the set_thread_area syscall. Co-authored-by: Johannes Berg Signed-off-by: Benjamin Berg Signed-off-by: Benjamin Berg Link: https://patch.msgid.link/20250602130052.545733-3-benjamin@sipsolutions.net Signed-off-by: Johannes Berg commit 247ed9e4a6869f3bf07bffd277a341a6833abdbc Author: Benjamin Berg Date: Mon Jun 2 15:00:46 2025 +0200 um: Move faultinfo extraction into userspace routine The segv handler is called slightly differently depending on whether PTRACE_FULL_FAULTINFO is set or not (32bit vs. 64bit). The only difference is that we don't try to pass the registers and instruction pointer to the segv handler. It would be good to either document or remove the difference, but I do not know why this difference exists. And, passing NULL can even result in a crash. Signed-off-by: Benjamin Berg Link: https://patch.msgid.link/20250602130052.545733-2-benjamin@sipsolutions.net Signed-off-by: Johannes Berg commit 10f885d63a0efd50b0d22bf27eb3cf727838e99e Author: Xi Ruoyao Date: Mon Jun 2 12:33:21 2025 +0800 arm64: Add override for MPAM As the message of the commit 09e6b306f3ba ("arm64: cpufeature: discover CPU support for MPAM") already states, if a buggy firmware fails to either enable MPAM or emulate the trap as if it were disabled, the kernel will just fail to boot. While upgrading the firmware should be the best solution, we have some hardware of which the vendor have made no response 2 months after we requested a firmware update. Allow overriding it so our devices don't become some e-waste. Cc: James Morse Cc: Marc Zyngier Cc: Will Deacon Cc: Shameer Kolothum Cc: Mingcong Bai Cc: Shaopeng Tan Cc: Ben Horgan Signed-off-by: Xi Ruoyao Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250602043723.216338-1-xry111@xry111.site Signed-off-by: Will Deacon commit 85f6d5b729eaace1549f1dcc284d9865f2c3ec02 Author: Benjamin Marzinski Date: Fri May 30 10:50:32 2025 -0400 dm-table: check BLK_FEAT_ATOMIC_WRITES inside limits_lock dm_set_device_limits() should check q->limits.features for BLK_FEAT_ATOMIC_WRITES while holding q->limits_lock, like it does for the rest of the queue limits. Fixes: b7c18b17a173 ("dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits") Signed-off-by: Benjamin Marzinski Signed-off-by: Mikulas Patocka commit 4b634918384c0f84c33aeb4dd9fd4c38e7be5ccb Author: Ryan Roberts Date: Fri May 30 16:23:47 2025 +0100 arm64/mm: Close theoretical race where stale TLB entry remains valid Commit 3ea277194daa ("mm, mprotect: flush TLB if potentially racing with a parallel reclaim leaving stale TLB entries") describes a race that, prior to the commit, could occur between reclaim and operations such as mprotect() when using reclaim's tlbbatch mechanism. See that commit for details but the summary is: """ Nadav Amit identified a theoritical race between page reclaim and mprotect due to TLB flushes being batched outside of the PTL being held. He described the race as follows: CPU0 CPU1 ---- ---- user accesses memory using RW PTE [PTE now cached in TLB] try_to_unmap_one() ==> ptep_get_and_clear() ==> set_tlb_ubc_flush_pending() mprotect(addr, PROT_READ) ==> change_pte_range() ==> [ PTE non-present - no flush ] user writes using cached RW PTE ... try_to_unmap_flush() """ The solution was to insert flush_tlb_batched_pending() in mprotect() and friends to explcitly drain any pending reclaim TLB flushes. In the modern version of this solution, arch_flush_tlb_batched_pending() is called to do that synchronisation. arm64's tlbbatch implementation simply issues TLBIs at queue-time (arch_tlbbatch_add_pending()), eliding the trailing dsb(ish). The trailing dsb(ish) is finally issued in arch_tlbbatch_flush() at the end of the batch to wait for all the issued TLBIs to complete. Now, the Arm ARM states: """ The completion of the TLB maintenance instruction is guaranteed only by the execution of a DSB by the observer that performed the TLB maintenance instruction. The execution of a DSB by a different observer does not have this effect, even if the DSB is known to be executed after the TLB maintenance instruction is observed by that different observer. """ arch_tlbbatch_add_pending() and arch_tlbbatch_flush() conform to this requirement because they are called from the same task (either kswapd or caller of madvise(MADV_PAGEOUT)), so either they are on the same CPU or if the task was migrated, __switch_to() contains an extra dsb(ish). HOWEVER, arm64's arch_flush_tlb_batched_pending() is also implemented as a dsb(ish). But this may be running on a CPU remote from the one that issued the outstanding TLBIs. So there is no architectural gurantee of synchonization. Therefore we are still vulnerable to the theoretical race described in Commit 3ea277194daa ("mm, mprotect: flush TLB if potentially racing with a parallel reclaim leaving stale TLB entries"). Fix this by flushing the entire mm in arch_flush_tlb_batched_pending(). This aligns with what the other arches that implement the tlbbatch feature do. Cc: Fixes: 43b3dfdd0455 ("arm64: support batched/deferred tlb shootdown during page reclamation/migration") Signed-off-by: Ryan Roberts Link: https://lore.kernel.org/r/20250530152445.2430295-1-ryan.roberts@arm.com Signed-off-by: Will Deacon commit dc0a083948040ff364d065da8bb50c29f77a39ad Author: Ard Biesheuvel Date: Sat May 31 14:30:05 2025 +0200 arm64: Work around convergence issue with LLD linker LLD will occasionally error out with a '__init_end does not converge' error if INIT_IDMAP_DIR_SIZE is defined in terms of _end, as this results in a circular dependency. Counter this by dimensioning the initial IDMAP page tables based on a new boundary marker 'kimage_limit', and define it such that its value should not change as a result of the initdata segment being pushed over a 64k segment boundary due to changes in INIT_IDMAP_DIR_SIZE, provided that its value doesn't change by more than 2M between linker passes. Reported-by: Arnd Bergmann Signed-off-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250531123005.3866382-2-ardb+git@google.com Signed-off-by: Will Deacon commit e931d3a9d5200bae9d938be2582072b2898e37f7 Author: Pavel Begunkov Date: Fri May 23 23:37:39 2025 +0100 MAINTAINERS: remove myself from io_uring Disassociate my name from the project over disagreements on development practices. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/814ec73b73323a8e1c87643d193a73f467fb191f.1748034476.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit e21560b7d33c4f692cc9cd5b75ff09024f5a69d2 Author: Ard Biesheuvel Date: Thu May 29 09:35:08 2025 +0200 arm64: Disable LLD linker ASSERT()s for the time being It turns out [1] that the way LLD handles ASSERT()s in the linker script can result in spurious failures, so disable them for the newly introduced BSS symbol export checks. Since we're not aware of any issues with the existing assertions in vmlinux.lds.S, leave those alone for now so that they can continue to provide useful coverage. A linker fix [2] is due to land in version 21 of LLD. Link: https://lore.kernel.org/r/202505261019.OUlitN6m-lkp@intel.com [1] Link: https://github.com/llvm/llvm-project/commit/5859863bab7f [2] Link: https://github.com/ClangBuiltLinux/linux/issues/2094 Signed-off-by: Ard Biesheuvel Tested-by: Arnd Bergmann Reviewed-by: Nathan Chancellor Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202505261019.OUlitN6m-lkp@intel.com/ Link: https://lore.kernel.org/r/20250529073507.2984959-2-ardb+git@google.com Signed-off-by: Will Deacon commit 3382a1ed7f778db841063f5d7e317ac55f9e7f72 Author: Shiming Cheng Date: Fri May 30 09:26:08 2025 +0800 net: fix udp gso skb_segment after pull from frag_list Commit a1e40ac5b5e9 ("net: gso: fix udp gso fraglist segmentation after pull from frag_list") detected invalid geometry in frag_list skbs and redirects them from skb_segment_list to more robust skb_segment. But some packets with modified geometry can also hit bugs in that code. We don't know how many such cases exist. Addressing each one by one also requires touching the complex skb_segment code, which risks introducing bugs for other types of skbs. Instead, linearize all these packets that fail the basic invariants on gso fraglist skbs. That is more robust. If only part of the fraglist payload is pulled into head_skb, it will always cause exception when splitting skbs by skb_segment. For detailed call stack information, see below. Valid SKB_GSO_FRAGLIST skbs - consist of two or more segments - the head_skb holds the protocol headers plus first gso_size - one or more frag_list skbs hold exactly one segment - all but the last must be gso_size Optional datapath hooks such as NAT and BPF (bpf_skb_pull_data) can modify fraglist skbs, breaking these invariants. In extreme cases they pull one part of data into skb linear. For UDP, this causes three payloads with lengths of (11,11,10) bytes were pulled tail to become (12,10,10) bytes. The skbs no longer meets the above SKB_GSO_FRAGLIST conditions because payload was pulled into head_skb, it needs to be linearized before pass to regular skb_segment. skb_segment+0xcd0/0xd14 __udp_gso_segment+0x334/0x5f4 udp4_ufo_fragment+0x118/0x15c inet_gso_segment+0x164/0x338 skb_mac_gso_segment+0xc4/0x13c __skb_gso_segment+0xc4/0x124 validate_xmit_skb+0x9c/0x2c0 validate_xmit_skb_list+0x4c/0x80 sch_direct_xmit+0x70/0x404 __dev_queue_xmit+0x64c/0xe5c neigh_resolve_output+0x178/0x1c4 ip_finish_output2+0x37c/0x47c __ip_finish_output+0x194/0x240 ip_finish_output+0x20/0xf4 ip_output+0x100/0x1a0 NF_HOOK+0xc4/0x16c ip_forward+0x314/0x32c ip_rcv+0x90/0x118 __netif_receive_skb+0x74/0x124 process_backlog+0xe8/0x1a4 __napi_poll+0x5c/0x1f8 net_rx_action+0x154/0x314 handle_softirqs+0x154/0x4b8 [118.376811] [C201134] rxq0_pus: [name:bug&]kernel BUG at net/core/skbuff.c:4278! [118.376829] [C201134] rxq0_pus: [name:traps&]Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP [118.470774] [C201134] rxq0_pus: [name:mrdump&]Kernel Offset: 0x178cc00000 from 0xffffffc008000000 [118.470810] [C201134] rxq0_pus: [name:mrdump&]PHYS_OFFSET: 0x40000000 [118.470827] [C201134] rxq0_pus: [name:mrdump&]pstate: 60400005 (nZCv daif +PAN -UAO) [118.470848] [C201134] rxq0_pus: [name:mrdump&]pc : [0xffffffd79598aefc] skb_segment+0xcd0/0xd14 [118.470900] [C201134] rxq0_pus: [name:mrdump&]lr : [0xffffffd79598a5e8] skb_segment+0x3bc/0xd14 [118.470928] [C201134] rxq0_pus: [name:mrdump&]sp : ffffffc008013770 Fixes: a1e40ac5b5e9 ("gso: fix udp gso fraglist segmentation after pull from frag_list") Signed-off-by: Shiming Cheng Reviewed-by: Willem de Bruijn Signed-off-by: David S. Miller commit 57cf46cd1fe351846e1b065ca9546eef66675ecd Author: Gabor Juhos Date: Tue May 27 13:08:16 2025 +0200 spi: spi-qpic-snand: document the limited bit error reporting capability The QPIC hardware is not capable of reporting the exact number of the corrected bit errors, it only reports the number of the corrected bytes. Document this behaviour in the code, and also issue a warning message to inform the user about it. No functional changes. Signed-off-by: Gabor Juhos Link: https://patch.msgid.link/20250527-qpic-snand-limited-biterr-caps-v1-1-61f7cf87be1e@gmail.com Signed-off-by: Mark Brown commit bae071aa7bcd034054cec91666c80f812adeccd9 Author: Yuuki NAGAO Date: Sat May 31 23:13:41 2025 +0900 ASoC: ti: omap-hdmi: Re-add dai_link->platform to fix card init The removed dai_link->platform component cause a fail which is exposed at runtime. (ex: when a sound tool is used) This patch re-adds the dai_link->platform component to have a full card registered. Before this patch: $ aplay -l **** List of PLAYBACK Hardware Devices **** card 1: HDMI [HDMI], device 0: HDMI snd-soc-dummy-dai-0 [] Subdevices: 1/1 Subdevice #0: subdevice #0 $ speaker-test -D plughw:1,0 -t sine speaker-test 1.2.8 Playback device is plughw:1,0 Stream parameters are 48000Hz, S16_LE, 1 channels Sine wave rate is 440.0000Hz Playback open error: -22,Invalid argument After this patch which restores the platform component: $ aplay -l **** List of PLAYBACK Hardware Devices **** card 0: HDMI [HDMI], device 0: HDMI snd-soc-dummy-dai-0 [HDMI snd-soc-dummy-dai-0] Subdevices: 0/1 Subdevice #0: subdevice #0 -> Resolve the playback error. Fixes: 3b0db249cf8f ("ASoC: ti: remove unnecessary dai_link->platform") Signed-off-by: Yuuki NAGAO Link: https://patch.msgid.link/20250531141341.81164-1-wf.yn386@gmail.com Signed-off-by: Mark Brown commit 59a4d9a9efd921ae2b722ffa52217124bcbc0acf Author: Cezary Rojewski Date: Fri May 30 16:12:31 2025 +0200 ASoC: pcm: Do not open FEs with no BEs connected The check is performed in prepare-step, that is dpcm_fe_dai_prepare() but that is very late - code operates on invalid configuration from dpcm_fe_dai_open() till it gets there. Relocate the check to the open-step to avoid any invalid scenarios. Reviewed-by: Amadeusz Sławiński Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20250530141231.2943351-1-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 9adf2de86611ac108d07e769a699556d87f052e2 Author: Shuming Fan Date: Mon Jun 2 16:58:51 2025 +0800 ASoC: rt1320: fix speaker noise when volume bar is 100% This patch updates the settings to fix the speaker noise. Signed-off-by: Shuming Fan Link: https://patch.msgid.link/20250602085851.4081886-1-shumingf@realtek.com Signed-off-by: Mark Brown commit 38b1befc7a35a475d90ec32bfbe319f4412880a1 Author: Cezary Rojewski Date: Fri May 30 16:10:25 2025 +0200 ASoC: Intel: avs: Include missing string.h File loader.c utilizes strscpy(). Reviewed-by: Amadeusz Sławiński Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20250530141025.2942936-10-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 93e246b6769bdacb09cfff4ea0f00fe5ab4f0d7a Author: Cezary Rojewski Date: Fri May 30 16:10:23 2025 +0200 ASoC: Intel: avs: Verify content returned by parse_int_array() The first element of the returned array stores its length. If it is 0, any manipulation beyond the element at index 0 ends with null-ptr-deref. Fixes: 5a565ba23abe ("ASoC: Intel: avs: Probing and firmware tracing over debugfs") Reviewed-by: Amadeusz Sławiński Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20250530141025.2942936-8-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 5f342aeee2724d31046172eb5caab8e0e8afd57d Author: Cezary Rojewski Date: Fri May 30 16:10:22 2025 +0200 ASoC: Intel: avs: Verify kcalloc() status when setting constraints All memory operations shall be checked. Fixes: f2f847461fb7 ("ASoC: Intel: avs: Constrain path based on BE capabilities") Reviewed-by: Amadeusz Sławiński Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20250530141025.2942936-7-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 9e3285be55e6c0829e451b4a341e3059da47ec9d Author: Amadeusz Sławiński Date: Fri May 30 16:10:21 2025 +0200 ASoC: Intel: avs: Fix paths in MODULE_FIRMWARE hints The binaries for cAVS architecture are located in "intel/avs" subdirectory, not "intel". Fixes: 94aa347d34e0 ("ASoC: Intel: avs: Add MODULE_FIRMWARE to inform about FW") Reviewed-by: Cezary Rojewski Signed-off-by: Amadeusz Sławiński Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20250530141025.2942936-6-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 2f78724d4f0c665c83e202e3989d5333a2cb1036 Author: Cezary Rojewski Date: Fri May 30 16:10:20 2025 +0200 ASoC: Intel: avs: Fix possible null-ptr-deref when initing hw Search result of avs_dai_find_path_template() shall be verified before being used. As 'template' is already known when avs_hw_constraints_init() is fired, drop the search entirely. Fixes: f2f847461fb7 ("ASoC: Intel: avs: Constrain path based on BE capabilities") Reviewed-by: Amadeusz Sławiński Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20250530141025.2942936-5-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 347c8d6db7c9d65d93ef226849b273823f54eaea Author: Cezary Rojewski Date: Fri May 30 16:10:19 2025 +0200 ASoC: Intel: avs: Fix PPLCxFMT calculation HDAudio transfer types utilize SDxFMT for front-end (HOST) and PPLCxFMT for back-end (LINK) side when setting up the stream. BE's substream->runtime duplicates FE runtime so switch to using BE's hw_params to address incorrect format values on the LINK side when FE and BE formats differ. The problem is introduced with commit d070002a20fc ("ASoC: Intel: avs: HDA PCM BE operations") but the code has been shuffled around since then so direct 'Fixes:' tag does not apply. Reviewed-by: Amadeusz Sławiński Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20250530141025.2942936-4-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 9ad1f3cd0d60444c69948854c7e50d2a61b63755 Author: Cezary Rojewski Date: Fri May 30 16:10:18 2025 +0200 ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX The procedure handling IPC timeouts and EXCEPTION_CAUGHT notification shall cancel any D0IX work before proceeding with DSP recovery. If SET_D0IX called from delayed_work is the failing IPC the procedure will deadlock. Conditionally skip cancelling the work to fix that. Fixes: 335c4cbd201d ("ASoC: Intel: avs: D0ix power state support") Reviewed-by: Amadeusz Sławiński Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20250530141025.2942936-3-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit ff0045de4ee0288dec683690f66f2f369b7d3466 Author: Cezary Rojewski Date: Fri May 30 16:10:17 2025 +0200 ASoC: codecs: hda: Fix RPM usage count underflow RPM manipulation in hda_codec_probe_complete()'s error path is superfluous and leads to RPM usage count underflow if the build-controls operation fails. hda_codec_probe_complete() is called in: 1) hda_codec_probe() for all non-HDMI codecs 2) in card->late_probe() for HDMI codecs Error path for hda_codec_probe() takes care of bus' RPM already. For 2) if late_probe() fails, ASoC performs card cleanup what triggers hda_codec_remote() - same treatment is in 1). Fixes: b5df2a7dca1c ("ASoC: codecs: Add HD-Audio codec driver") Reviewed-by: Amadeusz Sławiński Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20250530141025.2942936-2-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit b76d18b53a3f52880452a58cc982910abcccd111 Author: Tiwei Bie Date: Tue May 6 12:51:17 2025 +0800 um: vector: Use mac_pton() for MAC address parsing Use mac_pton() instead of custom approach. Suggested-by: Geert Uytterhoeven Signed-off-by: Tiwei Bie Link: https://patch.msgid.link/20250506045117.1896661-3-tiwei.btw@antgroup.com Signed-off-by: Johannes Berg commit 477c1c21da0d6ffc4dfe924178b90377f2938ba5 Author: Tiwei Bie Date: Tue May 6 12:51:16 2025 +0800 um: vector: Clean up and modernize log messages Use pr_*() and netdev_*() to print log messages. While at it, join split messages for easier grepping. Suggested-by: Geert Uytterhoeven Signed-off-by: Tiwei Bie Link: https://patch.msgid.link/20250506045117.1896661-2-tiwei.btw@antgroup.com Signed-off-by: Johannes Berg commit 10eabeca45fdfa48e8efd2c7fc0fd97314b65266 Author: Johannes Berg Date: Mon May 5 10:33:59 2025 +0200 um: chan_kern: use raw spinlock for irqs_to_free_lock Since this is called deep in the ARCH=um IRQ infrastructure it must use a raw spinlock. It's not really part of the driver, but rather the core UML IRQ code. Link: https://patch.msgid.link/20250505103358.ae7dc659f8b4.I64ca7aece30e0b4b0b5b35ad89cdd63db197c0ce@changeid Signed-off-by: Johannes Berg commit bb13e79cc9ef3b4f18b905df0ab75f6f92725558 Author: Lukas Bulwahn Date: Wed May 7 09:10:04 2025 +0200 MAINTAINERS: remove obsolete file entry in TUN/TAP DRIVER Commit 65eaac591b75 ("um: Remove obsolete legacy network transports") removes the directory arch/um/os-Linux/drivers/, but misses to remove the file entry in TUN/TAP DRIVER referring to that directory. Remove this obsolete file entry. While at it, put the section name in capital letters. Signed-off-by: Lukas Bulwahn Reviewed-by: Tiwei Bie Link: https://patch.msgid.link/20250507071004.35120-1-lukas.bulwahn@redhat.com Signed-off-by: Johannes Berg commit fd054188999ff19746cc09f4e0f196a113964db9 Author: Yongting Lin Date: Tue May 27 23:12:22 2025 +0800 um: Fix tgkill compile error on old host OSes tgkill is a quite old syscall since kernel 2.5.75, but unfortunately glibc doesn't support it before 2.30. Thus some systems fail to compile the latest UserMode Linux. Here is the compile error I encountered when I tried to compile UML in my system shipped with glibc-2.28. CALL scripts/checksyscalls.sh CC arch/um/os-Linux/sigio.o In file included from arch/um/os-Linux/sigio.c:17: arch/um/os-Linux/sigio.c: In function ‘write_sigio_thread’: arch/um/os-Linux/sigio.c:49:19: error: implicit declaration of function ‘tgkill’; did you mean ‘kill’? [-Werror=implicit-function-declaration] CATCH_EINTR(r = tgkill(pid, pid, SIGIO)); ^~~~~~ ./arch/um/include/shared/os.h:21:48: note: in definition of macro ‘CATCH_EINTR’ #define CATCH_EINTR(expr) while ((errno = 0, ((expr) < 0)) && (errno == EINTR)) ^~~~ cc1: some warnings being treated as errors Fix it by Replacing glibc call with raw syscall. Fixes: 33c9da5dfb18 ("um: Rewrite the sigio workaround based on epoll and tgkill") Signed-off-by: Yongting Lin Link: https://patch.msgid.link/20250527151222.40371-1-linyongting@gmail.com Signed-off-by: Johannes Berg commit b8c9c3b822fe8e033b9802516f6466099d915488 Author: Arnd Bergmann Date: Fri May 9 10:40:52 2025 +0200 um: stop using PCI port I/O arch/um is one of the last users of CONFIG_GENERIC_IOMAP, but upon closer look it appears that the PCI host bridge does not register any port I/O, and the absense of both custom inb/outb functions and a PCI_IOBASE constant means that actually trying to use port I/O results on a NULL pointer access. Build testing with clang confirms this by warning about this exact problem: include/asm-generic/io.h:549:31: error: performing pointer arithmetic on a null pointer has undefined behavior [-Werror,-Wnull-pointer-arithmetic] 549 | val = __raw_readb(PCI_IOBASE + addr); | ~~~~~~~~~~ ^ Remove all the Kconfig selects that refer to legacy port I/O and instead just build the normal MMIO path that is emulated by the virtio PCI host. Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20250509084125.1488601-1-arnd@kernel.org Signed-off-by: Johannes Berg commit 0323a5127e7c534cfc88efe0f850a0cb777e938b Author: Jesus Narvaez Date: Wed May 28 16:05:51 2025 -0700 drm/i915/guc: Handle race condition where wakeref count drops below 0 There is a rare race condition when preparing for a reset where guc_lrc_desc_unpin() could be in the process of deregistering a context while a different thread is scrubbing outstanding contexts and it alters the context state and does a wakeref put. Then, if there is a failure with deregister_context(), a second wakeref put could occur. As a result the wakeref count could drop below 0 and fail an INTEL_WAKEREF_BUG_ON() check. Therefore if there is a failure with deregister_context(), undo the context state changes and do a wakeref put only if the context was set to be destroyed earlier. v2: Expand comment to better explain change. (Daniele) v3: Removed addition to the original comment. (Daniele) Fixes: 2f2cc53b5fe7 ("drm/i915/guc: Close deregister-context race against CT-loss") Signed-off-by: Jesus Narvaez Cc: Daniele Ceraolo Spurio Cc: Alan Previn Cc: Anshuman Gupta Cc: Mousumi Jana Cc: Rodrigo Vivi Cc: Matt Roper Reviewed-by: Daniele Ceraolo Spurio Signed-off-by: John Harrison Link: https://lore.kernel.org/r/20250528230551.1855177-1-jesus.narvaez@intel.com (cherry picked from commit f36a75aba1c3176d177964bca76f86a075d2943a) Signed-off-by: Joonas Lahtinen commit 57d63c6cd0851d3af612a556ec61b0f2a9bd522f Author: Jouni Högander Date: Mon May 26 15:05:11 2025 +0300 drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP Wrong mask is used in PORT_ALPM_LFPS_CTL_FIRST_LFPS_HALF_CYCLE_DURATION and PORT_ALPM_LFPS_CTL_LAST_LFPS_HALF_CYCLE_DURATION. Fixes: 295099580f04 ("drm/i915/psr: Add missing ALPM AUX-Less register definitions") Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Link: https://lore.kernel.org/r/20250526120512.1702815-12-jouni.hogander@intel.com (cherry picked from commit 8097128a40ff378761034ec72cdbf6f46e466dc0) Signed-off-by: Joonas Lahtinen commit c557fd1050f6691dde36818dfc1a4c415c42901b Author: Jesus Narvaez Date: Wed May 14 15:52:24 2025 -0700 drm/i915/guc: Check if expecting reply before decrementing outstanding_submission_g2h When sending a H2G message where a reply is expected in guc_submission_send_busy_loop(), outstanding_submission_g2h is incremented before the send. However, if there is an error sending the message, outstanding_submission_g2h is decremented without checking if a reply is expected. Therefore, check if reply is expected when there is a failure before decrementing outstanding_submission_g2h. Fixes: 2f2cc53b5fe7 ("drm/i915/guc: Close deregister-context race against CT-loss") Signed-off-by: Jesus Narvaez Cc: Daniele Ceraolo Spurio Cc: Alan Previn Cc: Anshuman Gupta Cc: Mousumi Jana Cc: Rodrigo Vivi Cc: Matt Roper Reviewed-by: Daniele Ceraolo Spurio Signed-off-by: John Harrison Link: https://lore.kernel.org/r/20250514225224.4142684-1-jesus.narvaez@intel.com (cherry picked from commit a6a26786f22a4ab0227bcf610510c4c9c2df0808) Signed-off-by: Joonas Lahtinen commit 34a149a02b5f1eb788d1f79252fccc7028e3856b Author: Harald Freudenberger Date: Wed May 28 10:30:32 2025 +0200 s390/crypto: Select crypto engine in Kconfig when PAES is chosen The s390 PAES crypto algorithm has a dependency to the crypto engine. So enable the crypto engine via SELECT CRYPTO_ENGINE in drivers/crypto/Kconfig when CRYPTO_PAES_S390 is chosen. Fixes: 6cd87cb5ef6c ("s390/crypto: Rework protected key AES for true asynch support") Reported-by: Thomas Huth Closes: https://lore.kernel.org/linux-s390/f958f869-8da3-48d9-a118-f3cf9a9ea75c@redhat.com/ Reviewed-by: Holger Dengler Signed-off-by: Harald Freudenberger Reviewed-by: Thomas Huth Link: https://lore.kernel.org/r/20250528083032.224430-1-freude@linux.ibm.com Signed-off-by: Heiko Carstens commit 61374cc145f4a56377eaf87c7409a97ec7a34041 Merge: 438e22801b1958 4d62121ce9b58e Author: Paolo Bonzini Date: Mon Jun 2 03:05:29 2025 -0400 Merge tag 'kvmarm-fixes-6.16-1' of https://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 6.16, take #1 - Make the irqbypass hooks resilient to changes in the GSI<->MSI routing, avoiding behind stale vLPI mappings being left behind. The fix is to resolve the VGIC IRQ using the host IRQ (which is stable) and nuking the vLPI mapping upon a routing change. - Close another VGIC race where vCPU creation races with VGIC creation, leading to in-flight vCPUs entering the kernel w/o private IRQs allocated. - Fix a build issue triggered by the recently added workaround for Ampere's AC04_CPU_23 erratum. - Correctly sign-extend the VA when emulating a TLBI instruction potentially targeting a VNCR mapping. - Avoid dereferencing a NULL pointer in the VGIC debug code, which can happen if the device doesn't have any mapping yet. commit 438e22801b1958f86883812af70d402eda29c4f5 Author: Paolo Bonzini Date: Fri May 30 03:45:13 2025 -0400 rtmutex_api: provide correct extern functions Commit fb49f07ba1d9 ("locking/mutex: implement mutex_lock_killable_nest_lock") changed the set of functions that mutex.c defines when CONFIG_DEBUG_LOCK_ALLOC is set. - it removed the "extern" declaration of mutex_lock_killable_nested from include/linux/mutex.h, and replaced it with a macro since it could be treated as a special case of _mutex_lock_killable. It also removed a definition of the function in kernel/locking/mutex.c. - likewise, it replaced mutex_trylock() with the more generic mutex_trylock_nest_lock() and replaced mutex_trylock() with a macro. However, it left the old definitions in place in kernel/locking/rtmutex_api.c, which causes failures when building with CONFIG_RT_MUTEXES=y. Bring over the changes. Fixes: fb49f07ba1d9 ("locking/mutex: implement mutex_lock_killable_nest_lock") Reported-by: Randy Dunlap Tested-by: Randy Dunlap Cc: Peter Zijlstra Signed-off-by: Paolo Bonzini commit 4f9786035f9e519db41375818e1d0b5f20da2f10 Merge: ca39500f6af9cf a95ef0199e80f3 Author: Dmitry Torokhov Date: Sun Jun 1 21:41:07 2025 -0700 Merge branch 'next' into for-linus Prepare input updates for 6.16 merge window. commit 1c1df79ccf5615a007cb11ff30e997e58a9fa79a Merge: 84e2f918550e10 30837a49bd0aba Author: Dave Airlie Date: Mon Jun 2 11:56:00 2025 +1000 Merge tag 'amd-drm-fixes-6.16-2025-05-29' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-fixes-6.16-2025-05-29: amdgpu: - UserQ fixes - SMU 13.x fixes - VCN fixes - JPEG fixes - Misc cleanups - runtime pm fix - DCN 4.0.1 fixes - Misc display fixes - ISP fix - VRAM manager fix - RAS fixes amdkfd: - SVM fix - Misc cleanups - Ref leak fix - WPTR BO fix radeon: - Misc cleanups Signed-off-by: Dave Airlie From: Alex Deucher Link: https://lore.kernel.org/r/20250529205215.6790-1-alexander.deucher@amd.com commit 037e1bae588eacf98a0fedf52a7b72f14bbf0b26 Author: Henrique Carvalho Date: Wed May 28 17:30:03 2025 -0300 smb: client: use ParentLeaseKey in cifs_do_create Implement ParentLeaseKey logic in cifs_do_create() by looking up the parent cfid, copying its lease key into the fid struct, and setting the appropriate lease flag. Fixes: f047390a097e ("CIFS: Add create lease v2 context for SMB3") Signed-off-by: Henrique Carvalho Signed-off-by: Steve French commit 0f220d30c6fd04d3616737d8cdb0f8c7a76ee995 Author: Henrique Carvalho Date: Thu May 8 13:37:50 2025 -0300 smb: client: use ParentLeaseKey in open_cached_dir Implement ParentLeaseKey logic in open_cached_dir() by looking up the parent cfid, copying its lease key into the fid struct, and setting the appropriate lease flag. Fixes: f047390a097e ("CIFS: Add create lease v2 context for SMB3") Signed-off-by: Henrique Carvalho Signed-off-by: Steve French commit 51b78ffb803657fe38788d5715eee591cd7c0740 Author: Henrique Carvalho Date: Thu May 8 13:09:51 2025 -0300 smb: client: add ParentLeaseKey support According to MS-SMB2 3.2.4.3.8, when opening a file the client must lookup its parent directory, copy that entry’s LeaseKey into ParentLeaseKey, and set SMB2_LEASE_FLAG_PARENT_LEASE_KEY_SET. Extend lease context functions to carry a parent_lease_key and lease_flags and to add them to the lease context buffer accordingly in smb3_create_lease_buf. Also add a parent_lease_key field to struct cifs_fid and lease_flags to cifs_open_parms. Only applies to the SMB 3.x dialect family. Fixes: f047390a097e ("CIFS: Add create lease v2 context for SMB3") Signed-off-by: Henrique Carvalho Signed-off-by: Steve French commit a3e771afbb3bce91c8296828304903e7348003fe Author: Pali Rohár Date: Tue Dec 31 16:06:22 2024 +0100 cifs: Fix cifs_query_path_info() for Windows NT servers For TRANS2 QUERY_PATH_INFO request when the path does not exist, the Windows NT SMB server returns error response STATUS_OBJECT_NAME_NOT_FOUND or ERRDOS/ERRbadfile without the SMBFLG_RESPONSE flag set. Similarly it returns STATUS_DELETE_PENDING when the file is being deleted. And looks like that any error response from TRANS2 QUERY_PATH_INFO does not have SMBFLG_RESPONSE flag set. So relax check in check_smb_hdr() for detecting if the packet is response for this special case. This change fixes stat() operation against Windows NT SMB servers and also all operations which depends on -ENOENT result from stat like creat() or mkdir(). Signed-off-by: Pali Rohár Signed-off-by: Steve French commit 56e84c64fc257a95728ee73165456b025c48d408 Author: Pali Rohár Date: Thu Dec 26 19:55:13 2024 +0100 cifs: Fix validation of SMB1 query reparse point response Validate the SMB1 query reparse point response per [MS-CIFS] section 2.2.7.2 NT_TRANSACT_IOCTL. NT_TRANSACT_IOCTL response contains one word long setup data after which is ByteCount member. So check that SetupCount is 1 before trying to read and use ByteCount member. Output setup data contains ReturnedDataLen member which is the output length of executed IOCTL command by remote system. So check that output was not truncated before transferring over network. Change MaxSetupCount of NT_TRANSACT_IOCTL request from 4 to 1 as io_rsp structure already expects one word long output setup data. This should prevent server sending incompatible structure (in case it would be extended in future, which is unlikely). Change MaxParameterCount of NT_TRANSACT_IOCTL request from 2 to 0 as NT IOCTL does not have any documented output parameters and this function does not parse any output parameters at all. Fixes: ed3e0a149b58 ("smb: client: implement ->query_reparse_point() for SMB1") Signed-off-by: Pali Rohár Signed-off-by: Steve French commit 89381c72d52094988e11d23ef24a00066a0fa458 Author: Pali Rohár Date: Sat Nov 2 17:58:31 2024 +0100 cifs: Correctly set SMB1 SessionKey field in Session Setup Request [MS-CIFS] specification in section 2.2.4.53.1 where is described SMB_COM_SESSION_SETUP_ANDX Request, for SessionKey field says: The client MUST set this field to be equal to the SessionKey field in the SMB_COM_NEGOTIATE Response for this SMB connection. Linux SMB client currently set this field to zero. This is working fine against Windows NT SMB servers thanks to [MS-CIFS] product behavior <94>: Windows NT Server ignores the client's SessionKey. For compatibility with [MS-CIFS], set this SessionKey field in Session Setup Request to value retrieved from Negotiate response. Signed-off-by: Pali Rohár Signed-off-by: Steve French commit 6510ef4230b68c960309e0c1d6eb3e32eb785142 Author: Pali Rohár Date: Sun Oct 6 19:24:29 2024 +0200 cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode SMB1 Session Setup NTLMSSP Request in non-UNICODE mode is similar to UNICODE mode, just strings are encoded in ASCII and not in UTF-16. With this change it is possible to setup SMB1 session with NTLM authentication in non-UNICODE mode with Windows SMB server. This change fixes mounting SMB1 servers with -o nounicode mount option together with -o sec=ntlmssp mount option (which is the default sec=). Signed-off-by: Pali Rohár Signed-off-by: Steve French commit 3d8b44b104fb5f93a853ae34fbcf8d840e4482f5 Author: Alexandre Mergnat Date: Mon Apr 28 16:29:55 2025 +0200 rtc: mt6359: Add mt6357 support The MT6357 PMIC contains the same RTC as MT6358 which allows to add support for it trivially by just complementing the list of compatibles. Signed-off-by: Alexandre Mergnat Reviewed-by: AngeloGioacchino Del Regno Acked-by: Uwe Kleine-König Tested-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20250428-rtc-mt6357-v1-1-31f673b0a723@baylibre.com Signed-off-by: Alexandre Belloni commit ccb2dba3c19f04d2203a4b630180bf50fe710d22 Author: Uwe Kleine-König Date: Mon Apr 28 12:06:51 2025 +0200 rtc: test: Test date conversion for dates starting in 1900 While the RTC framework intends to only handle dates after 1970 for consumers, time conversion must also work for earlier dates to cover e.g. storing dates beyond an RTC's range_max. This is most relevant for the rtc-mt6397 driver that has range_min = RTC_TIMESTAMP_BEGIN_1900; range_max = mktime64(2027, 12, 31, 23, 59, 59); and so needs working support for timestamps in 1900 starting in less than three years. So shift the tested interval of timestamps to also cover years 1900 to 1970. Signed-off-by: Uwe Kleine-König Signed-off-by: Alexandre Mergnat Link: https://lore.kernel.org/r/20250428-enable-rtc-v4-5-2b2f7e3f9349@baylibre.com Signed-off-by: Alexandre Belloni commit da62b49830f83d1c80bfa1f2208db0cc6c19a1f9 Author: Uwe Kleine-König Date: Mon Apr 28 12:06:50 2025 +0200 rtc: test: Also test time and wday outcome of rtc_time64_to_tm() To cover calculation of the time and wday in the rtc kunit test also check tm_hour, tm_min, tm_sec and tm_wday of the rtc_time calculated by rtc_time64_to_tm(). There are no surprises, the two tests making use of rtc_time64_to_tm_test_date_range() continue to succeed. Signed-off-by: Uwe Kleine-König Signed-off-by: Alexandre Mergnat Link: https://lore.kernel.org/r/20250428-enable-rtc-v4-4-2b2f7e3f9349@baylibre.com Signed-off-by: Alexandre Belloni commit 46351921cbe11403a4fcab00e76fa03d99a7aef2 Author: Uwe Kleine-König Date: Mon Apr 28 12:06:49 2025 +0200 rtc: test: Emit the seconds-since-1970 value instead of days-since-1970 This is easier to handle because you can just consult date(1) to convert between a seconds-since-1970 value and a date string: $ date --utc -d @3661 Thu Jan 1 01:01:01 AM UTC 1970 $ date -d "Jan 1 12:00:00 AM UTC 1900" +%s -2208988800 The intended side effect is that this prepares the test for dates before 1970. The division of a negative value by 86400 doesn't result in the desired days-since-1970 value as e.g. secs=-82739 should map to days=-1. Signed-off-by: Uwe Kleine-König Signed-off-by: Alexandre Mergnat Link: https://lore.kernel.org/r/20250428-enable-rtc-v4-3-2b2f7e3f9349@baylibre.com Signed-off-by: Alexandre Belloni commit fe9f5f96cfe8b82d0f24cbfa93718925560f4f8d Author: Alexandre Mergnat Date: Mon Apr 28 12:06:48 2025 +0200 rtc: Fix offset calculation for .start_secs < 0 The comparison rtc->start_secs > rtc->range_max has a signed left-hand side and an unsigned right-hand side. So the comparison might become true for negative start_secs which is interpreted as a (possibly very large) positive value. As a negative value can never be bigger than an unsigned value the correct representation of the (mathematical) comparison rtc->start_secs > rtc->range_max in C is: rtc->start_secs >= 0 && rtc->start_secs > rtc->range_max Use that to fix the offset calculation currently used in the rtc-mt6397 driver. Fixes: 989515647e783 ("rtc: Add one offset seconds to expand RTC range") Signed-off-by: Alexandre Mergnat Reviewed-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20250428-enable-rtc-v4-2-2b2f7e3f9349@baylibre.com Signed-off-by: Alexandre Belloni commit 7df4cfef8b351fec3156160bedfc7d6d29de4cce Author: Alexandre Mergnat Date: Mon Apr 28 12:06:47 2025 +0200 rtc: Make rtc_time64_to_tm() support dates before 1970 Conversion of dates before 1970 is still relevant today because these dates are reused on some hardwares to store dates bigger than the maximal date that is representable in the device's native format. This prominently and very soon affects the hardware covered by the rtc-mt6397 driver that can only natively store dates in the interval 1900-01-01 up to 2027-12-31. So to store the date 2028-01-01 00:00:00 to such a device, rtc_time64_to_tm() must do the right thing for time=-2208988800. Signed-off-by: Alexandre Mergnat Reviewed-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20250428-enable-rtc-v4-1-2b2f7e3f9349@baylibre.com Signed-off-by: Alexandre Belloni commit 1e15a6803df01471e0065dabd8b9563692c47219 Author: Troy Mitchell Date: Sat May 31 15:20:40 2025 +0800 rtc: pcf8563: fix wrong alarm register When the regmap framework was introduced to this driver, the PCF8563_REG_AMN register within the set_alarm function was incorrectly changed to PCF8563_REG_SC. The PCF8563_REG_SC register is the seconds register. This caused alarm values to be written to the seconds register when an alarm was set. Which means the alarm would not trigger as expected and the seconds register would be overwritten with an incorrect value. Signed-off-by: Troy Mitchell Link: https://lore.kernel.org/r/20250531-pcf8563-fix-alarm-v2-1-cac4b1716167@gmail.com Signed-off-by: Alexandre Belloni commit f096bdbf08c9c696a6b5c18a36b75c43f8d86eba Author: Wolfram Sang Date: Mon May 26 11:58:04 2025 +0200 rtc: rzn1: support input frequencies other than 32768Hz When using the SCMP mode instead of SUBU, this RTC can also support other input frequencies than 32768Hz. Also, upcoming SoCs will only support SCMP. Signed-off-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Reviewed-by: Miquel Raynal Link: https://lore.kernel.org/r/20250526095801.35781-8-wsa+renesas@sang-engineering.com Signed-off-by: Alexandre Belloni commit a50f00cb87b1c69eb4a08ae5c79e9536da839dfd Author: Wolfram Sang Date: Mon May 26 11:58:03 2025 +0200 rtc: rzn1: Disable controller before initialization Datasheet says that the controller must be disabled before setting up either SUBU or SCMP. This did not matter so far because the driver only supported SUBU which was the default, too. It is good practice to follow datasheet recommendations, though. It will also be needed because SCMP mode will be added in a later patch. Signed-off-by: Wolfram Sang Reviewed-by: Miquel Raynal Link: https://lore.kernel.org/r/20250526095801.35781-7-wsa+renesas@sang-engineering.com Signed-off-by: Alexandre Belloni commit ae95a7e3214092900fc0688224626b203f95f165 Author: Wolfram Sang Date: Mon May 26 11:58:02 2025 +0200 dt-bindings: rtc: rzn1: add optional second clock The external crystal can be a second clock input. It is needed for the SCMP counting method which allows using crystals different than 32768Hz. It is also needed for an upcoming SoC which only supports the SCMP method. Signed-off-by: Wolfram Sang Reviewed-by: Krzysztof Kozlowski Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20250526095801.35781-6-wsa+renesas@sang-engineering.com Signed-off-by: Alexandre Belloni commit f1e7a277a1736e12cc4bd6d93b8a5c439b8ca20c Author: Ruben Devos Date: Sun Jun 1 19:18:55 2025 +0200 smb: client: add NULL check in automount_fullpath page is checked for null in __build_path_from_dentry_optional_prefix when tcon->origin_fullpath is not set. However, the check is missing when it is set. Add a check to prevent a potential NULL pointer dereference. Signed-off-by: Ruben Devos Cc: stable@vger.kernel.org Signed-off-by: Steve French commit baa39c169dd526cb0186187fc44ec462266efcc6 Author: Yonghong Song Date: Thu May 29 13:11:51 2025 -0700 selftests/bpf: Fix selftest btf_tag/btf_type_tag_percpu_vmlinux_helper failure Ihor Solodrai reported selftest 'btf_tag/btf_type_tag_percpu_vmlinux_helper' failure ([1]) during 6.16 merge window. The failure log: ... 7: (15) if r0 == 0x0 goto pc+1 ; R0=ptr_css_rstat_cpu() ; *(volatile int *)rstat; @ btf_type_tag_percpu.c:68 8: (61) r1 = *(u32 *)(r0 +0) cannot access ptr member updated_children with moff 0 in struct css_rstat_cpu with off 0 size 4 Two changes are needed. First, 'struct cgroup_rstat_cpu' needs to be replaced with 'struct css_rstat_cpu' to be consistent with new data structure. Second, layout of 'css_rstat_cpu' is changed compared to 'cgroup_rstat_cpu'. The first member becomes a pointer so the bpf prog needs to do 8-byte load instead of 4-byte load. [1] https://lore.kernel.org/bpf/6f688f2e-7d26-423a-9029-d1b1ef1c938a@linux.dev/ Cc: Ihor Solodrai Cc: JP Kobryn Signed-off-by: Yonghong Song Acked-by: JP Kobryn Link: https://lore.kernel.org/r/20250529201151.1787575-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov commit 4b65d5ae971430287855a89635a184c489bd02a5 Author: Saket Kumar Bhaskar Date: Mon May 12 14:41:07 2025 +0530 selftests/bpf: Fix bpf selftest build error On linux-next, build for bpf selftest displays an error due to mismatch in the expected function signature of bpf_testmod_test_read and bpf_testmod_test_write. Commit 97d06802d10a ("sysfs: constify bin_attribute argument of bin_attribute::read/write()") changed the required type for struct bin_attribute to const struct bin_attribute. To resolve the error, update corresponding signature for the callback. Fixes: 97d06802d10a ("sysfs: constify bin_attribute argument of bin_attribute::read/write()") Reported-by: Venkat Rao Bagalkote Closes: https://lore.kernel.org/all/e915da49-2b9a-4c4c-a34f-877f378129f6@linux.ibm.com/ Tested-by: Venkat Rao Bagalkote Signed-off-by: Saket Kumar Bhaskar Link: https://lore.kernel.org/r/20250512091108.2015615-1-skb99@linux.ibm.com Signed-off-by: Alexei Starovoitov commit cd2e103d57e5615f9bb027d772f93b9efd567224 Merge: bb1556ec946470 f39f18f3c3531a Author: Linus Torvalds Date: Sun Jun 1 11:37:01 2025 -0700 Merge tag 'hardening-v6.16-rc1-fix1-take2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening fixes from Kees Cook: - randstruct: gcc-plugin: Fix attribute addition with GCC 15 - ubsan: integer-overflow: depend on BROKEN to keep this out of CI - overflow: Introduce __DEFINE_FLEX for having no initializer - wifi: iwlwifi: mld: Work around Clang loop unrolling bug [ Take two after a jump scare due to some repo rewriting by 'b4' - Linus ] * tag 'hardening-v6.16-rc1-fix1-take2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: randstruct: gcc-plugin: Fix attribute addition overflow: Introduce __DEFINE_FLEX for having no initializer ubsan: integer-overflow: depend on BROKEN to keep this out of CI wifi: iwlwifi: mld: Work around Clang loop unrolling bug commit bb1556ec94647060c6b52bf434b9fd824724a6f4 Merge: a2604f8d43bf41 158f9f2f71523b Author: Linus Torvalds Date: Sun Jun 1 09:01:58 2025 -0700 Merge tag 'linux-watchdog-6.16-rc1' of git://www.linux-watchdog.org/linux-watchdog Pull watchdog updates from Wim Van Sebroeck: - Add watchdog timer for the NXP S32 platform - Add driver for Intel OC WDT - Add exynos990-wdt - Various other fixes and improvements * tag 'linux-watchdog-6.16-rc1' of git://www.linux-watchdog.org/linux-watchdog: (22 commits) watchdog: iTCO_wdt: Update the heartbeat value after clamping timeout watchdog: Add driver for Intel OC WDT watchdog: arm_smc_wdt: get wdt status through SMCWD_GET_TIMELEFT watchdog: iTCO: Drop driver-internal locking watchdog: apple: set max_hw_heartbeat_ms instead of max_timeout watchdog: qcom: introduce the device data for IPQ5424 watchdog device dt-bindings: watchdog: renesas,wdt: Document RZ/V2N (R9A09G056) support watchdog: lenovo_se30_wdt: Fix possible devm_ioremap() NULL pointer dereference in lenovo_se30_wdt_probe() watchdog: s3c2410_wdt: Add exynos990-wdt compatible data dt-bindings: watchdog: samsung-wdt: Add exynos990-wdt compatible dt-bindings: watchdog: Add rk3562 compatible dt-bindings: watchdog: fsl,scu-wdt: Document imx8qm watchdog: Add the Watchdog Timer for the NXP S32 platform dt-bindings: watchdog: Add NXP Software Watchdog Timer watchdog: Correct kerneldoc warnings watchdog: stm32: Fix wakeup source leaks on device unbind watchdog: Do not enable by default during compile testing watchdog: cros-ec: Avoid -Wflex-array-member-not-at-end warning watchdog: da9052_wdt: respect TWDMIN watchdog: da9052_wdt: do not disable wdt during probe ... commit a2604f8d43bf414db54c42ca6ea52803ce1c0b2f Merge: 9bebf9f9d5db91 00286d7d643d3c Author: Linus Torvalds Date: Sun Jun 1 08:59:50 2025 -0700 Merge tag 'i3c/for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux Pull i3c updates from Alexandre Belloni: "There is not much this this, mostly fixes around interrupt and IBI handling: - mipi-i3c-hci: interrupt handling fixes - svc: i.MX94 and i.MX95 support, IBI handling fixes" * tag 'i3c/for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux: i3c: controllers do not need to depend on I3C i3c: master: svc: switch to bulk clk API for flexible clock support dt-bindings: i3c: silvaco,i3c-master: add i.MX94 and i.MX95 I3C i3c: master: svc: skip address resend on repeat START i3c: master: svc: Emit STOP asap in the IBI transaction i3c: master: svc: Receive IBI requests in interrupt context i3c: mipi-i3c-hci: Move unexpected INTR_STATUS print before IO handler i3c: mipi-i3c-hci: Change name of INTR_STATUS bit 11 i3c: mipi-i3c-hci: Clear INTR_STATUS unconditionally i3c: mipi-i3c-hci: Fix handling status of i3c_hci_irq_handler() i3c: mipi-i3c-hci: Allow only relevant INTR_STATUS bit updates commit 9bebf9f9d5db910ab3bd285749ee0f869d39c642 Merge: 82dad698061c2d e5ef4cd2a47f27 Author: Linus Torvalds Date: Sun Jun 1 08:58:31 2025 -0700 Merge tag 'edac_urgent_for_v6.16_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC fix from Borislav Petkov: "Limit a register write width in altera_edac to avoid hw errors" * tag 'edac_urgent_for_v6.16_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/altera: Use correct write width with the INTTEST register commit 82dad698061c2db166fdcf92f549d34ba038e829 Merge: f563ba4ac68a4d f698ee1f400301 Author: Linus Torvalds Date: Sun Jun 1 08:56:34 2025 -0700 Merge tag 'for-linus' of https://github.com/openrisc/linux Pull OpenRISC updates from Stafford Horne: "Just a few documentation updates from the community: - Device tree documentation conversion from txt to yaml - Documentation addition to help users getting started with initramfs on OpenRISC * tag 'for-linus' of https://github.com/openrisc/linux: dt-bindings: interrupt-controller: Convert openrisc,ompic to DT schema dt-bindings: interrupt-controller: Convert opencores,or1k-pic to DT schema Documentation:openrisc: Add build instructions with initramfs commit f563ba4ac68a4dfdfb37baa24ff1a4f917e9ffe7 Merge: 7d4e49a77d9930 213205889d5ffc Author: Linus Torvalds Date: Sun Jun 1 08:55:28 2025 -0700 Merge tag 'parisc-for-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc updates from Helge Deller: "Fix building with gcc-15, formatting fix on unaligned warnings and replace __ASSEMBLY__ with __ASSEMBLER__ in headers" * tag 'parisc-for-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc/unaligned: Fix hex output to show 8 hex chars parisc: fix building with gcc-15 parisc: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers parisc: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers commit 72386d5245b249f5a0a8fabb881df7ad947b8ea4 Author: Dennis Marttinen Date: Thu May 29 17:45:12 2025 +0000 ceph: set superblock s_magic for IMA fsmagic matching The CephFS kernel driver forgets to set the filesystem magic signature in its superblock. As a result, IMA policy rules based on fsmagic matching do not apply as intended. This causes a major performance regression in Talos Linux [1] when mounting CephFS volumes, such as when deploying Rook Ceph [2]. Talos Linux ships a hardened kernel with the following IMA policy (irrelevant lines omitted): [...] dont_measure fsmagic=0xc36400 # CEPH_SUPER_MAGIC [...] measure func=FILE_CHECK mask=^MAY_READ euid=0 measure func=FILE_CHECK mask=^MAY_READ uid=0 [...] Currently, IMA compares 0xc36400 == 0x0 for CephFS files, resulting in all files opened with O_RDONLY or O_RDWR getting measured with SHA512 on every open(2): 10 69990c87e8af323d47e2d6ae4... ima-ng sha512: /data/cephfs/test-file Since O_WRONLY is rare, this results in an order of magnitude lower performance than expected for practically all file operations. Properly setting CEPH_SUPER_MAGIC in the CephFS superblock resolves the regression. Tests performed on a 3x replicated Ceph v19.3.0 cluster across three i5-7200U nodes each equipped with one Micron 7400 MAX M.2 disk (BlueStore) and Gigabit ethernet, on Talos Linux v1.10.2: FS-Mark 3.3 Test: 500 Files, Empty Files/s > Higher Is Better 6.12.27-talos . 16.6 |==== +twelho patch . 208.4 |==================================================== FS-Mark 3.3 Test: 500 Files, 1KB Size Files/s > Higher Is Better 6.12.27-talos . 15.6 |======= +twelho patch . 118.6 |==================================================== FS-Mark 3.3 Test: 500 Files, 32 Sub Dirs, 1MB Size Files/s > Higher Is Better 6.12.27-talos . 12.7 |=============== +twelho patch . 44.7 |===================================================== IO500 [3] 2fcd6d6 results (benchmarks within variance omitted): | IO500 benchmark | 6.12.27-talos | +twelho patch | Speedup | |-------------------|----------------|----------------|-----------| | mdtest-easy-write | 0.018524 kIOPS | 1.135027 kIOPS | 6027.33 % | | mdtest-hard-write | 0.018498 kIOPS | 0.973312 kIOPS | 5161.71 % | | ior-easy-read | 0.064727 GiB/s | 0.155324 GiB/s | 139.97 % | | mdtest-hard-read | 0.018246 kIOPS | 0.780800 kIOPS | 4179.29 % | This applies outside of synthetic benchmarks as well, for example, the time to rsync a 55 MiB directory with ~12k of mostly small files drops from an unusable 10m5s to a reasonable 26s (23x the throughput). [1]: https://www.talos.dev/ [2]: https://www.talos.dev/v1.10/kubernetes-guides/configuration/ceph-with-rook/ [3]: https://github.com/IO500/io500 Cc: stable@vger.kernel.org Signed-off-by: Dennis Marttinen Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit d50eb28f2de5a35670ce10c0d34b9c9088f43f54 Author: Viacheslav Dubeyko Date: Mon Feb 10 15:01:58 2025 -0800 ceph: cleanup hardcoded constants of file handle size The ceph/export.c contains very confusing logic of file handle size calculation based on hardcoded values. This patch makes the cleanup of this logic by means of introduction the named constants. Signed-off-by: Viacheslav Dubeyko Reviewed-by: Alex Markuze Signed-off-by: Ilya Dryomov commit 0abd87942e0c93964e93224836944712feba1d91 Author: Dmitry Kandybka Date: Tue Apr 22 12:32:04 2025 +0300 ceph: fix possible integer overflow in ceph_zero_objects() In 'ceph_zero_objects', promote 'object_size' to 'u64' to avoid possible integer overflow. Compile tested only. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Dmitry Kandybka Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit 060909278cc0a91373a20726bd3d8ce085f480a9 Author: Viacheslav Dubeyko Date: Thu Jan 16 16:30:08 2025 -0800 ceph: avoid kernel BUG for encrypted inode with unaligned file size The generic/397 test hits a BUG_ON for the case of encrypted inode with unaligned file size (for example, 33K or 1K): [ 877.737811] run fstests generic/397 at 2025-01-03 12:34:40 [ 877.875761] libceph: mon0 (2)127.0.0.1:40674 session established [ 877.876130] libceph: client4614 fsid 19b90bca-f1ae-47a6-93dd-0b03ee637949 [ 877.991965] libceph: mon0 (2)127.0.0.1:40674 session established [ 877.992334] libceph: client4617 fsid 19b90bca-f1ae-47a6-93dd-0b03ee637949 [ 878.017234] libceph: mon0 (2)127.0.0.1:40674 session established [ 878.017594] libceph: client4620 fsid 19b90bca-f1ae-47a6-93dd-0b03ee637949 [ 878.031394] xfs_io (pid 18988) is setting deprecated v1 encryption policy; recommend upgrading to v2. [ 878.054528] libceph: mon0 (2)127.0.0.1:40674 session established [ 878.054892] libceph: client4623 fsid 19b90bca-f1ae-47a6-93dd-0b03ee637949 [ 878.070287] libceph: mon0 (2)127.0.0.1:40674 session established [ 878.070704] libceph: client4626 fsid 19b90bca-f1ae-47a6-93dd-0b03ee637949 [ 878.264586] libceph: mon0 (2)127.0.0.1:40674 session established [ 878.265258] libceph: client4629 fsid 19b90bca-f1ae-47a6-93dd-0b03ee637949 [ 878.374578] -----------[ cut here ]------------ [ 878.374586] kernel BUG at net/ceph/messenger.c:1070! [ 878.375150] Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 878.378145] CPU: 2 UID: 0 PID: 4759 Comm: kworker/2:9 Not tainted 6.13.0-rc5+ #1 [ 878.378969] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 878.380167] Workqueue: ceph-msgr ceph_con_workfn [ 878.381639] RIP: 0010:ceph_msg_data_cursor_init+0x42/0x50 [ 878.382152] Code: 89 17 48 8b 46 70 55 48 89 47 08 c7 47 18 00 00 00 00 48 89 e5 e8 de cc ff ff 5d 31 c0 31 d2 31 f6 31 ff c3 cc cc cc cc 0f 0b <0f> 0b 0f 0b 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 [ 878.383928] RSP: 0018:ffffb4ffc7cbbd28 EFLAGS: 00010287 [ 878.384447] RAX: ffffffff82bb9ac0 RBX: ffff981390c2f1f8 RCX: 0000000000000000 [ 878.385129] RDX: 0000000000009000 RSI: ffff981288232b58 RDI: ffff981390c2f378 [ 878.385839] RBP: ffffb4ffc7cbbe18 R08: 0000000000000000 R09: 0000000000000000 [ 878.386539] R10: 0000000000000000 R11: 0000000000000000 R12: ffff981390c2f030 [ 878.387203] R13: ffff981288232b58 R14: 0000000000000029 R15: 0000000000000001 [ 878.387877] FS: 0000000000000000(0000) GS:ffff9814b7900000(0000) knlGS:0000000000000000 [ 878.388663] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 878.389212] CR2: 00005e106a0554e0 CR3: 0000000112bf0001 CR4: 0000000000772ef0 [ 878.389921] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 878.390620] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 878.391307] PKRU: 55555554 [ 878.391567] Call Trace: [ 878.391807] [ 878.392021] ? show_regs+0x71/0x90 [ 878.392391] ? die+0x38/0xa0 [ 878.392667] ? do_trap+0xdb/0x100 [ 878.392981] ? do_error_trap+0x75/0xb0 [ 878.393372] ? ceph_msg_data_cursor_init+0x42/0x50 [ 878.393842] ? exc_invalid_op+0x53/0x80 [ 878.394232] ? ceph_msg_data_cursor_init+0x42/0x50 [ 878.394694] ? asm_exc_invalid_op+0x1b/0x20 [ 878.395099] ? ceph_msg_data_cursor_init+0x42/0x50 [ 878.395583] ? ceph_con_v2_try_read+0xd16/0x2220 [ 878.396027] ? _raw_spin_unlock+0xe/0x40 [ 878.396428] ? raw_spin_rq_unlock+0x10/0x40 [ 878.396842] ? finish_task_switch.isra.0+0x97/0x310 [ 878.397338] ? __schedule+0x44b/0x16b0 [ 878.397738] ceph_con_workfn+0x326/0x750 [ 878.398121] process_one_work+0x188/0x3d0 [ 878.398522] ? __pfx_worker_thread+0x10/0x10 [ 878.398929] worker_thread+0x2b5/0x3c0 [ 878.399310] ? __pfx_worker_thread+0x10/0x10 [ 878.399727] kthread+0xe1/0x120 [ 878.400031] ? __pfx_kthread+0x10/0x10 [ 878.400431] ret_from_fork+0x43/0x70 [ 878.400771] ? __pfx_kthread+0x10/0x10 [ 878.401127] ret_from_fork_asm+0x1a/0x30 [ 878.401543] [ 878.401760] Modules linked in: hctr2 nhpoly1305_avx2 nhpoly1305_sse2 nhpoly1305 chacha_generic chacha_x86_64 libchacha adiantum libpoly1305 essiv authenc mptcp_diag xsk_diag tcp_diag udp_diag raw_diag inet_diag unix_diag af_packet_diag netlink_diag intel_rapl_msr intel_rapl_common intel_uncore_frequency_common skx_edac_common nfit kvm_intel kvm crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic ghash_clmulni_intel sha256_ssse3 sha1_ssse3 aesni_intel joydev crypto_simd cryptd rapl input_leds psmouse sch_fq_codel serio_raw bochs i2c_piix4 floppy qemu_fw_cfg i2c_smbus mac_hid pata_acpi msr parport_pc ppdev lp parport efi_pstore ip_tables x_tables [ 878.407319] ---[ end trace 0000000000000000 ]--- [ 878.407775] RIP: 0010:ceph_msg_data_cursor_init+0x42/0x50 [ 878.408317] Code: 89 17 48 8b 46 70 55 48 89 47 08 c7 47 18 00 00 00 00 48 89 e5 e8 de cc ff ff 5d 31 c0 31 d2 31 f6 31 ff c3 cc cc cc cc 0f 0b <0f> 0b 0f 0b 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 [ 878.410087] RSP: 0018:ffffb4ffc7cbbd28 EFLAGS: 00010287 [ 878.410609] RAX: ffffffff82bb9ac0 RBX: ffff981390c2f1f8 RCX: 0000000000000000 [ 878.411318] RDX: 0000000000009000 RSI: ffff981288232b58 RDI: ffff981390c2f378 [ 878.412014] RBP: ffffb4ffc7cbbe18 R08: 0000000000000000 R09: 0000000000000000 [ 878.412735] R10: 0000000000000000 R11: 0000000000000000 R12: ffff981390c2f030 [ 878.413438] R13: ffff981288232b58 R14: 0000000000000029 R15: 0000000000000001 [ 878.414121] FS: 0000000000000000(0000) GS:ffff9814b7900000(0000) knlGS:0000000000000000 [ 878.414935] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 878.415516] CR2: 00005e106a0554e0 CR3: 0000000112bf0001 CR4: 0000000000772ef0 [ 878.416211] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 878.416907] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 878.417630] PKRU: 55555554 (gdb) l *ceph_msg_data_cursor_init+0x42 0xffffffff823b45a2 is in ceph_msg_data_cursor_init (net/ceph/messenger.c:1070). 1065 1066 void ceph_msg_data_cursor_init(struct ceph_msg_data_cursor *cursor, 1067 struct ceph_msg *msg, size_t length) 1068 { 1069 BUG_ON(!length); 1070 BUG_ON(length > msg->data_length); 1071 BUG_ON(!msg->num_data_items); 1072 1073 cursor->total_resid = length; 1074 cursor->data = msg->data; The issue takes place because of this: [ 202.628853] libceph: net/ceph/messenger_v2.c:2034 prepare_sparse_read_data(): msg->data_length 33792, msg->sparse_read_total 36864 1070 BUG_ON(length > msg->data_length); The generic/397 test (xfstests) executes such steps: (1) create encrypted files and directories; (2) access the created files and folders with encryption key; (3) access the created files and folders without encryption key. The issue takes place in this portion of code: if (IS_ENCRYPTED(inode)) { struct page **pages; size_t page_off; err = iov_iter_get_pages_alloc2(&subreq->io_iter, &pages, len, &page_off); if (err < 0) { doutc(cl, "%llx.%llx failed to allocate pages, %d\n", ceph_vinop(inode), err); goto out; } /* should always give us a page-aligned read */ WARN_ON_ONCE(page_off); len = err; err = 0; osd_req_op_extent_osd_data_pages(req, 0, pages, len, 0, false, false); The reason of the issue is that subreq->io_iter.count keeps unaligned value of length: [ 347.751182] lib/iov_iter.c:1185 __iov_iter_get_pages_alloc(): maxsize 36864, maxpages 4294967295, start 18446659367320516064 [ 347.752808] lib/iov_iter.c:1196 __iov_iter_get_pages_alloc(): maxsize 33792, maxpages 4294967295, start 18446659367320516064 [ 347.754394] lib/iov_iter.c:1015 iter_folioq_get_pages(): maxsize 33792, maxpages 4294967295, extracted 0, _start_offset 18446659367320516064 This patch simply assigns the aligned value to subreq->io_iter.count before calling iov_iter_get_pages_alloc2(). [ idryomov: tag the comment with FIXME to make it clear that it's only a workaround for netfslib not coexisting with fscrypt nicely (this is also noted in another pre-existing comment) ] Cc: David Howells Cc: stable@vger.kernel.org Fixes: ee4cdf7ba857 ("netfs: Speed up buffered reading") Signed-off-by: Viacheslav Dubeyko Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit f39f18f3c3531aa802b58a20d39d96e82eb96c14 Author: Kees Cook Date: Fri May 30 15:18:28 2025 -0700 randstruct: gcc-plugin: Fix attribute addition Based on changes in the 2021 public version of the randstruct out-of-tree GCC plugin[1], more carefully update the attributes on resulting decls, to avoid tripping checks in GCC 15's comptypes_check_enum_int() when it has been configured with "--enable-checking=misc": arch/arm64/kernel/kexec_image.c:132:14: internal compiler error: in comptypes_check_enum_int, at c/c-typeck.cc:1519 132 | const struct kexec_file_ops kexec_image_ops = { | ^~~~~~~~~~~~~~ internal_error(char const*, ...), at gcc/gcc/diagnostic-global-context.cc:517 fancy_abort(char const*, int, char const*), at gcc/gcc/diagnostic.cc:1803 comptypes_check_enum_int(tree_node*, tree_node*, bool*), at gcc/gcc/c/c-typeck.cc:1519 ... Link: https://archive.org/download/grsecurity/grsecurity-3.1-5.10.41-202105280954.patch.gz [1] Reported-by: Thiago Jung Bauermann Closes: https://github.com/KSPP/linux/issues/367 Closes: https://lore.kernel.org/lkml/20250530000646.104457-1-thiago.bauermann@linaro.org/ Reported-by: Ingo Saitz Closes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1104745 Fixes: 313dd1b62921 ("gcc-plugins: Add the randstruct plugin") Tested-by: Thiago Jung Bauermann Link: https://lore.kernel.org/r/20250530221824.work.623-kees@kernel.org Signed-off-by: Kees Cook commit 5c78e793f78732b60276401f75cc1a101f9ad121 Author: Kees Cook Date: Fri May 30 12:06:47 2025 -0700 overflow: Introduce __DEFINE_FLEX for having no initializer While not yet in the tree, there is a proposed patch[1] that was depending on the prior behavior of _DEFINE_FLEX, which did not have an explicit initializer. Provide this via __DEFINE_FLEX now, which can also have attributes applied (e.g. __uninitialized). Examples of the resulting initializer behaviors can be seen here: https://godbolt.org/z/P7Go8Tr33 Link: https://lore.kernel.org/netdev/20250520205920.2134829-9-anthony.l.nguyen@intel.com [1] Fixes: 47e36ed78406 ("overflow: Fix direct struct member initialization in _DEFINE_FLEX()") Signed-off-by: Kees Cook commit 158f9f2f71523bab787f4fa7a7a1f390524350ca Author: Ziyan Fu Date: Tue Apr 29 18:25:33 2025 +0800 watchdog: iTCO_wdt: Update the heartbeat value after clamping timeout When executing "modprobe iTCO_wdt heartbeat=700", the user-specified 'heartbeat' parameter exceeds the valid range, the driver clamps the timeout to default 30s but fails to update the logged 'heartbeat' value, resulting in misleading log output: iTCO_wdt iTCO_wdt: timeout value out of range, using 30 iTCO_wdt iTCO_wdt: initialized. heartbeat=700 sec (nowayout=0) After validating the range, update the 'heartbeat' value with the clamped timeout value to ensure that log messages accurately reflect the actual runtime parameters. Signed-off-by: Ziyan Fu Reviewed-by: Wim Van Sebroeck Link: https://lore.kernel.org/r/20250429102533.11886-1-13281011316@163.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 535d1784d8a96dce79023ac5081de1aa8669388a Author: Diogo Ivo Date: Mon Mar 17 10:55:06 2025 +0000 watchdog: Add driver for Intel OC WDT Add a driver for the Intel Over-Clocking Watchdog found in Intel Platform Controller (PCH) chipsets. This watchdog is controlled via a simple single-register interface and would otherwise be standard except for the presence of a LOCK bit that can only be set once per power cycle, needing extra handling around it. Signed-off-by: Diogo Ivo Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20250317-ivo-intel_oc_wdt-v3-1-32c396f4eefd@siemens.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit cc0df5eba1b3a0eb54003d977a062ed39db09b0d Author: Antonio Borneo Date: Tue May 20 10:59:52 2025 +0200 watchdog: arm_smc_wdt: get wdt status through SMCWD_GET_TIMELEFT The optional SMCWD_GET_TIMELEFT command can be used to detect if the watchdog has already been started. See the implementation in OP-TEE secure OS [1]. At probe time, check if the watchdog is already started and then set WDOG_HW_RUNNING in the watchdog status. This will cause the watchdog framework to ping the watchdog until a userspace watchdog daemon takes over the control. Link: https://github.com/OP-TEE/optee_os/commit/a7f2d4bd8632 [1] Signed-off-by: Antonio Borneo Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20250520085952.210723-1-antonio.borneo@foss.st.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 27a46a0f088692bca08165e320e0293fd02638e2 Author: Guenter Roeck Date: Sat May 17 09:09:36 2025 -0700 watchdog: iTCO: Drop driver-internal locking The locking code in the iTCO watchdog driver has been carried along from before the watchdog core existed. The watchdog core protects calls into drivers since commit f4e9c82f64b5 ("watchdog: Add Locking support"), making driver-internal locking unnecessary. Drop it. Signed-off-by: Guenter Roeck Reviewed-by: Wim Van Sebroeck Link: https://lore.kernel.org/r/20250517160936.3231017-1-linux@roeck-us.net Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 45f1884d5cf2f66736d84bc11d023a7cc82b8838 Author: Florian Klink Date: Tue May 6 17:26:22 2025 +0300 watchdog: apple: set max_hw_heartbeat_ms instead of max_timeout The hardware only supports timeouts slightly below 3mins, but by using max_hw_heartbeat_ms we can let the kernel take care of supporting larger timeouts than that requested from userspace. Switching to max_hw_heartbeat_ms also means our set_timeout function now needs to configure the hardware to the minimum of either the requested timeout (in seconds) or the maximum supported by the user (in seconds). Signed-off-by: Florian Klink Reviewed-by: Wim Van Sebroeck Link: https://lore.kernel.org/r/20250506142621.11428-2-flokli@flokli.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 1aea3e1ec0e7611804c9124097eecf050bf5fdcd Author: Kathiravan Thirumoorthy Date: Fri May 2 18:47:51 2025 +0530 watchdog: qcom: introduce the device data for IPQ5424 watchdog device To retrieve the restart reason from IMEM, certain device specific data like IMEM compatible to lookup, location of IMEM to read, etc should be defined. To achieve that, introduce the separate device data for IPQ5424 and add the required details subsequently. Signed-off-by: Kathiravan Thirumoorthy Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20250502-wdt_reset_reason-v3-3-b2dc7ace38ca@oss.qualcomm.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit f55937e42c9951b615e291d9b7e6337747804463 Author: Lad Prabhakar Date: Fri May 2 13:00:54 2025 +0100 dt-bindings: watchdog: renesas,wdt: Document RZ/V2N (R9A09G056) support Document support for the watchdog IP found on the Renesas RZ/V2N (R9A09G056) SoC. The watchdog IP is identical to that on RZ/V2H(P), so `renesas,r9a09g057-wdt` will be used as a fallback compatible, enabling reuse of the existing driver without changes. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Acked-by: Conor Dooley Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20250502120054.47323-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit a4e2401438a26131ecff9be6a3a1d4cbfea66f9a Author: Henry Martin Date: Thu Apr 24 15:16:48 2025 +0800 watchdog: lenovo_se30_wdt: Fix possible devm_ioremap() NULL pointer dereference in lenovo_se30_wdt_probe() devm_ioremap() returns NULL on error. Currently, lenovo_se30_wdt_probe() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_ioremap() to prevent this issue. Fixes: c284153a2c55 ("watchdog: lenovo_se30_wdt: Watchdog driver for Lenovo SE30 platform") Signed-off-by: Henry Martin Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20250424071648.89016-1-bsdhenrymartin@gmail.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 53663d2cabac37f990a7df686322ad33eb6ce51d Author: Igor Belwon Date: Sun Apr 20 21:00:39 2025 +0200 watchdog: s3c2410_wdt: Add exynos990-wdt compatible data The Exynos990 has two watchdog clusters - cl0 and cl2. Add new driver data for these two clusters, making it possible to use the watchdog timer on this SoC. Signed-off-by: Igor Belwon Reviewed-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20250420-wdt-resends-april-v1-2-f58639673959@mentallysanemainliners.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit a2170f8493d6776b76277b9b1ab59a5642774ecf Author: Igor Belwon Date: Sun Apr 20 21:00:38 2025 +0200 dt-bindings: watchdog: samsung-wdt: Add exynos990-wdt compatible Add a dt-binding compatible for the Exynos990 Watchdog timer. This watchdog is compatible with the GS101/Exynos850 design, as such it requires the cluster-index and syscon-phandle properties to be present. It also contains a cl2 cluster, as such the cluster-index property has been expanded. Signed-off-by: Igor Belwon Reviewed-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20250420-wdt-resends-april-v1-1-f58639673959@mentallysanemainliners.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 0b43b8bc8ef88bb45b018b2d4853d38bfc5ce2a7 Author: Shivank Garg Date: Mon May 26 18:28:20 2025 +0000 mm/khugepaged: clean up refcount check using folio_expected_ref_count() Use folio_expected_ref_count() instead of open-coded logic in is_refcount_suitable(). This avoids code duplication and improves clarity. Drop is_refcount_suitable() as it is no longer needed. Link: https://lkml.kernel.org/r/20250526182818.37978-2-shivankg@amd.com Signed-off-by: Shivank Garg Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Acked-by: Dev Jain Reviewed-by: Baolin Wang Cc: Bharata B Rao Cc: Fengwei Yin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: Ryan Roberts Cc: Zi Yan Signed-off-by: Andrew Morton commit 66bce7afbaca6ca9022210b0cd9fa3405da36667 Author: Mark Brown Date: Tue May 27 17:04:48 2025 +0100 selftests/mm: fix test result reporting in gup_longterm The kselftest framework uses the string logged when a test result is reported as the unique identifier for a test, using it to track test results between runs. The gup_longterm test fails to follow this pattern, it runs a single test function repeatedly with various parameters but each result report is a string logging an error message which is fixed between runs. Since the code already logs each test uniquely before it starts refactor to also print this to a buffer, then use that name as the test result. This isn't especially pretty but is relatively straightforward and is a great help to tooling. Link: https://lkml.kernel.org/r/20250527-selftests-mm-cow-dedupe-v2-4-ff198df8e38e@kernel.org Signed-off-by: Mark Brown Cc: David Hildenbrand Cc: Lorenzo Stoakes Cc: Shuah Khan Signed-off-by: Andrew Morton commit 3f2d9a9ac544694e26c8faeb1a044c2bdcd0c793 Author: Mark Brown Date: Tue May 27 17:04:47 2025 +0100 selftests/mm: report unique test names for each cow test The kselftest framework uses the string logged when a test result is reported as the unique identifier for a test, using it to track test results between runs. The cow test completely fails to follow this pattern, it runs test functions repeatedly with various parameters with each result report from those functions being a string logging an error message which is fixed between runs. Since the code already logs each test uniquely before it starts refactor to also print this to a buffer, then use that name as the test result. This isn't especially pretty but is relatively straightforward and is a great help to tooling. Link: https://lkml.kernel.org/r/20250527-selftests-mm-cow-dedupe-v2-3-ff198df8e38e@kernel.org Signed-off-by: Mark Brown Cc: David Hildenbrand Cc: Lorenzo Stoakes Cc: Shuah Khan Signed-off-by: Andrew Morton commit 3f192afbede24c60e59db1272ad155a3a44f5fe7 Author: Mark Brown Date: Tue May 27 17:04:46 2025 +0100 selftests/mm: add helper for logging test start and results Several of the MM tests have a pattern of printing a description of the test to be run then reporting the actual TAP result using a generic string not connected to the specific test, often in a shared function used by many tests. The name reported typically varies depending on the specific result rather than the test too. This causes problems for tooling that works with test results, the names reported with the results are used to deduplicate tests and track them between runs so both duplicated names and changing names cause trouble for things like UIs and automated bisection. As a first step towards matching these tests better with the expectations of kselftest provide helpers which record the test name as part of the initial print and then use that as part of reporting a result. This is not added as a generic kselftest helper partly because the use of a variable to store the test name doesn't fit well with the header only implementation of kselftest.h and partly because it's not really an intended pattern. Ideally at some point the mm tests that use it will be updated to not need it. Link: https://lkml.kernel.org/r/20250527-selftests-mm-cow-dedupe-v2-2-ff198df8e38e@kernel.org Signed-off-by: Mark Brown Cc: David Hildenbrand Cc: Lorenzo Stoakes Cc: Shuah Khan Signed-off-by: Andrew Morton commit 109364fce504dae70b13eccc51a7bfc71528d154 Author: Mark Brown Date: Tue May 27 17:04:45 2025 +0100 selftests/mm: use standard ksft_finished() in cow and gup_longterm Patch series "selftests/mm: cow and gup_longterm cleanups", v2. The bulk of these changes modify the cow and gup_longterm tests to report unique and stable names for each test, bringing them into line with the expectations of tooling that works with kselftest. The string reported as a test result is used by tooling to both deduplicate tests and track tests between test runs, using the same string for multiple tests or changing the string depending on test result causes problems for user interfaces and automation such as bisection. It was suggested that converting to use kselftest_harness.h would be a good way of addressing this, however that really wants the set of tests to run to be known at compile time but both test programs dynamically enumarate the set of huge page sizes the system supports and test each. Refactoring to handle this would be even more invasive than these changes which are large but straightforward and repetitive. A version of the main gup_longterm cleanup was previously sent separately, this version factors out the helpers for logging the start of the test since the cow test looks very similar. This patch (of 4): The cow and gup_longterm test programs open code something that looks a lot like the standard ksft_finished() helper to summarise the test results and provide an exit code, convert to use ksft_finished(). Link: https://lkml.kernel.org/r/20250527-selftests-mm-cow-dedupe-v2-0-ff198df8e38e@kernel.org Link: https://lkml.kernel.org/r/20250527-selftests-mm-cow-dedupe-v2-1-ff198df8e38e@kernel.org Signed-off-by: Mark Brown Acked-by: David Hildenbrand Cc: Lorenzo Stoakes Cc: Shuah Khan Signed-off-by: Andrew Morton commit 79509ec1d253c536d223cbc06a5b51c13841fec2 Author: Enze Li Date: Sat May 31 17:39:37 2025 +0800 selftests/damon/_damon_sysfs: skip testcases if CONFIG_DAMON_SYSFS is disabled When CONFIG_DAMON_SYSFS is disabled, the selftests fail with the following outputs, not ok 2 selftests: damon: sysfs_update_schemes_tried_regions_wss_estimation.py # exit=1 not ok 3 selftests: damon: damos_quota.py # exit=1 not ok 4 selftests: damon: damos_quota_goal.py # exit=1 not ok 5 selftests: damon: damos_apply_interval.py # exit=1 not ok 6 selftests: damon: damos_tried_regions.py # exit=1 not ok 7 selftests: damon: damon_nr_regions.py # exit=1 not ok 11 selftests: damon: sysfs_update_schemes_tried_regions_hang.py # exit=1 The root cause of this issue is that all the testcases above do not check the sysfs interface of DAMON whether it exists or not. With this patch applied, all the testcases above now pass successfully. Link: https://lkml.kernel.org/r/20250531093937.1555159-1-lienze@kylinos.cn Signed-off-by: Enze Li Reviewed-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit ad6b26b6a0a79166b53209df2ca1cf8636296382 Author: Chen Yu Date: Fri May 23 20:51:15 2025 +0800 sched/numa: add statistics of numa balance task On systems with NUMA balancing enabled, it has been found that tracking task activities resulting from NUMA balancing is beneficial. NUMA balancing employs two mechanisms for task migration: one is to migrate a task to an idle CPU within its preferred node, and the other is to swap tasks located on different nodes when they are on each other's preferred nodes. The kernel already provides NUMA page migration statistics in /sys/fs/cgroup/mytest/memory.stat and /proc/{PID}/sched. However, it lacks statistics regarding task migration and swapping. Therefore, relevant counts for task migration and swapping should be added. The following two new fields: numa_task_migrated numa_task_swapped will be shown in /sys/fs/cgroup/{GROUP}/memory.stat, /proc/{PID}/sched and /proc/vmstat. Introducing both per-task and per-memory cgroup (memcg) NUMA balancing statistics facilitates a rapid evaluation of the performance and resource utilization of the target workload. For instance, users can first identify the container with high NUMA balancing activity and then further pinpoint a specific task within that group, and subsequently adjust the memory policy for that task. In short, although it is possible to iterate through /proc/$pid/sched to locate the problematic task, the introduction of aggregated NUMA balancing activity for tasks within each memcg can assist users in identifying the task more efficiently through a divide-and-conquer approach. As Libo Chen pointed out, the memcg event relies on the text names in vmstat_text, and /proc/vmstat generates corresponding items based on vmstat_text. Thus, the relevant task migration and swapping events introduced in vmstat_text also need to be populated by count_vm_numa_event(), otherwise these values are zero in /proc/vmstat. In theory, task migration and swap events are part of the scheduler's activities. The reason for exposing them through the memory.stat/vmstat interface is that we already have NUMA balancing statistics in memory.stat/vmstat, and these events are closely related to each other. Following Shakeel's suggestion, we describe the end-to-end flow/story of all these events occurring on a timeline for future reference: The goal of NUMA balancing is to co-locate a task and its memory pages on the same NUMA node. There are two strategies: migrate the pages to the task's node, or migrate the task to the node where its pages reside. Suppose a task p1 is running on Node 0, but its pages are located on Node 1. NUMA page fault statistics for p1 reveal its "page footprint" across nodes. If NUMA balancing detects that most of p1's pages are on Node 1: 1.Page Migration Attempt: The Numa balance first tries to migrate p1's pages to Node 0. The numa_page_migrate counter increments. 2.Task Migration Strategies: After the page migration finishes, Numa balance checks every 1 second to see if p1 can be migrated to Node 1. Case 2.1: Idle CPU Available If Node 1 has an idle CPU, p1 is directly scheduled there. This event is logged as numa_task_migrated. Case 2.2: No Idle CPU (Task Swap) If all CPUs on Node1 are busy, direct migration could cause CPU contention or load imbalance. Instead: The Numa balance selects a candidate task p2 on Node 1 that prefers Node 0 (e.g., due to its own page footprint). p1 and p2 are swapped. This cross-node swap is recorded as numa_task_swapped. Link: https://lkml.kernel.org/r/d00edb12ba0f0de3c5222f61487e65f2ac58f5b1.1748493462.git.yu.c.chen@intel.com Link: https://lkml.kernel.org/r/7ef90a88602ed536be46eba7152ed0d33bad5790.1748002400.git.yu.c.chen@intel.com Signed-off-by: Chen Yu Tested-by: K Prateek Nayak Tested-by: Madadi Vineeth Reddy Acked-by: Peter Zijlstra (Intel) Tested-by: Venkat Rao Bagalkote Cc: Aubrey Li Cc: Ayush Jain Cc: "Chen, Tim C" Cc: Ingo Molnar Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Libo Chen Cc: Mel Gorman Cc: Michal Hocko Cc: Michal Koutný Cc: Muchun Song Cc: Roman Gushchin Cc: Shakeel Butt Cc: Tejun Heo Signed-off-by: Andrew Morton commit 9709eb0f845b713ba163f2c461537d8add3e4e04 Author: Libo Chen Date: Fri May 23 20:51:01 2025 +0800 sched/numa: fix task swap by skipping kernel threads Patch series "sched/numa: add statistics of numa balance task migration", v6. Introduce task migration and swap statistics in the following places: /sys/fs/cgroup/{GROUP}/memory.stat /proc/{PID}/sched /proc/vmstat These statistics facilitate a rapid evaluation of the performance and resource utilization of the target workload. This patch (of 2): Task swapping is triggered when there are no idle CPUs in task A's preferred node. In this case, the NUMA load balancer chooses a task B on A's preferred node and swaps B with A. This helps improve NUMA locality without introducing load imbalance between nodes. In the current implementation, B's NUMA node preference is not mandatory. That is to say, a kernel thread might be incorrectly chosen as B. However, kernel thread and user space thread that does not have mm are not supposed to be covered by NUMA balancing because NUMA balancing only considers user pages via VMAs. According to Peter's suggestion for fixing this issue, we use PF_KTHREAD to skip the kernel thread. curr->mm is also checked because it is possible that user_mode_thread() might create a user thread without an mm. As per Prateek's analysis, after adding the PF_KTHREAD check, there is no need to further check the PF_IDLE flag: : - play_idle_precise() already ensures PF_KTHREAD is set before adding : PF_IDLE : : - cpu_startup_entry() is only called from the startup thread which : should be marked with PF_KTHREAD (based on my understanding looking at : commit cff9b2332ab7 ("kernel/sched: Modify initial boot task idle : setup")) In summary, the check in task_numa_compare() now aligns with task_tick_numa(). Link: https://lkml.kernel.org/r/cover.1748493462.git.yu.c.chen@intel.com Link: https://lkml.kernel.org/r/43d68b356b25d124f0d222ebedf3859e86eefb9f.1748493462.git.yu.c.chen@intel.com Link: https://lkml.kernel.org/r/cover.1748002400.git.yu.c.chen@intel.com Link: https://lkml.kernel.org/r/eaacc9c9bd37bac92d43a671867d85b2fdad3b06.1748002400.git.yu.c.chen@intel.com Signed-off-by: Chen Yu Signed-off-by: Libo Chen Suggested-by: Michal Koutný Tested-by: Ayush Jain Tested-by: Venkat Rao Bagalkote Reviewed-by: Shakeel Butt Cc: Aubrey Li Cc: "Chen, Tim C" Cc: Ingo Molnar Cc: Johannes Weiner Cc: Jonathan Corbet Cc: K Prateek Nayak Cc: Madadi Vineeth Reddy Cc: Mel Gorman Cc: Michal Hocko Cc: Muchun Song Cc: Peter Zijlstra Cc: Roman Gushchin Cc: Tejun Heo Signed-off-by: Andrew Morton commit 83da212b7fca407f6f30c7d6f02a8f910db8724d Author: Dan Carpenter Date: Wed May 28 11:13:45 2025 +0300 tools/testing: check correct variable in open_procmap() Check if "procmap_out->fd" is negative instead of "procmap_out" (which is a pointer). Link: https://lkml.kernel.org/r/aDbFuUTlJTBqziVd@stanley.mountain Fixes: bd23f293a0d5 ("tools/testing: add PROCMAP_QUERY helper functions in mm self tests") Signed-off-by: Dan Carpenter Reviewed-by: Lorenzo Stoakes Cc: levi.yun Cc: Shuah Khan Cc: Wei Yang Signed-off-by: Andrew Morton commit 918850c13608c7b138512c2ecbfd3436b7a51797 Author: Lorenzo Stoakes Date: Wed May 28 15:15:39 2025 +0100 tools/testing/vma: add missing function stub The hugetlb fix introduced in commit ee40c9920ac2 ("mm: fix copy_vma() error handling for hugetlb mappings") mistakenly did not provide a stub for the VMA userland testing, which results in a compile error when trying to build this. Provide this stub to resolve the issue. Link: https://lkml.kernel.org/r/20250528-fix-vma-test-v1-1-c8a5f533b38f@oracle.com Fixes: ee40c9920ac2 ("mm: fix copy_vma() error handling for hugetlb mappings") Signed-off-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Reviewed-by: Pedro Falcato Cc: Jann Horn Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 52084f258e46f09a71063447df31cbd48c0cacd0 Author: Jann Horn Date: Wed May 28 23:06:17 2025 +0200 mm/gup: update comment explaining why gup_fast() disables IRQs The current comment in gup_fast() talks about "IPIs that come from THPs splitting", which is outdated and refers to the old THP splitting implementation that was removed in commit ad0bed24e98b ("thp: drop all split_huge_page()-related code"), which landed in v4.5. Before then, THP splitting involved a pmdp_splitting_flush(), which sent an IPI to serialize against gup_fast(). Nowadays, we use tlb_remove_table_sync_one() to send IPIs that serialize against gup_fast(); this is used, for example, in THP *collapsing* to stop gup_fast() walks of a page table before depositing it. Link: https://lkml.kernel.org/r/20250528-gup-irq-comment-fix-v1-1-b9d83c345333@google.com Signed-off-by: Jann Horn Cc: David Hildenbrand Cc: Jason Gunthorpe Cc: John Hubbard Cc: Kirill A. Shuemov Cc: Peter Xu Signed-off-by: Andrew Morton commit bb084994d38fd36518ac50a33c8ddcea2239067e Author: David Hildenbrand Date: Wed May 28 21:52:44 2025 +0200 selftests/mm: two fixes for the pfnmap test When unregistering the signal handler, we have to pass SIG_DFL, and blindly reading from PFN 0 and PFN 1 seems to be problematic on !x86 systems. In particularly, on arm64 tx2 machines where noting resides at these physical memory locations, we can generate RAS errors. Let's fix it by scanning /proc/iomem for actual "System RAM". Link: https://lkml.kernel.org/r/20250528195244.1182810-1-david@redhat.com Fixes: 2616b370323a ("selftests/mm: add simple VM_PFNMAP tests based on mmap'ing /dev/mem") Signed-off-by: David Hildenbrand Reported-by: Ryan Roberts Closes: https://lore.kernel.org/all/232960c2-81db-47ca-a337-38c4bce5f997@arm.com/T/#u Reviewed-by: Ryan Roberts Tested-by: Aishwarya TCV Cc: Shuah Khan Cc: Lorenzo Stoakes Signed-off-by: Andrew Morton commit 595cf683519ab5a277d258a2251ee8cc7b838d6d Author: Shivank Garg Date: Mon May 26 18:28:18 2025 +0000 mm/khugepaged: fix race with folio split/free using temporary reference hpage_collapse_scan_file() calls is_refcount_suitable(), which in turn calls folio_mapcount(). folio_mapcount() checks folio_test_large() before proceeding to folio_large_mapcount(), but there is a race window where the folio may get split/freed between these checks, triggering: VM_WARN_ON_FOLIO(!folio_test_large(folio), folio) Take a temporary reference to the folio in hpage_collapse_scan_file(). This stabilizes the folio during refcount check and prevents incorrect large folio detection due to concurrent split/free. Use helper folio_expected_ref_count() + 1 to compare with folio_ref_count() instead of using is_refcount_suitable(). Link: https://lkml.kernel.org/r/20250526182818.37978-1-shivankg@amd.com Fixes: 05c5323b2a34 ("mm: track mapcount of large folios in single value") Signed-off-by: Shivank Garg Reported-by: syzbot+2b99589e33edbe9475ca@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/6828470d.a70a0220.38f255.000c.GAE@google.com Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Acked-by: Dev Jain Reviewed-by: Baolin Wang Cc: Bharata B Rao Cc: Fengwei Yin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: Ryan Roberts Cc: Zi Yan Cc: Signed-off-by: Andrew Morton commit e13e7922d03439e374c263049af5f740ceae6346 Author: Juan Yescas Date: Wed May 21 14:57:45 2025 -0700 mm: add CONFIG_PAGE_BLOCK_ORDER to select page block order Problem: On large page size configurations (16KiB, 64KiB), the CMA alignment requirement (CMA_MIN_ALIGNMENT_BYTES) increases considerably, and this causes the CMA reservations to be larger than necessary. This means that system will have less available MIGRATE_UNMOVABLE and MIGRATE_RECLAIMABLE page blocks since MIGRATE_CMA can't fallback to them. The CMA_MIN_ALIGNMENT_BYTES increases because it depends on MAX_PAGE_ORDER which depends on ARCH_FORCE_MAX_ORDER. The value of ARCH_FORCE_MAX_ORDER increases on 16k and 64k kernels. For example, in ARM, the CMA alignment requirement when: - CONFIG_ARCH_FORCE_MAX_ORDER default value is used - CONFIG_TRANSPARENT_HUGEPAGE is set: PAGE_SIZE | MAX_PAGE_ORDER | pageblock_order | CMA_MIN_ALIGNMENT_BYTES ----------------------------------------------------------------------- 4KiB | 10 | 9 | 4KiB * (2 ^ 9) = 2MiB 16Kib | 11 | 11 | 16KiB * (2 ^ 11) = 32MiB 64KiB | 13 | 13 | 64KiB * (2 ^ 13) = 512MiB There are some extreme cases for the CMA alignment requirement when: - CONFIG_ARCH_FORCE_MAX_ORDER maximum value is set - CONFIG_TRANSPARENT_HUGEPAGE is NOT set: - CONFIG_HUGETLB_PAGE is NOT set PAGE_SIZE | MAX_PAGE_ORDER | pageblock_order | CMA_MIN_ALIGNMENT_BYTES ------------------------------------------------------------------------ 4KiB | 15 | 15 | 4KiB * (2 ^ 15) = 128MiB 16Kib | 13 | 13 | 16KiB * (2 ^ 13) = 128MiB 64KiB | 13 | 13 | 64KiB * (2 ^ 13) = 512MiB This affects the CMA reservations for the drivers. If a driver in a 4KiB kernel needs 4MiB of CMA memory, in a 16KiB kernel, the minimal reservation has to be 32MiB due to the alignment requirements: reserved-memory { ... cma_test_reserve: cma_test_reserve { compatible = "shared-dma-pool"; size = <0x0 0x400000>; /* 4 MiB */ ... }; }; reserved-memory { ... cma_test_reserve: cma_test_reserve { compatible = "shared-dma-pool"; size = <0x0 0x2000000>; /* 32 MiB */ ... }; }; Solution: Add a new config CONFIG_PAGE_BLOCK_ORDER that allows to set the page block order in all the architectures. The maximum page block order will be given by ARCH_FORCE_MAX_ORDER. By default, CONFIG_PAGE_BLOCK_ORDER will have the same value that ARCH_FORCE_MAX_ORDER. This will make sure that current kernel configurations won't be affected by this change. It is a opt-in change. This patch will allow to have the same CMA alignment requirements for large page sizes (16KiB, 64KiB) as that in 4kb kernels by setting a lower pageblock_order. Tests: - Verified that HugeTLB pages work when pageblock_order is 1, 7, 10 on 4k and 16k kernels. - Verified that Transparent Huge Pages work when pageblock_order is 1, 7, 10 on 4k and 16k kernels. - Verified that dma-buf heaps allocations work when pageblock_order is 1, 7, 10 on 4k and 16k kernels. Benchmarks: The benchmarks compare 16kb kernels with pageblock_order 10 and 7. The reason for the pageblock_order 7 is because this value makes the min CMA alignment requirement the same as that in 4kb kernels (2MB). - Perform 100K dma-buf heaps (/dev/dma_heap/system) allocations of SZ_8M, SZ_4M, SZ_2M, SZ_1M, SZ_64, SZ_8, SZ_4. Use simpleperf (https://developer.android.com/ndk/guides/simpleperf) to measure the # of instructions and page-faults on 16k kernels. The benchmark was executed 10 times. The averages are below: # instructions | #page-faults order 10 | order 7 | order 10 | order 7 -------------------------------------------------------- 13,891,765,770 | 11,425,777,314 | 220 | 217 14,456,293,487 | 12,660,819,302 | 224 | 219 13,924,261,018 | 13,243,970,736 | 217 | 221 13,910,886,504 | 13,845,519,630 | 217 | 221 14,388,071,190 | 13,498,583,098 | 223 | 224 13,656,442,167 | 12,915,831,681 | 216 | 218 13,300,268,343 | 12,930,484,776 | 222 | 218 13,625,470,223 | 14,234,092,777 | 219 | 218 13,508,964,965 | 13,432,689,094 | 225 | 219 13,368,950,667 | 13,683,587,37 | 219 | 225 ------------------------------------------------------------------- 13,803,137,433 | 13,131,974,268 | 220 | 220 Averages There were 4.85% #instructions when order was 7, in comparison with order 10. 13,803,137,433 - 13,131,974,268 = -671,163,166 (-4.86%) The number of page faults in order 7 and 10 were the same. These results didn't show any significant regression when the pageblock_order is set to 7 on 16kb kernels. - Run speedometer 3.1 (https://browserbench.org/Speedometer3.1/) 5 times on the 16k kernels with pageblock_order 7 and 10. order 10 | order 7 | order 7 - order 10 | (order 7 - order 10) % ------------------------------------------------------------------- 15.8 | 16.4 | 0.6 | 3.80% 16.4 | 16.2 | -0.2 | -1.22% 16.6 | 16.3 | -0.3 | -1.81% 16.8 | 16.3 | -0.5 | -2.98% 16.6 | 16.8 | 0.2 | 1.20% ------------------------------------------------------------------- 16.44 16.4 -0.04 -0.24% Averages The results didn't show any significant regression when the pageblock_order is set to 7 on 16kb kernels. Link: https://lkml.kernel.org/r/20250521215807.1860663-1-jyescas@google.com Signed-off-by: Juan Yescas Acked-by: Zi Yan Reviewed-by: Vlastimil Babka Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: David Hildenbrand Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Minchan Kim Signed-off-by: Andrew Morton commit 49c69504f4d340d870f2c3f3d2f404c118ff7b23 Author: Jann Horn Date: Fri May 23 00:30:17 2025 +0200 mmu_notifiers: remove leftover stub macros Commit ec8832d007cb ("mmu_notifiers: don't invalidate secondary TLBs as part of mmu_notifier_invalidate_range_end()") removed the main definitions of {ptep,pmdp_huge,pudp_huge}_clear_flush_notify; just their !CONFIG_MMU_NOTIFIER stubs are left behind, remove them. Link: https://lkml.kernel.org/r/20250523-mmu-notifier-cleanup-unused-v1-1-cc1f47ebec33@google.com Signed-off-by: Jann Horn Reviewed-by: Alistair Popple Reviewed-by: Qi Zheng Reviewed-by: Jason Gunthorpe Signed-off-by: Andrew Morton commit cfc695109a6cd9b7228ad19ef7e74a851856ce3d Author: Mark Brown Date: Thu May 22 17:29:00 2025 +0100 selftests/mm: deduplicate test names in madv_populate The madv_populate selftest has some repetitive code for several different cases that it covers, included repeated test names used in ksft_test_result() reports. This causes problems for automation, the test name is used to both track the test between runs and distinguish between multiple tests within the same run. Fix this by tweaking the messages with duplication to be more specific about the contexts they're in. Link: https://lkml.kernel.org/r/20250522-selftests-mm-madv-populate-dedupe-v1-1-fd1dedd79b4b@kernel.org Signed-off-by: Mark Brown Reviewed-by: Liam R. Howlett Acked-by: David Hildenbrand Cc: Shuah Khan Signed-off-by: Andrew Morton commit 3bf67171e98272c918a41b899070e6e86741adc8 Author: Alice Ryhl Date: Thu May 1 12:16:16 2025 +0000 kcov: rust: add flags for KCOV with Rust Rust code is currently not instrumented properly when KCOV is enabled. Thus, add the relevant flags to perform instrumentation correctly. This is necessary for efficient fuzzing of Rust code. The sanitizer-coverage features of LLVM have existed for long enough that they are available on any LLVM version supported by rustc, so we do not need any Kconfig feature detection. The coverage level is set to 3, as that is the level needed by trace-pc. We do not instrument `core` since when we fuzz the kernel, we are looking for bugs in the kernel, not the Rust stdlib. Link: https://lkml.kernel.org/r/20250501-rust-kcov-v2-1-b71e83e9779f@google.com Signed-off-by: Alice Ryhl Co-developed-by: Matthew Maurer Signed-off-by: Matthew Maurer Reviewed-by: Alexander Potapenko Tested-by: Aleksandr Nogikh Acked-by: Miguel Ojeda Cc: Andreas Hindborg Cc: Andrey Konovalov Cc: Benno Lossin Cc: Bill Wendling Cc: Björn Roy Baron Cc: Boqun Feng Cc: Danilo Krummrich Cc: Dmitriy Vyukov Cc: Gary Guo Cc: Justin Stitt Cc: Masahiro Yamada Cc: Nathan Chancellor Cc: Trevor Gross Signed-off-by: Andrew Morton commit 5a78977262f47dd52a4880689a2ca3d21dbf149a Author: Alice Ryhl Date: Fri May 16 19:32:19 2025 +0000 mm: rust: make CONFIG_MMU ifdefs more narrow Currently the entire kernel::mm module is ifdef'd out when CONFIG_MMU=n. However, there are some downstream users of the module in rust/kernel/task.rs and rust/kernel/miscdevice.rs. Thus, update the cfgs so that only MmWithUserAsync is removed with CONFIG_MMU=n. The code is moved into a new file, since the #[cfg()] annotation otherwise has to be duplicated several times. Link: https://lkml.kernel.org/r/20250516193219.2987032-1-aliceryhl@google.com Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202505071753.kldNHYVQ-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202505072116.eSYC8igT-lkp@intel.com/ Fixes: 5bb9ed6cdfeb ("mm: rust: add abstraction for struct mm_struct") Signed-off-by: Alice Ryhl Reviewed-by: Boqun Feng Cc: Boqun Feng Cc: Liam Howlett Cc: Lorenzo Stoakes Signed-off-by: Andrew Morton commit bfe125f1b1870c7b5f05b489a525042d6715fcc1 Author: Roman Gushchin Date: Thu May 22 01:28:38 2025 +0000 mmu_gather: move tlb flush for VM_PFNMAP/VM_MIXEDMAP vmas into free_pgtables() Commit b67fbebd4cf9 ("mmu_gather: Force tlb-flush VM_PFNMAP vmas") added a forced tlbflush to tlb_vma_end(), which is required to avoid a race between munmap() and unmap_mapping_range(). However it added some overhead to other paths where tlb_vma_end() is used, but vmas are not removed, e.g. madvise(MADV_DONTNEED). Fix this by moving the tlb flush out of tlb_end_vma() into new tlb_flush_vmas() called from free_pgtables(), somewhat similar to the stable version of the original commit: commit 895428ee124a ("mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()"). Note, that if tlb->fullmm is set, no flush is required, as the whole mm is about to be destroyed. Link: https://lkml.kernel.org/r/20250522012838.163876-1-roman.gushchin@linux.dev Signed-off-by: Roman Gushchin Reviewed-by: Jann Horn Acked-by: Hugh Dickins Acked-by: Peter Zijlstra (Intel) Cc: Will Deacon Cc: "Aneesh Kumar K.V" Cc: Nick Piggin Signed-off-by: Andrew Morton commit 28615e6eed152f2fda5486680090b74aeed7b554 Author: SeongJae Park Date: Tue May 20 21:27:55 2025 -0700 mm/damon/Kconfig: enable CONFIG_DAMON by default As of this writing, multiple major distros including Alma, Amazon, Android, CentOS, Debian, Fedora, and Oracle are build-enabling DAMON (set CONFIG_DAMON[1]). Enabling it by default will save configuration setup time for the current and future DAMON users. Build-enabling DAMON does not introduce a real risk since it makes no behavioral change by default. It requires explicit user requests to do anything. Only one potential risk is making the size of the kernel a little bit larger. On a production-purpose configuration, it increases the resulting kernel package size by about 0.1 % of the final package file. I believe that's too small to be a real problem in common setups. Hence, the benefit of enabling CONFIG_DAMON outweighs the potential risk. Set CONFIG_DAMON by default. Link: https://oracle.github.io/kconfigs/?config=UTS_RELEASE&config=DAMON [1] Link: https://lkml.kernel.org/r/20250521042755.39653-3-sj@kernel.org Signed-off-by: SeongJae Park Acked-by: Honggyu Kim Signed-off-by: Andrew Morton commit 0acfc656df50403cbd9dcb2d7b2a04fce161e6e4 Author: SeongJae Park Date: Tue May 20 21:27:54 2025 -0700 mm/damon/Kconfig: set DAMON_{VADDR,PADDR,SYSFS} default to DAMON Patch series "mm/damon: build-enable essential DAMON components by default". As of this writing, multiple major distros including Alma, Amazon, Android, CentOS, Debian, Fedora, and Oracle are build-enabling DAMON (set CONFIG_DAMON[1]). Configuring DAMON is not very easy, since it is disabled by default, and there are multiple essential options that need to be manually turned on, one by one. Make it easier, by grouping essential configurations to be enabled with one selection, and enabling build of the essential parts of DAMON by default. Note that build-enabling DAMON does not introduce any real risk, since it makes no behavioral change by default. It requires explicit user requests to do anything. Only one potential risk is making the size of the kernel a little bit larger. On a production-purpose configuration, it increases the resulting kernel package binary size by about 0.1 % of the final package file. I believe that's too small to be a real problem in common setups. DAMON_{VADDR,PADDR,SYSFS} are de-facto essential parts of DAMON for normal usages. Because those need to be enabled one by one, however, and there are other test-purpose or non-essential configurations, it is easy to be confused and make mistakes at setup. Make the essential configurations default to CONFIG_DAMON, so that those can be enabled by default with a single change. Link: https://oracle.github.io/kconfigs/?config=UTS_RELEASE&config=DAMON [1] Link: https://lkml.kernel.org/r/20250521042755.39653-1-sj@kernel.org Link: https://lkml.kernel.org/r/20250521042755.39653-2-sj@kernel.org Signed-off-by: SeongJae Park Acked-by: Honggyu Kim Signed-off-by: Andrew Morton commit 3aefb1f06994ebbd94b7b2e5bf9cc3fecbd3eb39 Author: Wenjie Xu Date: Thu May 15 19:42:31 2025 +0800 hugetlb: show nr_huge_pages in report_hugepages() The number of pre-allocated huge pages should be nr_huge_pages, not free_huge_pages, although they are same during booting stage Link: https://lkml.kernel.org/r/20250515114231.65824-1-xuwenjie04@baidu.com Signed-off-by: Wenjie Xu Signed-off-by: Li RongQing Acked-by: Oscar Salvador Cc: Muchun Song Signed-off-by: Andrew Morton commit 115155901db2593d7adbd3e84d0889f591fbb6fc Author: Zi Yan Date: Fri May 16 09:29:38 2025 -0400 selftests/mm: skip hugevm test if kernel config file is not present When running hugevm tests in a machine without kernel config present, e.g., a VM running a kernel without CONFIG_IKCONFIG_PROC nor /boot/config-*, skip hugevm tests, which reads kernel config to get page table level information. Link: https://lkml.kernel.org/r/20250516132938.356627-3-ziy@nvidia.com Signed-off-by: Zi Yan Acked-by: Lorenzo Stoakes Cc: Adam Sindelar Cc: Lorenzo Stoakes Cc: Pedro Falcato Signed-off-by: Andrew Morton commit 6d211303121fdef3b960125ceeafd1073df05ae6 Author: Zi Yan Date: Fri May 16 09:29:37 2025 -0400 selftests/mm: skip guard_regions.uffd tests when uffd is not present Patch series "Skip mm selftests instead when kernel features are not present", v2. Two guard_regions tests on userfaultfd fail when userfaultfd is not present. Skip them instead. hugevm test reads kernel config to get page table level information and fails when neither /proc/config.gz nor /boot/config-* is present. Skip it instead. This patch (of 2): When userfaultfd is not compiled into kernel, userfaultfd() returns -1, causing guard_regions.uffd tests to fail. Skip the tests instead. Link: https://lkml.kernel.org/r/20250516132938.356627-1-ziy@nvidia.com Link: https://lkml.kernel.org/r/20250516132938.356627-2-ziy@nvidia.com Signed-off-by: Zi Yan Reviewed-by: Lorenzo Stoakes Reviewed-by: Pedro Falcato Cc: Adam Sindelar Signed-off-by: Andrew Morton commit c5a9deace6095c0dca86f5414493bcf1711f1ca3 Author: Kemeng Shi Date: Sat May 17 01:09:39 2025 +0800 mm/shmem: remove unneeded xa_is_value() check in shmem_unuse_swap_entries() As only value entry will be added to fbatch in shmem_find_swap_entries(), there is no need to do xa_is_value() check in shmem_unuse_swap_entries(). Link: https://lkml.kernel.org/r/20250516170939.965736-6-shikemeng@huaweicloud.com Signed-off-by: Kemeng Shi Reviewed-by: Baolin Wang Cc: Hugh Dickins Cc: Kairui Song Cc: kernel test robot Signed-off-by: Andrew Morton commit a5cdbe9f376f920af102fd0f0ecfd9952bb6bc40 Author: Kemeng Shi Date: Sat May 17 01:09:38 2025 +0800 mm: shmem: only remove inode from swaplist when it's swapped page count is 0 Even if we fail to allocate a swap entry, the inode might have previously allocated entry and we might take inode containing swap entry off swaplist. As a result, try_to_unuse() may enter a potential dead loop to repeatedly look for inode and clean it's swap entry. Only take inode off swaplist when it's swapped page count is 0 to fix the issue. Link: https://lkml.kernel.org/r/20250516170939.965736-5-shikemeng@huaweicloud.com Fixes: b487a2da3575 ("mm, swap: simplify folio swap allocation") Signed-off-by: Kemeng Shi Reviewed-by: Baolin Wang Reviewed-by: Kairui Song Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202505161438.9009cf47-lkp@intel.com Cc: Hugh Dickins Signed-off-by: Andrew Morton commit 3f778ab1b52450d467109321e2abfc4b36ec2d3e Author: Kemeng Shi Date: Sat May 17 01:09:37 2025 +0800 mm/shmem: fix potential dead loop in shmem_unuse() If multi shmem_unuse() for different swap type is called concurrently, a dead loop could occur as following: shmem_unuse(typeA) shmem_unuse(typeB) mutex_lock(&shmem_swaplist_mutex) list_for_each_entry_safe(info, next, ...) ... mutex_unlock(&shmem_swaplist_mutex) /* info->swapped may drop to 0 */ shmem_unuse_inode(&info->vfs_inode, type) mutex_lock(&shmem_swaplist_mutex) list_for_each_entry(info, next, ...) if (!info->swapped) list_del_init(&info->swaplist) ... mutex_unlock(&shmem_swaplist_mutex) mutex_lock(&shmem_swaplist_mutex) /* iterate with offlist entry and encounter a dead loop */ next = list_next_entry(info, swaplist); ... Restart the iteration if the inode is already off shmem_swaplist list to fix the issue. Link: https://lkml.kernel.org/r/20250516170939.965736-4-shikemeng@huaweicloud.com Fixes: b56a2d8af914 ("mm: rid swapoff of quadratic complexity") Signed-off-by: Kemeng Shi Reviewed-by: Baolin Wang Cc: Hugh Dickins Cc: Kairui Song Cc: kernel test robot Signed-off-by: Andrew Morton commit 594ec2ab389ab9cdada13ad85f503bbfc5658e84 Author: Kemeng Shi Date: Sat May 17 01:09:36 2025 +0800 mm: shmem: add missing shmem_unacct_size() in __shmem_file_setup() We will miss shmem_unacct_size() when is_idmapped_mnt() returns a failure. Move is_idmapped_mnt() before shmem_acct_size() to fix the issue. Link: https://lkml.kernel.org/r/20250516170939.965736-3-shikemeng@huaweicloud.com Fixes: 7a80e5b8c6fa ("shmem: support idmapped mounts for tmpfs") Signed-off-by: Kemeng Shi Reviewed-by: Baolin Wang Cc: Hugh Dickins Cc: Kairui Song Cc: kernel test robot Signed-off-by: Andrew Morton commit e08d5f515613a9860bfee7312461a19f422adb5e Author: Kemeng Shi Date: Sat May 17 01:09:35 2025 +0800 mm: shmem: avoid unpaired folio_unlock() in shmem_swapin_folio() Patch series "Some random fixes and cleanup to shmem", v3. This series contains some simple fixes and cleanup which are made during learning shmem. More details can be found in respective patches. This patch (of 5): If we get a folio from swap_cache_get_folio() successfully but encounter a failure before the folio is locked, we will unlock the folio which was not previously locked. Put the folio and set it to NULL when a failure occurs before the folio is locked to fix the issue. Link: https://lkml.kernel.org/r/20250516170939.965736-1-shikemeng@huaweicloud.com Link: https://lkml.kernel.org/r/20250516170939.965736-2-shikemeng@huaweicloud.com Fixes: 058313515d5a ("mm: shmem: fix potential data corruption during shmem swapin") Signed-off-by: Kemeng Shi Reviewed-by: Baolin Wang Reviewed-by: Kairui Song Cc: Hugh Dickins Cc: kernel test robot Signed-off-by: Andrew Morton commit 8e1c4961f44be6172553c062d8f425a4a4357afa Author: Akinobu Mita Date: Sat May 17 23:18:52 2025 +0900 mm/damon/core: avoid destroyed target reference from DAMOS quota When the number of the monitoring targets in running contexts is reduced, there may be DAMOS quotas referencing the targets that will be destroyed. Applying the scheme action for such DAMOS scheme will be skipped forever looking for the starting part of the region for the destroyed monitoring target. To fix this issue, when the monitoring target is destroyed, reset the starting part for all DAMOS quotas that reference the target. Link: https://lkml.kernel.org/r/20250517141852.142802-1-akinobu.mita@gmail.com Fixes: da87878010e5 ("mm/damon/sysfs: support online inputs update") Signed-off-by: Akinobu Mita Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit 3ac4638a734abbeb1d4a02b042e26a80a4205975 Author: Shakeel Butt Date: Sun May 18 23:31:42 2025 -0700 memcg: make memcg_rstat_updated nmi safe Currently kernel maintains memory related stats updates per-cgroup to optimize stats flushing. The stats_updates is defined as atomic64_t which is not nmi-safe on some archs. Actually we don't really need 64bit atomic as the max value stats_updates can get should be less than nr_cpus * MEMCG_CHARGE_BATCH. A normal atomic_t should suffice. Also the function cgroup_rstat_updated() is still not nmi-safe but there is parallel effort to make it nmi-safe, so until then let's ignore it in the nmi context. Link: https://lkml.kernel.org/r/20250519063142.111219-6-shakeel.butt@linux.dev Signed-off-by: Shakeel Butt Acked-by: Vlastimil Babka Cc: Alexei Starovoitov Cc: Johannes Weiner Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Muchun Song Cc: Peter Zijlstra Cc: Roman Gushchin Cc: Sebastian Andrzej Siewior Cc: Tejun Heo Signed-off-by: Andrew Morton commit 15ca4fa9045768dd798f101a09f0c27a2d1b0cdf Author: Shakeel Butt Date: Sun May 18 23:31:41 2025 -0700 memcg: nmi-safe slab stats updates The objcg based kmem [un]charging can be called in nmi context and it may need to update NR_SLAB_[UN]RECLAIMABLE_B stats. So, let's correctly handle the updates of these stats in the nmi context. Link: https://lkml.kernel.org/r/20250519063142.111219-5-shakeel.butt@linux.dev Signed-off-by: Shakeel Butt Acked-by: Vlastimil Babka Cc: Alexei Starovoitov Cc: Johannes Weiner Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Muchun Song Cc: Peter Zijlstra Cc: Roman Gushchin Cc: Sebastian Andrzej Siewior Cc: Tejun Heo Signed-off-by: Andrew Morton commit 9d3edf96cef6d65ca2be287e48d40aec90081f3f Author: Shakeel Butt Date: Sun May 18 23:31:40 2025 -0700 memcg: add nmi-safe update for MEMCG_KMEM The objcg based kmem charging and uncharging code path needs to update MEMCG_KMEM appropriately. Let's add support to update MEMCG_KMEM in nmi-safe way for those code paths. Link: https://lkml.kernel.org/r/20250519063142.111219-4-shakeel.butt@linux.dev Signed-off-by: Shakeel Butt Acked-by: Vlastimil Babka Cc: Alexei Starovoitov Cc: Johannes Weiner Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Muchun Song Cc: Peter Zijlstra Cc: Roman Gushchin Cc: Sebastian Andrzej Siewior Cc: Tejun Heo Signed-off-by: Andrew Morton commit 940b01fc8dc1aead398819215650727cb9e7335e Author: Shakeel Butt Date: Sun May 18 23:31:39 2025 -0700 memcg: nmi safe memcg stats for specific archs There are archs which have NMI but does not support this_cpu_* ops safely in the nmi context but they support safe atomic ops in nmi context. For such archs, let's add infra to use atomic ops for the memcg stats which can be updated in nmi. At the moment, the memcg stats which get updated in the objcg charging path are MEMCG_KMEM, NR_SLAB_RECLAIMABLE_B & NR_SLAB_UNRECLAIMABLE_B. Rather than adding support for all memcg stats to be nmi safe, let's just add infra to make these three stats nmi safe which this patch is doing. Link: https://lkml.kernel.org/r/20250519063142.111219-3-shakeel.butt@linux.dev Signed-off-by: Shakeel Butt Acked-by: Vlastimil Babka Cc: Alexei Starovoitov Cc: Johannes Weiner Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Muchun Song Cc: Peter Zijlstra Cc: Roman Gushchin Cc: Sebastian Andrzej Siewior Cc: Tejun Heo Signed-off-by: Andrew Morton commit 25352d2f2dc630b33cb61228dbdf7a0a2d6a4117 Author: Shakeel Butt Date: Sun May 18 23:31:38 2025 -0700 memcg: disable kmem charging in nmi for unsupported arch Patch series "memcg: nmi-safe kmem charging", v4. Users can attached their BPF programs at arbitrary execution points in the kernel and such BPF programs may run in nmi context. In addition, these programs can trigger memcg charged kernel allocations in the nmi context. However memcg charging infra for kernel memory is not equipped to handle nmi context for all architectures. This series removes the hurdles to enable kmem charging in the nmi context for most of the archs. For archs without CONFIG_HAVE_NMI, this series is a noop. For archs with NMI support and have CONFIG_ARCH_HAS_NMI_SAFE_THIS_CPU_OPS, the previous work to make memcg stats re-entrant is sufficient for allowing kmem charging in nmi context. For archs with NMI support but without CONFIG_ARCH_HAS_NMI_SAFE_THIS_CPU_OPS and with ARCH_HAVE_NMI_SAFE_CMPXCHG, this series added infra to support kmem charging in nmi context. Lastly those archs with NMI support but without CONFIG_ARCH_HAS_NMI_SAFE_THIS_CPU_OPS and ARCH_HAVE_NMI_SAFE_CMPXCHG, kmem charging in nmi context is not supported at all. Mostly used archs have support for CONFIG_ARCH_HAS_NMI_SAFE_THIS_CPU_OPS and this series should be almost a noop (other than making memcg_rstat_updated nmi safe) for such archs. This patch (of 5): The memcg accounting and stats uses this_cpu* and atomic* ops. There are archs which define CONFIG_HAVE_NMI but does not define CONFIG_ARCH_HAS_NMI_SAFE_THIS_CPU_OPS and ARCH_HAVE_NMI_SAFE_CMPXCHG, so memcg accounting for such archs in nmi context is not possible to support. Let's just disable memcg accounting in nmi context for such archs. Link: https://lkml.kernel.org/r/20250519063142.111219-1-shakeel.butt@linux.dev Link: https://lkml.kernel.org/r/20250519063142.111219-2-shakeel.butt@linux.dev Signed-off-by: Shakeel Butt Acked-by: Vlastimil Babka Cc: Alexei Starovoitov Cc: Johannes Weiner Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Muchun Song Cc: Peter Zijlstra Cc: Roman Gushchin Cc: Sebastian Andrzej Siewior Cc: Tejun Heo Signed-off-by: Andrew Morton commit 9abb8c208fcc26c644d4a25eb90a526c60ebbd62 Author: Mark Brown Date: Thu May 15 11:36:14 2025 +0200 selftests/mm: deduplicate default page size test results in thuge-gen The thuge-gen test program runs mmap() and shmget() tests for both every available page size and the default page size, resulting in two tests for the default size. These tests are distinct since the flags in the default case do not specify an explicit size, add the flags to the test name that is logged to deduplicate. Link: https://lkml.kernel.org/r/20250515-selfests-mm-thuge-gen-dup-v1-1-057d2836553f@kernel.org Signed-off-by: Mark Brown Acked-by: Dev Jain Cc: Shuah Khan Signed-off-by: Andrew Morton commit 62973e38670a660480ab19c9241f8d77e89b0199 Author: Mark Brown Date: Thu May 15 11:27:14 2025 +0200 selftests/mm: deduplicate test logging in test_mlock_lock() The mlock2-tests test_mlock_lock() test reports two test results with an identical string, one reporitng if it successfully locked a block of memory and another reporting if the lock is still present after doing an unlock (following a similar pattern to other tests in the same program). This confuses test automation since the test string is used to deduplicate tests, change the post unlock test to report "Unlocked" instead like the other tests to fix this. Link: https://lkml.kernel.org/r/20250515-selftest-mm-mlock2-dup-v1-1-963d5d7d243a@kernel.org Signed-off-by: Mark Brown Acked-by: Dev Jain Cc: Shuah Khan Signed-off-by: Andrew Morton commit dc75a0d93bd5a1c64104efb4ec680463afbdd755 Author: Sergey Senozhatsky Date: Wed May 14 11:47:51 2025 +0900 zram: support deflate-specific params Introduce support of algorithm specific parameters in algorithm_params device attribute. The expected format is algorithm.param=value. For starters, add support for deflate.winbits parameter. Link: https://lkml.kernel.org/r/20250514024825.1745489-3-senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Reviewed-by: Mikhail Zaslonko Cc: Minchan Kim Signed-off-by: Andrew Morton commit a5ade2e9fa6af5ba545c0f94a65dd001c90c1cf7 Author: Sergey Senozhatsky Date: Wed May 14 11:47:50 2025 +0900 zram: rename ZCOMP_PARAM_NO_LEVEL Patch series "zram: support algorithm-specific parameters". This patchset adds support for algorithm-specific parameters. For now, only deflate-specific winbits can be configured, which fixes deflate support on some s390 setups. This patch (of 2): Use more generic name because this will be default "un-set" value for more params in the future. Link: https://lkml.kernel.org/r/20250514024825.1745489-1-senozhatsky@chromium.org Link: https://lkml.kernel.org/r/20250514024825.1745489-2-senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Reviewed-by: Mikhail Zaslonko Cc: Minchan Kim Signed-off-by: Andrew Morton commit d9736929445e7f4c60f0093af61ff0b52e2d4412 Author: Matthew Wilcox (Oracle) Date: Wed May 14 18:06:04 2025 +0100 iov: remove copy_page_from_iter_atomic() All callers now use copy_folio_from_iter_atomic(), so convert copy_page_from_iter_atomic(). While I'm in there, use kmap_local_folio() and pagefault_disable() instead of kmap_atomic(). That allows preemption and/or task migration to happen during the copy_from_user(). Also use the new folio_test_partial_kmap() predicate instead of open-coding it. Link: https://lkml.kernel.org/r/20250514170607.3000994-4-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Cc: Alexander Viro Cc: Hugh Dickins Cc: Konstantin Komarov Signed-off-by: Andrew Morton commit 80ae99c5727f35d2ed7e011fb0b72c2fe7c5a908 Author: Matthew Wilcox (Oracle) Date: Wed May 14 18:06:03 2025 +0100 ntfs3: use folios more in ntfs_compress_write() Remove the local 'page' variable and do everything in terms of folios. Removes the last user of copy_page_from_iter_atomic() and a hidden call to compound_head() in ClearPageDirty(). Link: https://lkml.kernel.org/r/20250514170607.3000994-3-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Cc: Konstantin Komarov Cc: Alexander Viro Cc: Hugh Dickins Signed-off-by: Andrew Morton commit acc53a0b4c156877773da6e9eea4113dc7e770ae Author: Matthew Wilcox (Oracle) Date: Wed May 14 19:15:07 2025 +0100 mm: rename page->index to page->__folio_index All users of page->index have been converted to not refer to it any more. Update a few pieces of documentation that were missed and prevent new users from appearing (or at least make them easy to grep for). Link: https://lkml.kernel.org/r/20250514181508.3019795-1-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Acked-by: David Hildenbrand Signed-off-by: Andrew Morton commit e94715982c969135457df013d2f8b1742451803c Author: Matthew Wilcox (Oracle) Date: Fri May 16 16:13:29 2025 +0100 m68k: remove use of page->index Switch to using struct ptdesc to store the markbits which will allow us to remove index from struct page. Link: https://lkml.kernel.org/r/20250516151332.3705351-1-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Cc: Geert Uytterhoeven Signed-off-by: Andrew Morton commit 132263220ddacaa5d4a93c34675eb9639dcc3707 Author: Kent Overstreet Date: Fri May 30 19:09:11 2025 -0400 bcachefs: Add better logging to fsck_rename_dirent() Signed-off-by: Kent Overstreet commit 18dad454cd16cbb4c219dbd19a0008af52eb294a Author: Kent Overstreet Date: Sat May 24 16:33:39 2025 -0400 bcachefs: Replace rcu_read_lock() with guards The new guard(), scoped_guard() allow for more natural code. Some of the uses with creative flow control have been left. Signed-off-by: Kent Overstreet commit 9cb49fbf734609c79ba29c43d98e1230ecd1361a Author: Kent Overstreet Date: Sun May 25 01:41:17 2025 -0400 bcachefs: CLASS(btree_trans) Allow btree_trans to be used with CLASS(). Automatic cleanup, instead of manually calling bch2_trans_put(). We don't use DEFINE_CLASS because using a static inline for the constructor breaks bch2_trans_get()'s use of __func__, so we have to open code it. Signed-off-by: Kent Overstreet commit 7d4e49a77d9930c69751b9192448fda6ff9100f1 Merge: 00c010e130e583 375700bab5b150 Author: Linus Torvalds Date: Sat May 31 19:12:53 2025 -0700 Merge tag 'mm-nonmm-stable-2025-05-31-15-28' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull non-MM updates from Andrew Morton: - "hung_task: extend blocking task stacktrace dump to semaphore" from Lance Yang enhances the hung task detector. The detector presently dumps the blocking tasks's stack when it is blocked on a mutex. Lance's series extends this to semaphores - "nilfs2: improve sanity checks in dirty state propagation" from Wentao Liang addresses a couple of minor flaws in nilfs2 - "scripts/gdb: Fixes related to lx_per_cpu()" from Illia Ostapyshyn fixes a couple of issues in the gdb scripts - "Support kdump with LUKS encryption by reusing LUKS volume keys" from Coiby Xu addresses a usability problem with kdump. When the dump device is LUKS-encrypted, the kdump kernel may not have the keys to the encrypted filesystem. A full writeup of this is in the series [0/N] cover letter - "sysfs: add counters for lockups and stalls" from Max Kellermann adds /sys/kernel/hardlockup_count and /sys/kernel/hardlockup_count and /sys/kernel/rcu_stall_count - "fork: Page operation cleanups in the fork code" from Pasha Tatashin implements a number of code cleanups in fork.c - "scripts/gdb/symbols: determine KASLR offset on s390 during early boot" from Ilya Leoshkevich fixes some s390 issues in the gdb scripts * tag 'mm-nonmm-stable-2025-05-31-15-28' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (67 commits) llist: make llist_add_batch() a static inline delayacct: remove redundant code and adjust indentation squashfs: add optional full compressed block caching crash_dump, nvme: select CONFIGFS_FS as built-in scripts/gdb/symbols: determine KASLR offset on s390 during early boot scripts/gdb/symbols: factor out pagination_off() scripts/gdb/symbols: factor out get_vmlinux() kernel/panic.c: format kernel-doc comments mailmap: update and consolidate Casey Connolly's name and email nilfs2: remove wbc->for_reclaim handling fork: define a local GFP_VMAP_STACK fork: check charging success before zeroing stack fork: clean-up naming of vm_stack/vm_struct variables in vmap stacks code fork: clean-up ifdef logic around stack allocation kernel/rcu/tree_stall: add /sys/kernel/rcu_stall_count kernel/watchdog: add /sys/kernel/{hard,soft}lockup_count x86/crash: make the page that stores the dm crypt keys inaccessible x86/crash: pass dm crypt keys to kdump kernel Revert "x86/mm: Remove unused __set_memory_prot()" crash_dump: retrieve dm crypt keys in kdump kernel ... commit 42359f1615cf0c8184de67408ab294b574cfaaf6 Author: Kent Overstreet Date: Thu May 29 19:13:42 2025 -0400 bcachefs: CLASS(darray) Signed-off-by: Kent Overstreet commit 237a8e16bd71cce84e0e3404e1ed8df2b5d63c7c Author: Kent Overstreet Date: Sun May 25 02:59:35 2025 -0400 bcachefs: CLASS(printbuf) Add a DEFINE_CLASS() for printbufs. Signed-off-by: Kent Overstreet commit a0f7437906d115c3fff1b6242f57ca87262a879b Author: Kent Overstreet Date: Thu May 29 20:16:58 2025 -0400 bcachefs: sysfs trigger_journal_commit Signed-off-by: Kent Overstreet commit 1f42a0335a721eca962f792794e864797d09087a Author: Kent Overstreet Date: Thu May 29 18:02:21 2025 -0400 bcachefs: sysfs trigger_emergency_read_only Signed-off-by: Kent Overstreet commit 5802caf74fa5647a0e560b585bf7d1ac65b20e11 Author: Kent Overstreet Date: Thu May 29 16:56:50 2025 -0400 bcachefs: darray_find(), darray_find_p() New helpers to avoid open coded loops. Signed-off-by: Kent Overstreet commit 9a1accd3a57d4bfb6daeee2262b1b24b57ec2382 Author: Kent Overstreet Date: Thu May 29 20:06:01 2025 -0400 bcachefs: Journal keys are retained until shutdown, or journal replay finishes If we don't finish journal replay we need to keep journal keys around until the filesystem shuts down - otherwise e.g. -o norecovery, various tools (dump, list) break, and eventually we'll be doing journal replay in the background. Signed-off-by: Kent Overstreet commit 6447544c3d1473c9d8945e2cc0f3c71eba4c354b Author: Kent Overstreet Date: Thu May 29 17:32:35 2025 -0400 bcachefs: Improve error printing in btree_node_check_topology() We had a bug report where the errors from btree_node_check_topology() don't seem to be getting printed; log_fsck_err() does some fancy ratelimiting-type stuff that we don't want here. Instead, just use bch2_count_fsck_err(); this is simpler, and modelled after how we're currently handling bucket ref update errors in buckets.c. Signed-off-by: Kent Overstreet commit f402d9710b3e55fa2e47a939f69e4267d6d4406f Author: Kent Overstreet Date: Wed May 28 16:34:42 2025 -0400 bcachefs: bch2_readdir() now calls str_hash_check_key() More self healing code: readdir will now notice if there are dirents hashed incorrectly, and it'll repair them if errors=fix_safe. Signed-off-by: Kent Overstreet commit a5922682602788a0f9b37d58e15d7247ad6c54d4 Author: Kent Overstreet Date: Wed May 28 16:25:11 2025 -0400 bcachefs: bch2_str_hash_check_key() may now be called without snapshots_seen We don't track snapshot overwrites outside of fsck, so for this to be called at runtime outside of fsck we need to create it on demand, when we have repair to do. Signed-off-by: Kent Overstreet commit cb6f5d0decea51225b297b0ad3c393de12d68bf0 Author: Kent Overstreet Date: Wed May 28 15:20:20 2025 -0400 bcachefs: __bch2_insert_snapshot_whiteouts() refactoring Now uses bch2_get_snapshot_overwrites(), and much shorter. Signed-off-by: Kent Overstreet commit 801cb2bd6cb7ef2f4568b6646f92234c225c0932 Author: Kent Overstreet Date: Wed May 28 15:08:19 2025 -0400 bcachefs: bch2_get_snapshot_overwrites() New helper for getting a list of snapshot IDs that have overwritten a given key. Signed-off-by: Kent Overstreet commit d21262d4e35d448cbc80092c91f04cc0a5f2b0b4 Author: Kent Overstreet Date: Wed May 28 14:26:33 2025 -0400 bcachefs: bch2_dev_journal_bucket_delete() Recover from "journal and btree in same bucket". Signed-off-by: Kent Overstreet commit 0224d17d762ce036fde5ad18dd33236db6fca88b Author: Kent Overstreet Date: Tue May 27 22:20:27 2025 -0400 bcachefs: Runtime self healing for keys for deleted snapshots If snapshot deletion incorrectly missing some keys and leaves keys for deleted snapshots, that causes a bit of a problem for data move - we can't move an extent for a nonexistent snapshot, because the extent might have to be fragmented, and maintaining correct visibility in child snapshots doesn't work if it doesn't have a snapshot. Previously we'd just skip these keys, but it turns out that causes copygc to spin. So we need runtime self healing, i.e. calling check_key_has_snapshot() from the data move path. Snapshot deletion v2 included sentinal values for deleted snapshot nodes, so this is quite safe. Signed-off-by: Kent Overstreet commit f02d15327455822ed80e0b7d70b2ab3568a0389e Author: Kent Overstreet Date: Wed May 28 16:06:07 2025 -0400 bcachefs: Don't unlock trans before data_update_init() data_update_init() does need to do btree operations, delay doing the unlock-before-io. Signed-off-by: Kent Overstreet commit 642c1aabb001ee8410e6bfb6654b23bcead64e4e Author: Kent Overstreet Date: Wed May 28 11:31:51 2025 -0400 bcachefs: Use bch2_err_matches() for BCH_ERR_fsck_(fix|ignore) We'll be adding subtypes of these errors, and new error code tracing. Signed-off-by: Kent Overstreet commit 00c010e130e58301db2ea0cec1eadc931e1cb8cf Merge: b42966552bb8d3 c544a952ba61b1 Author: Linus Torvalds Date: Sat May 31 15:44:16 2025 -0700 Merge tag 'mm-stable-2025-05-31-14-50' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM updates from Andrew Morton: - "Add folio_mk_pte()" from Matthew Wilcox simplifies the act of creating a pte which addresses the first page in a folio and reduces the amount of plumbing which architecture must implement to provide this. - "Misc folio patches for 6.16" from Matthew Wilcox is a shower of largely unrelated folio infrastructure changes which clean things up and better prepare us for future work. - "memory,x86,acpi: hotplug memory alignment advisement" from Gregory Price adds early-init code to prevent x86 from leaving physical memory unused when physical address regions are not aligned to memory block size. - "mm/compaction: allow more aggressive proactive compaction" from Michal Clapinski provides some tuning of the (sadly, hard-coded (more sadly, not auto-tuned)) thresholds for our invokation of proactive compaction. In a simple test case, the reduction of a guest VM's memory consumption was dramatic. - "Minor cleanups and improvements to swap freeing code" from Kemeng Shi provides some code cleaups and a small efficiency improvement to this part of our swap handling code. - "ptrace: introduce PTRACE_SET_SYSCALL_INFO API" from Dmitry Levin adds the ability for a ptracer to modify syscalls arguments. At this time we can alter only "system call information that are used by strace system call tampering, namely, syscall number, syscall arguments, and syscall return value. This series should have been incorporated into mm.git's "non-MM" branch, but I goofed. - "fs/proc: extend the PAGEMAP_SCAN ioctl to report guard regions" from Andrei Vagin extends the info returned by the PAGEMAP_SCAN ioctl against /proc/pid/pagemap. This permits CRIU to more efficiently get at the info about guard regions. - "Fix parameter passed to page_mapcount_is_type()" from Gavin Shan implements that fix. No runtime effect is expected because validate_page_before_insert() happens to fix up this error. - "kernel/events/uprobes: uprobe_write_opcode() rewrite" from David Hildenbrand basically brings uprobe text poking into the current decade. Remove a bunch of hand-rolled implementation in favor of using more current facilities. - "mm/ptdump: Drop assumption that pxd_val() is u64" from Anshuman Khandual provides enhancements and generalizations to the pte dumping code. This might be needed when 128-bit Page Table Descriptors are enabled for ARM. - "Always call constructor for kernel page tables" from Kevin Brodsky ensures that the ctor/dtor is always called for kernel pgtables, as it already is for user pgtables. This permits the addition of more functionality such as "insert hooks to protect page tables". This change does result in various architectures performing unnecesary work, but this is fixed up where it is anticipated to occur. - "Rust support for mm_struct, vm_area_struct, and mmap" from Alice Ryhl adds plumbing to permit Rust access to core MM structures. - "fix incorrectly disallowed anonymous VMA merges" from Lorenzo Stoakes takes advantage of some VMA merging opportunities which we've been missing for 15 years. - "mm/madvise: batch tlb flushes for MADV_DONTNEED and MADV_FREE" from SeongJae Park optimizes process_madvise()'s TLB flushing. Instead of flushing each address range in the provided iovec, we batch the flushing across all the iovec entries. The syscall's cost was approximately halved with a microbenchmark which was designed to load this particular operation. - "Track node vacancy to reduce worst case allocation counts" from Sidhartha Kumar makes the maple tree smarter about its node preallocation. stress-ng mmap performance increased by single-digit percentages and the amount of unnecessarily preallocated memory was dramaticelly reduced. - "mm/gup: Minor fix, cleanup and improvements" from Baoquan He removes a few unnecessary things which Baoquan noted when reading the code. - ""Enhance sysfs handling for memory hotplug in weighted interleave" from Rakie Kim "enhances the weighted interleave policy in the memory management subsystem by improving sysfs handling, fixing memory leaks, and introducing dynamic sysfs updates for memory hotplug support". Fixes things on error paths which we are unlikely to hit. - "mm/damon: auto-tune DAMOS for NUMA setups including tiered memory" from SeongJae Park introduces new DAMOS quota goal metrics which eliminate the manual tuning which is required when utilizing DAMON for memory tiering. - "mm/vmalloc.c: code cleanup and improvements" from Baoquan He provides cleanups and small efficiency improvements which Baoquan found via code inspection. - "vmscan: enforce mems_effective during demotion" from Gregory Price changes reclaim to respect cpuset.mems_effective during demotion when possible. because presently, reclaim explicitly ignores cpuset.mems_effective when demoting, which may cause the cpuset settings to violated. This is useful for isolating workloads on a multi-tenant system from certain classes of memory more consistently. - "Clean up split_huge_pmd_locked() and remove unnecessary folio pointers" from Gavin Guo provides minor cleanups and efficiency gains in in the huge page splitting and migrating code. - "Use kmem_cache for memcg alloc" from Huan Yang creates a slab cache for `struct mem_cgroup', yielding improved memory utilization. - "add max arg to swappiness in memory.reclaim and lru_gen" from Zhongkun He adds a new "max" argument to the "swappiness=" argument for memory.reclaim MGLRU's lru_gen. This directs proactive reclaim to reclaim from only anon folios rather than file-backed folios. - "kexec: introduce Kexec HandOver (KHO)" from Mike Rapoport is the first step on the path to permitting the kernel to maintain existing VMs while replacing the host kernel via file-based kexec. At this time only memblock's reserve_mem is preserved. - "mm: Introduce for_each_valid_pfn()" from David Woodhouse provides and uses a smarter way of looping over a pfn range. By skipping ranges of invalid pfns. - "sched/numa: Skip VMA scanning on memory pinned to one NUMA node via cpuset.mems" from Libo Chen removes a lot of pointless VMA scanning when a task is pinned a single NUMA mode. Dramatic performance benefits were seen in some real world cases. - "JFS: Implement migrate_folio for jfs_metapage_aops" from Shivank Garg addresses a warning which occurs during memory compaction when using JFS. - "move all VMA allocation, freeing and duplication logic to mm" from Lorenzo Stoakes moves some VMA code from kernel/fork.c into the more appropriate mm/vma.c. - "mm, swap: clean up swap cache mapping helper" from Kairui Song provides code consolidation and cleanups related to the folio_index() function. - "mm/gup: Cleanup memfd_pin_folios()" from Vishal Moola does that. - "memcg: Fix test_memcg_min/low test failures" from Waiman Long addresses some bogus failures which are being reported by the test_memcontrol selftest. - "eliminate mmap() retry merge, add .mmap_prepare hook" from Lorenzo Stoakes commences the deprecation of file_operations.mmap() in favor of the new file_operations.mmap_prepare(). The latter is more restrictive and prevents drivers from messing with things in ways which, amongst other problems, may defeat VMA merging. - "memcg: decouple memcg and objcg stocks"" from Shakeel Butt decouples the per-cpu memcg charge cache from the objcg's one. This is a step along the way to making memcg and objcg charging NMI-safe, which is a BPF requirement. - "mm/damon: minor fixups and improvements for code, tests, and documents" from SeongJae Park is yet another batch of miscellaneous DAMON changes. Fix and improve minor problems in code, tests and documents. - "memcg: make memcg stats irq safe" from Shakeel Butt converts memcg stats to be irq safe. Another step along the way to making memcg charging and stats updates NMI-safe, a BPF requirement. - "Let unmap_hugepage_range() and several related functions take folio instead of page" from Fan Ni provides folio conversions in the hugetlb code. * tag 'mm-stable-2025-05-31-14-50' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (285 commits) mm: pcp: increase pcp->free_count threshold to trigger free_high mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page mm/hugetlb: pass folio instead of page to unmap_ref_private() memcg: objcg stock trylock without irq disabling memcg: no stock lock for cpu hot-unplug memcg: make __mod_memcg_lruvec_state re-entrant safe against irqs memcg: make count_memcg_events re-entrant safe against irqs memcg: make mod_memcg_state re-entrant safe against irqs memcg: move preempt disable to callers of memcg_rstat_updated memcg: memcg_rstat_updated re-entrant safe against irqs mm: khugepaged: decouple SHMEM and file folios' collapse selftests/eventfd: correct test name and improve messages alloc_tag: check mem_profiling_support in alloc_tag_init Docs/damon: update titles and brief introductions to explain DAMOS selftests/damon/_damon_sysfs: read tried regions directories in order mm/damon/tests/core-kunit: add a test for damos_set_filters_default_reject() mm/damon/paddr: remove unused variable, folio_list, in damon_pa_stat() mm/damon/sysfs-schemes: fix wrong comment on damons_sysfs_quota_goal_metric_strs ... commit 08652bd86e267b0c83ed013dd972c99c04c7e76a Author: Uday Shankar Date: Thu May 29 17:47:18 2025 -0600 Documentation: ublk: document UBLK_F_PER_IO_DAEMON Explain the restrictions imposed on ublk servers in two cases: 1. When UBLK_F_PER_IO_DAEMON is set (current ublk_drv) 2. When UBLK_F_PER_IO_DAEMON is not set (legacy) Remove most references to per-queue daemons, as the new UBLK_F_PER_IO_DAEMON feature renders that concept obsolete. Signed-off-by: Uday Shankar Reviewed-by: Caleb Sander Mateos Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250529-ublk_task_per_io-v8-9-e9d3b119336a@purestorage.com Signed-off-by: Jens Axboe commit 17574aa2a06b1f5bc447433ceaaa3df3543cc632 Author: Uday Shankar Date: Thu May 29 17:47:17 2025 -0600 selftests: ublk: add stress test for per io daemons Add a new test_stress_06 for the per io daemons feature. This is just a copy of test_stress_01 with the per_io_tasks flag added, with varying amounts of nthreads. This test is able to reproduce a panic which was caught manually during development [1]; in the current version of this patch set, it passes. Note that this commit also makes all stress tests using the run_io_and_remove helper more stressful by additionally exercising the batch submit (queue_rqs) path. [1] https://lore.kernel.org/linux-block/aDgwGoGCEpwd1mFY@fedora/ Suggested-by: Ming Lei Signed-off-by: Uday Shankar Link: https://lore.kernel.org/r/20250529-ublk_task_per_io-v8-8-e9d3b119336a@purestorage.com Signed-off-by: Jens Axboe commit 236918d3e9ac45d593c2f74e1df598483a508d2f Author: Uday Shankar Date: Thu May 29 17:47:16 2025 -0600 selftests: ublk: add functional test for per io daemons Add a new test test_generic_12 which: - sets up a ublk server with per_io_tasks and a different number of ublk server threads and ublk_queues. This is possible now that these objects are decoupled - runs some I/O load from a single CPU - verifies that all the ublk server threads handle some I/O Before this changeset, this test fails, since I/O issued from one CPU is always handled by the one ublk server thread. After this changeset, the test passes. In the future, the last check above may be strengthened to "verify that all ublk server threads handle the same amount of I/O." However, this requires some adjustments/bugfixes to tag allocation, so this work is postponed to a followup. Signed-off-by: Uday Shankar Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250529-ublk_task_per_io-v8-7-e9d3b119336a@purestorage.com Signed-off-by: Jens Axboe commit abe54c16034631db01aba02e06da569b33002ab1 Author: Uday Shankar Date: Thu May 29 17:47:15 2025 -0600 selftests: ublk: kublk: decouple ublk_queues from ublk server threads Add support in kublk for decoupled ublk_queues and ublk server threads. kublk now has two modes of operation: - (preexisting mode) threads and queues are paired 1:1, and each thread services all the I/Os of one queue - (new mode) thread and queue counts are independently configurable. threads service I/Os in a way that balances load across threads even if load is not balanced over queues. The default is the preexisting mode. The new mode is activated by passing the --per_io_tasks flag. Signed-off-by: Uday Shankar Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250529-ublk_task_per_io-v8-6-e9d3b119336a@purestorage.com Signed-off-by: Jens Axboe commit b9848ca7a7643b13feed9ebb67f5150eb731610c Author: Uday Shankar Date: Thu May 29 17:47:14 2025 -0600 selftests: ublk: kublk: move per-thread data out of ublk_queue Towards the goal of decoupling ublk_queues from ublk server threads, move resources/data that should be per-thread rather than per-queue out of ublk_queue and into a new struct ublk_thread. Signed-off-by: Uday Shankar Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250529-ublk_task_per_io-v8-5-e9d3b119336a@purestorage.com Signed-off-by: Jens Axboe commit 8f75ba28b8747d6a788daede0060d574b5693dac Author: Uday Shankar Date: Thu May 29 17:47:13 2025 -0600 selftests: ublk: kublk: lift queue initialization out of thread Currently, each ublk server I/O handler thread initializes its own queue. However, as we move towards decoupled ublk_queues and ublk server threads, this model does not make sense anymore, as there will no longer be a concept of a thread having "its own" queue. So lift queue initialization out of the per-thread ublk_io_handler_fn and into a loop in ublk_start_daemon (which runs once for each device). There is a part of ublk_queue_init (ring initialization) which does actually need to happen on the thread that will use the ring; that is separated into a separate ublk_thread_init which is still called by each I/O handler thread. Signed-off-by: Uday Shankar Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250529-ublk_task_per_io-v8-4-e9d3b119336a@purestorage.com Signed-off-by: Jens Axboe commit 97737097528397a8106ffc552e827a3dedccf132 Author: Uday Shankar Date: Thu May 29 17:47:12 2025 -0600 selftests: ublk: kublk: tie sqe allocation to io instead of queue We currently have a helper ublk_queue_alloc_sqes which the ublk targets use to allocate SQEs for their own operations. However, as we move towards decoupled ublk_queues and ublk server threads, this helper does not make sense anymore. SQEs are allocated from rings, and we will have one ring per thread to avoid locking. Change the SQE allocation helper to ublk_io_alloc_sqes. Currently this still allocates SQEs from the io's queue's ring, but when we fully decouple threads and queues, it will allocate from the io's thread's ring instead. Signed-off-by: Uday Shankar Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250529-ublk_task_per_io-v8-3-e9d3b119336a@purestorage.com Signed-off-by: Jens Axboe commit bf098d72696db1a947e72d549ec861dc1092deef Author: Uday Shankar Date: Thu May 29 17:47:11 2025 -0600 selftests: ublk: kublk: plumb q_id in io_uring user_data Currently, when we process CQEs, we know which ublk_queue we are working on because we know which ring we are working on, and ublk_queues and rings are in 1:1 correspondence. However, as we decouple ublk_queues from ublk server threads, ublk_queues and rings will no longer be in 1:1 correspondence - each ublk server thread will have a ring, and each thread may issue commands against more than one ublk_queue. So in order to know which ublk_queue a CQE refers to, plumb that information in the associated SQE's user_data. Signed-off-by: Uday Shankar Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250529-ublk_task_per_io-v8-2-e9d3b119336a@purestorage.com Signed-off-by: Jens Axboe commit ab03a61c66149327e022bdafa5843c6f82be267e Author: Uday Shankar Date: Thu May 29 17:47:10 2025 -0600 ublk: have a per-io daemon instead of a per-queue daemon Currently, ublk_drv associates to each hardware queue (hctx) a unique task (called the queue's ubq_daemon) which is allowed to issue COMMIT_AND_FETCH commands against the hctx. If any other task attempts to do so, the command fails immediately with EINVAL. When considered together with the block layer architecture, the result is that for each CPU C on the system, there is a unique ublk server thread which is allowed to handle I/O submitted on CPU C. This can lead to suboptimal performance under imbalanced load generation. For an extreme example, suppose all the load is generated on CPUs mapping to a single ublk server thread. Then that thread may be fully utilized and become the bottleneck in the system, while other ublk server threads are totally idle. This issue can also be addressed directly in the ublk server without kernel support by having threads dequeue I/Os and pass them around to ensure even load. But this solution requires inter-thread communication at least twice for each I/O (submission and completion), which is generally a bad pattern for performance. The problem gets even worse with zero copy, as more inter-thread communication would be required to have the buffer register/unregister calls to come from the correct thread. Therefore, address this issue in ublk_drv by allowing each I/O to have its own daemon task. Two I/Os in the same queue are now allowed to be serviced by different daemon tasks - this was not possible before. Imbalanced load can then be balanced across all ublk server threads by having the ublk server threads issue FETCH_REQs in a round-robin manner. As a small toy example, consider a system with a single ublk device having 2 queues, each of depth 4. A ublk server having 4 threads could issue its FETCH_REQs against this device as follows (where each entry is the qid,tag pair that the FETCH_REQ targets): ublk server thread: T0 T1 T2 T3 0,0 0,1 0,2 0,3 1,3 1,0 1,1 1,2 This setup allows for load that is concentrated on one hctx/ublk_queue to be spread out across all ublk server threads, alleviating the issue described above. Add the new UBLK_F_PER_IO_DAEMON feature to ublk_drv, which ublk servers can use to essentially test for the presence of this change and tailor their behavior accordingly. Signed-off-by: Uday Shankar Reviewed-by: Caleb Sander Mateos Reviewed-by: Ming Lei Reviewed-by: Jens Axboe Link: https://lore.kernel.org/r/20250529-ublk_task_per_io-v8-1-e9d3b119336a@purestorage.com Signed-off-by: Jens Axboe commit b42966552bb8d3027b66782fc1b53ce570e4d356 Merge: 4cb6c8af859113 05f6e183879d97 Author: Linus Torvalds Date: Sat May 31 11:34:27 2025 -0700 Merge tag 'fbdev-for-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev updates from Helge Deller: "Many small but important fixes for special cases in the fbdev, fbcon and vgacon code which were found with Syzkaller, Svace and other tools by various people and teams (e.g. Linux Verification Center). Some smaller code cleanups in the nvidiafb, arkfb, atyfb and viafb drivers and two spelling fixes" * tag 'fbdev-for-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var fbdev: sstfb.rst: Fix spelling mistake fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() fbcon: Make sure modelist not set on unregistered console vgacon: Add check for vc_origin address range in vgacon_scroll() fbdev: arkfb: Cast ics5342_init() allocation type fbdev: nvidiafb: Correct const string length in nvidiafb_setup() fbdev: atyfb: Remove unused PCI vendor ID fbdev: carminefb: Fix spelling mistake of CARMINE_TOTAL_DIPLAY_MEM fbdev: via: use new GPIO line value setter callbacks commit 4cb6c8af8591135ec000fbe4bb474139ceec595d Author: Mark Brown Date: Fri May 30 11:42:25 2025 +0100 selftests/filesystems: Fix build of anon_inode_test The newly added anon_inode_test test fails to build due to attempting to include a nonexisting overlayfs/wrapper.h: anon_inode_test.c:10:10: fatal error: overlayfs/wrappers.h: No such file or directory 10 | #include "overlayfs/wrappers.h" | ^~~~~~~~~~~~~~~~~~~~~~ This is due to 0bd92b9fe538 ("selftests/filesystems: move wrapper.h out of overlayfs subdir") which was added in the vfs-6.16.selftests branch which was based on -rc5 and did not contain the newly added test so once things were merged into mainline the build started failing - both parent commits are fine. Fixes: 3e406741b1989 ("Merge tag 'vfs-6.16-rc1.selftests' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs") Signed-off-by: Mark Brown Signed-off-by: Linus Torvalds commit dee264c16a6334dcdbea5c186f5ff35f98b1df42 Merge: 31848987f177a6 582847f9702461 Author: Linus Torvalds Date: Sat May 31 08:16:52 2025 -0700 Merge tag 'gcc-minimum-version-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic Pull compiler version requirement update from Arnd Bergmann: "Require gcc-8 and binutils-2.30 x86 already uses gcc-8 as the minimum version, this changes all other architectures to the same version. gcc-8 is used is Debian 10 and Red Hat Enterprise Linux 8, both of which are still supported, and binutils 2.30 is the oldest corresponding version on those. Ubuntu Pro 18.04 and SUSE Linux Enterprise Server 15 both use gcc-7 as the system compiler but additionally include toolchains that remain supported. With the new minimum toolchain versions, a number of workarounds for older versions can be dropped, in particular on x86_64 and arm64. Importantly, the updated compiler version allows removing two of the five remaining gcc plugins, as support for sancov and structeak features is already included in modern compiler versions. I tried collecting the known changes that are possible based on the new toolchain version, but expect that more cleanups will be possible. Since this touches multiple architectures, I merged the patches through the asm-generic tree." * tag 'gcc-minimum-version-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: Makefile.kcov: apply needed compiler option unconditionally in CFLAGS_KCOV Documentation: update binutils-2.30 version reference gcc-plugins: remove SANCOV gcc plugin Kbuild: remove structleak gcc plugin arm64: drop binutils version checks raid6: skip avx512 checks kbuild: require gcc-8 and binutils-2.30 commit 31848987f177a6c0944fd0254a55ffd7c52a8c50 Merge: ec71f661a572a7 9bba618694cc90 Author: Linus Torvalds Date: Sat May 31 08:14:37 2025 -0700 Merge tag 'soc-newsoc-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull sophgo SoC devicetree updates from Arnd Bergmann: "The Sophgo SG2044 SoC is their second generation server chip with 64 cores, following the SG2042. In addition, there are minor updates for the cv180x SoCs" * tag 'soc-newsoc-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: riscv: dts: sophgo: switch precise compatible for existed clock device for CV18XX riscv: dts: sophgo: Add initial device tree of Sophgo SRD3-10 dt-bindings: riscv: sophgo: Add SG2044 compatible string dt-bindings: interrupt-controller: Add Sophgo SG2044 PLIC dt-bindings: interrupt-controller: Add Sophgo SG2044 CLINT mswi riscv: dts: sopgho: use SOC_PERIPHERAL_IRQ to calculate interrupt number riscv: dts: sophgo: rename header file cv18xx.dtsi to cv180x.dtsi riscv: dts: sophgo: Move riscv cpu definition to a separate file riscv: dts: sophgo: Move all soc specific device into soc dtsi file riscv: sophgo: dts: Add spi controller for SG2042 riscv: dts: sophgo: sg2042: add pinctrl support commit ec71f661a572a770d7c861cd52a50cbbb0e1a8d1 Merge: f79749a8e42b3a 3f07353e2fd3e1 Author: Linus Torvalds Date: Sat May 31 08:08:56 2025 -0700 Merge tag 'soc-dt-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC devicetree updates from Arnd Bergmann: "There are 11 newly supported SoCs, but these are all either new variants of existing designs, or straight reuses of the existing chip in a new package: - RK3562 is a new chip based on the old Cortex-A53 core, apparently a low-cost version of the Cortex-A55 based RK3568/RK3566. - NXP i.MX94 is a minor variation of i.MX93/i.MX95 with a different set of on-chip peripherals. - Renesas RZ/V2N (R9A09G056) is a new member of the larger RZ/V2 family - Amlogic S6/S7/S7D - Samsung Exynos7870 is an older chip similar to Exynos7885 - WonderMedia wm8950 is a minor variation on the wm8850 chip - Amlogic s805y is almost idential to s805x - Allwinner A523 is similar to A527 and T527 - Qualcomm MSM8926 is a variant of MSM8226 - Qualcomm Snapdragon X1P42100 is related to R1E80100 There are also 65 boards, including reference designs for the chips above, this includes - 12 new boards based on TI K3 series chips, most of them from Toradex - 10 devices using Rockchips RK35xx and PX30 chips - 2 phones and 2 laptops based on Qualcomm Snapdragon designs - 10 NXP i.MX8/i.MX9 boards, mostly for embedded/industrial uses - 3 Samsung Galaxy phones based on Exynos7870 - 5 Allwinner based boards using a variety of ARMv8 chips - 9 32-bit machines, each based on a different SoC family Aside from the new hardware, there is the usual set of cleanups and newly added hardware support on existing machines, for a total of 965 devicetree changesets" * tag 'soc-dt-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (956 commits) MAINTAINERS, mailmap: update Sven Peter's email address arm64: dts: renesas: rzg3e-smarc-som: Reduce I2C2 clock frequency arm64: dts: nuvoton: Add pinctrl ARM: dts: samsung: sp5v210-aries: Align wifi node name with bindings arm64: dts: blaize-blzp1600: Enable GPIO support dt-bindings: clock: socfpga: convert to yaml arm64: dts: rockchip: move rk3562 pinctrl node outside the soc node arm64: dts: rockchip: fix rk3562 pcie unit addresses arm64: dts: rockchip: move rk3528 pinctrl node outside the soc node arm64: dts: rockchip: remove a double-empty line from rk3576 core dtsi arm64: dts: rockchip: move rk3576 pinctrl node outside the soc node arm64: dts: rockchip: fix rk3576 pcie unit addresses arm64: dts: rockchip: Drop assigned-clock* from cpu nodes on rk3588 arm64: dts: rockchip: Add missing SFC power-domains to rk3576 Revert "arm64: dts: mediatek: mt8390-genio-common: Add firmware-name for scp0" arm64: dts: mediatek: mt8188: Address binding warnings for MDP3 nodes arm64: dts: mt6359: Rename RTC node to match binding expectations arm64: dts: mt8365-evk: Add goodix touchscreen support arm64: dts: mediatek: mt8188: Add missing #reset-cells property arm64: dts: airoha: en7581: Add PCIe nodes to EN7581 SoC evaluation board ... commit f79749a8e42b3a6dcb980e87f3ef752962b9f094 Merge: 500af1defbcbb6 ae006498a0723e Author: Linus Torvalds Date: Sat May 31 08:06:14 2025 -0700 Merge tag 'soc-defconfig-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC defconfig updates from Arnd Bergmann: "The usual defconfig updates enable configuration options for drivers that got added. A few SoC specific options are enabled in Kconfig files instead, in place of the defconfig files" * tag 'soc-defconfig-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: arm64: defconfig: enable ACPM protocol and Exynos mailbox arm64: defconfig: Enable configs for MediaTek Genio EVK boards arm64: defconfig: mediatek: enable PHY drivers arm64: defconfig: Enable Rockchip SAI and ES8328 arm64: defconfig: Add Toradex Embedded Controller config arm64: defconfig: Enable TPIC2810 GPIO expander riscv: defconfig: spacemit: enable clock controller driver for SpacemiT K1 arm64: defconfig: Enable TMP102 as module arm64: defconfig: Enable hwspinlock and eQEP for K3 arm64: defconfig: Add CDNS_DSI and CDNS_PHY config riscv: defconfig: spacemit: enable gpio support for K1 SoC arm64: defconfig: Enable IPQ5424 RDP466 base configs riscv: Enable PM_GENERIC_DOMAINS for T-Head SoCs commit 500af1defbcbb6113c9a958b791517d0562b8d6d Merge: 297d9111e9fcf4 16066e29d3f5a4 Author: Linus Torvalds Date: Sat May 31 08:03:09 2025 -0700 Merge tag 'soc-arm-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC updates from Arnd Bergmann: "The main update in size is the removal of the TI DaVinci DA830 SoC support. DA830 is similar to DA850, which remain supported, but only the reference board was ever supported, and we removed that one 3 years ago as it had never been converted to devicetree. There are some other cleanups for OMAP4 and a few boards using old GPIO interfaces" * tag 'soc-arm-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: ARM: s3c: stop including gpio.h ARM: dts: davinci: da850-evm: Increase fifo threshold ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY ARM: broadcom: MAINTAINERS: Cover bcm2712 files bus: ti-sysc: PRUSS OCP configuration ARM: davinci: remove support for da830 ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 ARM: omap2plus_defconfig: enable I2C devices of GTA04 ARM: s3c/gpio: use new line value setter callbacks ARM: scoop/gpio: use new line value setter callbacks ARM: sa1100/gpio: use new line value setter callbacks ARM: orion/gpio: use new line value setter callbacks commit 297d9111e9fcf47dd1dcc6f79bba915f35378d01 Merge: 9d49da438819c5 5963edd98a2159 Author: Linus Torvalds Date: Sat May 31 07:53:30 2025 -0700 Merge tag 'soc-drivers-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC driver updates from Arnd Bergmann: "Updates are across the usual driver subsystems with SoC specific drivers: - added soc specicific drivers for sophgo cv1800 and sg2044, qualcomm sm8750, and amlogic c3 and s4 chips. - cache controller updates for sifive chips, plus binding changes for other cache descriptions. - memory controller drivers for mediatek mt6893, stm32 and cleanups for a few more drivers - reset controller drivers for T-Head TH1502, Sophgo sg2044 and Renesas RZ/V2H(P) - SCMI firmware updates to better deal with buggy firmware, plus better support for Qualcomm X1E and NXP i.MX specific interfaces - a new platform driver for the crypto firmware on Cznic Turris Omnia/MOX - cleanups for the TEE firmware subsystem and amdtee driver - minor updates and fixes for freescale/nxp, qualcomm, google, aspeed, wondermedia, ti, nxp, renesas, hisilicon, mediatek, broadcom and samsung SoCs" * tag 'soc-drivers-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (133 commits) soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() soc: aspeed: lpc: Fix impossible judgment condition ARM: aspeed: Don't select SRAM docs: firmware: qcom_scm: Fix kernel-doc warning soc: fsl: qe: Consolidate chained IRQ handler install/remove firmware: qcom: scm: Allow QSEECOM for HP EliteBook Ultra G1q dt-bindings: mfd: qcom,tcsr: Add compatible for ipq5018 dt-bindings: cache: add QiLai compatible to ax45mp memory: stm32_omm: Fix error handling in stm32_omm_disable_child() dt-bindings: cache: Convert marvell,tauros2-cache to DT schema dt-bindings: cache: Convert marvell,{feroceon,kirkwood}-cache to DT schema soc: samsung: exynos-pmu: enable CPU hotplug support for gs101 MAINTAINERS: Add google,gs101-pmu-intr-gen.yaml binding file dt-bindings: soc: samsung: exynos-pmu: gs101: add google,pmu-intr-gen phandle dt-bindings: soc: google: Add gs101-pmu-intr-gen binding documentation bus: fsl-mc: Use strscpy() instead of strscpy_pad() soc: fsl: qbman: Remove const from portal->cgrs allocation type bus: fsl_mc: Fix driver_managed_dma check bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value bus: fsl-mc: drop useless cleanup ... commit 213205889d5ffc19cb8df06aa6778b2d4724c887 Author: Helge Deller Date: Sat May 31 15:26:27 2025 +0200 parisc/unaligned: Fix hex output to show 8 hex chars Change back printk format to 0x%08lx instead of %#08lx, since the latter does not seem to reliably format the value to 8 hex chars. Signed-off-by: Helge Deller Cc: stable@vger.kernel.org # v5.18+ Fixes: e5e9e7f222e5b ("parisc/unaligned: Enhance user-space visible output") commit 9d49da438819c5dd82840eb63d929edbdccb80d8 Author: Linus Torvalds Date: Sat May 31 07:43:16 2025 -0700 Revert "iommu: make inclusion of arm/arm-smmu-v3 directory conditional" This reverts commit e436576b0231542f6f233279f0972989232575a8. That commit is very broken, and seems to have missed the fact that CONFIG_ARM_SMMU_V3 is not just a yes-or-no thing, but also can be modular. So it caused build errors on arm64 allmodconfig setups: ERROR: modpost: "arm_smmu_make_cdtable_ste" [drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-test.ko] undefined! ERROR: modpost: "arm_smmu_make_s2_domain_ste" [drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-test.ko] undefined! ERROR: modpost: "arm_smmu_make_s1_cd" [drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-test.ko] undefined! ... (and six more symbols just the same). Link: https://lore.kernel.org/all/CAHk-=wh4qRwm7AQ8sBmQj7qECzgAhj4r73RtCDfmHo5SdcN0Jw@mail.gmail.com/ Cc: Joerg Roedel Cc: Rolf Eike Beer Cc: Lu Baolu Signed-off-by: Linus Torvalds commit a913ef6fd883c05bd6538ed21ee1e773f0d750b7 Author: Ian Rogers Date: Wed May 28 21:39:37 2025 -0700 perf callchain: Always populate the addr_location map when adding IP Dropping symbols also meant the callchain maps wasn't populated, but the callchain map is needed to find the DSO. Plumb the symbols option better, falling back to thread__find_map() rather than thread__find_symbol() when symbols are disabled. Fixes: 02b2705017d2e5ad ("perf callchain: Allow symbols to be optional when resolving a callchain") Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Athira Rajeev Cc: Ben Gainey Cc: Chaitanya S Prakash Cc: Charlie Jenkins Cc: Chun-Tse Shao Cc: Colin Ian King Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Graham Woodward Cc: Howard Chu Cc: Ilkka Koskinen Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kajol Jain Cc: Kan Liang Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Levi Yun Cc: Li Huafei Cc: linux-arm-kernel@lists.infradead.org Cc: Mark Rutland Cc: Martin Liška Cc: Masami Hiramatsu Cc: Matt Fleming Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Song Liu Cc: Steinar H. Gunderson Cc: Stephen Brennan Cc: Steve Clevenger Cc: Thomas Falcon Cc: Veronika Molnarova Cc: Weilin Wang Cc: Will Deacon Cc: Yicong Yang Cc: Yujie Liu Cc: Zhongqiu Han Cc: Zixian Cai Link: https://lore.kernel.org/r/20250529044000.759937-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 0df14c1f1ed530ba21b603a2e282589c034367da Author: Namhyung Kim Date: Thu May 15 11:10:42 2025 -0700 perf lock contention: Reject more than 10ms delays for safety Delaying kernel operations can be dangerous and the kernel may kill (non-sleepable) BPF programs running for long in the future. Limit the max delay to 10ms and update the document about it. $ sudo ./perf lock con -abl -J 100000us@cgroup_mutex true lock delay is too long: 100000us (> 10ms) Usage: perf lock contention [] -J, --inject-delay Inject delays to specific locks Suggested-by: Alexei Starovoitov Signed-off-by: Namhyung Kim Cc: Adrian Hunter Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Peter Zijlstra Cc: Song Liu Link: https://lore.kernel.org/r/20250515181042.555189-1-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 05f6e183879d9785a3cdf2f08a498bc31b7a20aa Author: Murad Masimov Date: Mon Apr 28 18:34:07 2025 +0300 fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var If fb_add_videomode() in fb_set_var() fails to allocate memory for fb_videomode, later it may lead to a null-ptr dereference in fb_videomode_to_var(), as the fb_info is registered while not having the mode in modelist that is expected to be there, i.e. the one that is described in fb_info->var. ================================================================ general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 1 PID: 30371 Comm: syz-executor.1 Not tainted 5.10.226-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:fb_videomode_to_var+0x24/0x610 drivers/video/fbdev/core/modedb.c:901 Call Trace: display_to_var+0x3a/0x7c0 drivers/video/fbdev/core/fbcon.c:929 fbcon_resize+0x3e2/0x8f0 drivers/video/fbdev/core/fbcon.c:2071 resize_screen drivers/tty/vt/vt.c:1176 [inline] vc_do_resize+0x53a/0x1170 drivers/tty/vt/vt.c:1263 fbcon_modechanged+0x3ac/0x6e0 drivers/video/fbdev/core/fbcon.c:2720 fbcon_update_vcs+0x43/0x60 drivers/video/fbdev/core/fbcon.c:2776 do_fb_ioctl+0x6d2/0x740 drivers/video/fbdev/core/fbmem.c:1128 fb_ioctl+0xe7/0x150 drivers/video/fbdev/core/fbmem.c:1203 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __x64_sys_ioctl+0x19a/0x210 fs/ioctl.c:739 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x67/0xd1 ================================================================ The reason is that fb_info->var is being modified in fb_set_var(), and then fb_videomode_to_var() is called. If it fails to add the mode to fb_info->modelist, fb_set_var() returns error, but does not restore the old value of fb_info->var. Restore fb_info->var on failure the same way it is done earlier in the function. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Murad Masimov Signed-off-by: Helge Deller commit 17186f1f90d34fa701e4f14e6818305151637b9e Author: Murad Masimov Date: Mon Apr 28 18:34:06 2025 +0300 fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var If fb_add_videomode() in do_register_framebuffer() fails to allocate memory for fb_videomode, it will later lead to a null-ptr dereference in fb_videomode_to_var(), as the fb_info is registered while not having the mode in modelist that is expected to be there, i.e. the one that is described in fb_info->var. ================================================================ general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 1 PID: 30371 Comm: syz-executor.1 Not tainted 5.10.226-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:fb_videomode_to_var+0x24/0x610 drivers/video/fbdev/core/modedb.c:901 Call Trace: display_to_var+0x3a/0x7c0 drivers/video/fbdev/core/fbcon.c:929 fbcon_resize+0x3e2/0x8f0 drivers/video/fbdev/core/fbcon.c:2071 resize_screen drivers/tty/vt/vt.c:1176 [inline] vc_do_resize+0x53a/0x1170 drivers/tty/vt/vt.c:1263 fbcon_modechanged+0x3ac/0x6e0 drivers/video/fbdev/core/fbcon.c:2720 fbcon_update_vcs+0x43/0x60 drivers/video/fbdev/core/fbcon.c:2776 do_fb_ioctl+0x6d2/0x740 drivers/video/fbdev/core/fbmem.c:1128 fb_ioctl+0xe7/0x150 drivers/video/fbdev/core/fbmem.c:1203 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __x64_sys_ioctl+0x19a/0x210 fs/ioctl.c:739 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x67/0xd1 ================================================================ Even though fbcon_init() checks beforehand if fb_match_mode() in var_to_display() fails, it can not prevent the panic because fbcon_init() does not return error code. Considering this and the comment in the code about fb_match_mode() returning NULL - "This should not happen" - it is better to prevent registering the fb_info if its mode was not set successfully. Also move fb_add_videomode() closer to the beginning of do_register_framebuffer() to avoid having to do the cleanup on fail. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Murad Masimov Signed-off-by: Helge Deller commit 9c221db509695243f37fd68e5313a4c62eac9887 Author: Rujra Bhatt Date: Mon May 19 20:08:32 2025 +0530 fbdev: sstfb.rst: Fix spelling mistake Fix spelling: "tweeks" to "tweaks" Signed-off-by: Rujra Bhatt Signed-off-by: Helge Deller commit 3f6dae09fc8c306eb70fdfef70726e1f154e173a Author: Sergey Shtylyov Date: Wed May 14 23:35:58 2025 +0300 fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() In fb_find_mode_cvt(), iff mode->refresh somehow happens to be 0x80000000, cvt.f_refresh will become 0 when multiplying it by 2 due to overflow. It's then passed to fb_cvt_hperiod(), where it's used as a divider -- division by 0 will result in kernel oops. Add a sanity check for cvt.f_refresh to avoid such overflow... Found by Linux Verification Center (linuxtesting.org) with the Svace static analysis tool. Fixes: 96fe6a2109db ("[PATCH] fbdev: Add VESA Coordinated Video Timings (CVT) support") Signed-off-by: Sergey Shtylyov Signed-off-by: Helge Deller commit cedc1b63394a866bf8663a3e40f4546f1d28c8d8 Author: Kees Cook Date: Fri May 9 13:06:47 2025 -0700 fbcon: Make sure modelist not set on unregistered console It looks like attempting to write to the "store_modes" sysfs node will run afoul of unregistered consoles: UBSAN: array-index-out-of-bounds in drivers/video/fbdev/core/fbcon.c:122:28 index -1 is out of range for type 'fb_info *[32]' ... fbcon_info_from_console+0x192/0x1a0 drivers/video/fbdev/core/fbcon.c:122 fbcon_new_modelist+0xbf/0x2d0 drivers/video/fbdev/core/fbcon.c:3048 fb_new_modelist+0x328/0x440 drivers/video/fbdev/core/fbmem.c:673 store_modes+0x1c9/0x3e0 drivers/video/fbdev/core/fbsysfs.c:113 dev_attr_store+0x55/0x80 drivers/base/core.c:2439 static struct fb_info *fbcon_registered_fb[FB_MAX]; ... static signed char con2fb_map[MAX_NR_CONSOLES]; ... static struct fb_info *fbcon_info_from_console(int console) ... return fbcon_registered_fb[con2fb_map[console]]; If con2fb_map contains a -1 things go wrong here. Instead, return NULL, as callers of fbcon_info_from_console() are trying to compare against existing "info" pointers, so error handling should kick in correctly. Reported-by: syzbot+a7d4444e7b6e743572f7@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/679d0a8f.050a0220.163cdc.000c.GAE@google.com/ Signed-off-by: Kees Cook Signed-off-by: Helge Deller commit 864f9963ec6b4b76d104d595ba28110b87158003 Author: GONG Ruiqi Date: Sun Apr 27 10:53:03 2025 +0800 vgacon: Add check for vc_origin address range in vgacon_scroll() Our in-house Syzkaller reported the following BUG (twice), which we believed was the same issue with [1]: ================================================================== BUG: KASAN: slab-out-of-bounds in vcs_scr_readw+0xc2/0xd0 drivers/tty/vt/vt.c:4740 Read of size 2 at addr ffff88800f5bef60 by task syz.7.2620/12393 ... Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x72/0xa0 lib/dump_stack.c:106 print_address_description.constprop.0+0x6b/0x3d0 mm/kasan/report.c:364 print_report+0xba/0x280 mm/kasan/report.c:475 kasan_report+0xa9/0xe0 mm/kasan/report.c:588 vcs_scr_readw+0xc2/0xd0 drivers/tty/vt/vt.c:4740 vcs_write_buf_noattr drivers/tty/vt/vc_screen.c:493 [inline] vcs_write+0x586/0x840 drivers/tty/vt/vc_screen.c:690 vfs_write+0x219/0x960 fs/read_write.c:584 ksys_write+0x12e/0x260 fs/read_write.c:639 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x59/0x110 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x78/0xe2 ... Allocated by task 5614: kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:374 [inline] __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:383 kasan_kmalloc include/linux/kasan.h:201 [inline] __do_kmalloc_node mm/slab_common.c:1007 [inline] __kmalloc+0x62/0x140 mm/slab_common.c:1020 kmalloc include/linux/slab.h:604 [inline] kzalloc include/linux/slab.h:721 [inline] vc_do_resize+0x235/0xf40 drivers/tty/vt/vt.c:1193 vgacon_adjust_height+0x2d4/0x350 drivers/video/console/vgacon.c:1007 vgacon_font_set+0x1f7/0x240 drivers/video/console/vgacon.c:1031 con_font_set drivers/tty/vt/vt.c:4628 [inline] con_font_op+0x4da/0xa20 drivers/tty/vt/vt.c:4675 vt_k_ioctl+0xa10/0xb30 drivers/tty/vt/vt_ioctl.c:474 vt_ioctl+0x14c/0x1870 drivers/tty/vt/vt_ioctl.c:752 tty_ioctl+0x655/0x1510 drivers/tty/tty_io.c:2779 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl+0x12d/0x190 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x59/0x110 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x78/0xe2 Last potentially related work creation: kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 __kasan_record_aux_stack+0x94/0xa0 mm/kasan/generic.c:492 __call_rcu_common.constprop.0+0xc3/0xa10 kernel/rcu/tree.c:2713 netlink_release+0x620/0xc20 net/netlink/af_netlink.c:802 __sock_release+0xb5/0x270 net/socket.c:663 sock_close+0x1e/0x30 net/socket.c:1425 __fput+0x408/0xab0 fs/file_table.c:384 __fput_sync+0x4c/0x60 fs/file_table.c:465 __do_sys_close fs/open.c:1580 [inline] __se_sys_close+0x68/0xd0 fs/open.c:1565 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x59/0x110 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x78/0xe2 Second to last potentially related work creation: kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 __kasan_record_aux_stack+0x94/0xa0 mm/kasan/generic.c:492 __call_rcu_common.constprop.0+0xc3/0xa10 kernel/rcu/tree.c:2713 netlink_release+0x620/0xc20 net/netlink/af_netlink.c:802 __sock_release+0xb5/0x270 net/socket.c:663 sock_close+0x1e/0x30 net/socket.c:1425 __fput+0x408/0xab0 fs/file_table.c:384 task_work_run+0x154/0x240 kernel/task_work.c:239 exit_task_work include/linux/task_work.h:45 [inline] do_exit+0x8e5/0x1320 kernel/exit.c:874 do_group_exit+0xcd/0x280 kernel/exit.c:1023 get_signal+0x1675/0x1850 kernel/signal.c:2905 arch_do_signal_or_restart+0x80/0x3b0 arch/x86/kernel/signal.c:310 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x1b3/0x1e0 kernel/entry/common.c:218 do_syscall_64+0x66/0x110 arch/x86/entry/common.c:87 entry_SYSCALL_64_after_hwframe+0x78/0xe2 The buggy address belongs to the object at ffff88800f5be000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 2656 bytes to the right of allocated 1280-byte region [ffff88800f5be000, ffff88800f5be500) ... Memory state around the buggy address: ffff88800f5bee00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88800f5bee80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88800f5bef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff88800f5bef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88800f5bf000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== By analyzing the vmcore, we found that vc->vc_origin was somehow placed one line prior to vc->vc_screenbuf when vc was in KD_TEXT mode, and further writings to /dev/vcs caused out-of-bounds reads (and writes right after) in vcs_write_buf_noattr(). Our further experiments show that in most cases, vc->vc_origin equals to vga_vram_base when the console is in KD_TEXT mode, and it's around vc->vc_screenbuf for the KD_GRAPHICS mode. But via triggerring a TIOCL_SETVESABLANK ioctl beforehand, we can make vc->vc_origin be around vc->vc_screenbuf while the console is in KD_TEXT mode, and then by writing the special 'ESC M' control sequence to the tty certain times (depends on the value of `vc->state.y - vc->vc_top`), we can eventually move vc->vc_origin prior to vc->vc_screenbuf. Here's the PoC, tested on QEMU: ``` int main() { const int RI_NUM = 10; // should be greater than `vc->state.y - vc->vc_top` int tty_fd, vcs_fd; const char *tty_path = "/dev/tty0"; const char *vcs_path = "/dev/vcs"; const char escape_seq[] = "\x1bM"; // ESC + M const char trigger_seq[] = "Let's trigger an OOB write."; struct vt_sizes vt_size = { 70, 2 }; int blank = TIOCL_BLANKSCREEN; tty_fd = open(tty_path, O_RDWR); char vesa_mode[] = { TIOCL_SETVESABLANK, 1 }; ioctl(tty_fd, TIOCLINUX, vesa_mode); ioctl(tty_fd, TIOCLINUX, &blank); ioctl(tty_fd, VT_RESIZE, &vt_size); for (int i = 0; i < RI_NUM; ++i) write(tty_fd, escape_seq, sizeof(escape_seq) - 1); vcs_fd = open(vcs_path, O_RDWR); write(vcs_fd, trigger_seq, sizeof(trigger_seq)); close(vcs_fd); close(tty_fd); return 0; } ``` To solve this problem, add an address range validation check in vgacon_scroll(), ensuring vc->vc_origin never precedes vc_screenbuf. Reported-by: syzbot+9c09fda97a1a65ea859b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9c09fda97a1a65ea859b [1] Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Co-developed-by: Yi Yang Signed-off-by: Yi Yang Signed-off-by: GONG Ruiqi Signed-off-by: Helge Deller commit ede481f6dad47d40b7e561cfbc6c04286a9faf1a Author: Kees Cook Date: Fri Apr 25 23:23:06 2025 -0700 fbdev: arkfb: Cast ics5342_init() allocation type In preparation for making the kmalloc family of allocators type aware, we need to make sure that the returned type from the allocation matches the type of the variable being assigned. (Before, the allocator would always return "void *", which can be implicitly cast to any pointer type.) The assigned type is "struct dac_info *" but the returned type will be "struct ics5342_info *", which has a larger allocation size. This is by design, as struct ics5342_info contains struct dac_info as its first member. (patch slightly modified by Helge Deller) Signed-off-by: Kees Cook Signed-off-by: Helge Deller commit 34fe05cd2d0f4cc625afb656469a9838f02ca59e Author: Zijun Hu Date: Mon Apr 7 19:55:20 2025 +0800 fbdev: nvidiafb: Correct const string length in nvidiafb_setup() The actual length of const string "noaccel" is 7, but the strncmp() branch in nvidiafb_setup() wrongly hard codes it as 6. Fix by using actual length 7 as argument of the strncmp(). Signed-off-by: Zijun Hu Signed-off-by: Helge Deller commit c9b26429c8c7aa2836322aeab38be4254d166e02 Author: Andy Shevchenko Date: Thu Apr 24 14:56:52 2025 +0300 fbdev: atyfb: Remove unused PCI vendor ID The custom definition of PCI vendor ID in video/mach64.h is unused. Remove it. Note, that the proper one is available in pci_ids.h. Signed-off-by: Andy Shevchenko Signed-off-by: Helge Deller commit 67ebb5890a15e82f369df46e9411250252b5a98c Author: Colin Ian King Date: Fri Apr 18 13:51:35 2025 +0100 fbdev: carminefb: Fix spelling mistake of CARMINE_TOTAL_DIPLAY_MEM There is a spelling mistake in macro CARMINE_TOTAL_DIPLAY_MEM. Fix it. Signed-off-by: Colin Ian King Signed-off-by: Helge Deller commit 2be358790e15c34668f3694d4c3d1f2c5f29a709 Author: Bartosz Golaszewski Date: Tue Apr 8 09:42:56 2025 +0200 fbdev: via: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Reviewed-by: Linus Walleij Signed-off-by: Helge Deller commit 86aa94cd50b138be0dd872b0779fa3036e641881 Author: Dapeng Mi Date: Thu May 29 08:02:36 2025 +0000 perf/x86/intel: Fix incorrect MSR index calculations in intel_pmu_config_acr() The MSR offset calculations in intel_pmu_config_acr() are buggy. To calculate fixed counter MSR addresses in intel_pmu_config_acr(), the HW counter index "idx" is subtracted by INTEL_PMC_IDX_FIXED. This leads to the ACR mask value of fixed counters to be incorrectly saved to the positions of GP counters in acr_cfg_b[], e.g. For fixed counter 0, its ACR counter mask should be saved to acr_cfg_b[32], but it's saved to acr_cfg_b[0] incorrectly. Fix this issue. [ mingo: Clarified & improved the changelog. ] Fixes: ec980e4facef ("perf/x86/intel: Support auto counter reload") Signed-off-by: Dapeng Mi Signed-off-by: Ingo Molnar Reviewed-by: Kan Liang Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250529080236.2552247-2-dapeng1.mi@linux.intel.com commit 99850a1c93fe7ca40ad9efddc00acec6e85c5e48 Author: Steven Rostedt Date: Thu May 29 13:10:24 2025 -0400 x86/fpu: Remove unused trace events The following trace events are not used and defining them just wastes memory: x86_fpu_before_restore x86_fpu_after_restore x86_fpu_init_state Simply remove them. Signed-off-by: Steven Rostedt (Google) Signed-off-by: Ingo Molnar Cc: H. Peter Anvin Cc: Dave Hansen Cc: Linux Trace Kernel Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Oleg Nesterov Link: https://lore.kernel.org/all/20250529130138.544ffec4@gandalf.local.home # background Link: https://lore.kernel.org/r/20250529131024.7c2ef96f@gandalf.local.home # x86 submission commit 8bf722c684b31368a6f1fba7abcffb0da99722ed Merge: 03ebff0c837b36 99d232804405e3 Author: Linus Torvalds Date: Fri May 30 21:20:11 2025 -0700 Merge tag 'trace-ringbuffer-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull ring-buffer updates from Steven Rostedt: - Allow the persistent ring buffer to be memory mapped In the last merge window there was issues with the implementation of mapping the persistent ring buffer because it was assumed that the persistent memory was just physical memory without being part of the kernel virtual address space. But this was incorrect and the persistent ring buffer can be mapped the same way as the allocated ring buffer is mapped. The metadata for the persistent ring buffer is different than the normal ring buffer and the organization of mapping it to user space is a little different. Make the updates needed to the meta data to allow the persistent ring buffer to be mapped to user space. - Fix cpus_read_lock() with buffer->mutex and cpu_buffer->mapping_lock Mapping the ring buffer to user space uses the cpu_buffer->mapping_lock. The buffer->mutex can be taken when the mapping_lock is held, giving the locking order of: cpu_buffer->mapping_lock -->> buffer->mutex. But there also exists the ordering: buffer->mutex -->> cpus_read_lock() mm->mmap_lock -->> cpu_buffer->mapping_lock cpus_read_lock() -->> mm->mmap_lock causing a circular chain of: cpu_buffer->mapping_lock -> buffer->mutex -->> cpus_read_lock() -->> mm->mmap_lock -->> cpu_buffer->mapping_lock By moving the cpus_read_lock() outside the buffer->mutex where: cpus_read_lock() -->> buffer->mutex, breaks the deadlock chain. - Do not trigger WARN_ON() for commit overrun When the ring buffer is user space mapped and there's a "commit overrun" (where an interrupt preempted an event, and then added so many events it filled the buffer having to drop events when it hit the preempted event) a WARN_ON() was triggered if this was read via a memory mapped buffer. This is due to "missed events" being non zero when the reader page ended up with the commit page. The idea was, if the writer is on the reader page, there's only one page that has been written to and there should be no missed events. But if a commit overrun is done where the writer is off the commit page and looped around to the commit page causing missed events, it is possible that the reader page is the commit page with missed events. Instead of triggering a WARN_ON() when the reader page is the commit page with missed events, trigger it when the reader page is the tail_page with missed events. That's because the writer is always on the tail_page if an event was interrupted (which holds the commit event) and continues off the commit page. - Reset the persistent buffer if it is fully consumed On boot up, if the user fully consumes the last boot buffer of the persistent buffer, if it reboots without enabling it, there will still be events in the buffer which can cause confusion. Instead, reset the buffer when it is fully consumed, so that the data is not read again. - Clean up some goto out jumps There's a few cases that the code jumps to the "out:" label that simply returns a value. There used to be more work done at those labels but now that they simply return a value use a return instead of jumping to a label. - Use guard() to simplify some of the code Add guard() around some locking instead of jumping to a label to do the unlocking. - Use free() to simplify some of the code Use free(kfree) on variables that will get freed on error and use return_ptr() to return the variable when its not freed. There's one instance where free(kfree) simplifies the code on a temp variable that was allocated just for the function use. * tag 'trace-ringbuffer-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ring-buffer: Simplify functions with __free(kfree) to free allocations ring-buffer: Make ring_buffer_{un}map() simpler with guard(mutex) ring-buffer: Simplify ring_buffer_read_page() with guard() ring-buffer: Simplify reset_disabled_cpu_buffer() with use of guard() ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() ring-buffer: Removed unnecessary if() goto out where out is the next line tracing: Reset last-boot buffers when reading out all cpu buffers ring-buffer: Allow reserve_mem persistent ring buffers to be mmapped ring-buffer: Do not trigger WARN_ON() due to a commit_overrun ring-buffer: Move cpus_read_lock() outside of buffer->mutex commit 03ebff0c837b3636f0a33901e9b2cd66a13f5f3b Merge: 0f70f5b08a47a3 52b70e5b605c38 Author: Linus Torvalds Date: Fri May 30 21:11:21 2025 -0700 Merge tag 'microblaze-v6.16' of git://git.monstr.eu/linux-2.6-microblaze Pull microblaze update from Michal Simek: - Small OF update * tag 'microblaze-v6.16' of git://git.monstr.eu/linux-2.6-microblaze: microblaze: Use of_property_present() for non-boolean properties commit 558428921eddbd5083fe8116e31b8af460712f44 Merge: 44abca1fe32099 ead7f9b8de6563 Author: Jakub Kicinski Date: Fri May 30 19:53:53 2025 -0700 Merge branch 'net-fix-inet_proto_csum_replace_by_diff-for-ipv6' Paul Chaignon says: ==================== net: Fix inet_proto_csum_replace_by_diff for IPv6 This patchset fixes a bug that causes skb->csum to hold an incorrect value when calling inet_proto_csum_replace_by_diff for an IPv6 packet in CHECKSUM_COMPLETE state. This bug affects BPF helper bpf_l4_csum_replace and IPv6 ILA in adj-transport mode. In those cases, inet_proto_csum_replace_by_diff updates the L4 checksum field after an IPv6 address change. These two changes cancel each other in terms of checksum, so skb->csum shouldn't be updated. v2: https://lore.kernel.org/aCz84JU60wd8etiT@mail.gmail.com ==================== Link: https://patch.msgid.link/cover.1748509484.git.paul.chaignon@gmail.com Signed-off-by: Jakub Kicinski commit ead7f9b8de65632ef8060b84b0c55049a33cfea1 Author: Paul Chaignon Date: Thu May 29 12:28:35 2025 +0200 bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE In Cilium, we use bpf_csum_diff + bpf_l4_csum_replace to, among other things, update the L4 checksum after reverse SNATing IPv6 packets. That use case is however not currently supported and leads to invalid skb->csum values in some cases. This patch adds support for IPv6 address changes in bpf_l4_csum_update via a new flag. When calling bpf_l4_csum_replace in Cilium, it ends up calling inet_proto_csum_replace_by_diff: 1: void inet_proto_csum_replace_by_diff(__sum16 *sum, struct sk_buff *skb, 2: __wsum diff, bool pseudohdr) 3: { 4: if (skb->ip_summed != CHECKSUM_PARTIAL) { 5: csum_replace_by_diff(sum, diff); 6: if (skb->ip_summed == CHECKSUM_COMPLETE && pseudohdr) 7: skb->csum = ~csum_sub(diff, skb->csum); 8: } else if (pseudohdr) { 9: *sum = ~csum_fold(csum_add(diff, csum_unfold(*sum))); 10: } 11: } The bug happens when we're in the CHECKSUM_COMPLETE state. We've just updated one of the IPv6 addresses. The helper now updates the L4 header checksum on line 5. Next, it updates skb->csum on line 7. It shouldn't. For an IPv6 packet, the updates of the IPv6 address and of the L4 checksum will cancel each other. The checksums are set such that computing a checksum over the packet including its checksum will result in a sum of 0. So the same is true here when we update the L4 checksum on line 5. We'll update it as to cancel the previous IPv6 address update. Hence skb->csum should remain untouched in this case. The same bug doesn't affect IPv4 packets because, in that case, three fields are updated: the IPv4 address, the IP checksum, and the L4 checksum. The change to the IPv4 address and one of the checksums still cancel each other in skb->csum, but we're left with one checksum update and should therefore update skb->csum accordingly. That's exactly what inet_proto_csum_replace_by_diff does. This special case for IPv6 L4 checksums is also described atop inet_proto_csum_replace16, the function we should be using in this case. This patch introduces a new bpf_l4_csum_replace flag, BPF_F_IPV6, to indicate that we're updating the L4 checksum of an IPv6 packet. When the flag is set, inet_proto_csum_replace_by_diff will skip the skb->csum update. Fixes: 7d672345ed295 ("bpf: add generic bpf_csum_diff helper") Signed-off-by: Paul Chaignon Acked-by: Daniel Borkmann Link: https://patch.msgid.link/96a6bc3a443e6f0b21ff7b7834000e17fb549e05.1748509484.git.paul.chaignon@gmail.com Signed-off-by: Jakub Kicinski commit 6043b794c7668c19dabc4a93c75b924a19474d59 Author: Paul Chaignon Date: Thu May 29 12:28:05 2025 +0200 net: Fix checksum update for ILA adj-transport During ILA address translations, the L4 checksums can be handled in different ways. One of them, adj-transport, consist in parsing the transport layer and updating any found checksum. This logic relies on inet_proto_csum_replace_by_diff and produces an incorrect skb->csum when in state CHECKSUM_COMPLETE. This bug can be reproduced with a simple ILA to SIR mapping, assuming packets are received with CHECKSUM_COMPLETE: $ ip a show dev eth0 14: eth0@if15: mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 62:ae:35:9e:0f:8d brd ff:ff:ff:ff:ff:ff link-netnsid 0 inet6 3333:0:0:1::c078/64 scope global valid_lft forever preferred_lft forever inet6 fd00:10:244:1::c078/128 scope global nodad valid_lft forever preferred_lft forever inet6 fe80::60ae:35ff:fe9e:f8d/64 scope link proto kernel_ll valid_lft forever preferred_lft forever $ ip ila add loc_match fd00:10:244:1 loc 3333:0:0:1 \ csum-mode adj-transport ident-type luid dev eth0 Then I hit [fd00:10:244:1::c078]:8000 with a server listening only on [3333:0:0:1::c078]:8000. With the bug, the SYN packet is dropped with SKB_DROP_REASON_TCP_CSUM after inet_proto_csum_replace_by_diff changed skb->csum. The translation and drop are visible on pwru [1] traces: IFACE TUPLE FUNC eth0:9 [fd00:10:244:3::3d8]:51420->[fd00:10:244:1::c078]:8000(tcp) ipv6_rcv eth0:9 [fd00:10:244:3::3d8]:51420->[fd00:10:244:1::c078]:8000(tcp) ip6_rcv_core eth0:9 [fd00:10:244:3::3d8]:51420->[fd00:10:244:1::c078]:8000(tcp) nf_hook_slow eth0:9 [fd00:10:244:3::3d8]:51420->[fd00:10:244:1::c078]:8000(tcp) inet_proto_csum_replace_by_diff eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) tcp_v6_early_demux eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) ip6_route_input eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) ip6_input eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) ip6_input_finish eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) ip6_protocol_deliver_rcu eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) raw6_local_deliver eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) ipv6_raw_deliver eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) tcp_v6_rcv eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) __skb_checksum_complete eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) kfree_skb_reason(SKB_DROP_REASON_TCP_CSUM) eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) skb_release_head_state eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) skb_release_data eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) skb_free_head eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) kfree_skbmem This is happening because inet_proto_csum_replace_by_diff is updating skb->csum when it shouldn't. The L4 checksum is updated such that it "cancels" the IPv6 address change in terms of checksum computation, so the impact on skb->csum is null. Note this would be different for an IPv4 packet since three fields would be updated: the IPv4 address, the IP checksum, and the L4 checksum. Two would cancel each other and skb->csum would still need to be updated to take the L4 checksum change into account. This patch fixes it by passing an ipv6 flag to inet_proto_csum_replace_by_diff, to skip the skb->csum update if we're in the IPv6 case. Note the behavior of the only other user of inet_proto_csum_replace_by_diff, the BPF subsystem, is left as is in this patch and fixed in the subsequent patch. With the fix, using the reproduction from above, I can confirm skb->csum is not touched by inet_proto_csum_replace_by_diff and the TCP SYN proceeds to the application after the ILA translation. Link: https://github.com/cilium/pwru [1] Fixes: 65d7ab8de582 ("net: Identifier Locator Addressing module") Signed-off-by: Paul Chaignon Acked-by: Daniel Borkmann Link: https://patch.msgid.link/b5539869e3550d46068504feb02d37653d939c0b.1748509484.git.paul.chaignon@gmail.com Signed-off-by: Jakub Kicinski commit 44abca1fe32099ec8872488add959bed24d1d7af Merge: 3ec52330497664 cbefe2ffa77845 Author: Jakub Kicinski Date: Fri May 30 19:33:30 2025 -0700 Merge branch 'net-stmmac-prevent-div-by-0' Alexis Lothoré says: ==================== net: stmmac: prevent div by 0 fix a small splat I am observing on a STM32MP157 platform at boot (see commit 1) due to a division by 0. v3: https://lore.kernel.org/20250528-stmmac_tstamp_div-v3-0-b525ecdfd84c@bootlin.com v2: https://lore.kernel.org/20250527-stmmac_tstamp_div-v2-1-663251b3b542@bootlin.com v1: https://lore.kernel.org/20250523-stmmac_tstamp_div-v1-1-bca8a5a3a477@bootlin.com ==================== Link: https://patch.msgid.link/20250529-stmmac_tstamp_div-v4-0-d73340a794d5@bootlin.com Signed-off-by: Jakub Kicinski commit cbefe2ffa7784525ec5d008ba87c7add19ec631a Author: Alexis Lothoré Date: Thu May 29 11:07:24 2025 +0200 net: stmmac: make sure that ptp_rate is not 0 before configuring EST If the ptp_rate recorded earlier in the driver happens to be 0, this bogus value will propagate up to EST configuration, where it will trigger a division by 0. Prevent this division by 0 by adding the corresponding check and error code. Suggested-by: Maxime Chevallier Signed-off-by: Alexis Lothoré Fixes: 8572aec3d0dc ("net: stmmac: Add basic EST support for XGMAC") Link: https://patch.msgid.link/20250529-stmmac_tstamp_div-v4-2-d73340a794d5@bootlin.com Signed-off-by: Jakub Kicinski commit 030ce919e114a111e83b7976ecb3597cefd33f26 Author: Alexis Lothoré Date: Thu May 29 11:07:23 2025 +0200 net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping The stmmac platform drivers that do not open-code the clk_ptp_rate value after having retrieved the default one from the device-tree can end up with 0 in clk_ptp_rate (as clk_get_rate can return 0). It will eventually propagate up to PTP initialization when bringing up the interface, leading to a divide by 0: Division by zero in kernel. CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.30-00001-g48313bd5768a #22 Hardware name: STM32 (Device Tree Support) Call trace: unwind_backtrace from show_stack+0x18/0x1c show_stack from dump_stack_lvl+0x6c/0x8c dump_stack_lvl from Ldiv0_64+0x8/0x18 Ldiv0_64 from stmmac_init_tstamp_counter+0x190/0x1a4 stmmac_init_tstamp_counter from stmmac_hw_setup+0xc1c/0x111c stmmac_hw_setup from __stmmac_open+0x18c/0x434 __stmmac_open from stmmac_open+0x3c/0xbc stmmac_open from __dev_open+0xf4/0x1ac __dev_open from __dev_change_flags+0x1cc/0x224 __dev_change_flags from dev_change_flags+0x24/0x60 dev_change_flags from ip_auto_config+0x2e8/0x11a0 ip_auto_config from do_one_initcall+0x84/0x33c do_one_initcall from kernel_init_freeable+0x1b8/0x214 kernel_init_freeable from kernel_init+0x24/0x140 kernel_init from ret_from_fork+0x14/0x28 Exception stack(0xe0815fb0 to 0xe0815ff8) Prevent this division by 0 by adding an explicit check and error log about the actual issue. While at it, remove the same check from stmmac_ptp_register, which then becomes duplicate Fixes: 19d857c9038e ("stmmac: Fix calculations for ptp counters when clock input = 50Mhz.") Signed-off-by: Alexis Lothoré Reviewed-by: Yanteng Si Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20250529-stmmac_tstamp_div-v4-1-d73340a794d5@bootlin.com Signed-off-by: Jakub Kicinski commit 3ec523304976648b45a3eef045e97d17122ff1b2 Author: Saurabh Sengar Date: Thu May 29 03:18:30 2025 -0700 hv_netvsc: fix potential deadlock in netvsc_vf_setxdp() The MANA driver's probe registers netdevice via the following call chain: mana_probe() register_netdev() register_netdevice() register_netdevice() calls notifier callback for netvsc driver, holding the netdev mutex via netdev_lock_ops(). Further this netvsc notifier callback end up attempting to acquire the same lock again in dev_xdp_propagate() leading to deadlock. netvsc_netdev_event() netvsc_vf_setxdp() dev_xdp_propagate() This deadlock was not observed so far because net_shaper_ops was never set, and thus the lock was effectively a no-op in this case. Fix this by using netif_xdp_propagate() instead of dev_xdp_propagate() to avoid recursive locking in this path. And, since no deadlock is observed on the other path which is via netvsc_probe, add the lock exclusivly for that path. Also, clean up the unregistration path by removing the unnecessary call to netvsc_vf_setxdp(), since unregister_netdevice_many_notify() already performs this cleanup via dev_xdp_uninstall(). Fixes: 97246d6d21c2 ("net: hold netdev instance lock during ndo_bpf") Cc: stable@vger.kernel.org Signed-off-by: Saurabh Sengar Tested-by: Erni Sri Satya Vennela Reviewed-by: Haiyang Zhang Reviewed-by: Subbaraya Sundeep Link: https://patch.msgid.link/1748513910-23963-1-git-send-email-ssengar@linux.microsoft.com Signed-off-by: Jakub Kicinski commit c1f4cb8a8d48db5c8396e1976c5b2e7922d944b9 Author: Pranjal Shrivastava Date: Wed May 28 21:10:58 2025 +0000 net: Fix net_devmem_bind_dmabuf for non-devmem configs Fix the signature of the net_devmem_bind_dmabuf API for CONFIG_NET_DEVMEM=n. Fixes: bd61848900bf ("net: devmem: Implement TX path") Signed-off-by: Pranjal Shrivastava Link: https://patch.msgid.link/20250528211058.1826608-1-praan@google.com Signed-off-by: Jakub Kicinski commit efdddc4484859082da6c7877ed144c8121c8ea55 Author: Álvaro Fernández Rojas Date: Thu May 29 14:44:06 2025 +0200 net: dsa: tag_brcm: legacy: fix pskb_may_pull length BRCM_LEG_PORT_ID was incorrectly used for pskb_may_pull length. The correct check is BRCM_LEG_TAG_LEN + VLAN_HLEN, or 10 bytes. Fixes: 964dbf186eaa ("net: dsa: tag_brcm: add support for legacy tags") Signed-off-by: Álvaro Fernández Rojas Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20250529124406.2513779-1-noltari@gmail.com Signed-off-by: Jakub Kicinski commit d1a866d5530698a4be4214048c2282c7e5bfcdac Merge: d3faab9b5a6a04 03dba9cea72f97 Author: Jakub Kicinski Date: Fri May 30 19:15:58 2025 -0700 Merge tag 'for-net-2025-05-30' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - hci_qca: move the SoC type check to the right place - MGMT: reject malformed HCI_CMD_SYNC commands - btnxpuart: Fix missing devm_request_irq() return value check - L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION * tag 'for-net-2025-05-30' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION Bluetooth: hci_qca: move the SoC type check to the right place Bluetooth: btnxpuart: Fix missing devm_request_irq() return value check Bluetooth: MGMT: reject malformed HCI_CMD_SYNC commands ==================== Link: https://patch.msgid.link/20250530174835.405726-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit ee9a4e92799d72b1a2237d76065562b1f1cf334f Author: Andrea Righi Date: Fri May 30 17:46:29 2025 +0200 sched_ext: idle: Properly handle invalid prev_cpu during idle selection The default idle selection policy doesn't properly handle the case where @prev_cpu is not part of the task's allowed CPUs. In this situation, it may return an idle CPU that is not usable by the task, breaking the assumption that the returned CPU must always be within the allowed cpumask, causing inefficiencies or even stalls in certain cases. This issue can arise in the following cases: - The task's affinity may have changed by the time the function is invoked, especially now that the idle selection logic can be used from multiple contexts (i.e., BPF test_run call). - The BPF scheduler may provide a @prev_cpu that is not part of the allowed mask, either unintentionally or as a placement hint. In fact @prev_cpu may not necessarily refer to the CPU the task last ran on, but it can also be considered as a target CPU that the scheduler wishes to use for the task. Therefore, enforce the right behavior by always checking whether @prev_cpu is in the allowed mask, when using scx_bpf_select_cpu_and(), and it's also usable by the task (@p->cpus_ptr). If it is not, try to find a valid CPU nearby @prev_cpu, following the usual locality-aware fallback path (SMT, LLC, node, allowed CPUs). This ensures the returned CPU is always allowed, improving robustness to affinity changes and invalid scheduler hints, while preserving locality as much as possible. Fixes: a730e3f7a48bc ("sched_ext: idle: Consolidate default idle CPU selection kfuncs") Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit c853d18706de8c9525126b362f747d2e480e93df Author: JP Kobryn Date: Wed May 28 16:51:30 2025 -0700 cgroup: adjust criteria for rstat subsystem cpu lock access Previously it was found that on uniprocessor machines the size of raw_spinlock_t could be zero so a pre-processor conditional was used to avoid the allocation of ss->rstat_ss_cpu_lock. The conditional did not take into account cases where lock debugging features were enabled. Cover these cases along with the original non-smp case by explicitly using the size of size of the lock type as criteria for allocation/access where applicable. Signed-off-by: JP Kobryn Fixes: 748922dcfabd "cgroup: use subsystem-specific rstat locks to avoid contention" Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202505281034.7ae1668d-lkp@intel.com Reviewed-by: Shakeel Butt Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit a95ef0199e80f3384eb992889322957d26c00102 Author: Dan Carpenter Date: Fri May 30 16:13:32 2025 -0700 Input: ims-pcu - check record size in ims_pcu_flash_firmware() The "len" variable comes from the firmware and we generally do trust firmware, but it's always better to double check. If the "len" is too large it could result in memory corruption when we do "memcpy(fragment->data, rec->data, len);" Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/131fd1ae92c828ee9f4fa2de03d8c210ae1f3524.1748463049.git.dan.carpenter@linaro.org Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 8f38219fa139623c29db2cb0f17d0a197a86e344 Author: Gatien Chevallier Date: Fri May 30 16:09:23 2025 -0700 Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() gpio_keys_irq_isr() and gpio_keys_irq_timer() access the same resources. There could be a concurrent access if a GPIO interrupt occurs in parallel of a HR timer interrupt. Guard back those resources with a spinlock. Fixes: 019002f20cb5 ("Input: gpio-keys - use hrtimer for release timer") Signed-off-by: Gatien Chevallier Link: https://lore.kernel.org/r/20250528-gpio_keys_preempt_rt-v2-2-3fc55a9c3619@foss.st.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit f4a8f561d08e39f7833d4a278ebfb12a41eef15f Author: Fabrice Gasnier Date: Fri May 30 15:36:43 2025 -0700 Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT When enabling PREEMPT_RT, the gpio_keys_irq_timer() callback runs in hard irq context, but the input_event() takes a spin_lock, which isn't allowed there as it is converted to a rt_spin_lock(). [ 4054.289999] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 [ 4054.290028] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/0 ... [ 4054.290195] __might_resched+0x13c/0x1f4 [ 4054.290209] rt_spin_lock+0x54/0x11c [ 4054.290219] input_event+0x48/0x80 [ 4054.290230] gpio_keys_irq_timer+0x4c/0x78 [ 4054.290243] __hrtimer_run_queues+0x1a4/0x438 [ 4054.290257] hrtimer_interrupt+0xe4/0x240 [ 4054.290269] arch_timer_handler_phys+0x2c/0x44 [ 4054.290283] handle_percpu_devid_irq+0x8c/0x14c [ 4054.290297] handle_irq_desc+0x40/0x58 [ 4054.290307] generic_handle_domain_irq+0x1c/0x28 [ 4054.290316] gic_handle_irq+0x44/0xcc Considering the gpio_keys_irq_isr() can run in any context, e.g. it can be threaded, it seems there's no point in requesting the timer isr to run in hard irq context. Relax the hrtimer not to use the hard context. Fixes: 019002f20cb5 ("Input: gpio-keys - use hrtimer for release timer") Suggested-by: Sebastian Andrzej Siewior Signed-off-by: Fabrice Gasnier Signed-off-by: Gatien Chevallier Link: https://lore.kernel.org/r/20250528-gpio_keys_preempt_rt-v2-1-3fc55a9c3619@foss.st.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 0f70f5b08a47a3bc1a252e5f451a137cde7c98ce Merge: edb94482e9d6da 2dbf6e0df447d1 Author: Linus Torvalds Date: Fri May 30 15:38:29 2025 -0700 Merge tag 'pull-automount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull automount updates from Al Viro: "Automount wart removal A bunch of odd boilerplate gone from instances - the reason for those was the need to protect the yet-to-be-attched mount from mark_mounts_for_expiry() deciding to take it out. But that's easy to detect and take care of in mark_mounts_for_expiry() itself; no need to have every instance simulate mount being busy by grabbing an extra reference to it, with finish_automount() undoing that once it attaches that mount. Should've done it that way from the very beginning... This is a flagday change, thankfully there are very few instances. vfs_submount() is gone - its sole remaining user (trace_automount) had been switched to saner primitives" * tag 'pull-automount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: kill vfs_submount() saner calling conventions for ->d_automount() commit e8fe33fdd797e22c85d7cda97e1ee8f27b09a609 Author: George Anthony Vernon Date: Mon May 26 14:59:52 2025 +0100 Input: amijoy - make headings compliant w/ guidelines in documentation Make heading adornments compliant with the guidelines to improve organisation of the page. Signed-off-by: George Anthony Vernon Reviewed-by: Bagas Sanjaya Link: https://lore.kernel.org/r/20250526135957.180254-5-contact@gvernon.com Signed-off-by: Dmitry Torokhov commit 11172ec55b4c827052985407abf6d909b5266fd3 Author: George Anthony Vernon Date: Mon May 26 14:59:51 2025 +0100 Input: amijoy - fix grammar in documentation Make small grammar fixes to Amiga joystick documentation. Signed-off-by: George Anthony Vernon Reviewed-by: Bagas Sanjaya Link: https://lore.kernel.org/r/20250526135957.180254-4-contact@gvernon.com Signed-off-by: Dmitry Torokhov commit ed1d9c2b0dbc3c2d4b86f006e39d2c0ca8ac15c8 Author: George Anthony Vernon Date: Mon May 26 14:59:50 2025 +0100 Input: amijoy - fix Amiga 4-joystick adapter pinout in documentation Pinout incorrectly duplicated pin 18, correct this. Signed-off-by: George Anthony Vernon Link: https://lore.kernel.org/r/20250526135957.180254-3-contact@gvernon.com Signed-off-by: Dmitry Torokhov commit fb81e4738ec9d727830be2787556932446271369 Author: George Anthony Vernon Date: Mon May 26 14:59:49 2025 +0100 Input: amijoy - fix broken table formatting in documentation Missing '+' led to unintended spanning cell. Correct this. Signed-off-by: George Anthony Vernon Reviewed-by: Bagas Sanjaya Link: https://lore.kernel.org/r/20250526135957.180254-2-contact@gvernon.com Signed-off-by: Dmitry Torokhov commit edb94482e9d6da6e397e8b1cd0400d673b24fd35 Merge: a82ba839915926 b70cb459890b75 Author: Linus Torvalds Date: Fri May 30 15:07:55 2025 -0700 Merge tag 'pull-ufs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull UFS updates from Al Viro: "The bulk of this is Eric's conversion of UFS to new mount API, with a bit of cleanups from me. I hoped to get stricter sanity checks on superblock flags into that pile, but... next cycle, hopefully" * tag 'pull-ufs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: ufs: convert ufs to the new mount API ufs: reject multiple conflicting -o ufstype=... on mount ufs: split ->s_mount_opt - don't mix flavour and on-error commit a82ba839915926f8713183fd023c6d9357bae26c Merge: 724b03ee96b8d4 3b5260d12b1fe7 Author: Linus Torvalds Date: Fri May 30 15:04:11 2025 -0700 Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull mount propagation fix from Al Viro: "6.15 allowed mount propagation to destinations in detached trees; unfortunately, that breaks existing userland, so the old behaviour needs to be restored. It's not exactly a revert - the original behaviour had a bug, where existence of detached tree might disrupt propagation between locations not in detached trees. Thankfully, userland did not depend upon that bug, so we want to keep the fix" * tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: Don't propagate mounts into detached trees commit ec49e253322bf29e721c6153d9e7be95eef33b33 Author: Niklas Cassel Date: Tue May 6 09:39:39 2025 +0200 PCI: qcom: Replace PERST# sleep time with proper macro Replace the PERST# sleep time with the proper macro (PCIE_T_PVPERL_MS). No functional change. Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Wilfred Mallawa Reviewed-by: Hans Zhang <18255117159@163.com> Reviewed-by: Krishna Chaitanya Chundru Link: https://patch.msgid.link/20250506073934.433176-10-cassel@kernel.org commit d34719d0e81f5bf1750931562a36a6f3fa6512bc Author: Niklas Cassel Date: Tue May 6 09:39:38 2025 +0200 PCI: dw-rockchip: Replace PERST# sleep time with proper macro Replace the PERST# sleep time with the proper macro (PCIE_T_PVPERL_MS). No functional change. Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Laszlo Fiat Reviewed-by: Hans Zhang <18255117159@163.com> Reviewed-by: Wilfred Mallawa Link: https://patch.msgid.link/20250506073934.433176-9-cassel@kernel.org commit 9dc63d8ff182150d7d7b318ab9389702a2c0a292 Author: Emil Tantilov Date: Thu May 8 11:47:15 2025 -0700 idpf: avoid mailbox timeout delays during reset Mailbox operations are not possible while the driver is in reset. Operations that require MBX exchange with the control plane will result in long delays if executed while a reset is in progress: ethtool -L combined 8& echo 1 > /sys/class/net//device/reset idpf 0000:83:00.0: HW reset detected idpf 0000:83:00.0: Device HW Reset initiated idpf 0000:83:00.0: Transaction timed-out (op:504 cookie:be00 vc_op:504 salt:be timeout:2000ms) idpf 0000:83:00.0: Transaction timed-out (op:508 cookie:bf00 vc_op:508 salt:bf timeout:2000ms) idpf 0000:83:00.0: Transaction timed-out (op:512 cookie:c000 vc_op:512 salt:c0 timeout:2000ms) idpf 0000:83:00.0: Transaction timed-out (op:510 cookie:c100 vc_op:510 salt:c1 timeout:2000ms) idpf 0000:83:00.0: Transaction timed-out (op:509 cookie:c200 vc_op:509 salt:c2 timeout:60000ms) idpf 0000:83:00.0: Transaction timed-out (op:509 cookie:c300 vc_op:509 salt:c3 timeout:60000ms) idpf 0000:83:00.0: Transaction timed-out (op:505 cookie:c400 vc_op:505 salt:c4 timeout:60000ms) idpf 0000:83:00.0: Failed to configure queues for vport 0, -62 Disable mailbox communication in case of a reset, unless it's done during a driver load, where the virtchnl operations are needed to configure the device. Fixes: 8077c727561aa ("idpf: add controlq init and reset checks") Co-developed-by: Joshua Hay Signed-off-by: Joshua Hay Signed-off-by: Emil Tantilov Reviewed-by: Ahmed Zaki Reviewed-by: Aleksandr Loktionov Reviewed-by: Simon Horman Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit 7292af042bcf22e2c18b96ed250f78498a5b28ab Author: Brian Vazquez Date: Thu May 1 17:06:17 2025 +0000 idpf: fix a race in txq wakeup Add a helper function to correctly handle the lockless synchronization when the sender needs to block. The paradigm is if (no_resources()) { stop_queue(); barrier(); if (!no_resources()) restart_queue(); } netif_subqueue_maybe_stop already handles the paradigm correctly, but the code split the check for resources in three parts, the first one (descriptors) followed the protocol, but the other two (completions and tx_buf) were only doing the first part and so race prone. Luckily netif_subqueue_maybe_stop macro already allows you to use a function to evaluate the start/stop conditions so the fix only requires the right helper function to evaluate all the conditions at once. The patch removes idpf_tx_maybe_stop_common since it's no longer needed and instead adjusts separately the conditions for singleq and splitq. Note that idpf_tx_buf_hw_update doesn't need to check for resources since that will be covered in idpf_tx_splitq_frame. To reproduce: Reduce the threshold for pending completions to increase the chances of hitting this pause by changing your kernel: drivers/net/ethernet/intel/idpf/idpf_txrx.h -#define IDPF_TX_COMPLQ_OVERFLOW_THRESH(txcq) ((txcq)->desc_count >> 1) +#define IDPF_TX_COMPLQ_OVERFLOW_THRESH(txcq) ((txcq)->desc_count >> 4) Use pktgen to force the host to push small pkts very aggressively: ./pktgen_sample02_multiqueue.sh -i eth1 -s 100 -6 -d $IP -m $MAC \ -p 10000-10000 -t 16 -n 0 -v -x -c 64 Fixes: 6818c4d5b3c2 ("idpf: add splitq start_xmit") Reviewed-by: Jacob Keller Reviewed-by: Madhu Chittim Signed-off-by: Josh Hay Signed-off-by: Brian Vazquez Signed-off-by: Luigi Rizzo Reviewed-by: Simon Horman Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit 73145e6d81070d34a21431c9e0d7aaf2f29ca048 Author: Michal Kubiak Date: Tue May 13 12:55:29 2025 +0200 ice: fix rebuilding the Tx scheduler tree for large queue counts The current implementation of the Tx scheduler allows the tree to be rebuilt as the user adds more Tx queues to the VSI. In such a case, additional child nodes are added to the tree to support the new number of queues. Unfortunately, this algorithm does not take into account that the limit of the VSI support node may be exceeded, so an additional node in the VSI layer may be required to handle all the requested queues. Such a scenario occurs when adding XDP Tx queues on machines with many CPUs. Although the driver still respects the queue limit returned by the FW, the Tx scheduler was unable to add those queues to its tree and returned one of the errors below. Such a scenario occurs when adding XDP Tx queues on machines with many CPUs (e.g. at least 321 CPUs, if there is already 128 Tx/Rx queue pairs). Although the driver still respects the queue limit returned by the FW, the Tx scheduler was unable to add those queues to its tree and returned the following errors: Failed VSI LAN queue config for XDP, error: -5 or: Failed to set LAN Tx queue context, error: -22 Fix this problem by extending the tree rebuild algorithm to check if the current VSI node can support the requested number of queues. If it cannot, create as many additional VSI support nodes as necessary to handle all the required Tx queues. Symmetrically, adjust the VSI node removal algorithm to remove all nodes associated with the given VSI. Also, make the search for the next free VSI node more restrictive. That is, add queue group nodes only to the VSI support nodes that have a matching VSI handle. Finally, fix the comment describing the tree update algorithm to better reflect the current scenario. Fixes: b0153fdd7e8a ("ice: update VSI config dynamically") Reviewed-by: Dawid Osuchowski Reviewed-by: Przemek Kitszel Signed-off-by: Michal Kubiak Reviewed-by: Simon Horman Tested-by: Jesse Brandeburg Tested-by: Saritha Sanigani (A Contingent Worker at Intel) Signed-off-by: Tony Nguyen commit 6fa2942578472c9cab13a8fc1dae0d830193e0a1 Author: Michal Kubiak Date: Tue May 13 12:55:28 2025 +0200 ice: create new Tx scheduler nodes for new queues only The current implementation of the Tx scheduler tree attempts to create nodes for all Tx queues, ignoring the fact that some queues may already exist in the tree. For example, if the VSI already has 128 Tx queues and the user requests for 16 new queues, the Tx scheduler will compute the tree for 272 queues (128 existing queues + 144 new queues), instead of 144 queues (128 existing queues and 16 new queues). Fix that by modifying the node count calculation algorithm to skip the queues that already exist in the tree. Fixes: 5513b920a4f7 ("ice: Update Tx scheduler tree for VSI multi-Tx queue support") Reviewed-by: Dawid Osuchowski Reviewed-by: Przemek Kitszel Reviewed-by: Jacob Keller Signed-off-by: Michal Kubiak Reviewed-by: Simon Horman Tested-by: Jesse Brandeburg Tested-by: Saritha Sanigani (A Contingent Worker at Intel) Signed-off-by: Tony Nguyen commit 0153f36041b8e52019ebfa8629c13bf8f9b0a951 Author: Michal Kubiak Date: Tue May 13 12:55:27 2025 +0200 ice: fix Tx scheduler error handling in XDP callback When the XDP program is loaded, the XDP callback adds new Tx queues. This means that the callback must update the Tx scheduler with the new queue number. In the event of a Tx scheduler failure, the XDP callback should also fail and roll back any changes previously made for XDP preparation. The previous implementation had a bug that not all changes made by the XDP callback were rolled back. This caused the crash with the following call trace: [ +9.549584] ice 0000:ca:00.0: Failed VSI LAN queue config for XDP, error: -5 [ +0.382335] Oops: general protection fault, probably for non-canonical address 0x50a2250a90495525: 0000 [#1] SMP NOPTI [ +0.010710] CPU: 103 UID: 0 PID: 0 Comm: swapper/103 Not tainted 6.14.0-net-next-mar-31+ #14 PREEMPT(voluntary) [ +0.010175] Hardware name: Intel Corporation M50CYP2SBSTD/M50CYP2SBSTD, BIOS SE5C620.86B.01.01.0005.2202160810 02/16/2022 [ +0.010946] RIP: 0010:__ice_update_sample+0x39/0xe0 [ice] [...] [ +0.002715] Call Trace: [ +0.002452] [ +0.002021] ? __die_body.cold+0x19/0x29 [ +0.003922] ? die_addr+0x3c/0x60 [ +0.003319] ? exc_general_protection+0x17c/0x400 [ +0.004707] ? asm_exc_general_protection+0x26/0x30 [ +0.004879] ? __ice_update_sample+0x39/0xe0 [ice] [ +0.004835] ice_napi_poll+0x665/0x680 [ice] [ +0.004320] __napi_poll+0x28/0x190 [ +0.003500] net_rx_action+0x198/0x360 [ +0.003752] ? update_rq_clock+0x39/0x220 [ +0.004013] handle_softirqs+0xf1/0x340 [ +0.003840] ? sched_clock_cpu+0xf/0x1f0 [ +0.003925] __irq_exit_rcu+0xc2/0xe0 [ +0.003665] common_interrupt+0x85/0xa0 [ +0.003839] [ +0.002098] [ +0.002106] asm_common_interrupt+0x26/0x40 [ +0.004184] RIP: 0010:cpuidle_enter_state+0xd3/0x690 Fix this by performing the missing unmapping of XDP queues from q_vectors and setting the XDP rings pointer back to NULL after all those queues are released. Also, add an immediate exit from the XDP callback in case of ring preparation failure. Fixes: efc2214b6047 ("ice: Add support for XDP") Reviewed-by: Dawid Osuchowski Reviewed-by: Przemek Kitszel Reviewed-by: Jacob Keller Signed-off-by: Michal Kubiak Reviewed-by: Aleksandr Loktionov Reviewed-by: Simon Horman Tested-by: Jesse Brandeburg Tested-by: Saritha Sanigani (A Contingent Worker at Intel) Signed-off-by: Tony Nguyen commit 724b03ee96b8d45310d89c9c3b0aa5ee0dbb72f7 Merge: 1fbbb629452ca1 46550e2b878d60 Author: Linus Torvalds Date: Fri May 30 12:42:57 2025 -0700 Merge tag 'efi-next-for-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI updates from Ard Biesheuvel: "Not a lot going on in the EFI tree this cycle. The only thing that stands out is the new support for SBAT metadata, which was a bit contentious when it was first proposed, because in the initial incarnation, it would have required us to maintain a revocation index, and bump it each time a vulnerability affecting UEFI secure boot got fixed. This was shot down for obvious reasons. This time, only the changes needed to emit the SBAT section into the PE/COFF image are being carried upstream, and it is up to the distros to decide what to put in there when creating and signing the build. This only has the EFI zboot bits (which the distros will be using for arm64); the x86 bzImage changes should be arriving next cycle, presumably via the -tip tree. Summary: - Add support for emitting a .sbat section into the EFI zboot image, so that downstreams can easily include revocation metadata in the signed EFI images - Align PE symbolic constant names with other projects - Bug fix for the efi_test module - Log the physical address and size of the EFI memory map when failing to map it - A kerneldoc fix for the EFI stub code" * tag 'efi-next-for-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: include: pe.h: Fix PE definitions efi/efi_test: Fix missing pending status update in getwakeuptime efi: zboot specific mechanism for embedding SBAT section efi/libstub: Describe missing 'out' parameter in efi_load_initrd efi: Improve logging around memmap init commit 1fbbb629452ca16909b440b9217a28f42202dc60 Merge: 976aa630da5b55 f4c606df263b6d Author: Linus Torvalds Date: Fri May 30 12:11:46 2025 -0700 Merge tag 'acpi-6.16-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "These address issues introduced by recent ACPI changes merged previously: - Unbreak acpi_ut_safe_strncpy() by restoring its previous behavior changed incorrectly by a recent update (Ahmed Salem) - Make a new static checker warning in the recently introduced ACPI MRRM table parser go away (Dan Carpenter) - Fix ACPI table referece leak in error path of einj_probe() (Dan Carpenter)" * tag 'acpi-6.16-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPICA: Switch back to using strncpy() in acpi_ut_safe_strncpy() ACPI: MRRM: Silence error code static checker warning ACPI: APEI: EINJ: Clean up on error in einj_probe() commit 976aa630da5b5508c278487db31b873ddf6bae8f Merge: 8477ab143069c6 3d031d0d8daab8 Author: Linus Torvalds Date: Fri May 30 11:54:29 2025 -0700 Merge tag 'pm-6.16-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more power management updates from Rafael Wysocki: "These revert an x86 commit that introduced a nasty power regression on some systems, fix PSCI cpuidle driver and ACPI cpufreq driver regressions, add Rust abstractions for cpufreq, OPP, clk, and cpumasks, add a Rust-based cpufreq-dt driver, and do a minor SCMI cpufreq driver cleanup: - Revert an x86 commit that went into 6.15 and caused idle power, including power in suspend-to-idle, to rise rather dramatically on systems booting with "nosmt" in the kernel command line (Rafael Wysocki) - Prevent freeing an uninitialized pointer in error path of dt_idle_state_present() in the PSCI cpuidle driver (Dan Carpenter) - Use KHz as the nominal_freq units in get_max_boost_ratio() in the ACPI cpufreq driver (iGautham Shenoy) - Add Rust abstractions for CPUFreq framework (Viresh Kumar) - Add Rust abstractions for OPP framework (Viresh Kumar) - Add basic Rust abstractions for Clk and Cpumask frameworks (Viresh Kumar) - Clean up the SCMI cpufreq driver somewhat (Mike Tipton)" * tag 'pm-6.16-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (21 commits) Revert "x86/smp: Eliminate mwait_play_dead_cpuid_hint()" acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio() rust: opp: Move `cfg(CONFIG_OF)` attribute to the top of doc test cpuidle: psci: Fix uninitialized variable in dt_idle_state_present() rust: opp: Make the doctest example depend on CONFIG_OF cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs cpufreq: Add Rust-based cpufreq-dt driver rust: opp: Extend OPP abstractions with cpufreq support rust: cpufreq: Extend abstractions for driver registration rust: cpufreq: Extend abstractions for policy and driver ops rust: cpufreq: Add initial abstractions for cpufreq framework rust: opp: Add abstractions for the configuration options rust: opp: Add abstractions for the OPP table rust: opp: Add initial abstractions for OPP framework rust: cpu: Add from_cpu() rust: macros: enable use of hyphens in module names rust: clk: Add initial abstractions rust: clk: Add helpers for Rust code MAINTAINERS: Add entry for Rust cpumask API rust: cpumask: Add initial abstractions ... commit 3d031d0d8daab86f9c3e9e89c80fec08367fb304 Merge: 25961ae6c80b2b 70523f335734b0 Author: Rafael J. Wysocki Date: Fri May 30 20:21:36 2025 +0200 Merge branch 'pm-cpuidle' Fix an issue in the PSCI cpuidle driver introduced recently and a nasty x86 power regression introduced in 6.15: - Prevent freeing an uninitialized pointer in error path of dt_idle_state_present() in the PSCI cpuidle driver (Dan Carpenter). - Revert an x86 commit that went into 6.15 and caused idle power, including power in suspend-to-idle, to rise rather dramatically on systems booting with "nosmt" in the kernel command line (Rafael Wysocki). * pm-cpuidle: Revert "x86/smp: Eliminate mwait_play_dead_cpuid_hint()" cpuidle: psci: Fix uninitialized variable in dt_idle_state_present() commit 25961ae6c80b2b940e941f0b3bd0c5c8c1b9ee60 Merge: 9d230d500b0e5f cb6a85f38f456b Author: Rafael J. Wysocki Date: Fri May 30 20:11:09 2025 +0200 Merge branch 'pm-cpufreq' Merge Rust support for cpufreq and OPP, a new Rust-based cpufreq-dt driver, an SCMI cpufreq driver cleanup, and an ACPI cpufreq driver regression fix: - Add Rust abstractions for CPUFreq framework (Viresh Kumar). - Add Rust abstractions for OPP framework (Viresh Kumar). - Add basic Rust abstractions for Clk and Cpumask frameworks (Viresh Kumar). - Clean up the SCMI cpufreq driver somewhat (Mike Tipton). - Use KHz as the nominal_freq units in get_max_boost_ratio() in the ACPI cpufreq driver (iGautham Shenoy). * pm-cpufreq: acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio() rust: opp: Move `cfg(CONFIG_OF)` attribute to the top of doc test rust: opp: Make the doctest example depend on CONFIG_OF cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs cpufreq: Add Rust-based cpufreq-dt driver rust: opp: Extend OPP abstractions with cpufreq support rust: cpufreq: Extend abstractions for driver registration rust: cpufreq: Extend abstractions for policy and driver ops rust: cpufreq: Add initial abstractions for cpufreq framework rust: opp: Add abstractions for the configuration options rust: opp: Add abstractions for the OPP table rust: opp: Add initial abstractions for OPP framework rust: cpu: Add from_cpu() rust: macros: enable use of hyphens in module names rust: clk: Add initial abstractions rust: clk: Add helpers for Rust code MAINTAINERS: Add entry for Rust cpumask API rust: cpumask: Add initial abstractions rust: cpumask: Add few more helpers commit f4c606df263b6de746412dee707bc4b590adf45a Merge: 3702a515edec51 d0b29661a95bbf 9375e5e3557bf9 ce57cc1269c580 Author: Rafael J. Wysocki Date: Fri May 30 19:58:09 2025 +0200 Merge branches 'acpica', 'acpi-tables' and 'acpi-apei' Merge fixes for issues introduced by recent ACPI changes merged previously: - Unbreak acpi_ut_safe_strncpy() by restoring its previous behavior changed incorrectly by a recent update (Ahmed Salem). - Make a new static checker warning in the recently introduced ACPI MRRM table parser go away (Dan Carpenter). - Fix ACPI table referece leak in error path of einj_probe() (Dan Carpenter). * acpica: ACPICA: Switch back to using strncpy() in acpi_ut_safe_strncpy() * acpi-tables: ACPI: MRRM: Silence error code static checker warning * acpi-apei: ACPI: APEI: EINJ: Clean up on error in einj_probe() commit 8477ab143069c6b05d6da4a8184ded8b969240f5 Merge: dd91b5e1d64487 879b141b7cfa09 Author: Linus Torvalds Date: Fri May 30 10:44:20 2025 -0700 Merge tag 'iommu-updates-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu updates from Joerg Roedel: "Core: - Introduction of iommu-pages infrastructure to consolitate page-table allocation code among hardware drivers. This is ground-work for more generalization in the future - Remove IOMMU_DEV_FEAT_SVA and IOMMU_DEV_FEAT_IOPF feature flags - Convert virtio-iommu to domain_alloc_paging() - KConfig cleanups - Some small fixes for possible overflows and race conditions Intel VT-d driver: - Restore WO permissions on second-level paging entries - Use ida to manage domain id - Miscellaneous cleanups AMD-Vi: - Make sure notifiers finish running before module unload - Add support for HTRangeIgnore feature - Allow matching ACPI HID devices without matching UIDs ARM-SMMU: - SMMUv2: - Recognise the compatible string for SAR2130P MDSS in the Qualcomm driver, as this device requires an identity domain - Fix Adreno stall handling so that GPU debugging is more robust and doesn't e.g. result in deadlock - SMMUv3: - Fix ->attach_dev() error reporting for unrecognised domains - IO-pgtable: - Allow clients (notably, drivers that process requests from userspace) to silence warnings when mapping an already-mapped IOVA S390: - Add support for additional table regions Mediatek: - Add support for MT6893 MM IOMMU And some smaller fixes and improvements in various other drivers" * tag 'iommu-updates-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (75 commits) iommu/vt-d: Restore context entry setup order for aliased devices iommu/mediatek: Fix compatible typo for mediatek,mt6893-iommu-mm iommu/arm-smmu-qcom: Make set_stall work when the device is on iommu/arm-smmu: Move handing of RESUME to the context fault handler iommu/arm-smmu-qcom: Enable threaded IRQ for Adreno SMMUv2/MMU500 iommu/io-pgtable-arm: Add quirk to quiet WARN_ON() iommu: Clear the freelist after iommu_put_pages_list() iommu/vt-d: Change dmar_ats_supported() to return boolean iommu/vt-d: Eliminate pci_physfn() in dmar_find_matched_satc_unit() iommu/vt-d: Replace spin_lock with mutex to protect domain ida iommu/vt-d: Use ida to manage domain id iommu/vt-d: Restore WO permissions on second-level paging entries iommu/amd: Allow matching ACPI HID devices without matching UIDs iommu: make inclusion of arm/arm-smmu-v3 directory conditional iommu: make inclusion of riscv directory conditional iommu: make inclusion of amd directory conditional iommu: make inclusion of intel directory conditional iommu: remove duplicate selection of DMAR_TABLE iommu/fsl_pamu: remove trailing space after \n iommu/arm-smmu-qcom: Add SAR2130P MDSS compatible ... commit 03dba9cea72f977e873e4e60e220fa596959dd8f Author: Luiz Augusto von Dentz Date: Wed May 28 14:53:11 2025 -0400 Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION Depending on the security set the response to L2CAP_LE_CONN_REQ shall be just L2CAP_CR_LE_ENCRYPTION if only encryption when BT_SECURITY_MEDIUM is selected since that means security mode 2 which doesn't require authentication which is something that is covered in the qualification test L2CAP/LE/CFC/BV-25-C. Link: https://github.com/bluez/bluez/issues/1270 Fixes: 27e2d4c8d28b ("Bluetooth: Add basic LE L2CAP connect request receiving support") Signed-off-by: Luiz Augusto von Dentz commit 0fb410c914eb03c7e9d821e26d03bac0a239e5db Author: Bartosz Golaszewski Date: Tue May 27 09:47:37 2025 +0200 Bluetooth: hci_qca: move the SoC type check to the right place Commit 3d05fc82237a ("Bluetooth: qca: set power_ctrl_enabled on NULL returned by gpiod_get_optional()") accidentally changed the prevous behavior where power control would be disabled without the BT_EN GPIO only on QCA_WCN6750 and QCA_WCN6855 while also getting the error check wrong. We should treat every IS_ERR() return value from devm_gpiod_get_optional() as a reason to bail-out while we should only set power_ctrl_enabled to false on the two models mentioned above. While at it: use dev_err_probe() to save a LOC. Cc: stable@vger.kernel.org Fixes: 3d05fc82237a ("Bluetooth: qca: set power_ctrl_enabled on NULL returned by gpiod_get_optional()") Signed-off-by: Bartosz Golaszewski Reviewed-by: Krzysztof Kozlowski Tested-by: Hsin-chen Chuang Reviewed-by: Hsin-chen Chuang Signed-off-by: Luiz Augusto von Dentz commit edc14f2adc6401d67bf73828d9135c80d32615a2 Author: Krzysztof Kozlowski Date: Sun May 25 21:00:21 2025 +0200 Bluetooth: btnxpuart: Fix missing devm_request_irq() return value check Return value of devm_request_irq() must be checked (function is even annotated) and without it clang W=1 complains: btnxpuart.c:494:6: error: unused variable 'ret' [-Werror,-Wunused-variable] Setting up wakeup IRQ handler is not really critical, because the handler is empty, so just log the informational message so user could submit proper bug report and silences the clang warning. Fixes: c50b56664e48 ("Bluetooth: btnxpuart: Implement host-wakeup feature") Signed-off-by: Krzysztof Kozlowski Reviewed-by: Neeraj Sanjay Kale Signed-off-by: Luiz Augusto von Dentz commit 03f1700b9b4d4f2fed3165370f3c23db76553178 Author: Dmitry Antipov Date: Thu May 22 21:16:02 2025 +0300 Bluetooth: MGMT: reject malformed HCI_CMD_SYNC commands In 'mgmt_hci_cmd_sync()', check whether the size of parameters passed in 'struct mgmt_cp_hci_cmd_sync' matches the total size of the data (i.e. 'sizeof(struct mgmt_cp_hci_cmd_sync)' plus trailing bytes). Otherwise, large invalid 'params_len' will cause 'hci_cmd_sync_alloc()' to do 'skb_put_data()' from an area beyond the one actually passed to 'mgmt_hci_cmd_sync()'. Reported-by: syzbot+5fe2d5bfbfbec0b675a0@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5fe2d5bfbfbec0b675a0 Fixes: 827af4787e74 ("Bluetooth: MGMT: Add initial implementation of MGMT_OP_HCI_CMD_SYNC") Signed-off-by: Dmitry Antipov Signed-off-by: Luiz Augusto von Dentz commit d1c696dba120624256ab335ab8247f535b872309 Author: Manivannan Sadhasivam Date: Thu May 8 12:40:32 2025 +0530 PCI: host-common: Convert to library for host controller drivers This common library will be used as a placeholder for helper functions shared by the host controller drivers. This avoids placing the host controller drivers specific helpers in drivers/pci/*.c, to avoid enlarging the kernel image on platforms that do not use host controller drivers at all (like x86/ACPI platforms). Suggested-by: Lukas Wunner Signed-off-by: Manivannan Sadhasivam Signed-off-by: Krzysztof Wilczyński Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250508-pcie-reset-slot-v4-3-7050093e2b50@linaro.org commit b06d125e6280603a34d9064cd9c12748ca2edb04 Author: Manivannan Sadhasivam Date: Thu May 8 12:40:30 2025 +0530 PCI/ERR: Remove misleading TODO regarding kernel panic A PCI device is just another peripheral in a system. So failure to recover it, must not result in a kernel panic. So remove the TODO which is quite misleading. Signed-off-by: Manivannan Sadhasivam Signed-off-by: Krzysztof Wilczyński Signed-off-by: Bjorn Helgaas Reviewed-by: Wilfred Mallawa Link: https://patch.msgid.link/20250508-pcie-reset-slot-v4-1-7050093e2b50@linaro.org commit 9126d2754c5e5d1818765811a10af0a14cf1fa0a Author: Andrew Price Date: Wed May 28 16:02:37 2025 +0100 gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add When gfs2_sys_fs_add() fails, it sets sb->s_fs_info to NULL on its error path (see commit 0d515210b696 ("GFS2: Add kobject release method")). The intention seems to be to prevent dereferencing sb->s_fs_info once the object pointed to has been deallocated, but that would be better achieved by setting the pointer to NULL in free_sbd(). As a consequence, when the call to gfs2_sys_fs_add() fails in gfs2_fill_super(), sdp = GFS2_SB(inode) will evaluate to NULL in iput() -> gfs2_drop_inode(), and accessing sdp->sd_flags will be a NULL pointer dereference. Fix that by only setting sb->s_fs_info to NULL when actually freeing the object pointed to in free_sbd(). Fixes: ae9f3bd8259a ("gfs2: replace sd_aspace with sd_inode") Reported-by: syzbot+b12826218502df019f9d@syzkaller.appspotmail.com Signed-off-by: Andrew Price Signed-off-by: Andreas Gruenbacher commit dd91b5e1d6448794c07378d1be12e3261c8769e7 Merge: 883e3c9f408143 92a251c3df8ea1 Author: Linus Torvalds Date: Fri May 30 10:18:56 2025 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma updates from Jason Gunthorpe: "Usual collection of driver fixes: - Small bug fixes and cleansup in hfi, hns, rxe, mlx5, mana siw - Further ODP functionality in rxe - Remote access MRs in mana, along with more page sizes - Improve CM scalability with a rwlock around the agent - More trace points for hns - ODP hmm conversion to the new two step dma API - Support the ethernet HW device in mana as well as the RNIC - Cleanups: - Use secs_to_jiffies() when appropriate - Use ERR_CAST() instead of naked casts - Don't use %pK in printk - Unusued functions removed - Allocation type matching" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (57 commits) RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work RDMA/bnxt_re: Support extended stats for Thor2 VF RDMA/hns: Fix endian issue in trace events RDMA/mlx5: Avoid flexible array warning IB/cm: Remove dead code and adjust naming RDMA/core: Avoid hmm_dma_map_alloc() for virtual DMA devices RDMA/rxe: Break endless pagefault loop for RO pages RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc RDMA/bnxt_re: Fix missing error handling for tx_queue RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output RDMA/mlx5: Add support for 200Gbps per lane speeds RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction net: mana: Add support for auxiliary device servicing events RDMA/mana_ib: unify mana_ib functions to support any gdma device RDMA/mana_ib: Add support of mana_ib for RNIC and ETH nic net: mana: Probe rdma device in mana driver RDMA/siw: replace redundant ternary operator with just rv RDMA/umem: Separate implicit ODP initialization from explicit ODP RDMA/core: Convert UMEM ODP DMA mapping to caching IOVA and page linkage ... commit 883e3c9f40814377a239ca0becbcc77deab5ffe5 Merge: eafd95ea74846e 17b7d785fc7fc9 Author: Linus Torvalds Date: Fri May 30 10:07:53 2025 -0700 Merge tag 'i2c-for-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c updates from Wolfram Sang: "Core updates: - move towards using the 'fwnode' handle instead of 'of_node' (meaning 'of_node' even gets removed from i2c_board_info) - add support for Write Disable-aware SPD eeproms - minor stuff (use new helpers, typo fixes) i2c-atr (address translator) updates: - support per-channel alias pools - added support for dynamic address translation (also adds FPC202 driver as its user) - add 'static' and 'passthrough' flags Cleanups and refactorings - Many drivers switched to dev_err_probe() - Generic cleanups applied to designware, iproc, ismt, mlxbf, npcm7xx, qcom-geni, pasemi, and thunderx - davinci: declare I2C mangling support among I2C features - designware: clean up DTS handling - designware: fix PM runtime on driver unregister - imx: improve error logging during probe - lpc2k: improve checks in probe error path - xgene-slimpro: improve PCC shared memory handling - pasemi: improve error handling in reset, smbus clear, timeouts - tegra: validate buffer length during transfers - wmt: convert binding to YAML format Improvements and extended support: - microchip-core: add SMBus support - mlxbf: add support for repeated start in block transfers - mlxbf: improve timer configuration - npcm: attempt clock toggle recovery before failing init - octeon: add support for block mode operations - pasemi: add support for unjam device feature - riic: add support for bus recovery New device support: - MediaTek Dimensity 1200 (MT6893) - Sophgo SG2044 - Renesas RZ/V2N (R9A09G056) - Rockchip RK3528 - AMD ISP (new driver)" * tag 'i2c-for-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (89 commits) i2c: Use str_read_write() helper i2c: mlxbf: avoid 64-bit division i2c: viai2c-wmt: Replace dev_err() with dev_err_probe() in probe function i2c: designware: Don't warn about missing get_clk_rate_khz i2c: designware: Invoke runtime suspend on quick slave re-registration i2c-mlxbf: Improve I2C bus timing configuration i2c-mlxbf: Add repeated start condition support i2c: xgene-slimpro: Replace dev_err() with dev_err_probe() in probe function dt-bindings: i2c: i2c-wmt: Convert to YAML i2c: microchip-corei2c: add smbus support i2c: mlxbf: Allow build with COMPILE_TEST i2c: I2C_DESIGNWARE_AMDISP should depend on DRM_AMD_ISP i2c: atr: add passthrough flag i2c: atr: add static flag i2c: atr: allow replacing mappings in attach_addr() i2c: atr: deduplicate logic in attach_addr() i2c: atr: do not create mapping in detach_addr() i2c: atr: split up i2c_atr_get_mapping_by_addr() i2c: atr: find_mapping() -> get_mapping() i2c: atr: Fix lockdep for nested ATRs ... commit eafd95ea74846eda3e3eac6b2bb7f34619d8a6f8 Merge: 9f32a03e3e0d37 08dcbe30be481b Author: Linus Torvalds Date: Fri May 30 09:46:28 2025 -0700 Merge tag 'pinctrl-v6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control updates from Linus Walleij: "An especially linear and sparse improvement and new drivers release. Nothing exciting. The biggest change in Bartosz changes to make gpiochip set/get calls return error codes (something we should have fixed ages ago but is now finally getting fixed.) Core changes: - Add the devres devm_pinctrl_register_mappings() call that can register some pin control machine mappings and have them go away with the associated device New drivers: - Support for the Mediatek MT6893 and MT8196 SoCs - Support for the Renesas RZ/V2N SoC - Support for the NXP Freescale i.MX943 SoC Improvements: - Per-SoC suspend/resume callbacks in the Samsung drivers - Set all pins as input (High-Z) at probe in the MCP23S08 driver - Switch most GPIO chips to use the setters/getters with a return value - EGPIO support in the Qualcomm QCM2290 driver - Fix up the number of available GPIO lines in Qualcomm QCS8300 and QCS615" * tag 'pinctrl-v6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (82 commits) pinctrl: freescale: Add support for imx943 pinctrl pinctrl: core: add devm_pinctrl_register_mappings() pinctrl: remove extern specifier for functions in machine.h pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms pinctrl: freescale: Enable driver if platform is enabled. pinctrl: freescale: Depend imx-scu driver on OF pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() pinctrl: armada-37xx: propagate error from armada_37xx_gpio_direction_output() pinctrl: armada-37xx: set GPIO output value before setting direction pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31 pinctrl: meson: Drop unused aml_pctl_find_group_by_name() pinctrl: at91: Fix possible out-of-boundary access pinctrl: add stubs for OF-specific pinconf functions pinctrl: qcom: correct the ngpios entry for QCS8300 pinctrl: qcom: correct the ngpios entry for QCS615 dt-bindings: pinctrl: qcom: correct gpio-ranges in examples for qcs8300 dt-bindings: pinctrl: qcom: correct gpio-ranges in examples for qcs615 ... commit 9f32a03e3e0d372c520d829dd4da6022fe88832a Merge: d8441523f21375 63bfd78aae9a90 Author: Linus Torvalds Date: Fri May 30 09:15:40 2025 -0700 Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk updates from Stephen Boyd: "This has been a semi-quiet cycle. The core framework remains unchanged this time around. In terms of shiny new code though, we have support for the SpacemiT K1 SoC, Sophgo SG2044, and T-HEAD TH1520 VO clk drivers joining the usual silicon players like Qualcomm, Samsung, Allwinner, and Renesas. Surprisingly, the Qualcomm pile was smaller than usual but that is likely because they put one SoC support inside a driver for a different SoC that is very similar. Other than all those new clk drivers there are the usual clk data updates to fix parents, frequency tables, and add missing clks along with some Kconfig changes to make compile testing simpler and even more DT binding conversions to boot. The exciting part is still the new SoC support like SpacemiT and Sophgo support though, which really dominate the diffstat because they introduce a whole new silicon vendor clk driver. New Drivers: - Camera clock controller driver for Qualcomm QCS8300 - DE (display engine) 3.3 clocks on Allwinner H616 - Samsung ExynosAutov920 CPU cluster CL0, CL1 and CL2 clock controllers - Video Output (VO) subsystem clk controller in the T-HEAD TH1520 SoC - Clock driver for Sophgo SG2044 - Clock driver for SpacemiT K1 SoC - Renesas RZ/V2N (R9A09G056) SoC clk driver Updates: - Correct data in various SoC clk drivers - Allow clkaN to be optional in the Qualcomm RPMh clock controller driver if command db doesn't define it - Change Kconfig options to not enable by default during compile testing - Add missing clks in various SoC clk drivers - Remove some duplicate clk DT bindings and convert some more to YAML" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (93 commits) clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks clk: qcom: gcc: Set FORCE_MEM_CORE_ON for gcc_ufs_axi_clk for 8650/8750 clk: qcom: rpmh: make clkaN optional clk: qcom: Add support for Camera Clock Controller on QCS8300 clk: rockchip: rk3528: add slab.h header include clk: rockchip: rk3576: add missing slab.h include clk: meson: Do not enable by default during compile testing clk: meson-g12a: add missing fclk_div2 to spicc clk: qcom: gcc-msm8939: Fix mclk0 & mclk1 for 24 MHz clk: rockchip: rename gate-grf clk file clk: rockchip: rename branch_muxgrf to branch_grf_mux clk: sunxi-ng: ccu: add Display Engine 3.3 (DE33) support dt-bindings: allwinner: add H616 DE33 clock binding clk: samsung: correct clock summary for hsi1 block dt-bindings: clock: add SM6350 QCOM video clock bindings clk: rockchip: Pass NULL as reg pointer when registering GRF MMC clocks clk: sunxi-ng: h616: Add LVDS reset for LCD TCON dt-bindings: clock: sun50i-h616-ccu: Add LVDS reset clk: rockchip: rk3036: mark ddrphy as critical clk: rockchip: rk3036: fix implementation of usb480m clock mux ... commit d8441523f21375b11a4593a2d89942b407bcb44f Merge: f66bc387efbee5 9883494c45a13d Author: Linus Torvalds Date: Fri May 30 08:40:25 2025 -0700 Merge tag 'f2fs-for-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs Pull f2fs updates from Jaegeuk Kim: "In this round, Matthew converted most of page operations to using folio. Beyond the work, we've applied some performance tunings such as GC and linear lookup, in addition to enhancing fault injection and sanity checks. Enhancements: - large number of folio conversions - add a control to turn on/off the linear lookup for performance - tune GC logics for zoned block device - improve fault injection and sanity checks Bug fixes: - handle error cases of memory donation - fix to correct check conditions in f2fs_cross_rename - fix to skip f2fs_balance_fs() if checkpoint is disabled - don't over-report free space or inodes in statvfs - prevent the current section from being selected as a victim during GC - fix to calculate first_zoned_segno correctly - fix to avoid inconsistence between SIT and SSA for zoned block device As usual, there are several debugging patches and clean-ups as well" * tag 'f2fs-for-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (195 commits) f2fs: fix to correct check conditions in f2fs_cross_rename f2fs: use d_inode(dentry) cleanup dentry->d_inode f2fs: fix to skip f2fs_balance_fs() if checkpoint is disabled f2fs: clean up to check bi_status w/ BLK_STS_OK f2fs: introduce is_{meta,node}_folio f2fs: add ckpt_valid_blocks to the section entry f2fs: add a method for calculating the remaining blocks in the current segment in LFS mode. f2fs: introduce FAULT_VMALLOC f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx f2fs: add f2fs_bug_on() in f2fs_quota_read() f2fs: add f2fs_bug_on() to detect potential bug f2fs: remove unused sbi argument from checksum functions f2fs: fix 32-bits hexademical number in fault injection doc f2fs: don't over-report free space or inodes in statvfs f2fs: return bool from __write_node_folio f2fs: simplify return value handling in f2fs_fsync_node_pages f2fs: always unlock the page in f2fs_write_single_data_page f2fs: remove wbc->for_reclaim handling f2fs: return bool from __f2fs_write_meta_folio f2fs: fix to return correct error number in f2fs_sync_node_pages() ... commit dc43f6a70b9685acabfda210f7cbb0520e952510 Author: Kent Overstreet Date: Wed May 28 11:27:59 2025 -0400 bcachefs: Mark bch_errcode helpers __attribute__((const)) These don't access global memory or defer pointer arguments - this enables CSE optimizations. Signed-off-by: Kent Overstreet commit 66621f016d792157fc661fe2cce40ab128009d79 Author: Kent Overstreet Date: Thu May 29 15:02:37 2025 -0400 bcachefs: Add missing printbuf_reset() in bch2_check_dirent_inode_dirent() We were accidentally including the contents from the previous fsck_err(). Signed-off-by: Kent Overstreet commit f1dc067bc10ac95550869dbe25dc4db1420f4f6a Author: Kent Overstreet Date: Wed May 28 01:00:34 2025 -0400 bcachefs: sysfs/errors Make the superblock error counters available in sysfs; the only other way they can be seen is 'show-super', but we don't write the superblock every time the error count gets incremented. Signed-off-by: Kent Overstreet commit ee084fa96123ede8b0563a1b5a9b23adc43cd50d Author: Tianyang Zhang Date: Fri May 30 21:45:57 2025 +0800 LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() ERROR INFO: CPU 25 Unable to handle kernel paging request at virtual address 0x0 ... Call Trace: [<900000000023c30c>] huge_pte_offset+0x3c/0x58 [<900000000057fd4c>] hugetlb_follow_page_mask+0x74/0x438 [<900000000051fee8>] __get_user_pages+0xe0/0x4c8 [<9000000000522414>] faultin_page_range+0x84/0x380 [<9000000000564e8c>] madvise_vma_behavior+0x534/0xa48 [<900000000056689c>] do_madvise+0x1bc/0x3e8 [<9000000000566df4>] sys_madvise+0x24/0x38 [<90000000015b9e88>] do_syscall+0x78/0x98 [<9000000000221f18>] handle_syscall+0xb8/0x158 In some cases, pmd may be NULL and rely on NULL as the return value for processing, so it is necessary to determine this situation here. Cc: stable@vger.kernel.org Fixes: bd51834d1cf6 ("LoongArch: Return NULL from huge_pte_offset() for invalid PMD") Signed-off-by: Tianyang Zhang Signed-off-by: Huacai Chen commit 712e6a914328e9672d534fc77edd596234ec2d7f Author: Huacai Chen Date: Fri May 30 21:45:48 2025 +0800 LoongArch: Preserve firmware configuration when desired If we must preserve the firmware resource assignments, claim the existing resources rather than reassigning everything. According to PCI Firmware Specification: if ACPI DSM#5 function returns 0, the OS must retain the resource allocation for PCI in the firmware; if ACPI DSM#5 function returns 1, the OS can ignore the resource allocation for PCI and reallocate it. Signed-off-by: Qihang Gao Signed-off-by: Juxin Gao Signed-off-by: Huacai Chen commit 52c22661c79a7b6af7fad9f77200738fc6c51878 Author: Huacai Chen Date: Fri May 30 21:45:48 2025 +0800 LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg When building kernel with LLVM there are occasionally such errors: In file included from ./include/linux/spinlock.h:59: In file included from ./include/linux/irqflags.h:17: arch/loongarch/include/asm/irqflags.h:38:3: error: must not be $r0 or $r1 38 | "csrxchg %[val], %[mask], %[reg]\n\t" | ^ :1:16: note: instantiated into assembly here 1 | csrxchg $a1, $ra, 0 | ^ To prevent the compiler from allocating $r0 or $r1 for the "mask" of the csrxchg instruction, the 'q' constraint must be used but Clang < 21 does not support it. So force to use $t0 in the inline asm, in order to avoid using $r0/$r1 while keeping the backward compatibility. Cc: stable@vger.kernel.org Link: https://github.com/llvm/llvm-project/pull/141037 Reviewed-by: Yanteng Si Suggested-by: WANG Rui Signed-off-by: Huacai Chen commit a24f2fb70cb62180486ad4d74f809ff35ddd1cf9 Author: Huacai Chen Date: Fri May 30 21:45:43 2025 +0800 LoongArch: Introduce the numa_memblks conversion Commit 87482708210ff3333a ("mm: introduce numa_memblks") has moved numa_memblks from x86 to the generic code, but LoongArch was left out of this conversion. This patch introduces the generic numa_memblks for LoongArch. In detail: 1. Enable NUMA_MEMBLKS (but disable NUMA_EMU) in Kconfig; 2. Use generic definition for numa_memblk and numa_meminfo; 3. Use generic implementation for numa_add_memblk() and its friends; 4. Use generic implementation for numa_set_distance() and its friends; 5. Use generic implementation for memory_add_physaddr_to_nid() and its friends. Note: Disable NUMA_EMU because it needs more efforts and no obvious demand now. Tested-by: Binbin Zhou Signed-off-by: Yuquan Wang Signed-off-by: Huacai Chen commit 9559d5806319a9254d9053b22a31324e1929aac6 Author: Huacai Chen Date: Fri May 30 21:45:43 2025 +0800 LoongArch: Increase max supported CPUs up to 2048 Increase max supported CPUs up to 2048, including: 1. Increase CSR.CPUID register's effective width; 2. Define MAX_CORE_PIC (a.k.a. max physical ID) to 2048; 3. Allow NR_CPUS (a.k.a. max logical ID) to be as large as 2048; 4. Introduce acpi_numa_x2apic_affinity_init() to handle ACPI SRAT for CPUID >= 256. Note: The reason of increasing to 2048 rather than 4096/8192 is because the IPI hardware can only support 2048 as a maximum. Reviewed-by: Yanteng Si Signed-off-by: Huacai Chen commit a45728fd4120011c78af1d056e571b84d47dfcc1 Author: Youling Tang Date: Fri May 30 21:45:42 2025 +0800 LoongArch: Enable HAVE_ARCH_STACKLEAK Add support for the stackleak feature. It initializes the stack with the poison value before returning from system calls which improves the kernel security. At the same time, disables the plugin in EFI stub code because EFI stub is out of scope for the protection. Tested on Loongson-3A5000 (enable GCC_PLUGIN_STACKLEAK and LKDTM): # echo STACKLEAK_ERASING > /sys/kernel/debug/provoke-crash/DIRECT # dmesg lkdtm: Performing direct entry STACKLEAK_ERASING lkdtm: stackleak stack usage: high offset: 320 bytes current: 448 bytes lowest: 1264 bytes tracked: 1264 bytes untracked: 208 bytes poisoned: 14528 bytes low offset: 64 bytes lkdtm: OK: the rest of the thread stack is properly erased Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit b37981ce540dffa64a4664ccf0e20dbef6c2c638 Author: Yuli Wang Date: Fri May 30 21:45:42 2025 +0800 LoongArch: Enable ARCH_SUPPORTS_MSEAL_SYSTEM_MAPPINGS Provide support for CONFIG_MSEAL_SYSTEM_MAPPINGS on LoongArch, covering the vdso. Link: https://lore.kernel.org/all/25bad37f-273e-4626-999c-e1890be96182@lucifer.local/ Acked-by: Liam R. Howlett Acked-by: Lorenzo Stoakes Reviewed-by: Jeff Xu Tested-by: Yuli Wang Signed-off-by: Yuli Wang Signed-off-by: Huacai Chen commit 93f437315660219245f99724d7597e5b2ea40df3 Author: Tianyang Zhang Date: Fri May 30 21:45:42 2025 +0800 LoongArch: Add SCHED_MC (Multi-core scheduler) support In order to achieve more reasonable load balancing behavior, add SCHED_MC (Multi-core scheduler) support. The LLC distribution of LoongArch now is consistent with NUMA node, the balancing domain of SCHED_MC can effectively reduce the situation where processes are awakened to smt_sibling. Co-developed-by: Hongliang Wang Signed-off-by: Hongliang Wang Signed-off-by: Tianyang Zhang Signed-off-by: Huacai Chen commit 980d4a42d595a00be2cec6a39ae3bfa6011ffcb3 Author: Youling Tang Date: Fri May 30 21:45:42 2025 +0800 LoongArch: Add some annotations in archhelp - Add annotations to the kernel image. - Modify the annotations of make insatll. Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit 75cffd392bfabc30ee88836887ea5439ec3b8089 Author: Youling Tang Date: Fri May 30 21:45:42 2025 +0800 LoongArch: Using generic scripts/install.sh in `make install` Use the generic script/install.sh to perform the make install operation. This will automatically generate the initrd file and modify the grub.cfg without manual intervention (The previous kernel image, config file and System.map will also be generated), similar to other architectures. Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit a96c7330da0b4cc64c6f79044d03f52532bdfc5b Author: Youling Tang Date: Fri May 30 21:45:33 2025 +0800 LoongArch: Add a default install.sh As specified in scripts/install.sh, the priority order is as follows (from highest to lowest): ~/bin/installkernel /sbin/installkernel arch/loongarch/boot/install.sh Fallback to default install.sh if installkernel is not found. Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit c006d5d691481acebb34f49b4017dd536e906a2e Merge: 0ff41df1cb268f 8278fd6006a02e Author: Huacai Chen Date: Fri May 30 21:38:40 2025 +0800 Merge commit 'core-entry-2025-05-25' into loongarch-next LoongArch architecture changes for 6.16 modify some same files with the core-entry changes, so merge them to create a base to resolve conflicts. commit b9802b54d41bbe98f673e08bc148b0c563fdc02e Author: Huacai Chen Date: Fri May 30 12:16:58 2025 +0800 asm-generic: Add sched.h inclusion in simd.h Commit 7ba8df47810f073 ("asm-generic: Make simd.h more resilient") causes a build error for PREEMPT_RT kernels: CC lib/crypto/sha256.o In file included from ./include/asm-generic/simd.h:6, from ./arch/loongarch/include/generated/asm/simd.h:1, from ./include/crypto/internal/simd.h:9, from ./include/crypto/internal/sha2.h:6, from lib/crypto/sha256.c:15: ./include/asm-generic/simd.h: In function 'may_use_simd': ./include/linux/preempt.h:111:34: error: 'current' undeclared (first use in this function) 111 | # define softirq_count() (current->softirq_disable_cnt & SOFTIRQ_MASK) | ^~~~~~~ ./include/linux/preempt.h:112:82: note: in expansion of macro 'softirq_count' 112 | # define irq_count() ((preempt_count() & (NMI_MASK | HARDIRQ_MASK)) | softirq_count()) | ^~~~~~~~~~~~~ ./include/linux/preempt.h:143:34: note: in expansion of macro 'irq_count' 143 | #define in_interrupt() (irq_count()) | ^~~~~~~~~ ./include/asm-generic/simd.h:18:17: note: in expansion of macro 'in_interrupt' 18 | return !in_interrupt(); | ^~~~~~~~~~~~ So add sched.h inclusion in simd.h to fix it. Fixes: 7ba8df47810f073 ("asm-generic: Make simd.h more resilient") Signed-off-by: Huacai Chen Signed-off-by: Herbert Xu commit cddded9803cd6c4f53432cc64377d34522aa11c9 Author: Eric Biggers Date: Thu May 29 11:59:13 2025 -0700 crypto: s390/sha256 - rename module to sha256-s390 When the s390 SHA-256 code is built as a loadable module, name it sha256-s390.ko instead of sha256.ko. This avoids a module name collision with crypto/sha256.ko and makes it consistent with the other architectures. We should consider making a single module provide all the SHA-256 library code, which would prevent issues like this. But for now this is the fix that's needed. Fixes: b9eac03edcf8 ("crypto: s390/sha256 - implement library instead of shash") Reported-by: Alex Williamson Closes: https://lore.kernel.org/r/20250529110526.6d2959a9.alex.williamson@redhat.com/ Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit 5a0c749125c001cba673e9951b0002fba7ea2886 Author: Randy Dunlap Date: Wed May 28 20:20:05 2025 -0700 MIPS: loongson2ef: lemote-2f: add missing function prototypes Add several missing function prototypes for lemote-2f to eliminate build warnings: arch/mips/loongson2ef/lemote-2f/machtype.c:10:13: warning: no previous prototype for 'mach_prom_init_machtype' [-Wmissing-prototypes] 10 | void __init mach_prom_init_machtype(void) arch/mips/loongson2ef/common/machtype.c:34:20: warning: no previous prototype for 'mach_prom_init_machtype' [-Wmissing-prototypes] 34 | void __weak __init mach_prom_init_machtype(void) arch/mips/loongson2ef/lemote-2f/pm.c:52:6: warning: no previous prototype for 'setup_wakeup_events' [-Wmissing-prototypes] 52 | void setup_wakeup_events(void) arch/mips/loongson2ef/lemote-2f/pm.c:90:5: warning: no previous prototype for 'wakeup_loongson' [-Wmissing-prototypes] 90 | int wakeup_loongson(void) arch/mips/loongson2ef/lemote-2f/pm.c:137:13: warning: no previous prototype for 'mach_suspend' [-Wmissing-prototypes] 137 | void __weak mach_suspend(void) arch/mips/loongson2ef/lemote-2f/pm.c:142:13: warning: no previous prototype for 'mach_resume' [-Wmissing-prototypes] 142 | void __weak mach_resume(void) Signed-off-by: Randy Dunlap Cc: Jiaxun Yang Cc: linux-mips@vger.kernel.org Cc: Thomas Bogendoerfer Signed-off-by: Thomas Bogendoerfer commit 314da9d6b3119328c1a38234c68e720380d14957 Author: Randy Dunlap Date: Wed May 28 20:19:56 2025 -0700 MIPS: loongson2ef: cs5536: add missing function prototypes Add missing function prototypes for cs5536, mostly for PCI functions, and for init_mfgpt_clocksource(). arch/mips/loongson2ef/common/cs5536/cs5536_ide.c:15:6: warning: no previous prototype for 'pci_ide_write_reg' [-Wmissing-prototypes] 15 | void pci_ide_write_reg(int reg, u32 value) arch/mips/loongson2ef/common/cs5536/cs5536_ide.c:96:5: warning: no previous prototype for 'pci_ide_read_reg' [-Wmissing-prototypes] 96 | u32 pci_ide_read_reg(int reg) arch/mips/loongson2ef/common/cs5536/cs5536_ehci.c:15:6: warning: no previous prototype for 'pci_ehci_write_reg' [-Wmissing-prototypes] 15 | void pci_ehci_write_reg(int reg, u32 value) arch/mips/loongson2ef/common/cs5536/cs5536_ehci.c:75:5: warning: no previous prototype for 'pci_ehci_read_reg' [-Wmissing-prototypes] 75 | u32 pci_ehci_read_reg(int reg) arch/mips/loongson2ef/common/cs5536/cs5536_acc.c:15:6: warning: no previous prototype for 'pci_acc_write_reg' [-Wmissing-prototypes] 15 | void pci_acc_write_reg(int reg, u32 value) arch/mips/loongson2ef/common/cs5536/cs5536_acc.c:62:5: warning: no previous prototype for 'pci_acc_read_reg' [-Wmissing-prototypes] 62 | u32 pci_acc_read_reg(int reg) arch/mips/loongson2ef/common/cs5536/cs5536_ohci.c:15:6: warning: no previous prototype for 'pci_ohci_write_reg' [-Wmissing-prototypes] 15 | void pci_ohci_write_reg(int reg, u32 value) arch/mips/loongson2ef/common/cs5536/cs5536_ohci.c:70:5: warning: no previous prototype for 'pci_ohci_read_reg' [-Wmissing-prototypes] 70 | u32 pci_ohci_read_reg(int reg) arch/mips/loongson2ef/common/cs5536/cs5536_isa.c:84:6: warning: no previous prototype for 'pci_isa_write_bar' [-Wmissing-prototypes] 84 | void pci_isa_write_bar(int n, u32 value) arch/mips/loongson2ef/common/cs5536/cs5536_isa.c:110:5: warning: no previous prototype for 'pci_isa_read_bar' [-Wmissing-prototypes] 110 | u32 pci_isa_read_bar(int n) arch/mips/loongson2ef/common/cs5536/cs5536_isa.c:134:6: warning: no previous prototype for 'pci_isa_write_reg' [-Wmissing-prototypes] 134 | void pci_isa_write_reg(int reg, u32 value) arch/mips/loongson2ef/common/cs5536/cs5536_isa.c:228:5: warning: no previous prototype for 'pci_isa_read_reg' [-Wmissing-prototypes] 228 | u32 pci_isa_read_reg(int reg) arch/mips/loongson2ef/common/cs5536/cs5536_mfgpt.c:195:12: warning: no previous prototype for 'init_mfgpt_clocksource' [-Wmissing-prototypes] 195 | int __init init_mfgpt_clocksource(void) Signed-off-by: Randy Dunlap Cc: Jiaxun Yang Cc: linux-mips@vger.kernel.org Cc: Thomas Bogendoerfer Signed-off-by: Thomas Bogendoerfer commit d3faab9b5a6a0477d69c38bd11c43aa5e936f929 Author: Oliver Neukum Date: Wed May 28 13:03:54 2025 +0200 net: usb: aqc111: debug info before sanitation If we sanitize error returns, the debug statements need to come before that so that we don't lose information. Signed-off-by: Oliver Neukum Fixes: 405b0d610745 ("net: usb: aqc111: fix error handling of usbnet read calls") Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit f4d22ac96a45afb44545189a4807ccec5bc8f945 Merge: 39d86db34e41b9 01bf468c4e086b Author: Jens Axboe Date: Fri May 30 04:42:53 2025 -0600 Merge tag 'md-6.16-20250530' of https://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux into block-6.16 Pull MD fixes from Yu: "- fix REQ_RAHEAD and REQ_NOWAIT IO err handling for raid1/10 - fix max_write_behind setting for dm-raid - some minor cleanups" * tag 'md-6.16-20250530' of https://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux: md/md-bitmap: remove parameter slot from bitmap_create() md/md-bitmap: cleanup bitmap_ops->startwrite() md/dm-raid: remove max_write_behind setting limit md/md-bitmap: fix dm-raid max_write_behind setting md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT commit 3d6d84c8f2f66d3fd6a43a1e2ce8e6b54c573960 Author: Álvaro Fernández Rojas Date: Thu May 29 15:09:15 2025 +0200 spi: bcm63xx-hsspi: fix shared reset Some bmips SoCs (bcm6362, bcm63268) share the same SPI reset for both SPI and HSSPI controllers, so reset shouldn't be exclusive. Fixes: 0eeadddbf09a ("spi: bcm63xx-hsspi: add reset support") Reported-by: Jonas Gorski Signed-off-by: Álvaro Fernández Rojas Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20250529130915.2519590-3-noltari@gmail.com Signed-off-by: Mark Brown commit 5ad20e3d8cfe3b2e42bbddc7e0ebaa74479bb589 Author: Álvaro Fernández Rojas Date: Thu May 29 15:09:14 2025 +0200 spi: bcm63xx-spi: fix shared reset Some bmips SoCs (bcm6362, bcm63268) share the same SPI reset for both SPI and HSSPI controllers, so reset shouldn't be exclusive. Fixes: 38807adeaf1e ("spi: bcm63xx-spi: add reset support") Reported-by: Jonas Gorski Signed-off-by: Álvaro Fernández Rojas Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20250529130915.2519590-2-noltari@gmail.com Signed-off-by: Mark Brown commit 4d62121ce9b58ea23c8d62207cbc604e98ecdc0a Author: Marc Zyngier Date: Fri May 30 10:16:47 2025 +0100 KVM: arm64: vgic-debug: Avoid dereferencing NULL ITE pointer Dan reports that iterating over a device ITEs can legitimately lead to a NULL pointer, and that the NULL check is placed *after* the pointer has already been dereferenced. Hoist the pointer check as early as possible and be done with it. Reported-by: Dan Carpenter Fixes: 30deb51a677b ("KVM: arm64: vgic-its: Add debugfs interface to expose ITS tables") Link: https://lore.kernel.org/r/aDBylI1YnjPatAbr@stanley.mountain Cc: Jing Zhang Link: https://lore.kernel.org/r/20250530091647.1152489-1-maz@kernel.org Signed-off-by: Marc Zyngier commit 07212d16adc7a02810e1641c2721762751ce4f88 Author: Oliver Upton Date: Fri May 23 12:47:22 2025 -0700 KVM: arm64: vgic-init: Plug vCPU vs. VGIC creation race syzkaller has found another ugly race in the VGIC, this time dealing with VGIC creation. Since kvm_vgic_create() doesn't sufficiently protect against in-flight vCPU creations, it is possible to get a vCPU into the kernel w/ an in-kernel VGIC but no allocation of private IRQs: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000d20 Mem abort info: ESR = 0x0000000096000046 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000046, ISS2 = 0x00000000 CM = 0, WnR = 1, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000103e4f000 [0000000000000d20] pgd=0800000102e1c403, p4d=0800000102e1c403, pud=0800000101146403, pmd=0000000000000000 Internal error: Oops: 0000000096000046 [#1] PREEMPT SMP CPU: 9 UID: 0 PID: 246 Comm: test Not tainted 6.14.0-rc6-00097-g0c90821f5db8 #16 Hardware name: linux,dummy-virt (DT) pstate: 814020c5 (Nzcv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : _raw_spin_lock_irqsave+0x34/0x8c lr : kvm_vgic_set_owner+0x54/0xa4 sp : ffff80008086ba20 x29: ffff80008086ba20 x28: ffff0000c19b5640 x27: 0000000000000000 x26: 0000000000000000 x25: ffff0000c4879bd0 x24: 000000000000001e x23: 0000000000000000 x22: 0000000000000000 x21: ffff0000c487af80 x20: ffff0000c487af18 x19: 0000000000000000 x18: 0000001afadd5a8b x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000001 x14: ffff0000c19b56c0 x13: 0030c9adf9d9889e x12: ffffc263710e1908 x11: 0000001afb0d74f2 x10: e0966b840b373664 x9 : ec806bf7d6a57cd5 x8 : ffff80008086b980 x7 : 0000000000000001 x6 : 0000000000000001 x5 : 0000000080800054 x4 : 4ec4ec4ec4ec4ec5 x3 : 0000000000000000 x2 : 0000000000000001 x1 : 0000000000000000 x0 : 0000000000000d20 Call trace: _raw_spin_lock_irqsave+0x34/0x8c (P) kvm_vgic_set_owner+0x54/0xa4 kvm_timer_enable+0xf4/0x274 kvm_arch_vcpu_run_pid_change+0xe0/0x380 kvm_vcpu_ioctl+0x93c/0x9e0 __arm64_sys_ioctl+0xb4/0xec invoke_syscall+0x48/0x110 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x30/0xd0 el0t_64_sync_handler+0x10c/0x138 el0t_64_sync+0x198/0x19c Code: b9000841 d503201f 52800001 52800022 (88e17c02) ---[ end trace 0000000000000000 ]--- Plug the race by explicitly checking for an in-progress vCPU creation and failing kvm_vgic_create() when that's the case. Add some comments to document all the things kvm_vgic_create() is trying to guard against too. Reported-by: Alexander Potapenko Signed-off-by: Oliver Upton Tested-by: Alexander Potapenko Link: https://lore.kernel.org/r/20250523194722.4066715-6-oliver.upton@linux.dev Signed-off-by: Marc Zyngier commit 4bf3693d36af9768c9bcc1df3a12d00ad6ea8083 Author: Oliver Upton Date: Fri May 23 12:47:21 2025 -0700 KVM: arm64: Unmap vLPIs affected by changes to GSI routing information KVM's interrupt infrastructure is dodgy at best, allowing for some ugly 'off label' usage of the various UAPIs. In one example, userspace can change the routing entry of a particular "GSI" after configuring irqbypass with KVM_IRQFD. KVM/arm64 is oblivious to this, and winds up preserving the stale translation in cases where vLPIs are configured. Honor userspace's intentions and tear down the vLPI mapping if affected by a "GSI" routing change. Make no attempt to reconstruct vLPIs if the new target is an MSI and just fall back to software injection. Tested-by: Sweet Tea Dorminy Signed-off-by: Oliver Upton Link: https://lore.kernel.org/r/20250523194722.4066715-5-oliver.upton@linux.dev Signed-off-by: Marc Zyngier commit 05b9405f2fa1848e984f231708fa1e5d385e4d27 Author: Oliver Upton Date: Fri May 23 12:47:20 2025 -0700 KVM: arm64: Resolve vLPI by host IRQ in vgic_v4_unset_forwarding() The virtual mapping and "GSI" routing of a particular vLPI is subject to change in response to the guest / userspace. This can be pretty annoying to deal with when KVM needs to track the physical state that's managed for vLPI direct injection. Make vgic_v4_unset_forwarding() resilient by using the host IRQ to resolve the vgic IRQ. Since this uses the LPI xarray directly, finding the ITS by doorbell address + grabbing it's its_lock is no longer necessary. Note that matching the right ITS / ITE is already handled in vgic_v4_set_forwarding(), and unless there's a bug in KVM's VGIC ITS emulation the virtual mapping that should remain stable for the lifetime of the vLPI mapping. Tested-by: Sweet Tea Dorminy Signed-off-by: Oliver Upton Link: https://lore.kernel.org/r/20250523194722.4066715-4-oliver.upton@linux.dev Signed-off-by: Marc Zyngier commit fc4dafe87b93ec94204896c4bc8cad7e71bdd151 Author: Oliver Upton Date: Fri May 23 12:47:19 2025 -0700 KVM: arm64: Protect vLPI translation with vgic_irq::irq_lock Though undocumented, KVM generally protects the translation of a vLPI with the its_lock. While this makes perfectly good sense, as the ITS itself contains the guest translation, an upcoming change will require twiddling the vLPI mapping in an atomic context. Switch to using the vIRQ's irq_lock to protect the translation. Use of the its_lock in vgic_v4_unset_forwarding() is preserved for now as it still needs to walk the ITS. Tested-by: Sweet Tea Dorminy Signed-off-by: Oliver Upton Link: https://lore.kernel.org/r/20250523194722.4066715-3-oliver.upton@linux.dev Signed-off-by: Marc Zyngier commit 761aabe76e6b1eb8850e72141cb026c7057e46fd Author: Oliver Upton Date: Fri May 23 12:47:18 2025 -0700 KVM: arm64: Use lock guard in vgic_v4_set_forwarding() The locking dance is about to get more interesting, switch the its_lock over to a lock guard to make it a bit easier to handle. Tested-by: Sweet Tea Dorminy Signed-off-by: Oliver Upton Link: https://lore.kernel.org/r/20250523194722.4066715-2-oliver.upton@linux.dev Signed-off-by: Marc Zyngier commit 667304740537e546dac676be9eb81cee41d2ebdd Author: Marc Zyngier Date: Sun May 25 18:57:59 2025 +0100 KVM: arm64: Mask out non-VA bits from TLBI VA* on VNCR invalidation When handling a TLBI VA* instruction that potentially targets a VNCR page mapping, we fail to mask out the top bits that contain the ASID and TTL fields, hence potentially failing the VA check in the TLB code. An additional wrinkle is that we fail to sign extend the VA, again leading to failed VA checks. Fix both in one go by sign-extending the VA from bit 48, making it comparable to the way we interpret VNCR_EL2.BADDR. Fixes: 4ffa72ad8f37e ("KVM: arm64: nv: Add S1 TLB invalidation primitive for VNCR_EL2") Link: https://lore.kernel.org/r/20250525175759.780891-1-maz@kernel.org Signed-off-by: Marc Zyngier commit 94d889713d8b8e3bb78e19a1bbe76e36e34e8113 Author: Marc Zyngier Date: Fri May 23 18:02:08 2025 +0100 arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue Broonie reports that fed55f49fad18 ("arm64: errata: Work around AmpereOne's erratum AC04_CPU_23") breaks one of the vdso selftests (vdso_test_chacha) as it indirectly drags asm/sysreg.h. It is rather unfortunate (and worrying) that userspace gets built with non-UAPI headers. In any case, paper over the issue by dragging linux/kconfig.h in asm/sysreg.h. It is the right thing to do, at least from the kernel perspective. Reported-by: Mark Brown Fixes: fed55f49fad18 ("arm64: errata: Work around AmpereOne's erratum AC04_CPU_23") Link: https://lore.kernel.org/r/aDCDGZ-G-nCP3hJI@finisterre.sirena.org.uk Cc: D Scott Phillips Cc: Catalin Marinas Cc: Oliver Upton Cc: Will Deacon Reviewed-by: Oliver Upton Acked-by: Will Deacon Link: https://lore.kernel.org/r/20250523170208.530818-1-maz@kernel.org Signed-off-by: Marc Zyngier commit 01bf468c4e086b2f52a0c9dfa677c6016fc915ae Author: Yu Kuai Date: Sat May 24 14:13:02 2025 +0800 md/md-bitmap: remove parameter slot from bitmap_create() All callers pass in '-1' for 'slot', hence it can be removed. Link: https://lore.kernel.org/linux-raid/20250524061320.370630-6-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai Reviewed-by: Christoph Hellwig Reviewed-by: Xiao Ni Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke commit 38f520a37d541a52ce16437a379824fabcd768da Author: Yu Kuai Date: Sat May 24 14:13:00 2025 +0800 md/md-bitmap: cleanup bitmap_ops->startwrite() bitmap_startwrite() always return 0, and the caller doesn't check return value as well, hence change the method to void. Also rename startwrite/endwrite to start_write/end_write, which is more in line with the usual naming convention. Link: https://lore.kernel.org/linux-raid/20250524061320.370630-4-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai Reviewed-by: Xiao Ni Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke commit b886475804230cad8075e1ed8c7fb2333f7c41c1 Author: Yu Kuai Date: Sat May 24 14:13:11 2025 +0800 md/dm-raid: remove max_write_behind setting limit The comments said 'vaule in kB', while the value actually means the number of write_behind IOs. And since md-bitmap will automatically adjust the value to max COUNTER_MAX / 2, there is no need to fail early. Also move some macros that is only used md-bitmap.c. Link: https://lore.kernel.org/linux-raid/20250524061320.370630-15-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Reviewed-by: Xiao Ni commit 2afe17794cfed5f80295b1b9facd66e6f65e5002 Author: Yu Kuai Date: Sat May 24 14:13:10 2025 +0800 md/md-bitmap: fix dm-raid max_write_behind setting It's supposed to be COUNTER_MAX / 2, not COUNTER_MAX. Link: https://lore.kernel.org/linux-raid/20250524061320.370630-14-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke commit 9f346f7d4ea73692b82f5102ca8698e4040469ea Author: Yu Kuai Date: Tue May 27 16:14:07 2025 +0800 md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT IO with REQ_RAHEAD or REQ_NOWAIT can fail early, even if the storage medium is fine, hence record badblocks or remove the disk from array does not make sense. This problem if found by lvm2 test lvcreate-large-raid, where dm-zero will fail read ahead IO directly. Fixes: e879a0d9cb08 ("md/raid1,raid10: don't ignore IO flags") Reported-and-tested-by: Mikulas Patocka Closes: https://lore.kernel.org/all/34fa755d-62c8-4588-8ee1-33cb1249bdf2@redhat.com/ Link: https://lore.kernel.org/linux-raid/20250527081407.3004055-1-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai commit 3f07353e2fd3e154921e539044b26e85ca910dbe Merge: 4c2cebc2e87d72 f62bb41740462b Author: Arnd Bergmann Date: Fri May 30 09:10:42 2025 +0200 Merge tag 'renesas-dts-for-v6.16-tag5' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/dt Renesas DTS updates for v6.16 (take five) - Reduce I2C2 clock frequency on the RZ/G3E SMARC SoM. * tag 'renesas-dts-for-v6.16-tag5' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: arm64: dts: renesas: rzg3e-smarc-som: Reduce I2C2 clock frequency Link: https://lore.kernel.org/r/cover.1748355530.git.geert+renesas@glider.be Signed-off-by: Arnd Bergmann commit 4c2cebc2e87d72857a66c121adb5ba1f72e3111f Author: Sven Peter Date: Thu May 29 00:17:18 2025 +0200 MAINTAINERS, mailmap: update Sven Peter's email address Update my mail address to my new @kernel.org one and also add a mailmap entry to make sure everything gets sent there for easier filtering. Signed-off-by: Sven Peter Link: https://lore.kernel.org/r/20250528221718.45204-1-sven@kernel.org Signed-off-by: Arnd Bergmann commit 5402c4d4d2000a9baa30c1157c97152ec6383733 Author: Amir Goldstein Date: Sun May 25 12:47:31 2025 +0200 exportfs: require ->fh_to_parent() to encode connectable file handles When user requests a connectable file handle explicitly with the AT_HANDLE_CONNECTABLE flag, fail the request if filesystem (e.g. nfs) does not know how to decode a connected non-dir dentry. Fixes: c374196b2b9f ("fs: name_to_handle_at() support for "explicit connectable" file handles") Signed-off-by: Amir Goldstein Link: https://lore.kernel.org/20250525104731.1461704-1-amir73il@gmail.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 66b7c51ceb9f08e7dfb6b25e811b5b791100eda8 Author: Kent Overstreet Date: Tue May 27 20:51:00 2025 -0400 bcachefs: bch2_check_fix_ptrs() can now repair btree roots This is straightforward enough: check_fix_ptrs() currently only runs before we go RW, so updating the btree root pointer in c->btree_roots suffices - it'll be written out in the first journal write we do. For that, do_bch2_trans_commit_to_journal_replay() now handles JSET_ENTRY_btree_root entries. Signed-off-by: Kent Overstreet commit a7c9add482c7b0e7e28433816fa9e8f7b890086e Author: Kent Overstreet Date: Tue May 27 14:39:43 2025 -0400 bcachefs: Include b->ob.nr in cached_btree_node_to_text() We have a bug report that looks like we might be leaking open buckets - let's check if they got left attached to the cached btree node. Signed-off-by: Kent Overstreet commit e87de7d4918bd43901685dd1dd5620fc1aafd0aa Author: Kent Overstreet Date: Mon May 26 17:03:48 2025 -0400 bcachefs: Move devs_sorted to alloc_request More stack usage work. Signed-off-by: Kent Overstreet commit ff6369da9ac366f4a18735902ab8f50f5690ee83 Author: Kent Overstreet Date: Mon May 26 17:15:11 2025 -0400 bcachefs: reduce stack usage in alloc_sectors_start() with typical config options, variables in different inline functions aren't sharing stack space - and these are slowpaths. Signed-off-by: Kent Overstreet commit eabef52ff881e91f41c7bd6696c9355d12fc00c2 Author: Kent Overstreet Date: Mon May 26 14:24:19 2025 -0400 bcachefs: bch2_alloc_v4_to_text() Specialize the .to_text() for alloc_v4, to avoid the temporary on the stack for conversion from old versions. Signed-off-by: Kent Overstreet commit 0c34e7ff69036ffcb006ee86fd0143f3620dd491 Author: Kent Overstreet Date: Mon May 26 13:26:10 2025 -0400 bcachefs: Tweak bch2_data_update_init() for stack usage - Separate out a slowpath for bkey_nocow_lock() - Don't call bch2_bkey_ptrs_c() or loop over pointers more than necessary Signed-off-by: Kent Overstreet commit 56e5c7f65f582d60e900f356f0dff542b90630b1 Author: Kent Overstreet Date: Mon May 26 14:15:28 2025 -0400 bcachefs: kill replicas_sectors arg to __trigger_extent() Signed-off-by: Kent Overstreet commit 92caf17189a5b32bb9349a7a1f329cdd5fa51eb4 Author: Kent Overstreet Date: Mon May 26 16:16:17 2025 -0400 bcachefs: Don't stack allocate bch_writepage_state Signed-off-by: Kent Overstreet commit cd831a9494524726babf835434da1438bcff6f45 Author: Kent Overstreet Date: Mon May 26 16:29:56 2025 -0400 bcachefs: factor out break_cycle_fail() More stack usage work. Signed-off-by: Kent Overstreet commit 19c0a8aa8ae302a3b038283c7d7eee0371ae3bf5 Author: Kent Overstreet Date: Mon May 26 12:48:19 2025 -0400 bcachefs: btree_node_missing_err() Factor out an error path for a small stack usage improvement. Signed-off-by: Kent Overstreet commit 0d25264ecfa3868c9308684fe344da1eb2f4502c Author: Kent Overstreet Date: Sun May 25 17:56:45 2025 -0400 bcachefs: Kill bkey_buf in btree_path_down() Allocate some (smaller) temporary storage in btree_trans for this - btree_path_down() is in our max-stack call stack. Signed-off-by: Kent Overstreet commit 99813d88e371c3a60d65810125b8d1568364f254 Author: Kent Overstreet Date: Tue May 27 20:37:21 2025 -0400 bcachefs: Add missing error logging in delete_dead_inodes() Signed-off-by: Kent Overstreet commit f54b2a80d0df06f8c13cbd102ca9dc2c6a578c5c Author: Kent Overstreet Date: Tue May 27 22:06:04 2025 -0400 bcachefs: Fix misaligned bucket check in journal space calculations Fix an assertion pop in the tiering_misaligned test: rounding down to bucket size at the end of the journal space calculations leaves cur_entry_sectors == 0, which is incorrect with !cur_entry_err. Signed-off-by: Kent Overstreet commit 813825d24135aa3109cf7746ce11f1ec2ab901fd Author: Kent Overstreet Date: Tue May 27 20:37:50 2025 -0400 bcachefs: Fix incorrect multiple dev check in journal write path It's uncomon to have multiple devices with journalling only on a subset, but can be specified with the 'data_allowed' option. We need to know if we're doing data/metadata writes to multiple devices, as that requires issuing flushes before the journal writes. Signed-off-by: Kent Overstreet commit 327971cef509c6380ed4bd8587fad26ceb2ab90b Author: Kent Overstreet Date: Tue May 27 21:45:56 2025 -0400 bcachefs: Catch data_update_done events in trace_io_move_start_fail Signed-off-by: Kent Overstreet commit c7897b5055df20e954c269897052c9397e0fff1a Author: Kent Overstreet Date: Tue May 27 21:54:22 2025 -0400 bcachefs: io_move_evacuate_bucket tracepoint, counter Signed-off-by: Kent Overstreet commit 060ff4b794748ef5d290c9b58075453ed4eac59d Author: Kent Overstreet Date: Mon May 26 23:00:21 2025 -0400 bcachefs: trace_io_move_pred Signed-off-by: Kent Overstreet commit d6efd42a8450c67d283dbaacd127dcccca858f51 Author: Kent Overstreet Date: Sun May 25 17:04:11 2025 -0400 bcachefs: Fix infinite loop in journal_entry_btree_keys_to_text() Fix an infinite loop when bkey_i->k.u64s is 0. This only happens in userspace, where 'bcachefs list_journal' can print the entire contents of the journal, and non-dirty entries aren't validated. Signed-off-by: Kent Overstreet commit cd04497b10e6178a7510329465d05788b906ce5f Author: Kent Overstreet Date: Mon May 26 12:21:57 2025 -0400 bcachefs: Journal read error message improvements - Don't print a checksum error when we first read a journal entry: we print a checksum error later if we'll be using the journal entry. - Continuing with the theme of of improving error messages and grouping errors into a single log message per error, print a single 'checksum error' message per journal entry, and use bch2_journal_ptr_to_text() to print out where on the device it was. - Factor out checksum error messages and checking for missing journal entries into helpers, bch2_journal_read() has gotten obnoxiously big. Signed-off-by: Kent Overstreet commit f66bc387efbee59978e076ce9bf123ac353b389c Merge: 35360498220603 fd2963e729ed69 Author: Linus Torvalds Date: Thu May 29 22:17:52 2025 -0700 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI updates from James Bottomley: "Updates to the usual drivers (smartpqi, ufs, lpfc, scsi_debug, target, hisi_sas) with the only substantive core change being the removal of the stream_status member from the scsi_stream_status_header (to get rid of flex array members)" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (77 commits) scsi: target: core: Constify struct target_opcode_descriptor scsi: target: core: Constify enabled() in struct target_opcode_descriptor scsi: hisi_sas: Fix warning detected by sparse scsi: mpt3sas: Fix _ctl_get_mpt_mctp_passthru_adapter() to return IOC pointer scsi: sg: Remove unnecessary NULL check before unregister_sysctl_table() scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort() scsi: ufs: qcom: dt-bindings: Document the SM8750 UFS Controller scsi: mvsas: Fix typos in SAS/SATA VSP register comments scsi: fnic: Replace memset() with eth_zero_addr() scsi: ufs: core: Support updating device command timeout scsi: ufs: core: Change hwq_id type and value scsi: ufs: core: Increase the UIC command timeout further scsi: zfcp: Simplify workqueue allocation scsi: ufs: core: Print error value as hex format in ufshcd_err_handler() scsi: sd: Remove the stream_status member from scsi_stream_status_header scsi: docs: Clean up some style in scsi_mid_low_api scsi: core: Remove unused scsi_dev_info_list_del_keyed() scsi: isci: Remove unused sci_remote_device_reset() scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH scsi: smartpqi: Delete a stray tab in pqi_is_parity_write_stream() ... commit 21fae34a27dd67612b865e377149c7e663a41fa9 Merge: dd59137bfe70cf 946026ba4293a1 Author: Christian Brauner Date: Fri May 30 07:12:08 2025 +0200 Merge patch series "rust: file: mark `LocalFile` as `repr(transparent)`" Mark files as repr(transparent) to ensure identical layout between C and Rust. * patches from https://lore.kernel.org/20250527204636.12573-1-pekkarr@protonmail.com: rust: file: improve safety comments rust: file: mark `LocalFile` as `repr(transparent)` Link: https://lore.kernel.org/20250527204636.12573-1-pekkarr@protonmail.com Signed-off-by: Christian Brauner commit 946026ba4293a14970b4b0b72f5f0cbb698ad77e Author: Pekka Ristola Date: Tue May 27 20:48:59 2025 +0000 rust: file: improve safety comments Some of the safety comments in `LocalFile`'s methods incorrectly refer to the `File` type instead of `LocalFile`, so fix them to use the correct type. Also add missing Markdown code spans around lifetimes in the safety comments, i.e. change 'a to `'a`. Link: https://github.com/Rust-for-Linux/linux/issues/1165 Signed-off-by: Pekka Ristola Link: https://lore.kernel.org/20250527204636.12573-2-pekkarr@protonmail.com Reviewed-by: Benno Lossin Reviewed-by: Alice Ryhl Signed-off-by: Christian Brauner commit 15ecd83dc06277385ad71dc7ea26911d9a79acaf Author: Pekka Ristola Date: Tue May 27 20:48:55 2025 +0000 rust: file: mark `LocalFile` as `repr(transparent)` Unsafe code in `LocalFile`'s methods assumes that the type has the same layout as the inner `bindings::file`. This is not guaranteed by the default struct representation in Rust, but requires specifying the `transparent` representation. The `File` struct (which also wraps `bindings::file`) is already marked as `repr(transparent)`, so this change makes their layouts equivalent. Fixes: 851849824bb5 ("rust: file: add Rust abstraction for `struct file`") Closes: https://github.com/Rust-for-Linux/linux/issues/1165 Signed-off-by: Pekka Ristola Link: https://lore.kernel.org/20250527204636.12573-1-pekkarr@protonmail.com Reviewed-by: Benno Lossin Reviewed-by: Alice Ryhl Signed-off-by: Christian Brauner commit dd59137bfe70cf3646021b4721e430213b9c71bd Author: Alistair Popple Date: Fri May 23 14:37:49 2025 +1000 fs/dax: Fix "don't skip locked entries when scanning entries" Commit 6be3e21d25ca ("fs/dax: don't skip locked entries when scanning entries") introduced a new function, wait_entry_unlocked_exclusive(), which waits for the current entry to become unlocked without advancing the XArray iterator state. Waiting for the entry to become unlocked requires dropping the XArray lock. This requires calling xas_pause() prior to dropping the lock which leaves the xas in a suitable state for the next iteration. However this has the side-effect of advancing the xas state to the next index. Normally this isn't an issue because xas_for_each() contains code to detect this state and thus avoid advancing the index a second time on the next loop iteration. However both callers of and wait_entry_unlocked_exclusive() itself subsequently use the xas state to reload the entry. As xas_pause() updated the state to the next index this will cause the current entry which is being waited on to be skipped. This caused the following warning to fire intermittently when running xftest generic/068 on an XFS filesystem with FS DAX enabled: [ 35.067397] ------------[ cut here ]------------ [ 35.068229] WARNING: CPU: 21 PID: 1640 at mm/truncate.c:89 truncate_folio_batch_exceptionals+0xd8/0x1e0 [ 35.069717] Modules linked in: nd_pmem dax_pmem nd_btt nd_e820 libnvdimm [ 35.071006] CPU: 21 UID: 0 PID: 1640 Comm: fstest Not tainted 6.15.0-rc7+ #77 PREEMPT(voluntary) [ 35.072613] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/204 [ 35.074845] RIP: 0010:truncate_folio_batch_exceptionals+0xd8/0x1e0 [ 35.075962] Code: a1 00 00 00 f6 47 0d 20 0f 84 97 00 00 00 4c 63 e8 41 39 c4 7f 0b eb 61 49 83 c5 01 45 39 ec 7e 58 42 f68 [ 35.079522] RSP: 0018:ffffb04e426c7850 EFLAGS: 00010202 [ 35.080359] RAX: 0000000000000000 RBX: ffff9d21e3481908 RCX: ffffb04e426c77f4 [ 35.081477] RDX: ffffb04e426c79e8 RSI: ffffb04e426c79e0 RDI: ffff9d21e34816e8 [ 35.082590] RBP: ffffb04e426c79e0 R08: 0000000000000001 R09: 0000000000000003 [ 35.083733] R10: 0000000000000000 R11: 822b53c0f7a49868 R12: 000000000000001f [ 35.084850] R13: 0000000000000000 R14: ffffb04e426c78e8 R15: fffffffffffffffe [ 35.085953] FS: 00007f9134c87740(0000) GS:ffff9d22abba0000(0000) knlGS:0000000000000000 [ 35.087346] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 35.088244] CR2: 00007f9134c86000 CR3: 000000040afff000 CR4: 00000000000006f0 [ 35.089354] Call Trace: [ 35.089749] [ 35.090168] truncate_inode_pages_range+0xfc/0x4d0 [ 35.091078] truncate_pagecache+0x47/0x60 [ 35.091735] xfs_setattr_size+0xc7/0x3e0 [ 35.092648] xfs_vn_setattr+0x1ea/0x270 [ 35.093437] notify_change+0x1f4/0x510 [ 35.094219] ? do_truncate+0x97/0xe0 [ 35.094879] do_truncate+0x97/0xe0 [ 35.095640] path_openat+0xabd/0xca0 [ 35.096278] do_filp_open+0xd7/0x190 [ 35.096860] do_sys_openat2+0x8a/0xe0 [ 35.097459] __x64_sys_openat+0x6d/0xa0 [ 35.098076] do_syscall_64+0xbb/0x1d0 [ 35.098647] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 35.099444] RIP: 0033:0x7f9134d81fc1 [ 35.100033] Code: 75 57 89 f0 25 00 00 41 00 3d 00 00 41 00 74 49 80 3d 2a 26 0e 00 00 74 6d 89 da 48 89 ee bf 9c ff ff ff5 [ 35.102993] RSP: 002b:00007ffcd41e0d10 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 35.104263] RAX: ffffffffffffffda RBX: 0000000000000242 RCX: 00007f9134d81fc1 [ 35.105452] RDX: 0000000000000242 RSI: 00007ffcd41e1200 RDI: 00000000ffffff9c [ 35.106663] RBP: 00007ffcd41e1200 R08: 0000000000000000 R09: 0000000000000064 [ 35.107923] R10: 00000000000001a4 R11: 0000000000000202 R12: 0000000000000066 [ 35.109112] R13: 0000000000100000 R14: 0000000000100000 R15: 0000000000000400 [ 35.110357] [ 35.110769] irq event stamp: 8415587 [ 35.111486] hardirqs last enabled at (8415599): [] __up_console_sem+0x52/0x60 [ 35.113067] hardirqs last disabled at (8415610): [] __up_console_sem+0x37/0x60 [ 35.114575] softirqs last enabled at (8415300): [] handle_softirqs+0x315/0x3f0 [ 35.115933] softirqs last disabled at (8415291): [] __irq_exit_rcu+0xa1/0xc0 [ 35.117316] ---[ end trace 0000000000000000 ]--- Fix this by using xas_reset() instead, which is equivalent in implementation to xas_pause() but does not advance the XArray state. Fixes: 6be3e21d25ca ("fs/dax: don't skip locked entries when scanning entries") Signed-off-by: Alistair Popple Link: https://lore.kernel.org/20250523043749.1460780-1-apopple@nvidia.com Reviewed-by: Dan Williams Reviewed-by: Jan Kara Cc: Dan Williams Cc: Alison Schofield Cc: "Matthew Wilcow (Oracle)" Cc: Balbir Singh Cc: "Darrick J. Wong" Cc: Dave Chinner Cc: David Hildenbrand Cc: Jan Kara Cc: John Hubbard Cc: Ted Ts'o Cc: Alexander Viro Cc: Christian Brauner Signed-off-by: Christian Brauner commit 3536049822060347c8cb5a923186a8d65a8f7a48 Merge: 02897f5e56b22e 4518e5a60c7fbf Author: Linus Torvalds Date: Thu May 29 22:09:08 2025 -0700 Merge tag 'vfio-v6.16-rc1' of https://github.com/awilliam/linux-vfio Pull VFIO updates from Alex Williamson: - Remove an outdated DMA unmap optimization that relies on a feature only implemented in AMDv1 page tables. (Jason Gunthorpe) - Fix various migration issues in the hisi_acc_vfio_pci variant driver, including use of a wrong DMA address requiring an update to the migration data structure, resending task completion interrupt after migration to re-sync queues, fixing a write-back cache sequencing issue, fixing a driver unload issue, behaving correctly when the guest driver is not loaded, and avoiding to squash errors from sub-functions. (Longfang Liu) - mlx5-vfio-pci variant driver update to make use of the new two-step DMA API for migration, using a page array directly rather than using a page list mapped across a scatter list. (Leon Romanovsky) - Fix an incorrect loop index used when unwinding allocation of dirty page bitmaps on error, resulting in temporary failure in freeing unused bitmaps. (Li RongQing) * tag 'vfio-v6.16-rc1' of https://github.com/awilliam/linux-vfio: vfio/type1: Fix error unwind in migration dirty bitmap allocation vfio/mlx5: Enable the DMA link API vfio/mlx5: Rewrite create mkey flow to allow better code reuse vfio/mlx5: Explicitly use number of pages instead of allocated length hisi_acc_vfio_pci: update function return values. hisi_acc_vfio_pci: bugfix live migration function without VF device driver hisi_acc_vfio_pci: bugfix the problem of uninstalling driver hisi_acc_vfio_pci: bugfix cache write-back issue hisi_acc_vfio_pci: add eq and aeq interruption restore hisi_acc_vfio_pci: fix XQE dma address error vfio/type1: Remove Fine Grained Superpages detection commit 02897f5e56b22e78d376faff1533ad800991650e Merge: ae5ec8adb8ec9c 08effa6b77f7db Author: Linus Torvalds Date: Thu May 29 21:37:11 2025 -0700 Merge tag 'for-linus-6.16-1' of https://github.com/cminyard/linux-ipmi Pull IPMI updates from Corey Minyard: "Restructure the IPMI driver. This is a restructure of the IPMI driver, mostly to remove SRCU. The locking had issues, and they were not going to be straightforward to fix. Plus it used tons of memory and was generally a pain. Most of this moves handling of messages out of bh and interrupt context and runs it in thread context. Then getting rid of SRCU is easy. This also has a minor cleanup to remove a warning on newer GCCs and to fix some documentation" * tag 'for-linus-6.16-1' of https://github.com/cminyard/linux-ipmi: (26 commits) docs: ipmi: fix spelling and grammar mistakes ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() ipmi:watchdog: Use the new interface for panic messages ipmi:msghandler: Export and fix panic messaging capability Documentation:ipmi: Remove comments about interrupt level ipmi:ssif: Fix a shutdown race ipmi:msghandler: Don't deliver messages to deleted users ipmi:si: Rework startup of IPMI devices ipmi:msghandler: Add a error return from unhandle LAN cmds ipmi:msghandler: Shut down lower layer first at unregister ipmi:msghandler: Remove proc_fs.h ipmi:msghandler: Don't check for shutdown when returning responses ipmi:msghandler: Don't acquire a user refcount for queued messages ipmi:msghandler: Fix locking around users and interfaces ipmi:msghandler: Remove some user level processing in panic mode ipmi: Add a note about the pretimeout callback ipmi:watchdog: Change lock to mutex ipmi:msghandler: Remove srcu for the ipmi_interfaces list ipmi:msghandler: Remove srcu from the ipmi user structure ipmi:msghandler: Use the system_wq, not system_bh_wq ... commit ae5ec8adb8ec9c2aa916f853737c101faa87e5ba Merge: bbd9c366bfb272 9d948b8804096d Author: Linus Torvalds Date: Thu May 29 21:21:11 2025 -0700 Merge tag 'tsm-for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm Pull trusted security manager (TSM) updates from Dan Williams: - Add a general sysfs scheme for publishing "Measurement" values provided by the architecture's TEE Security Manager. Use it to publish TDX "Runtime Measurement Registers" ("RTMRs") that either maintain a hash of stored values (similar to a TPM PCR) or provide statically provisioned data. These measurements are validated by a relying party. - Reorganize the drivers/virt/coco/ directory for "host" and "guest" shared infrastructure. - Fix a configfs-tsm-report unregister bug - With CONFIG_TSM_MEASUREMENTS joining CONFIG_TSM_REPORTS and in anticipation of more shared "TSM" infrastructure arriving, rename the maintainer entry to "TRUSTED SECURITY MODULE (TSM) INFRASTRUCTURE". * tag 'tsm-for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm: tsm-mr: Fix init breakage after bin_attrs constification by scoping non-const pointers to init phase sample/tsm-mr: Fix missing static for sample_report virt: tdx-guest: Transition to scoped_cond_guard for mutex operations virt: tdx-guest: Refactor and streamline TDREPORT generation virt: tdx-guest: Expose TDX MRs as sysfs attributes x86/tdx: tdx_mcall_get_report0: Return -EBUSY on TDCALL_OPERAND_BUSY error x86/tdx: Add tdx_mcall_extend_rtmr() interface tsm-mr: Add tsm-mr sample code tsm-mr: Add TVM Measurement Register support configfs-tsm-report: Fix NULL dereference of tsm_ops coco/guest: Move shared guest CC infrastructure to drivers/virt/coco/guest/ configfs-tsm: Namespace TSM report symbols commit bbd9c366bfb2723435e82717ebbb3398f93a1f63 Merge: b78f1293f90642 ed16618c380c32 Author: Linus Torvalds Date: Thu May 29 21:13:17 2025 -0700 Merge tag 'x86_sgx_for_6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull Intel software guard extension (SGX) updates from Dave Hansen: "A couple of x86/sgx changes. The first one is a no-brainer to use the (simple) SHA-256 library. For the second one, some folks doing testing noticed that SGX systems under memory pressure were inducing fatal machine checks at pretty unnerving rates, despite the SGX code having _some_ awareness of memory poison. It turns out that the SGX reclaim path was not checking for poison _and_ it always accesses memory to copy it around. Make sure that poisoned pages are not reclaimed" * tag 'x86_sgx_for_6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/sgx: Prevent attempts to reclaim poisoned pages x86/sgx: Use SHA-256 library API instead of crypto_shash API commit b78f1293f90642ff9809935aa9df7b964e0f17ba Merge: 472c5f736b54c4 2fbdb6d8e03b70 Author: Linus Torvalds Date: Thu May 29 21:04:36 2025 -0700 Merge tag 'trace-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing updates from Steven Rostedt: - Have module addresses get updated in the persistent ring buffer The addresses of the modules from the previous boot are saved in the persistent ring buffer. If the same modules are loaded and an address is in the old buffer points to an address that was both saved in the persistent ring buffer and is loaded in memory, shift the address to point to the address that is loaded in memory in the trace event. - Print function names for irqs off and preempt off callsites When ignoring the print fmt of a trace event and just printing the fields directly, have the fields for preempt off and irqs off events still show the function name (via kallsyms) instead of just showing the raw address. - Clean ups of the histogram code The histogram functions saved over 800 bytes on the stack to process events as they come in. Instead, create per-cpu buffers that can hold this information and have a separate location for each context level (thread, softirq, IRQ and NMI). Also add some more comments to the code. - Add "common_comm" field for histograms Add "common_comm" that uses the current->comm as a field in an event histogram and acts like any of the other fields of the event. - Show "subops" in the enabled_functions file When the function graph infrastructure is used, a subsystem has a "subops" that it attaches its callback function to. Instead of the enabled_functions just showing a function calling the function that calls the subops functions, also show the subops functions that will get called for that function too. - Add "copy_trace_marker" option to instances There are cases where an instance is created for tooling to write into, but the old tooling has the top level instance hardcoded into the application. New tools want to consume the data from an instance and not the top level buffer. By adding a copy_trace_marker option, whenever the top instance trace_marker is written into, a copy of it is also written into the instance with this option set. This allows new tools to read what old tools are writing into the top buffer. If this option is cleared by the top instance, then what is written into the trace_marker is not written into the top instance. This is a way to redirect the trace_marker writes into another instance. - Have tracepoints created by DECLARE_TRACE() use trace__tp() If a tracepoint is created by DECLARE_TRACE() instead of TRACE_EVENT(), then it will not be exposed via tracefs. Currently there's no way to differentiate in the kernel the tracepoint functions between those that are exposed via tracefs or not. A calling convention has been made manually to append a "_tp" prefix for events created by DECLARE_TRACE(). Instead of doing this manually, force it so that all DECLARE_TRACE() events have this notation. - Use __string() for task->comm in some sched events Instead of hardcoding the comm to be TASK_COMM_LEN in some of the scheduler events use __string() which makes it dynamic. Note, if these events are parsed by user space it they may break, and the event may have to be converted back to the hardcoded size. - Have function graph "depth" be unsigned to the user Internally to the kernel, the "depth" field of the function graph event is signed due to -1 being used for end of boundary. What actually gets recorded in the event itself is zero or positive. Reflect this to user space by showing "depth" as unsigned int and be consistent across all events. - Allow an arbitrary long CPU string to osnoise_cpus_write() The filtering of which CPUs to write to can exceed 256 bytes. If a machine has 256 CPUs, and the filter is to filter every other CPU, the write would take a string larger than 256 bytes. Instead of using a fixed size buffer on the stack that is 256 bytes, allocate it to handle what is passed in. - Stop having ftrace check the per-cpu data "disabled" flag The "disabled" flag in the data structure passed to most ftrace functions is checked to know if tracing has been disabled or not. This flag was added back in 2008 before the ring buffer had its own way to disable tracing. The "disable" flag is now not always set when needed, and the ring buffer flag should be used in all locations where the disabled is needed. Since the "disable" flag is redundant and incorrect, stop using it. Fix up some locations that use the "disable" flag to use the ring buffer info. - Use a new tracer_tracing_disable/enable() instead of data->disable flag There's a few cases that set the data->disable flag to stop tracing, but this flag is not consistently used. It is also an on/off switch where if a function set it and calls another function that sets it, the called function may incorrectly enable it. Use a new trace_tracing_disable() and tracer_tracing_enable() that uses a counter and can be nested. These use the ring buffer flags which are always checked making the disabling more consistent. - Save the trace clock in the persistent ring buffer Save what clock was used for tracing in the persistent ring buffer and set it back to that clock after a reboot. - Remove unused reference to a per CPU data pointer in mmiotrace functions - Remove unused buffer_page field from trace_array_cpu structure - Remove more strncpy() instances - Other minor clean ups and fixes * tag 'trace-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (36 commits) tracing: Fix compilation warning on arm32 tracing: Record trace_clock and recover when reboot tracing/sched: Use __string() instead of fixed lengths for task->comm tracepoint: Have tracepoints created with DECLARE_TRACE() have _tp suffix tracing: Cleanup upper_empty() in pid_list tracing: Allow the top level trace_marker to write into another instances tracing: Add a helper function to handle the dereference arg in verifier tracing: Remove unnecessary "goto out" that simply returns ret is trigger code tracing: Fix error handling in event_trigger_parse() tracing: Rename event_trigger_alloc() to trigger_data_alloc() tracing: Replace deprecated strncpy() with strscpy() for stack_trace_filter_buf tracing: Remove unused buffer_page field from trace_array_cpu structure tracing: Use atomic_inc_return() for updating "disabled" counter in irqsoff tracer tracing: Convert the per CPU "disabled" counter to local from atomic tracing: branch: Use trace_tracing_is_on_cpu() instead of "disabled" field ring-buffer: Add ring_buffer_record_is_on_cpu() tracing: Do not use per CPU array_buffer.data->disabled for cpumask ftrace: Do not disabled function graph based on "disabled" field tracing: kdb: Use tracer_tracing_on/off() instead of setting per CPU disabled tracing: Use tracer_tracing_disable() instead of "disabled" field for ftrace_dump_one() ... commit 472c5f736b54c476c9bfaa0258c4c07fc6ddeea4 Merge: e0797d3b91de75 8020361d51eea5 Author: Linus Torvalds Date: Thu May 29 20:59:52 2025 -0700 Merge tag 'trace-tools-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing tools updates from Steven Rostedt: - Set distinctive value for failed tests When running "make check" that performs tests on rtla the failure is checked by examining the output. Instead have the tool return an error status if it exceeds the threadhold. - Define __NR_sched_setattr for LoongArch Define __NR_sched_setattr to allow this to build for LoongArch. - Define _GNU_SOURCE for timerlat_bpf.c Due to modifications of struct sched_attr in utils.h when _GNU_SOURCE is not defined, this can cause errors for timerlat_bpf_init() and breakage in BPF sample collection mode. * tag 'trace-tools-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: rtla: Define _GNU_SOURCE in timerlat_bpf.c rtla: Define __NR_sched_setattr for LoongArch rtla: Set distinctive exit value for failed tests commit 8c56bfe53bd881c7b598c54a3a06216743c57bbc Author: Anubhav Shelat Date: Thu May 29 10:33:35 2025 -0400 perf trace: Set errpid to false for rseq and set_robust_list The 'rseq' and 'set_robust_list' syscalls don't return a pid, so set errpid for both to false. Fixes: 0c1019e3463b263a ("perf trace: Mark the 'rseq' arg in the rseq syscall as coming from user space") Fixes: 1de5b5dcb8353f36 ("perf trace: Mark the 'head' arg in the set_robust_list syscall as coming from user space") Signed-off-by: Anubhav Shelat Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Dapeng Mi Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Michael Petlan Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250529143334.1469669-2-ashelat@redhat.com [ Remove explicit .errpid = false, omitting its initialization zeroes it, as noted by Namhyung ] Signed-off-by: Arnaldo Carvalho de Melo commit 7a17bbc1d952057898cb0739e60665908fbb8c72 Author: Sylvan Smit Date: Thu May 29 18:29:23 2025 +0200 rust: list: Fix typo `much` in arc.rs Correct the typo (s/much/must) in the ListArc documentation. Reported-by: Miguel Ojeda Closes: https://github.com/Rust-for-Linux/linux/issues/1166 Fixes: a48026315cd7 ("rust: list: add tracking for ListArc") Signed-off-by: Sylvan Smit Reviewed-by: Benno Lossin Link: https://lore.kernel.org/r/20250529162923.434978-1-sylvan@sylvansmit.com [ Changed tag to "Reported-by" and sorted. - Miguel ] Signed-off-by: Miguel Ojeda commit b20fbbc08a363f28fd0f3ad5163b2b0ff7605ba5 Author: Tamir Duberstein Date: Thu May 29 09:11:33 2025 -0400 rust: check type of `$ptr` in `container_of!` Add a compile-time check that `*$ptr` is of the type of `$type->$($f)*`. Rename those placeholders for clarity. Given the incorrect usage: > diff --git a/rust/kernel/rbtree.rs b/rust/kernel/rbtree.rs > index 8d978c896747..6a7089149878 100644 > --- a/rust/kernel/rbtree.rs > +++ b/rust/kernel/rbtree.rs > @@ -329,7 +329,7 @@ fn raw_entry(&mut self, key: &K) -> RawEntry<'_, K, V> { > while !(*child_field_of_parent).is_null() { > let curr = *child_field_of_parent; > // SAFETY: All links fields we create are in a `Node`. > - let node = unsafe { container_of!(curr, Node, links) }; > + let node = unsafe { container_of!(curr, Node, key) }; > > // SAFETY: `node` is a non-null node so it is valid by the type invariants. > match key.cmp(unsafe { &(*node).key }) { this patch produces the compilation error: > error[E0308]: mismatched types > --> rust/kernel/lib.rs:220:45 > | > 220 | $crate::assert_same_type(field_ptr, (&raw const (*container_ptr).$($fields)*).cast_mut()); > | ------------------------ --------- ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ expected `*mut rb_node`, found `*mut K` > | | | > | | expected all arguments to be this `*mut bindings::rb_node` type because they need to match the type of this parameter > | arguments to this function are incorrect > | > ::: rust/kernel/rbtree.rs:270:6 > | > 270 | impl RBTree > | - found this type parameter > ... > 332 | let node = unsafe { container_of!(curr, Node, key) }; > | ------------------------------------ in this macro invocation > | > = note: expected raw pointer `*mut bindings::rb_node` > found raw pointer `*mut K` > note: function defined here > --> rust/kernel/lib.rs:227:8 > | > 227 | pub fn assert_same_type(_: T, _: T) {} > | ^^^^^^^^^^^^^^^^ - ---- ---- this parameter needs to match the `*mut bindings::rb_node` type of parameter #1 > | | | > | | parameter #2 needs to match the `*mut bindings::rb_node` type of this parameter > | parameter #1 and parameter #2 both reference this parameter `T` > = note: this error originates in the macro `container_of` (in Nightly builds, run with -Z macro-backtrace for more info) [ We decided to go with a variation of v1 [1] that became v4, since it seems like the obvious approach, the error messages seem good enough and the debug performance should be fine, given the kernel is always built with -O2. In the future, we may want to make the helper non-hidden, with proper documentation, for others to use. [1] https://lore.kernel.org/rust-for-linux/CANiq72kQWNfSV0KK6qs6oJt+aGdgY=hXg=wJcmK3zYcokY1LNw@mail.gmail.com/ - Miguel ] Suggested-by: Alice Ryhl Link: https://lore.kernel.org/all/CAH5fLgh6gmqGBhPMi2SKn7mCmMWfOSiS0WP5wBuGPYh9ZTAiww@mail.gmail.com/ Signed-off-by: Tamir Duberstein Reviewed-by: Benno Lossin Link: https://lore.kernel.org/r/20250529-b4-container-of-type-check-v4-1-bf3a7ad73cec@gmail.com [ Added intra-doc link. - Miguel ] Signed-off-by: Miguel Ojeda commit d0b29661a95bbf804b6fe9bdff1d8927206c9f38 Author: Ahmed Salem Date: Thu May 29 17:43:13 2025 +0200 ACPICA: Switch back to using strncpy() in acpi_ut_safe_strncpy() ACPICA commit b90d0d65ec97ff8279ad826f4102e0d31c5f662a I mistakenly replaced strncpy() with memcpy() in commit ebf27765421c ("ACPICA: Replace strncpy() with memcpy()"), not realizing the entire context behind *why* strncpy() was used. In this safer implementation of strncpy(), it does not make sense to use memcpy() only to null-terminate strings passed to acpi_ut_safe_strncpy() one byte early. The consequences of doing so are understandably *bad*, as was evident by the kernel test bot reporting problems [1]. Fixes: ebf27765421c ("ACPICA: Replace strncpy() with memcpy()") Link: https://lore.kernel.org/all/202505081033.50e45ff4-lkp@intel.com [1] Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202505081033.50e45ff4-lkp@intel.com Link: https://github.com/acpica/acpica/commit/b90d0d65 Signed-off-by: Ahmed Salem Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/12685690.O9o76ZdvQC@rjwysocki.net commit e0797d3b91de75b6c95b4a0e0649ebd4aac1d9d1 Merge: db340159f19ae0 d5a2693f93e497 Author: Linus Torvalds Date: Thu May 29 10:38:23 2025 -0700 Merge tag 'fs_for_v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull ext2 and isofs updates from Jan Kara: - isofs fix of handling of particularly formatted Rock Ridge timestamps - Add deprecation notice about support of DAX in ext2 filesystem driver * tag 'fs_for_v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: ext2: Deprecate DAX isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry commit db340159f19ae083afb33fce0aaadc77c6b0d547 Merge: 1193e205dbb6fe 58f5fbeb367ff6 Author: Linus Torvalds Date: Thu May 29 10:34:26 2025 -0700 Merge tag 'fsnotify_for_v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull fsnotify updates from Jan Kara: "Two fanotify cleanups and support for watching namespace-owned filesystems by namespace admins (most useful for being able to watch for new mounts / unmounts happening within a user namespace)" * tag 'fsnotify_for_v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fanotify: support watching filesystems and mounts inside userns fanotify: remove redundant permission checks fanotify: Drop use of flex array in fanotify_fh commit 1193e205dbb6feca917dc8e1862ffcdf2194234b Merge: 9d230d500b0e5f 9c96808f10d841 Author: Linus Torvalds Date: Thu May 29 10:19:22 2025 -0700 Merge tag 'platform-drivers-x86-v6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform drivers updates from Ilpo Järvinen: "The changes are mostly business as usual. Besides pdx86 changes, there are a few power supply changes needed for related pdx86 features, move of oxpec driver from hwmon (oxp-sensors) to pdx86, and one FW version warning to hid-asus. Highlights: - alienware-wmi-wmax: - Add HWMON support - Add ABI and admin-guide documentation - Expose GPIO debug methods through debug FS - Support manual fan control and "custom" thermal profile - amd/hsmp: - Add sysfs files to show HSMP telemetry - Report power readings and limits via hwmon - amd/isp4: Add AMD ISP platform config for OV05C10 - asus-wmi: - Refactor Ally suspend/resume to work better with older FW - hid-asus: check ROG Ally MCU version and warn about old FW versions - dasharo-acpi: - Add driver for Dasharo devices supporting fans and temperatures monitoring - dell-ddv: - Expose the battery health and manufacture date to userspace using power supply extensions - Implement the battery matching algorithm - dell-pc: - Improve error propagation - Use faux device - int3472: - Add delays to avoid GPIO regulator spikes - Add handshake pin support - Make regulator supply name configurable and allow registering more than 1 GPIO regulator - Map mt9m114 powerdown pin to powerenable - intel/pmc: Add separate SSRAM Telemetry driver - intel-uncore-freq: Add attributes to show agent types and die ID - ISST: - Support SST-TF revision 2 (allows more cores per bucket) - Support SST-PP revision 2 (fabric 1 frequencies) - Remove unnecessary SST MSRs restore (the package retains MSRs despite CPU offlining) - mellanox: Add support for SN2201, SN4280, SN5610, and SN5640 - mellanox: mlxbf-pmc: Support additional PMC blocks - oxpec: - Add OneXFly variants - Add support for charge limit, charge thresholds, and turbo LED - Distinguish current X1 variants to avoid unwanted matching to new variants - Follow hwmon conventions - Move from hwmon/oxp-sensors to platform/x86 to match the enlarged scope - power supply: - Add inhibit-charge-awake (needed by oxpec) - Add additional battery health status values ("blown fuse" and "cell imbalance") (needed by dell-ddv) - powerwell-ec: Add driver for Portwell EC supporting GPIO and watchdog - thinkpad-acpi: Support camera shutter switch hotkey - tuxedo: Add virtual LampArray for TUXEDO NB04 devices - tools/power/x86/intel-speed-select: - Support displaying SST-PP revision 2 fields - Skip uncore frequency update on newer generations of CPUs - Miscellaneous cleanups / refactoring / improvements" * tag 'platform-drivers-x86-v6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (112 commits) thermal/drivers/acerhdf: Constify struct thermal_zone_device_ops platform/x86/amd/hsmp: fix building with CONFIG_HWMON=m platform/x86: asus-wmi: fix build without CONFIG_SUSPEND docs: ABI: Fix "aassociated" to "associated" platform/x86: Add AMD ISP platform config for OV05C10 Documentation: admin-guide: pm: Add documentation for die_id platform/x86/intel-uncore-freq: Add attributes to show die_id platform/x86/intel: power-domains: Add interface to get Linux die ID Documentation: admin-guide: pm: Add documentation for agent_types platform/x86/intel-uncore-freq: Add attributes to show agent types platform/x86/tuxedo: Prevent invalid Kconfig state platform/x86: dell-ddv: Expose the battery health to userspace platform/x86: dell-ddv: Expose the battery manufacture date to userspace platform/x86: dell-ddv: Implement the battery matching algorithm power: supply: core: Add additional health status values platform/x86/amd/hsmp: acpi: Add sysfs files to display HSMP telemetry platform/x86/amd/hsmp: Report power via hwmon sensors platform/x86/amd/hsmp: Use a single DRIVER_VERSION for all hsmp modules platform/mellanox: mlxreg-dpu: Fix smatch warnings platform: mellanox: nvsw-sn2200: Fix .items in nvsw_sn2201_busbar_hotplug ... commit 9d230d500b0e5f7be863e2bf2386be5f80dd18aa Merge: bf373e4c786bfe 071d8e4c2a3b09 Author: Linus Torvalds Date: Thu May 29 09:11:39 2025 -0700 Merge tag 'driver-core-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core updates from Greg KH: "Here are the driver core / kernfs changes for 6.16-rc1. Not a huge number of changes this development cycle, here's the summary of what is included in here: - kernfs locking tweaks, pushing some global locks down into a per-fs image lock - rust driver core and pci device bindings added for new features. - sysfs const work for bin_attributes. The final churn of switching away from and removing the transitional struct members, "read_new", "write_new" and "bin_attrs_new" will come after the merge window to avoid unnecesary merge conflicts. - auxbus device creation helpers added - fauxbus fix for creating sysfs files after the probe completed properly - other tiny updates for driver core things. All of these have been in linux-next for over a week with no reported issues" * tag 'driver-core-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: kernfs: Relax constraint in draining guard Documentation: embargoed-hardware-issues.rst: Remove myself drivers: hv: fix up const issue with vmbus_chan_bin_attrs firmware_loader: use SHA-256 library API instead of crypto_shash API docs: debugfs: do not recommend debugfs_remove_recursive PM: wakeup: Do not expose 4 device wakeup source APIs kernfs: switch global kernfs_rename_lock to per-fs lock kernfs: switch global kernfs_idr_lock to per-fs lock driver core: auxiliary bus: Fix IS_ERR() vs NULL mixup in __devm_auxiliary_device_create() sysfs: constify attribute_group::bin_attrs sysfs: constify bin_attribute argument of bin_attribute::read/write() software node: Correct a OOB check in software_node_get_reference_args() devres: simplify devm_kstrdup() using devm_kmemdup() platform: replace magic number with macro PLATFORM_DEVID_NONE component: do not try to unbind unbound components driver core: auxiliary bus: add device creation helpers driver core: faux: Add sysfs groups after probing commit e5ef4cd2a47f27c0c9d8ff6c0f63a18937c071a3 Author: Niravkumar L Rabara Date: Tue May 27 07:57:07 2025 -0700 EDAC/altera: Use correct write width with the INTTEST register On the SoCFPGA platform, the INTTEST register supports only 16-bit writes. A 32-bit write triggers an SError to the CPU so do 16-bit accesses only. [ bp: AI-massage the commit message. ] Fixes: c7b4be8db8bc ("EDAC, altera: Add Arria10 OCRAM ECC support") Signed-off-by: Niravkumar L Rabara Signed-off-by: Matthew Gerlach Signed-off-by: Borislav Petkov (AMD) Acked-by: Dinh Nguyen Cc: stable@kernel.org Link: https://lore.kernel.org/20250527145707.25458-1-matthew.gerlach@altera.com commit 70523f335734b0b42f97647556d331edf684c7dc Author: Rafael J. Wysocki Date: Thu May 29 15:40:43 2025 +0200 Revert "x86/smp: Eliminate mwait_play_dead_cpuid_hint()" Revert commit 96040f7273e2 ("x86/smp: Eliminate mwait_play_dead_cpuid_hint()") because it introduced a significant power regression on systems that start with "nosmt" in the kernel command line. Namely, on such systems, SMT siblings permanently go offline early, when cpuidle has not been initialized yet, so after the above commit, hlt_play_dead() is called for them. Later on, when the processor attempts to enter a deep package C-state, including PC10 which is requisite for reaching minimum power in suspend-to-idle, it is not able to do that because of the SMT siblings staying in C1 (which they have been put into by HLT). As a result, the idle power (including power in suspend-to-idle) rises quite dramatically on those systems with all of the possible consequences, which (needless to say) may not be expected by their users. This issue is hard to debug and potentially dangerous, so it needs to be addressed as soon as possible in a way that will work for 6.15.y, hence the revert. Of course, after this revert, the issue that commit 96040f7273e2 attempted to address will be back and it will need to be fixed again later. Fixes: 96040f7273e2 ("x86/smp: Eliminate mwait_play_dead_cpuid_hint()") Reported-by: Todd Brandt Tested-by: Todd Brandt Cc: 6.15+ # 6.15+ Signed-off-by: Rafael J. Wysocki Acked-by: Dave Hansen Link: https://patch.msgid.link/12674167.O9o76ZdvQC@rjwysocki.net commit bf373e4c786bfe989e637195252698f45b157a68 Merge: 8ca154e4910eff 89ab97de44fec8 Author: Linus Torvalds Date: Thu May 29 08:22:07 2025 -0700 Merge tag 'devicetree-for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree updates from Rob Herring: "DT Bindings: - Convert all remaining interrupt-controller bindings to DT schema - Convert Rockchip CDN-DP and Freescale TCON, M4IF, TigerP, LDB, PPC PMC, imx-drm, and ftm-quaddec to DT schema - Add bindings for fsl,vf610-pit, fsl,ls1021a-wdt, sgx,vz89te, maxim,max30208, ti,lp8864, and fairphone,fp5-sndcard - Add top-level constraints for renesas,vsp1 and renesas,fcp - Add missing constraint in amlogic,pinctrl-a4 'group' nodes - Adjust the allowed properties for dwc3-xilinx, sony,imx219, pci-iommu, and renesas,dsi - Add EcoNet vendor prefix - Fix the reserved-memory.yaml in fsl,qman-fqd - Drop obsolete numa.txt and cpu-topology.txt which are schemas in dtschema now - Drop Renesas RZ/N1S bindings - Ensure Arm cpu nodes don't allow undocumented properties. Add all the properties which are in use and undocumented. Drop the Mediatek cpufreq binding which is not a binding, but just what DT properties the driver uses. - Add compatibles for Renesas RZ/G3E and RZ/V2N Mali Bifrost GPU - Update documentation on defining child nodes with separate schemas - Add bindings to PSCI MAINTAINERS entry DT core: - Add new functions to simplify driver handling of 'memory-region' properties. Users to be added next cycle. - Simplify of_dma_set_restricted_buffer() to use of_for_each_phandle() - Add missing unlock on error in unittest_data_add()" * tag 'devicetree-for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (87 commits) dt-bindings: timer: Add fsl,vf610-pit.yaml dt-bindings: gpu: mali-bifrost: Add compatible for RZ/G3E SoC ASoC: dt-bindings: qcom,sm8250: Add Fairphone 5 sound card dt-bindings: arm/cpus: Allow 2 power-domains entries dt-bindings: usb: dwc3-xilinx: allow dma-coherent media: dt-bindings: sony,imx219: Allow props from video-interface-devices dt-bindings: soundwire: qcom: Document v2.1.0 version of IP block dt-bindings: watchdog: fsl-imx-wdt: add compatible string fsl,ls1021a-wdt dt-bindings: pinctrl: amlogic,pinctrl-a4: Add missing constraint on allowed 'group' node properties dt-bindings: display: rockchip: Convert cdn-dp-rockchip.txt to yaml dt-bindings: display: bridge: renesas,dsi: allow properties from dsi-controller dt-bindings: trivial-devices: Add VZ89TE to trivial media: dt-bindings: renesas,vsp1: add top-level constraints media: dt-bindings: renesas,fcp: add top-level constraints dt-bindings: trivial-devices: Add Maxim max30208 dt-bindings: soc: fsl,qman-fqd: Fix reserved-memory.yaml reference dt-bindings: interrupt-controller: Convert ti,omap-intc-irq to DT schema dt-bindings: interrupt-controller: Convert ti,omap4-wugen-mpu to DT schema dt-bindings: interrupt-controller: Convert ti,keystone-irq to DT schema dt-bindings: interrupt-controller: Convert technologic,ts4800-irqc to DT schema ... commit 8ca154e4910efff1b04e7750e007d75732c68323 Merge: 43db1111073049 206cc44588f72b Author: Linus Torvalds Date: Thu May 29 08:15:35 2025 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio updates from Michael Tsirkin: - A new virtio RTC driver - vhost scsi now logs write descriptors so migration works - Some hardening work in virtio core - An old spec compliance issue fixed in vhost net - A couple of cleanups, fixes in vringh, virtio-pci, vdpa * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: virtio: reject shm region if length is zero virtio_rtc: Add RTC class driver virtio_rtc: Add Arm Generic Timer cross-timestamping virtio_rtc: Add PTP clocks virtio_rtc: Add module and driver core vringh: use bvec_kmap_local vhost: vringh: Use matching allocation type in resize_iovec() virtio-pci: Fix result size returned for the admin command completion vdpa/octeon_ep: Control PCI dev enabling manually vhost-scsi: log event queue write descriptors vhost-scsi: log control queue write descriptors vhost-scsi: log I/O queue write descriptors vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors vhost: modify vhost_log_write() for broader users commit 43db1111073049220381944af4a3b8a5400eda71 Merge: 12e9b9e5223b0e e9f17038d814c0 Author: Linus Torvalds Date: Thu May 29 08:10:01 2025 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm updates from Paolo Bonzini: "As far as x86 goes this pull request "only" includes TDX host support. Quotes are appropriate because (at 6k lines and 100+ commits) it is much bigger than the rest, which will come later this week and consists mostly of bugfixes and selftests. s390 changes will also come in the second batch. ARM: - Add large stage-2 mapping (THP) support for non-protected guests when pKVM is enabled, clawing back some performance. - Enable nested virtualisation support on systems that support it, though it is disabled by default. - Add UBSAN support to the standalone EL2 object used in nVHE/hVHE and protected modes. - Large rework of the way KVM tracks architecture features and links them with the effects of control bits. While this has no functional impact, it ensures correctness of emulation (the data is automatically extracted from the published JSON files), and helps dealing with the evolution of the architecture. - Significant changes to the way pKVM tracks ownership of pages, avoiding page table walks by storing the state in the hypervisor's vmemmap. This in turn enables the THP support described above. - New selftest checking the pKVM ownership transition rules - Fixes for FEAT_MTE_ASYNC being accidentally advertised to guests even if the host didn't have it. - Fixes for the address translation emulation, which happened to be rather buggy in some specific contexts. - Fixes for the PMU emulation in NV contexts, decoupling PMCR_EL0.N from the number of counters exposed to a guest and addressing a number of issues in the process. - Add a new selftest for the SVE host state being corrupted by a guest. - Keep HCR_EL2.xMO set at all times for systems running with the kernel at EL2, ensuring that the window for interrupts is slightly bigger, and avoiding a pretty bad erratum on the AmpereOne HW. - Add workaround for AmpereOne's erratum AC04_CPU_23, which suffers from a pretty bad case of TLB corruption unless accesses to HCR_EL2 are heavily synchronised. - Add a per-VM, per-ITS debugfs entry to dump the state of the ITS tables in a human-friendly fashion. - and the usual random cleanups. LoongArch: - Don't flush tlb if the host supports hardware page table walks. - Add KVM selftests support. RISC-V: - Add vector registers to get-reg-list selftest - VCPU reset related improvements - Remove scounteren initialization from VCPU reset - Support VCPU reset from userspace using set_mpstate() ioctl x86: - Initial support for TDX in KVM. This finally makes it possible to use the TDX module to run confidential guests on Intel processors. This is quite a large series, including support for private page tables (managed by the TDX module and mirrored in KVM for efficiency), forwarding some TDVMCALLs to userspace, and handling several special VM exits from the TDX module. This has been in the works for literally years and it's not really possible to describe everything here, so I'll defer to the various merge commits up to and including commit 7bcf7246c42a ('Merge branch 'kvm-tdx-finish-initial' into HEAD')" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (248 commits) x86/tdx: mark tdh_vp_enter() as __flatten Documentation: virt/kvm: remove unreferenced footnote RISC-V: KVM: lock the correct mp_state during reset KVM: arm64: Fix documentation for vgic_its_iter_next() KVM: arm64: np-guest CMOs with PMD_SIZE fixmap KVM: arm64: Stage-2 huge mappings for np-guests KVM: arm64: Add a range to pkvm_mappings KVM: arm64: Convert pkvm_mappings to interval tree KVM: arm64: Add a range to __pkvm_host_test_clear_young_guest() KVM: arm64: Add a range to __pkvm_host_wrprotect_guest() KVM: arm64: Add a range to __pkvm_host_unshare_guest() KVM: arm64: Add a range to __pkvm_host_share_guest() KVM: arm64: Introduce for_each_hyp_page KVM: arm64: Handle huge mappings for np-guest CMOs KVM: arm64: nv: Release faulted-in VNCR page from mmu_lock critical section KVM: arm64: nv: Handle TLBI S1E2 for VNCR invalidation with mmu_lock held KVM: arm64: nv: Hold mmu_lock when invalidating VNCR SW-TLB before translating RISC-V: KVM: add KVM_CAP_RISCV_MP_STATE_RESET RISC-V: KVM: Remove scounteren initialization KVM: RISC-V: remove unnecessary SBI reset state ... commit 12e9b9e5223b0e6e259b84bda216a54c8bfee200 Merge: 90b83efa670165 1d887d6f810dbf Author: Linus Torvalds Date: Thu May 29 08:01:53 2025 -0700 Merge tag 'ipe-pr-20250527' of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe Pull IPE update from Fan Wu: "A single commit from Jasjiv Singh, that adds an errno field to IPE policy load auditing to log failures with error details, not just successes. This improves the security audit trail and helps diagnose policy deployment issues" * tag 'ipe-pr-20250527' of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe: ipe: add errno field to IPE policy load auditing commit d0b497df02e9b2ebcb5771c7b16e424c0614a366 Author: Stephan Gerhold Date: Tue May 6 15:10:09 2025 +0200 mailbox: qcom-apcs-ipc: Assign OF node to clock controller child device Currently, the child device for the clock controller inside the APCS block is created without any OF node assigned, so the drivers need to rely on the parent device for obtaining any resources. Add support for defining the clock controller inside a "clock-controller" subnode to break up circular dependencies between the mailbox and required parent clocks of the clock controller. For backwards compatibility, if the subnode is not defined, reuse the OF node from the parent device. Signed-off-by: Stephan Gerhold Reviewed-by: Dmitry Baryshkov Signed-off-by: Jassi Brar commit c3c51387141db549c96db2fd4b8161fa0b4d7301 Author: Stephan Gerhold Date: Tue May 6 15:10:08 2025 +0200 dt-bindings: mailbox: qcom,apcs: Add separate node for clock-controller APCS "global" is sort of a "miscellaneous" hardware block that combines multiple registers inside the application processor subsystem. Two distinct use cases are currently stuffed together in a single device tree node: - Mailbox: to communicate with other remoteprocs in the system. - Clock: for controlling the CPU frequency. These two use cases have unavoidable circular dependencies: the mailbox is needed as early as possible during boot to start controlling shared resources like clocks and power domains, while the clock controller needs one of these shared clocks as its parent. Currently, there is no way to distinguish these two use cases for generic mechanisms like fw_devlink. This is currently blocking conversion of the deprecated custom "qcom,ipc" properties to the standard "mboxes", see e.g. commit d92e9ea2f0f9 ("arm64: dts: qcom: msm8939: revert use of APCS mbox for RPM"): 1. remoteproc &rpm needs mboxes = <&apcs1_mbox 8>; 2. The clock controller inside &apcs1_mbox needs clocks = <&rpmcc RPM_SMD_XO_CLK_SRC>. 3. &rpmcc is a child of remoteproc &rpm The mailbox itself does not need any clocks and should probe early to unblock the rest of the boot process. The "clocks" are only needed for the separate clock controller. In Linux, these are already two separate drivers that can probe independently. Break up the circular dependency chain in the device tree by separating the clock controller into a separate child node. Deprecate the old approach of specifying the clock properties as part of the root node, but keep them for backwards compatibility. Signed-off-by: Stephan Gerhold Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jassi Brar commit 30837a49bd0aba0f311d4056cd48753955f60d40 Author: Lang Yu Date: Fri May 23 10:04:54 2025 +0800 drm/amdkfd: Map wptr BO to GART unconditionally For simulation C models that don't run CP FW where adev->mes.sched_version is not populated correctly. This causes NULL dereference in amdgpu_amdkfd_free_gtt_mem(dev->adev, (void **)&pqn->q->wptr_bo_gart) and warning on unpinned BO in amdgpu_bo_gpu_offset(q->properties.wptr_bo). Compared with adding version check here and there, always map wptr BO to GART simplifies things. v2: Add NULL check in amdgpu_amdkfd_free_gtt_mem.(Philip) Signed-off-by: Lang Yu Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 684530526f07d488986bc34244034e54e00759a4 Author: Alex Deucher Date: Mon May 19 15:51:47 2025 -0400 drm/amdgpu/mes: remove some unused functions Nothing uses them so remove them. Leftover from MES bring up. Reviewed-by: Michael Chen Signed-off-by: Alex Deucher commit 40f970ba7a4ab77be2ffe6d50a70416c8876496a Author: Alex Deucher Date: Mon May 19 15:46:25 2025 -0400 drm/amdgpu/mes: add missing locking in helper functions We need to take the MES lock. Reviewed-by: Michael Chen Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 82a277d529f3fa03d2374f961143afd97469e44e Author: Mario Limonciello Date: Tue May 27 10:59:42 2025 -0500 drm/amd: Export DMCUB version to sysfs For supported ASICs DMCU version is exported, but ASICs that support DMCUB there is no information exported to sysfs. Add an attribute for DMCUB. Reviewed-by: Lijo Lazar Link: https://lore.kernel.org/r/20250527155942.476354-1-mario.limonciello@amd.com Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 324194b528b490d431af24b88c7596f480ed7c81 Author: Asad Kamal Date: Mon May 26 15:27:08 2025 +0800 drm/amd/pm: Enable static metrics table support Enable static metrics support to fetch board voltage and pldm version for smu_v13_0_14 Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit c7d43a148593e71563a4d3b83527d2917149526d Author: Asad Kamal Date: Mon May 26 15:23:41 2025 +0800 drm/amd/pm: Enable static metrics table support Enable static metrics support to fetch board voltage and pldm version for other smu_v13_0_6 program Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 347efe5b396c61bc129832910665d899ee86448e Author: Christophe JAILLET Date: Sat May 24 18:51:25 2025 +0200 drm/amd/display: Constify struct timing_generator_funcs 'struct timing_generator_funcs' are not modified in these drivers. Constifying these structures moves some data to a read-only section, so increases overall security, especially when the structure holds some function pointers. Signed-off-by: Christophe JAILLET Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit c3e9826a22027a21d998d3e64882fa377b613006 Author: Wentao Liang Date: Mon May 26 10:37:31 2025 +0800 drm/amd/display: Add null pointer check for get_first_active_display() The function mod_hdcp_hdcp1_enable_encryption() calls the function get_first_active_display(), but does not check its return value. The return value is a null pointer if the display list is empty. This will lead to a null pointer dereference in mod_hdcp_hdcp2_enable_encryption(). Add a null pointer check for get_first_active_display() and return MOD_HDCP_STATUS_DISPLAY_NOT_FOUND if the function return null. Fixes: 2deade5ede56 ("drm/amd/display: Remove hdcp display state with mst fix") Signed-off-by: Wentao Liang Reviewed-by: Alex Hung Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # v5.8 commit fce0afca3562ceb5386241159280590beeee2f51 Author: ganglxie Date: Thu May 22 15:14:28 2025 +0800 drm/amdgpu: Get mca address for old eeprom records after getting mca address for old eeprom records with 'address==0', it can be correctly parsed under none-nps1, or it will be dropped. Signed-off-by: ganglxie Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 31e837d242cbb58afed8e0d2a722745bc50ad154 Author: ganglxie Date: Thu May 22 14:28:52 2025 +0800 drm/amdgpu: handle old RAS eeprom data in non-nps1 mode Get MCA address from PA in nps1, then convert MCA address to PA in specific nps mode. Signed-off-by: ganglxie Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 90237b16ec1d7afa16e2173cc9a664377214cdd9 Author: Yifan Zhang Date: Wed May 21 18:06:28 2025 +0800 amd/amdkfd: fix a kfd_process ref leak This patch is to fix a kfd_prcess ref leak. Signed-off-by: Yifan Zhang Reviewed-by: Philip Yang Signed-off-by: Alex Deucher commit 5ae9de5867dbf23e53d244dfd62216bec95234a8 Author: Arunpravin Paneer Selvam Date: Mon Dec 30 22:24:53 2024 +0530 drm/amdgpu: Add userq fence support to SDMAv6.0 Add userq fence support to SDMAv6.0 Signed-off-by: Arunpravin Paneer Selvam Acked-by: Christian König Signed-off-by: Alex Deucher commit 1091fba163834f51a02d5d149bd657804e6ab749 Author: Sunday Clement Date: Fri May 23 17:49:50 2025 -0400 drm/amdkfd: Identical code for different branches This patch removes the if/else statement in the cik_event_interrupt_wq function because it is redundant with both branches resulting in identical outcomes, this improves code readibility. Signed-off-by: Sunday Clement Reviewed-by: Harish Kasiviswanathan Signed-off-by: Alex Deucher commit 978592136cfed3491330acfff12a90812d0c6a58 Author: Asad Kamal Date: Wed May 21 19:17:50 2025 +0800 drm/amd/pm: Optimize get gpu metrics data function Optimize get gpu metrics data function for smu_v13_0_12 to allocate metrics structure only once v2: Free and alloc moved to same function(Kevin) Signed-off-by: Asad Kamal Reviewed-by: Yang Wang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 4d2f6b4e4c7ed32e7fa39fcea37344a9eab99094 Author: John Olender Date: Tue Apr 29 07:24:28 2025 -0400 drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram The drm_mm allocator tolerated being passed end > mm->size, but the drm_buddy allocator does not. Restore the pre-buddy-allocator behavior of allowing such placements. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3448 Signed-off-by: John Olender Reviewed-by: Alex Deucher Reviewed-by: Arunpravin Paneer Selvam Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit bf394d28548c3c0a01e113fdef20ddb6cd2df106 Author: David (Ming Qiang) Wu Date: Wed May 14 18:59:11 2025 -0400 drm/amdgpu/vcn5.0.1: read back register after written The addition of register read-back in VCN v5.0.1 is intended to prevent potential race conditions. Reviewed-by: Ruijing Dong Signed-off-by: David (Ming Qiang) Wu Signed-off-by: Alex Deucher commit a8bce9b7a2ccb5cbbe9967a37e617a9ef963e540 Author: David (Ming Qiang) Wu Date: Wed May 14 18:58:37 2025 -0400 drm/amdgpu/vcn5: read back register after written The addition of register read-back in VCN v5.0.0 is intended to prevent potential race conditions. Reviewed-by: Ruijing Dong Signed-off-by: David (Ming Qiang) Wu Signed-off-by: Alex Deucher commit 4d4275a0387790fbe0a016c075dcbb39d58b63ab Author: David (Ming Qiang) Wu Date: Wed May 14 18:56:35 2025 -0400 drm/amdgpu/vcn4.0.5: read back register after written The addition of register read-back in VCN v4.0.5 is intended to prevent potential race conditions. Reviewed-by: Ruijing Dong Signed-off-by: David (Ming Qiang) Wu Signed-off-by: Alex Deucher commit 5b4c6413c89613cb46669b576d83658fe6e734da Author: David (Ming Qiang) Wu Date: Wed May 14 18:55:59 2025 -0400 drm/amdgpu/vcn4.0.3: read back register after written The addition of register read-back in VCN v4.0.3 is intended to prevent potential race conditions. Reviewed-by: Ruijing Dong Signed-off-by: David (Ming Qiang) Wu Signed-off-by: Alex Deucher commit a3810a5e37c58329aa2c7992f3172a423f4ae194 Author: David (Ming Qiang) Wu Date: Wed May 14 18:55:27 2025 -0400 drm/amdgpu/vcn4: read back register after written The addition of register read-back in VCN v4.0.0 is intended to prevent potential race conditions. Reviewed-by: Ruijing Dong Signed-off-by: David (Ming Qiang) Wu Signed-off-by: Alex Deucher commit b7a4842a917e3a251b5a6aa1a21a5daf6d396ef3 Author: David (Ming Qiang) Wu Date: Wed May 14 18:54:39 2025 -0400 drm/amdgpu/vcn3: read back register after written The addition of register read-back in VCN v3.0 is intended to prevent potential race conditions. Reviewed-by: Ruijing Dong Signed-off-by: David (Ming Qiang) Wu Signed-off-by: Alex Deucher commit d9e688b9148bb23629d32017344888dd67ec2ab1 Author: David (Ming Qiang) Wu Date: Wed May 14 18:54:01 2025 -0400 drm/amdgpu/vcn2.5: read back register after written The addition of register read-back in VCN v2.5 is intended to prevent potential race conditions. Reviewed-by: Ruijing Dong Signed-off-by: David (Ming Qiang) Wu Signed-off-by: Alex Deucher commit 8c5ed7f5abe2cae3b0bf33d4f51f6fb03aadf3ff Author: David (Ming Qiang) Wu Date: Wed May 14 18:52:13 2025 -0400 drm/amdgpu/vcn2: read back register after written The addition of register read-back in VCN v2.0 is intended to prevent potential race conditions. Reviewed-by: Ruijing Dong Signed-off-by: David (Ming Qiang) Wu Signed-off-by: Alex Deucher commit 988b1d2164a1cbe56616a1ded0c877a3ae753558 Author: Fangzhi Zuo Date: Tue May 20 15:30:25 2025 -0400 Revert "drm/amd/display: pause the workload setting in dm" This reverts commit 50f29ead1f1ba48983b6c5e3813b15e497714f55. Reason for revert: cause corruption on Dell U3224KB DP2 display. Signed-off-by: Fangzhi Zuo Reviewed-by: Kenneth Feng Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 0ef2803173f180fe31b5083b1dcf0f8fa6e5608f Author: David (Ming Qiang) Wu Date: Wed May 14 18:50:15 2025 -0400 drm/amdgpu/vcn1: read back register after written V3: drop changes where readbacks have implemented. This patch set is to add readbacks only. V2: use common register UVD_STATUS for readback (standard PCI MMIO behavior, i.e. readback post all writes to let the writes hit the hardware) add readback in ..._stop() for more coverage. Similar to the changes made for VCN v4.0.5 where readback to post the writes to avoid race with the doorbell, the addition of register readback support in other VCN versions is intended to prevent potential race conditions, even though such issues have not been observed yet. This change ensures consistency across different VCN variants and helps avoid similar issues. The overhead introduced is negligible. Reviewed-by: Ruijing Dong Signed-off-by: David (Ming Qiang) Wu Signed-off-by: Alex Deucher commit 040585df957d45ebec0297bad525f39471229987 Author: Aurabindo Pillai Date: Thu May 22 10:34:50 2025 -0400 drm/amd/display: Reuse Subvp debug option for FAMS FAMS is the successor to SubVP starting with DCN4x. Reuse the same debug option to disable FAMS for debugging purposes. Signed-off-by: Aurabindo Pillai Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit 1b824eef269db44d068bbc0de74c94a8e8f9ce02 Author: Aurabindo Pillai Date: Wed May 21 16:05:39 2025 -0400 Revert "drm/amd/display: more liberal vmin/vmax update for freesync" This reverts commit cfb2d41831ee5647a4ae0ea7c24971a92d5dfa0d since it causes regressions on certain configs. Revert until the issue can be isolated and debugged. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4238 Signed-off-by: Aurabindo Pillai Acked-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 27eab4c644236a9324084a70fe79e511cbd07393 Author: Horatiu Vultur Date: Wed May 28 11:36:19 2025 +0200 net: lan966x: Make sure to insert the vlan tags also in host mode When running these commands on DUT (and similar at the other end) ip link set dev eth0 up ip link add link eth0 name eth0.10 type vlan id 10 ip addr add 10.0.0.1/24 dev eth0.10 ip link set dev eth0.10 up ping 10.0.0.2 The ping will fail. The reason why is failing is because, the network interfaces for lan966x have a flag saying that the HW can insert the vlan tags into the frames(NETIF_F_HW_VLAN_CTAG_TX). Meaning that the frames that are transmitted don't have the vlan tag inside the skb data, but they have it inside the skb. We already get that vlan tag and put it in the IFH but the problem is that we don't configure the HW to rewrite the frame when the interface is in host mode. The fix consists in actually configuring the HW to insert the vlan tag if it is different than 0. Reviewed-by: Maxime Chevallier Fixes: 6d2c186afa5d ("net: lan966x: Add vlan support.") Signed-off-by: Horatiu Vultur Link: https://patch.msgid.link/20250528093619.3738998-1-horatiu.vultur@microchip.com Signed-off-by: Paolo Abeni commit cb6a85f38f456b086c366e346ebb67ffa70c7243 Author: Gautham R. Shenoy Date: Thu May 29 14:21:43 2025 +0530 acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio() commit 083466754596 ("cpufreq: ACPI: Fix max-frequency computation") modified get_max_boost_ratio() to return the nominal_freq advertised in the _CPC object. This was for the purposes of computing the maximum frequency. The frequencies advertised in _CPC objects are in MHz. However, cpufreq expects the frequency to be in KHz. Since the nominal_freq returned by get_max_boost_ratio() was not in KHz but instead in MHz,the cpuinfo_max_frequency that was computed using this nominal_freq was incorrect and an invalid value which resulted in cpufreq reporting the P0 frequency as the cpuinfo_max_freq. Fix this by converting the nominal_freq to KHz before returning the same from get_max_boost_ratio(). Reported-by: Manu Bretelle Closes: https://lore.kernel.org/lkml/aDaB63tDvbdcV0cg@HQ-GR2X1W2P57/ Fixes: 083466754596 ("cpufreq: ACPI: Fix max-frequency computation") Signed-off-by: Gautham R. Shenoy Cc: 6.14+ # 6.14+ Link: https://patch.msgid.link/20250529085143.709-1-gautham.shenoy@amd.com Signed-off-by: Rafael J. Wysocki commit 99d232804405e35d7a9af1536a057578a1442e81 Author: Steven Rostedt Date: Tue May 27 14:31:44 2025 -0400 ring-buffer: Simplify functions with __free(kfree) to free allocations The function rb_allocate_pages() allocates cpu_buffer and on error needs to free it. It has a single return. Use __free(kfree) and return directly on errors and have the return use return_ptr(cpu_buffer). The function alloc_buffer() allocates buffer and on error needs to free it. It has a single return. Use __free(kfree) and return directly on errors and have the return use return_ptr(buffer). The function __rb_map_vma() allocates a temporary array "pages". Have it use __free() and not worry about freeing it when returning. Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20250527143144.6edc4625@gandalf.local.home Reviewed-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 60bc720e10eac397b3adae975095df77bc368b88 Author: Steven Rostedt Date: Tue May 27 12:20:09 2025 -0400 ring-buffer: Make ring_buffer_{un}map() simpler with guard(mutex) Convert the taking of the buffer->mutex and the cpu_buffer->mapping_lock over to guard(mutex) and simplify the ring_buffer_map() and ring_buffer_unmap() functions. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Vincent Donnefort Link: https://lore.kernel.org/20250527122009.267efb72@gandalf.local.home Signed-off-by: Steven Rostedt (Google) commit b2e7c6ed26e90fab1e5e626071e54e3b9ec9cb5a Author: Steven Rostedt Date: Tue May 27 14:52:16 2025 -0400 ring-buffer: Simplify ring_buffer_read_page() with guard() The function ring_buffer_read_page() had two gotos. One was simply returning "ret" and the other was unlocking the reader_lock. There's no reason to use goto to simply return the "ret" variable. Instead just return the value. The jump to the unlocking of the reader_lock can be replaced by guard(raw_spinlock_irqsave)(&cpu_buffer->reader_lock). With these two changes the "ret" variable is no longer used and can be removed. The return value on non-error is what was read and is stored in the "read" variable. Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20250527145216.0187cf36@gandalf.local.home Reviewed-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit f0d8cbc8ccc6299046ceb5023a2af9e2b75c4106 Author: Steven Rostedt Date: Tue May 27 14:46:23 2025 -0400 ring-buffer: Simplify reset_disabled_cpu_buffer() with use of guard() Use guard(raw_spinlock_irqsave)() in reset_disabled_cpu_buffer() to simplify the locking. Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20250527144623.77a9cc47@gandalf.local.home Reviewed-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit f115d2b70bff2665f67fa8e8dc5ed9452b696c44 Author: Steven Rostedt Date: Tue May 27 14:57:53 2025 -0400 ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() The function ring_buffer_swap_cpu() has a bunch of jumps to the label out that simply returns "ret". There's no reason to jump to a label that simply returns a value. Just return directly from there. This goes back to almost the beginning when commit 8aabee573dff ("ring-buffer: remove unneeded get_online_cpus") was introduced. That commit removed a put_online_cpus() from that label, but never updated all the jumps to it that now no longer needed to do anything but return a value. Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20250527145753.6b45d840@gandalf.local.home Reviewed-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 2d22216521b12c4b09479aa684504092cd67970b Author: Steven Rostedt Date: Tue May 27 15:51:16 2025 -0400 ring-buffer: Removed unnecessary if() goto out where out is the next line In the function ring_buffer_discard_commit() there's an if statement that jumps to the next line: if (rb_try_to_discard(cpu_buffer, event)) goto out; out: This was caused by the change that modified the way timestamps were taken in interrupt context, and removed the code between the if statement and the goto, but failed to update the conditional logic. Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20250527155116.227f35be@gandalf.local.home Fixes: a389d86f7fd0 ("ring-buffer: Have nested events still record running time stamp") Reviewed-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 32dc0042528d385d83bf458e4cf3a49c5110afea Author: Masami Hiramatsu (Google) Date: Fri May 23 00:54:52 2025 +0900 tracing: Reset last-boot buffers when reading out all cpu buffers Reset the last-boot ring buffers when read() reads out all cpu buffers through trace_pipe/trace_pipe_raw. This prevents ftrace to unwind ring buffer read pointer next boot. Note that this resets only when all per-cpu buffers are empty, and read via read(2) syscall. For example, if you read only one of the per-cpu trace_pipe, it does not reset it. Also, reading buffer by splice(2) syscall does not reset because some data in the reader (the last) page. Cc: Mathieu Desnoyers Link: https://lore.kernel.org/174792929202.496143.8184644221859580999.stgit@mhiramat.tok.corp.google.com Suggested-by: Steven Rostedt Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit c2a08311427cc8c5c547e5d700cb2f93d63fcb2a Author: Steven Rostedt Date: Tue Apr 1 16:25:54 2025 -0400 ring-buffer: Allow reserve_mem persistent ring buffers to be mmapped When the persistent ring buffer is created from the memory returned by reserve_mem there is nothing prohibiting it to be memory mapped to user space. The memory is the same as the pages allocated by alloc_page(). The way the memory is managed by the ring buffer code is slightly different though and needs to be addressed. The persistent memory uses the page->id for its own purpose where as the user mmap buffer currently uses that for the subbuf array mapped to user space. If the buffer is a persistent buffer, use the page index into that buffer as the identifier instead of the page->id. That is, the page->id for a persistent buffer, represents the order of the buffer is in the link list. ->id == 0 means it is the reader page. When a reader page is swapped, the new reader page's ->id gets zero, and the old reader page gets the ->id of the page that it swapped with. The user space mapping has the ->id is the index of where it was mapped in user space and does not change while it is mapped. Since the persistent buffer is fixed in its location, the index of where a page is in the memory range can be used as the "id" to put in the meta page array, and it can be mapped in the same order to user space as it is in the persistent memory. A new rb_page_id() helper function is used to get and set the id depending on if the page is a normal memory allocated buffer or a physical memory mapped buffer. Cc: Linus Torvalds Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Cc: Vincent Donnefort Cc: Vlastimil Babka Cc: Mike Rapoport Cc: Jann Horn Link: https://lore.kernel.org/20250401203332.246646011@goodmis.org Signed-off-by: Steven Rostedt (Google) commit 4fc78a7c9ca994e1da5d3940704d4e8f0ea8c5e4 Author: Steven Rostedt Date: Wed May 28 12:15:55 2025 -0400 ring-buffer: Do not trigger WARN_ON() due to a commit_overrun When reading a memory mapped buffer the reader page is just swapped out with the last page written in the write buffer. If the reader page is the same as the commit buffer (the buffer that is currently being written to) it was assumed that it should never have missed events. If it does, it triggers a WARN_ON_ONCE(). But there just happens to be one scenario where this can legitimately happen. That is on a commit_overrun. A commit overrun is when an interrupt preempts an event being written to the buffer and then the interrupt adds so many new events that it fills and wraps the buffer back to the commit. Any new events would then be dropped and be reported as "missed_events". In this case, the next page to read is the commit buffer and after the swap of the reader page, the reader page will be the commit buffer, but this time there will be missed events and this triggers the following warning: ------------[ cut here ]------------ WARNING: CPU: 2 PID: 1127 at kernel/trace/ring_buffer.c:7357 ring_buffer_map_get_reader+0x49a/0x780 Modules linked in: kvm_intel kvm irqbypass CPU: 2 UID: 0 PID: 1127 Comm: trace-cmd Not tainted 6.15.0-rc7-test-00004-g478bc2824b45-dirty #564 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:ring_buffer_map_get_reader+0x49a/0x780 Code: 00 00 00 48 89 fe 48 c1 ee 03 80 3c 2e 00 0f 85 ec 01 00 00 4d 3b a6 a8 00 00 00 0f 85 8a fd ff ff 48 85 c0 0f 84 55 fe ff ff <0f> 0b e9 4e fe ff ff be 08 00 00 00 4c 89 54 24 58 48 89 54 24 50 RSP: 0018:ffff888121787dc0 EFLAGS: 00010002 RAX: 00000000000006a2 RBX: ffff888100062800 RCX: ffffffff8190cb49 RDX: ffff888126934c00 RSI: 1ffff11020200a15 RDI: ffff8881010050a8 RBP: dffffc0000000000 R08: 0000000000000000 R09: ffffed1024d26982 R10: ffff888126934c17 R11: ffff8881010050a8 R12: ffff888126934c00 R13: ffff8881010050b8 R14: ffff888101005000 R15: ffff888126930008 FS: 00007f95c8cd7540(0000) GS:ffff8882b576e000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f95c8de4dc0 CR3: 0000000128452002 CR4: 0000000000172ef0 Call Trace: ? __pfx_ring_buffer_map_get_reader+0x10/0x10 tracing_buffers_ioctl+0x283/0x370 __x64_sys_ioctl+0x134/0x190 do_syscall_64+0x79/0x1c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f95c8de48db Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 RSP: 002b:00007ffe037ba110 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffe037bb2b0 RCX: 00007f95c8de48db RDX: 0000000000000000 RSI: 0000000000005220 RDI: 0000000000000006 RBP: 00007ffe037ba180 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe037bb6f8 R14: 00007f95c9065000 R15: 00005575c7492c90 irq event stamp: 5080 hardirqs last enabled at (5079): [] _raw_spin_unlock_irqrestore+0x50/0x70 hardirqs last disabled at (5080): [] _raw_spin_lock_irqsave+0x63/0x70 softirqs last enabled at (4182): [] handle_softirqs+0x552/0x710 softirqs last disabled at (4159): [] __irq_exit_rcu+0x107/0x210 ---[ end trace 0000000000000000 ]--- The above was triggered by running on a kernel with both lockdep and KASAN as well as kmemleak enabled and executing the following command: # perf record -o perf-test.dat -a -- trace-cmd record --nosplice -e all -p function hackbench 50 With perf interjecting a lot of interrupts and trace-cmd enabling all events as well as function tracing, with lockdep, KASAN and kmemleak enabled, it could cause an interrupt preempting an event being written to add enough events to wrap the buffer. trace-cmd was modified to have --nosplice use mmap instead of reading the buffer. The way to differentiate this case from the normal case of there only being one page written to where the swap of the reader page received that one page (which is the commit page), check if the tail page is on the reader page. The difference between the commit page and the tail page is that the tail page is where new writes go to, and the commit page holds the first write that hasn't been committed yet. In the case of an interrupt preempting the write of an event and filling the buffer, it would move the tail page but not the commit page. Have the warning only trigger if the tail page is also on the reader page, and also print out the number of events dropped by a commit overrun as that can not yet be safely added to the page so that the reader can see there were events dropped. Cc: stable@vger.kernel.org Cc: Mathieu Desnoyers Cc: Vincent Donnefort Link: https://lore.kernel.org/20250528121555.2066527e@gandalf.local.home Fixes: fe832be05a8ee ("ring-buffer: Have mmapped ring buffer keep track of missed events") Reviewed-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 589561cb455189154a7110a39d9fcc39965f3104 Author: Yang Shen Date: Thu May 29 14:17:04 2025 +0800 MAINTAINERS: Update HiSilicon SFC driver maintainer Add Yang Shen as the maintainer of the HiSilicon SFC driver, replacing Jay Fang. Signed-off-by: Yang Shen Reviewed-by: Jay Fang Link: https://patch.msgid.link/20250529061704.190725-1-shenyang39@huawei.com Signed-off-by: Mark Brown commit 3b5d1efc878adee4835165663297a75193343d37 Author: Yang Shen Date: Thu May 29 14:14:06 2025 +0800 MAINTAINERS: Update HiSilicon SPI Controller driver maintainer Add Yang Shen as the maintainer of the HiSilicon SPI Controller driver, replacing Jay Fang. Signed-off-by: Yang Shen Reviewed-by: Jay Fang Link: https://patch.msgid.link/20250529061406.183992-1-shenyang39@huawei.com Signed-off-by: Mark Brown commit f65dca1752b70ec4f678ae4dbdd5892335bcbbd8 Merge: 54d34165b4f786 54ec8b08216f3b Author: Paolo Abeni Date: Thu May 29 12:55:33 2025 +0200 Merge tag 'linux-can-fixes-for-6.16-20250529' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2025-05-29 this is a pull request of 1 patch for net/main. The patch is by Fedor Pchelkin and fixes a slab-out-of-bounds access in the kvaser_pciefd driver. linux-can-fixes-for-6.16-20250529 * tag 'linux-can-fixes-for-6.16-20250529' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: kvaser_pciefd: refine error prone echo_skb_max handling logic ==================== Link: https://patch.msgid.link/20250529075313.1101820-1-mkl@pengutronix.de Signed-off-by: Paolo Abeni commit 54d34165b4f786d7fea8412a18fb4a54c1eab623 Author: Dan Carpenter Date: Wed May 28 11:11:09 2025 +0300 net/mlx4_en: Prevent potential integer overflow calculating Hz The "freq" variable is in terms of MHz and "max_val_cycles" is in terms of Hz. The fact that "max_val_cycles" is a u64 suggests that support for high frequency is intended but the "freq_khz * 1000" would overflow the u32 type if we went above 4GHz. Use unsigned long long type for the mutliplication to prevent that. Fixes: 31c128b66e5b ("net/mlx4_en: Choose time-stamping shift value according to HW frequency") Signed-off-by: Dan Carpenter Reviewed-by: Simon Horman Link: https://patch.msgid.link/aDbFHe19juIJKjsb@stanley.mountain Signed-off-by: Paolo Abeni commit dabb90391028799fb524680feb4eb96eb904ca6f Author: Miklos Szeredi Date: Tue Apr 8 15:14:20 2025 +0200 fuse: increase readdir buffer size Increase the buffer size to the count requested by userspace. This improves performance. Signed-off-by: Miklos Szeredi Signed-off-by: Bernd Schubert commit 467e245d47e6662a4cbf4184d9e6d0b1b120c0bf Author: Miklos Szeredi Date: Wed Apr 16 12:44:55 2025 +0200 readdir: supply dir_context.count as readdir buffer size hint This is a preparation for large readdir buffers in fuse. Simply setting the fuse buffer size to the userspace buffer size should work, the record sizes are similar (fuse's is slightly larger than libc's, so no overflow should ever happen). Signed-off-by: Miklos Szeredi Signed-off-by: Jaco Kroon commit c31f91c6af96a5eb0632f4aee8d4e39cad7d7559 Author: Miklos Szeredi Date: Wed Apr 16 10:53:58 2025 +0200 fuse: don't allow signals to interrupt getdents copying When getting the directory contents, the entries are first fetched to a kernel buffer, then they are copied to userspace with dir_emit(). This second phase is non-blocking as long as the userspace buffer is not paged out, making it interruptible makes zero sense. Overload d_type as flags, since it only uses 4 bits from 32. Reviewed-by: Bernd Schubert Signed-off-by: Miklos Szeredi commit f3cb8bd908c72eb7b766eca05aac1685749eff02 Author: Joanne Koong Date: Mon May 12 15:58:40 2025 -0700 fuse: support large folios for writeback Add support for folios larger than one page size for writeback. Signed-off-by: Joanne Koong Reviewed-by: Josef Bacik Reviewed-by: Jeff Layton Signed-off-by: Miklos Szeredi commit 906354c87f4917210aa4400708906200ae71614c Author: Joanne Koong Date: Mon May 12 15:58:38 2025 -0700 fuse: support large folios for readahead Add support for folios larger than one page size for readahead. Signed-off-by: Joanne Koong Reviewed-by: Jeff Layton Signed-off-by: Miklos Szeredi commit ff7c3ee4842d87f8fad000039d87692eb03e31e7 Author: Joanne Koong Date: Mon May 12 15:58:37 2025 -0700 fuse: support large folios for queued writes Add support for folios larger than one page size for queued writes. Signed-off-by: Joanne Koong Reviewed-by: Josef Bacik Reviewed-by: Jeff Layton Reviewed-by: Bernd Schubert Signed-off-by: Miklos Szeredi commit c91440c89fbd9d7d23430e5b4cb9e2fd779cc078 Author: Joanne Koong Date: Mon May 12 15:58:36 2025 -0700 fuse: support large folios for stores Add support for folios larger than one page size for stores. Also change variable naming from "this_num" to "nr_bytes". Signed-off-by: Joanne Koong Reviewed-by: Josef Bacik Reviewed-by: Jeff Layton Signed-off-by: Miklos Szeredi commit cacc0645bcad3e20ad17e5942944c51cbe13297e Author: Joanne Koong Date: Mon May 12 15:58:35 2025 -0700 fuse: support large folios for symlinks Support large folios for symlinks and change the name from fuse_getlink_page() to fuse_getlink_folio(). Signed-off-by: Joanne Koong Reviewed-by: Josef Bacik Reviewed-by: Jeff Layton Reviewed-by: Bernd Schubert Signed-off-by: Miklos Szeredi commit 351a24eb48209b50e575a28a0abe07d551187ca8 Author: Joanne Koong Date: Mon May 12 15:58:34 2025 -0700 fuse: support large folios for folio reads Add support for folios larger than one page size for folio reads into the page cache. Signed-off-by: Joanne Koong Reviewed-by: Josef Bacik Reviewed-by: Jeff Layton Reviewed-by: Bernd Schubert Signed-off-by: Miklos Szeredi commit d60a6015e1a2848fc04237bd37ac65b204772313 Author: Joanne Koong Date: Mon May 12 15:58:33 2025 -0700 fuse: support large folios for writethrough writes Add support for folios larger than one page size for writethrough writes. Signed-off-by: Joanne Koong Reviewed-by: Jeff Layton Signed-off-by: Miklos Szeredi commit 63c69ad3d18a8032d50c65de5a3b87136f0cfb42 Author: Joanne Koong Date: Mon May 12 15:58:32 2025 -0700 fuse: refactor fuse_fill_write_pages() Refactor the logic in fuse_fill_write_pages() for copying out write data. This will make the future change for supporting large folios for writes easier. No functional changes. Signed-off-by: Joanne Koong Reviewed-by: Josef Bacik Reviewed-by: Jeff Layton Reviewed-by: Bernd Schubert Signed-off-by: Miklos Szeredi commit 3568a956932621cafadafc8b75fcf6dc06555105 Author: Joanne Koong Date: Mon May 12 15:58:31 2025 -0700 fuse: support large folios for retrieves Add support for folios larger than one page size for retrieves. Signed-off-by: Joanne Koong Reviewed-by: Josef Bacik Reviewed-by: Jeff Layton Reviewed-by: Bernd Schubert Signed-off-by: Miklos Szeredi commit 394244b24fdd09cbbe0290494073ad95a547b44f Author: Joanne Koong Date: Mon May 12 15:58:30 2025 -0700 fuse: support copying large folios Currently, all folios associated with fuse are one page size. As part of the work to enable large folios, this commit adds support for copying to/from folios larger than one page size. Signed-off-by: Joanne Koong Reviewed-by: Jeff Layton Reviewed-by: Bernd Schubert Signed-off-by: Miklos Szeredi commit 293bb049380e14a176e98d3701b85b6b5d3140fd Author: Ard Biesheuvel Date: Wed Apr 2 08:05:31 2025 +0100 ARM: 9446/1: Disallow kernel mode NEON when IRQs are disabled Commit c79f81631142 ("ARM: 9283/1: permit non-nested kernel mode NEON in softirq context") relaxed the rules around the use of SIMD instructions in kernel mode on ARM, to allow such use when serving a softirq. To avoid having to preserve/restore kernel mode NEON state when such a softirq is taken, softirqs are now disabled when using the NEON from task context. However, the fact that the softirq API does not allow unmasking of softirqs with interrupts disabled was overlooked, resulting in a WARN() in some cases, as reported by Guenter: WARNING: CPU: 0 PID: 1145 at kernel/softirq.c:369 __local_bh_enable_ip+0x118/0x194 Call trace: unwind_backtrace from show_stack+0x10/0x14 show_stack from dump_stack_lvl+0x7c/0xac dump_stack_lvl from __warn+0x7c/0x1b8 __warn from warn_slowpath_fmt+0x19c/0x1a4 warn_slowpath_fmt from __local_bh_enable_ip+0x118/0x194 __local_bh_enable_ip from crc_t10dif_arch+0xd4/0xe8 crc_t10dif_arch from crc_t10dif_wrapper+0x14/0x1c crc_t10dif_wrapper from crc_main_test+0x178/0x360 crc_main_test from kunit_try_run_case+0x78/0x1e0 kunit_try_run_case from kunit_generic_run_threadfn_adapter+0x1c/0x34 kunit_generic_run_threadfn_adapter from kthread+0x118/0x254 kthread from ret_from_fork+0x14/0x28 While disabling softirqs is not really needed when running with IRQs disabled (given that the only way a softirq can be delivered asynchrously is over the back of an IRQ), let's not complicate this logic more than needed, and simply disallow use of the NEON in kernel mode when IRQs are disabled. Another approach might be to only disable and re-enable softirqs if IRQs are enabled, but other than the test case above, there are no clear use cases for doing non-trivial arithmetic processing (hence using an accelerated SIMD implementation) with IRQs disabled. Reported-by: Guenter Roeck Tested-by: Guenter Roeck Link: https://lore.kernel.org/all/389b899f-893c-4855-9e30-d8920a5d6f91@roeck-us.net Reviewed-by: Eric Biggers Signed-off-by: Ard Biesheuvel Signed-off-by: Russell King (Oracle) commit ba99c627aac85bc746fb4a6e2d79edb3ad100326 Author: Yanqing Wang Date: Wed May 28 15:53:51 2025 +0800 driver: net: ethernet: mtk_star_emac: fix suspend/resume issue Identify the cause of the suspend/resume hang: netif_carrier_off() is called during link state changes and becomes stuck while executing linkwatch_work(). To resolve this issue, call netif_device_detach() during the Ethernet suspend process to temporarily detach the network device from the kernel and prevent the suspend/resume hang. Fixes: 8c7bd5a454ff ("net: ethernet: mtk-star-emac: new driver") Signed-off-by: Yanqing Wang Signed-off-by: Macpaul Lin Signed-off-by: Biao Huang Link: https://patch.msgid.link/20250528075351.593068-1-macpaul.lin@mediatek.com Signed-off-by: Paolo Abeni commit 4257271d2a5bd2d2a889a2f105dd6650c857988d Author: Geert Uytterhoeven Date: Tue May 27 21:33:41 2025 +0200 hinic3: Remove printed message during module init No driver should spam the kernel log when merely being loaded. Fixes: 17fcb3dc12bbee8e ("hinic3: module initialization and tx/rx logic") Signed-off-by: Geert Uytterhoeven Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/5310dac0b3ab4bd16dd8fb761566f12e73b38cab.1748357352.git.geert+renesas@glider.be Signed-off-by: Paolo Abeni commit f29ccaa07cf3d35990f4d25028cc55470d29372b Author: Charalampos Mitrodimas Date: Tue May 27 16:35:44 2025 +0000 net: tipc: fix refcount warning in tipc_aead_encrypt syzbot reported a refcount warning [1] caused by calling get_net() on a network namespace that is being destroyed (refcount=0). This happens when a TIPC discovery timer fires during network namespace cleanup. The recently added get_net() call in commit e279024617134 ("net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done") attempts to hold a reference to the network namespace. However, if the namespace is already being destroyed, its refcount might be zero, leading to the use-after-free warning. Replace get_net() with maybe_get_net(), which safely checks if the refcount is non-zero before incrementing it. If the namespace is being destroyed, return -ENODEV early, after releasing the bearer reference. [1]: https://lore.kernel.org/all/68342b55.a70a0220.253bc2.0091.GAE@google.com/T/#m12019cf9ae77e1954f666914640efa36d52704a2 Reported-by: syzbot+f0c4a4aba757549ae26c@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68342b55.a70a0220.253bc2.0091.GAE@google.com/T/#m12019cf9ae77e1954f666914640efa36d52704a2 Fixes: e27902461713 ("net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done") Signed-off-by: Charalampos Mitrodimas Reviewed-by: Tung Nguyen Link: https://patch.msgid.link/20250527-net-tipc-warning-v2-1-df3dc398a047@posteo.net Signed-off-by: Paolo Abeni commit fd579a2ebbe4b7e6b388915a50d904e772a35c61 Author: David Howells Date: Tue May 27 16:01:43 2025 +0100 rxrpc: Fix return from none_validate_challenge() Fix the return value of none_validate_challenge() to be explicitly true (which indicates the source packet should simply be discarded) rather than implicitly true (because rxrpc_abort_conn() always returns -EPROTO which gets converted to true). Note that this change doesn't change the behaviour of the code (which is correct by accident) and, in any case, we *shouldn't* get a CHALLENGE packet to an rxnull connection (ie. no security). Reported-by: Dan Carpenter Closes: https://lists.infradead.org/pipermail/linux-afs/2025-April/009738.html Signed-off-by: David Howells cc: Marc Dionne cc: Jakub Kicinski cc: "David S. Miller" cc: Eric Dumazet cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org cc: netdev@vger.kernel.org Reviewed-by: Simon Horman Link: https://patch.msgid.link/10720.1748358103@warthog.procyon.org.uk Fixes: 5800b1cf3fd8 ("rxrpc: Allow CHALLENGEs to the passed to the app for a RESPONSE") Signed-off-by: Paolo Abeni commit f41a94aade120dc60322865f363cee7865f2df01 Author: Alok Tiwari Date: Tue May 27 06:08:16 2025 -0700 gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt Previously, the RX_BUFFERS_POSTED stat incorrectly reported the fill_cnt from RX queue 0 for all queues, resulting in inaccurate per-queue statistics. Fix this by correctly indexing priv->rx[idx].fill_cnt for each RX queue. Fixes: 24aeb56f2d38 ("gve: Add Gvnic stats AQ command and ethtool show/set-priv-flags.") Signed-off-by: Alok Tiwari Link: https://patch.msgid.link/20250527130830.1812903-1-alok.a.tiwari@oracle.com Signed-off-by: Paolo Abeni commit eb7fd7aa35bfcc1e1fda4ecc42ccfcb526cdc780 Author: Quentin Schulz Date: Tue May 27 13:56:23 2025 +0200 net: stmmac: platform: guarantee uniqueness of bus_id bus_id is currently derived from the ethernetX alias. If one is missing for the device, 0 is used. If ethernet0 points to another stmmac device or if there are 2+ stmmac devices without an ethernet alias, then bus_id will be 0 for all of those. This is an issue because the bus_id is used to generate the mdio bus id (new_bus->id in drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c stmmac_mdio_register) and this needs to be unique. This allows to avoid needing to define ethernet aliases for devices with multiple stmmac controllers (such as the Rockchip RK3588) for multiple stmmac devices to probe properly. Obviously, the bus_id isn't guaranteed to be stable across reboots if no alias is set for the device but that is easily fixed by simply adding an alias if this is desired. Fixes: 25c83b5c2e82 ("dt:net:stmmac: Add support to dwmac version 3.610 and 3.710") Signed-off-by: Quentin Schulz Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20250527-stmmac-mdio-bus_id-v2-1-a5ca78454e3c@cherry.de Signed-off-by: Paolo Abeni commit 54ec8b08216f3be2cc98b33633d3c8ea79749895 Author: Fedor Pchelkin Date: Wed May 28 22:27:12 2025 +0300 can: kvaser_pciefd: refine error prone echo_skb_max handling logic echo_skb_max should define the supported upper limit of echo_skb[] allocated inside the netdevice's priv. The corresponding size value provided by this driver to alloc_candev() is KVASER_PCIEFD_CAN_TX_MAX_COUNT which is 17. But later echo_skb_max is rounded up to the nearest power of two (for the max case, that would be 32) and the tx/ack indices calculated further during tx/rx may exceed the upper array boundary. Kasan reported this for the ack case inside kvaser_pciefd_handle_ack_packet(), though the xmit function has actually caught the same thing earlier. BUG: KASAN: slab-out-of-bounds in kvaser_pciefd_handle_ack_packet+0x2d7/0x92a drivers/net/can/kvaser_pciefd.c:1528 Read of size 8 at addr ffff888105e4f078 by task swapper/4/0 CPU: 4 UID: 0 PID: 0 Comm: swapper/4 Not tainted 6.15.0 #12 PREEMPT(voluntary) Call Trace: dump_stack_lvl lib/dump_stack.c:122 print_report mm/kasan/report.c:521 kasan_report mm/kasan/report.c:634 kvaser_pciefd_handle_ack_packet drivers/net/can/kvaser_pciefd.c:1528 kvaser_pciefd_read_packet drivers/net/can/kvaser_pciefd.c:1605 kvaser_pciefd_read_buffer drivers/net/can/kvaser_pciefd.c:1656 kvaser_pciefd_receive_irq drivers/net/can/kvaser_pciefd.c:1684 kvaser_pciefd_irq_handler drivers/net/can/kvaser_pciefd.c:1733 __handle_irq_event_percpu kernel/irq/handle.c:158 handle_irq_event kernel/irq/handle.c:210 handle_edge_irq kernel/irq/chip.c:833 __common_interrupt arch/x86/kernel/irq.c:296 common_interrupt arch/x86/kernel/irq.c:286 Tx max count definitely matters for kvaser_pciefd_tx_avail(), but for seq numbers' generation that's not the case - we're free to calculate them as would be more convenient, not taking tx max count into account. The only downside is that the size of echo_skb[] should correspond to the max seq number (not tx max count), so in some situations a bit more memory would be consumed than could be. Thus make the size of the underlying echo_skb[] sufficient for the rounded max tx value. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 8256e0ca6010 ("can: kvaser_pciefd: Fix echo_skb race") Cc: stable@vger.kernel.org Signed-off-by: Fedor Pchelkin Link: https://patch.msgid.link/20250528192713.63894-1-pchelkin@ispras.ru Signed-off-by: Marc Kleine-Budde commit 63bfd78aae9a90210b0d369bb2836cca90402a95 Merge: 3e515fc8601a1e b217785073f073 0409ac483a81a2 09febae220d2ea b176dab2389c3c Author: Stephen Boyd Date: Thu May 29 00:30:39 2025 -0700 Merge branches 'clk-amlogic', 'clk-allwinner', 'clk-rockchip' and 'clk-qcom' into clk-next * clk-amlogic: clk: meson: Do not enable by default during compile testing clk: meson-g12a: add missing fclk_div2 to spicc * clk-allwinner: clk: sunxi-ng: ccu: add Display Engine 3.3 (DE33) support dt-bindings: allwinner: add H616 DE33 clock binding clk: sunxi-ng: h616: Add LVDS reset for LCD TCON dt-bindings: clock: sun50i-h616-ccu: Add LVDS reset clk: sunxi: Do not enable by default during compile testing clk: sunxi-ng: Do not enable by default during compile testing * clk-rockchip: clk: rockchip: rk3528: add slab.h header include clk: rockchip: rk3576: add missing slab.h include clk: rockchip: rename gate-grf clk file clk: rockchip: rename branch_muxgrf to branch_grf_mux clk: rockchip: Pass NULL as reg pointer when registering GRF MMC clocks clk: rockchip: rk3036: mark ddrphy as critical clk: rockchip: rk3036: fix implementation of usb480m clock mux dt-bindings: clock: rk3036: add SCLK_USB480M clock-id clk: rockchip: rk3528: Add SD/SDIO tuning clocks in GRF region clk: rockchip: Support MMC clocks in GRF region dt-bindings: clock: Add GRF clock definition for RK3528 clk: rockchip: add GATE_GRFs for SAI MCLKOUT to rk3576 clk: rockchip: introduce GRF gates clk: rockchip: introduce auxiliary GRFs dt-bindings: clock: rk3576: add IOC gated clocks clk: rockchip: rk3568: Add PLL rate for 33.3MHz clk: rockchip: Drop empty init callback for rk3588 PLL type clk: rockchip: rk3588: Add PLL rate for 1500 MHz * clk-qcom: clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks clk: qcom: gcc: Set FORCE_MEM_CORE_ON for gcc_ufs_axi_clk for 8650/8750 clk: qcom: rpmh: make clkaN optional clk: qcom: Add support for Camera Clock Controller on QCS8300 clk: qcom: gcc-msm8939: Fix mclk0 & mclk1 for 24 MHz dt-bindings: clock: add SM6350 QCOM video clock bindings clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs clk: qcom: Fix missing error check for dev_pm_domain_attach() commit 3e515fc8601a1ea85becf7d990ad8700e012a70a Merge: 7459da16c9a4bf 6bbc69e58aa836 a08f0ac32bf48e 29c98b13921eb1 3a4c538e13d65e Author: Stephen Boyd Date: Thu May 29 00:30:28 2025 -0700 Merge branches 'clk-socfpga', 'clk-sophgo', 'clk-thead' and 'clk-samsung' into clk-next * clk-socfpga: clk: socfpga: stratix10: Optimize local variables clk: socfpga: clk-pll: Optimize local variables * clk-sophgo: clk: sophgo: Add clock controller support for SG2044 SoC clk: sophgo: Add PLL clock controller support for SG2044 SoC dt-bindings: clock: sophgo: add clock controller for SG2044 dt-bindings: soc: sophgo: Add SG2044 top syscon device clk: sophgo: Add support for newly added precise compatible dt-bindings: clock: sophgo: Use precise compatible for CV1800 series SoC * clk-thead: clk: thead: Add clock support for VO subsystem in T-HEAD TH1520 SoC dt-bindings: clock: thead: Add TH1520 VO clock controller * clk-samsung: clk: samsung: correct clock summary for hsi1 block clk: samsung: exynosautov920: Fix incorrect CLKS_NR_CPUCL0 definition clk: samsung: exynosautov920: add cpucl1/2 clock support dt-bindings: clock: exynosautov920: add cpucl1/2 clock definitions clk: samsung: exynosautov920: add cpucl0 clock support dt-bindings: clock: exynosautov920: add cpucl0 clock definitions clk: samsung: Use samsung CCF common function commit 7459da16c9a4bf324e7f5789f296e02e7bc24b68 Merge: 72b421e645a3d8 1ffbdb7aa89af5 f37f6ba2302e82 7a0c1872ee7db2 Author: Stephen Boyd Date: Thu May 29 00:30:17 2025 -0700 Merge branches 'clk-bindings', 'clk-renesas', 'clk-spacemit' and 'clk-cleanup' into clk-next * clk-bindings: dt-bindings: clock: Drop st,stm32h7-rcc.txt dt-bindings: clock: convert bcm2835-aux-clock to yaml dt-bindings: clock: Drop maxim,max77686.txt dt-bindings: clock: convert vf610-clock.txt to yaml format * clk-renesas: (26 commits) clk: renesas: r9a09g047: Add XSPI clock/reset clk: renesas: r9a09g047: Add support for xspi mux and divider dt-bindings: clock: renesas,r9a09g047-cpg: Add XSPI and GBETH PTP core clocks clk: renesas: Use str_on_off() helper clk: renesas: r9a09g057: Add clock and reset entries for USB2 dt-bindings: clock: renesas,r9a09g057-cpg: Add USB2 PHY and GBETH PTP core clocks clk: renesas: rzv2h: Use both CLK_ON and CLK_MON bits for clock state validation clk: renesas: rzv2h: Use str_on_off() helper in rzv2h_mod_clock_endisable() clk: renesas: rzv2h: Support static dividers without RMW clk: renesas: rzv2h: Add macro for defining static dividers clk: renesas: rzv2h: Add support for static mux clocks clk: renesas: r9a09g047: Add clock and reset entries for GE3D clk: renesas: rzv2h: Fix a typo clk: renesas: rzv2h: Add support for RZ/V2N SoC clk: renesas: rzv2h: Sort compatible list based on SoC part number dt-bindings: pinctrl: renesas: Document RZ/V2N SoC dt-bindings: clock: renesas: Document RZ/V2N SoC CPG dt-bindings: soc: renesas: Document SYS for RZ/V2N SoC dt-bindings: soc: renesas: Document Renesas RZ/V2N SoC variants and EVK clk: renesas: rzv2h: Simplify rzv2h_cpg_assert()/rzv2h_cpg_deassert() ... * clk-spacemit: clk: spacemit: k1: Add TWSI8 bus and function clocks clk: spacemit: Add clock support for SpacemiT K1 SoC dt-bindings: clock: spacemit: Add spacemit,k1-pll dt-bindings: soc: spacemit: Add spacemit,k1-syscon * clk-cleanup: clk: test: Forward-declare struct of_phandle_args in kunit/clk.h clk: davinci: Use of_get_available_child_by_name() clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() clk: bcm: rpi: Drop module alias clk: bcm: kona: Remove unused scaled_div_build commit b176dab2389c3c958ae14a44514fdecb42857b76 Merge: 0af2f6be1b4281 201bf08ba9e26e Author: Stephen Boyd Date: Wed May 28 23:03:20 2025 -0700 Merge tag 'qcom-clk-for-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into clk-qcom Pull Qualcomm clk driver updates from Bjorn Andersson: - Camera clock controller driver for Qualcomm QCS8300 - Correct wait_val values for a variety of Qualcomm GDSCs - Fix Qualcomm X Elite UFS clock settings - Allow clkaN to be optional in the Qualcomm RPMh clock controller driver if command db doesn't define it commit 271683bb2cf32e5126c592b5d5e6a756fa374fd9 Author: Dong Chenchen Date: Tue May 27 19:41:52 2025 +0800 page_pool: Fix use-after-free in page_pool_recycle_in_ring syzbot reported a uaf in page_pool_recycle_in_ring: BUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30 kernel/locking/lockdep.c:5862 Read of size 8 at addr ffff8880286045a0 by task syz.0.284/6943 CPU: 0 UID: 0 PID: 6943 Comm: syz.0.284 Not tainted 6.13.0-rc3-syzkaller-gdfa94ce54f41 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 lock_release+0x151/0xa30 kernel/locking/lockdep.c:5862 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:165 [inline] _raw_spin_unlock_bh+0x1b/0x40 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] ptr_ring_produce_bh include/linux/ptr_ring.h:164 [inline] page_pool_recycle_in_ring net/core/page_pool.c:707 [inline] page_pool_put_unrefed_netmem+0x748/0xb00 net/core/page_pool.c:826 page_pool_put_netmem include/net/page_pool/helpers.h:323 [inline] page_pool_put_full_netmem include/net/page_pool/helpers.h:353 [inline] napi_pp_put_page+0x149/0x2b0 net/core/skbuff.c:1036 skb_pp_recycle net/core/skbuff.c:1047 [inline] skb_free_head net/core/skbuff.c:1094 [inline] skb_release_data+0x6c4/0x8a0 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x1c9/0x380 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1263 [inline] __skb_queue_purge_reason include/linux/skbuff.h:3343 [inline] root cause is: page_pool_recycle_in_ring ptr_ring_produce spin_lock(&r->producer_lock); WRITE_ONCE(r->queue[r->producer++], ptr) //recycle last page to pool page_pool_release page_pool_scrub page_pool_empty_ring ptr_ring_consume page_pool_return_page //release all page __page_pool_destroy free_percpu(pool->recycle_stats); free(pool) //free spin_unlock(&r->producer_lock); //pool->ring uaf read recycle_stat_inc(pool, ring); page_pool can be free while page pool recycle the last page in ring. Add producer-lock barrier to page_pool_release to prevent the page pool from being free before all pages have been recycled. recycle_stat_inc() is empty when CONFIG_PAGE_POOL_STATS is not enabled, which will trigger Wempty-body build warning. Add definition for pool stat macro to fix warning. Suggested-by: Jakub Kicinski Link: https://lore.kernel.org/netdev/20250513083123.3514193-1-dongchenchen2@huawei.com Fixes: ff7d6b27f894 ("page_pool: refurbish version of page_pool code") Reported-by: syzbot+204a4382fcb3311f3858@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=204a4382fcb3311f3858 Signed-off-by: Dong Chenchen Reviewed-by: Toke Høiland-Jørgensen Reviewed-by: Mina Almasry Link: https://patch.msgid.link/20250527114152.3119109-1-dongchenchen2@huawei.com Signed-off-by: Jakub Kicinski commit 9ad0452c0277b816a435433cca601304cfac7c21 Author: Qasim Ijaz Date: Mon May 26 19:36:07 2025 +0100 net: ch9200: fix uninitialised access during mii_nway_restart In mii_nway_restart() the code attempts to call mii->mdio_read which is ch9200_mdio_read(). ch9200_mdio_read() utilises a local buffer called "buff", which is initialised with control_read(). However "buff" is conditionally initialised inside control_read(): if (err == size) { memcpy(data, buf, size); } If the condition of "err == size" is not met, then "buff" remains uninitialised. Once this happens the uninitialised "buff" is accessed and returned during ch9200_mdio_read(): return (buff[0] | buff[1] << 8); The problem stems from the fact that ch9200_mdio_read() ignores the return value of control_read(), leading to uinit-access of "buff". To fix this we should check the return value of control_read() and return early on error. Reported-by: syzbot Closes: https://syzkaller.appspot.com/bug?extid=3361c2d6f78a3e0892f9 Tested-by: syzbot Fixes: 4a476bd6d1d9 ("usbnet: New driver for QinHeng CH9200 devices") Cc: stable@vger.kernel.org Signed-off-by: Qasim Ijaz Link: https://patch.msgid.link/20250526183607.66527-1-qasdev00@gmail.com Signed-off-by: Jakub Kicinski commit 8542d6fac25c03b4bf36b2d762cfe60fda8491bb Author: Tengteng Yang Date: Tue May 27 11:04:19 2025 +0800 Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated When a process under memory pressure is not part of any cgroup and the charged flag is false, trace_sock_exceed_buf_limit was not called as expected. This regression was introduced by commit 2def8ff3fdb6 ("sock: Code cleanup on __sk_mem_raise_allocated()"). The fix changes the default value of charged to true while preserving existing logic. Fixes: 2def8ff3fdb6 ("sock: Code cleanup on __sk_mem_raise_allocated()") Signed-off-by: Abel Wu Signed-off-by: Tengteng Yang Link: https://patch.msgid.link/20250527030419.67693-1-yangtengteng@bytedance.com Signed-off-by: Jakub Kicinski commit 1ce98bb2bb30713ec4374ef11ead0d7d3e856766 Author: Tamir Duberstein Date: Fri Apr 11 10:08:27 2025 -0400 rust: workqueue: remove HasWork::OFFSET Implement `HasWork::work_container_of` in `impl_has_work!`, narrowing the interface of `HasWork` and replacing pointer arithmetic with `container_of!`. Remove the provided implementation of `HasWork::get_work_offset` without replacement; an implementation is already generated in `impl_has_work!`. Remove the `Self: Sized` bound on `HasWork::work_container_of` which was apparently necessary to access `OFFSET` as `OFFSET` no longer exists. A similar API change was discussed on the hrtimer series[1]. Link: https://lore.kernel.org/all/20250224-hrtimer-v3-v6-12-rc2-v9-1-5bd3bf0ce6cc@kernel.org/ [1] Reviewed-by: Benno Lossin Reviewed-by: Alice Ryhl Tested-by: Alice Ryhl Reviewed-by: Andreas Hindborg Signed-off-by: Tamir Duberstein Acked-by: Tejun Heo Link: https://lore.kernel.org/r/20250411-no-offset-v3-1-c0b174640ec3@gmail.com Signed-off-by: Miguel Ojeda commit d6a0e0bfecccdcecb08defe75a137c7262352102 Author: Kees Cook Date: Wed May 28 11:26:22 2025 -0700 ubsan: integer-overflow: depend on BROKEN to keep this out of CI Depending on !COMPILE_TEST isn't sufficient to keep this feature out of CI because we can't stop it from being included in randconfig builds. This feature is still highly experimental, and is developed in lock-step with Clang's Overflow Behavior Types[1]. Depend on BROKEN to keep it from being enabled by anyone not expecting it. Link: https://discourse.llvm.org/t/rfc-v2-clang-introduce-overflowbehaviortypes-for-wrapping-and-non-wrapping-arithmetic/86507 [1] Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202505281024.f42beaa7-lkp@intel.com Fixes: 557f8c582a9b ("ubsan: Reintroduce signed overflow sanitizer") Acked-by: Eric Biggers Link: https://lore.kernel.org/r/20250528182616.work.296-kees@kernel.org Reviewed-by: Nathan Chancellor Acked-by: Marco Elver Signed-off-by: Kees Cook commit 90b83efa6701656e02c86e7df2cb1765ea602d07 Merge: 1b98f357dadd6e c5cebb241e27ed Author: Linus Torvalds Date: Wed May 28 15:52:42 2025 -0700 Merge tag 'bpf-next-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Pull bpf updates from Alexei Starovoitov: - Fix and improve BTF deduplication of identical BTF types (Alan Maguire and Andrii Nakryiko) - Support up to 12 arguments in BPF trampoline on arm64 (Xu Kuohai and Alexis Lothoré) - Support load-acquire and store-release instructions in BPF JIT on riscv64 (Andrea Parri) - Fix uninitialized values in BPF_{CORE,PROBE}_READ macros (Anton Protopopov) - Streamline allowed helpers across program types (Feng Yang) - Support atomic update for hashtab of BPF maps (Hou Tao) - Implement json output for BPF helpers (Ihor Solodrai) - Several s390 JIT fixes (Ilya Leoshkevich) - Various sockmap fixes (Jiayuan Chen) - Support mmap of vmlinux BTF data (Lorenz Bauer) - Support BPF rbtree traversal and list peeking (Martin KaFai Lau) - Tests for sockmap/sockhash redirection (Michal Luczaj) - Introduce kfuncs for memory reads into dynptrs (Mykyta Yatsenko) - Add support for dma-buf iterators in BPF (T.J. Mercier) - The verifier support for __bpf_trap() (Yonghong Song) * tag 'bpf-next-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (135 commits) bpf, arm64: Remove unused-but-set function and variable. selftests/bpf: Add tests with stack ptr register in conditional jmp bpf: Do not include stack ptr register in precision backtracking bookkeeping selftests/bpf: enable many-args tests for arm64 bpf, arm64: Support up to 12 function arguments bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() bpf: Avoid __bpf_prog_ret0_warn when jit fails bpftool: Add support for custom BTF path in prog load/loadall selftests/bpf: Add unit tests with __bpf_trap() kfunc bpf: Warn with __bpf_trap() kfunc maybe due to uninitialized variable bpf: Remove special_kfunc_set from verifier selftests/bpf: Add test for open coded dmabuf_iter selftests/bpf: Add test for dmabuf_iter bpf: Add open coded dmabuf iterator bpf: Add dmabuf iterator dma-buf: Rename debugfs symbols bpf: Fix error return value in bpf_copy_from_user_dynptr libbpf: Use mmap to parse vmlinux BTF from sysfs selftests: bpf: Add a test for mmapable vmlinux BTF btf: Allow mmap of vmlinux btf ... commit 1b98f357dadd6ea613a435fbaef1a5dd7b35fd21 Merge: 47cf96fbe39383 f6bd8faeb113c8 Author: Linus Torvalds Date: Wed May 28 15:24:36 2025 -0700 Merge tag 'net-next-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next Pull networking updates from Paolo Abeni: "Core: - Implement the Device Memory TCP transmit path, allowing zero-copy data transmission on top of TCP from e.g. GPU memory to the wire. - Move all the IPv6 routing tables management outside the RTNL scope, under its own lock and RCU. The route control path is now 3x times faster. - Convert queue related netlink ops to instance lock, reducing again the scope of the RTNL lock. This improves the control plane scalability. - Refactor the software crc32c implementation, removing unneeded abstraction layers and improving significantly the related micro-benchmarks. - Optimize the GRO engine for UDP-tunneled traffic, for a 10% performance improvement in related stream tests. - Cover more per-CPU storage with local nested BH locking; this is a prep work to remove the current per-CPU lock in local_bh_disable() on PREMPT_RT. - Introduce and use nlmsg_payload helper, combining buffer bounds verification with accessing payload carried by netlink messages. Netfilter: - Rewrite the procfs conntrack table implementation, improving considerably the dump performance. A lot of user-space tools still use this interface. - Implement support for wildcard netdevice in netdev basechain and flowtables. - Integrate conntrack information into nft trace infrastructure. - Export set count and backend name to userspace, for better introspection. BPF: - BPF qdisc support: BPF-qdisc can be implemented with BPF struct_ops programs and can be controlled in similar way to traditional qdiscs using the "tc qdisc" command. - Refactor the UDP socket iterator, addressing long standing issues WRT duplicate hits or missed sockets. Protocols: - Improve TCP receive buffer auto-tuning and increase the default upper bound for the receive buffer; overall this improves the single flow maximum thoughput on 200Gbs link by over 60%. - Add AFS GSSAPI security class to AF_RXRPC; it provides transport security for connections to the AFS fileserver and VL server. - Improve TCP multipath routing, so that the sources address always matches the nexthop device. - Introduce SO_PASSRIGHTS for AF_UNIX, to allow disabling SCM_RIGHTS, and thus preventing DoS caused by passing around problematic FDs. - Retire DCCP socket. DCCP only receives updates for bugs, and major distros disable it by default. Its removal allows for better organisation of TCP fields to reduce the number of cache lines hit in the fast path. - Extend TCP drop-reason support to cover PAWS checks. Driver API: - Reorganize PTP ioctl flag support to require an explicit opt-in for the drivers, avoiding the problem of drivers not rejecting new unsupported flags. - Converted several device drivers to timestamping APIs. - Introduce per-PHY ethtool dump helpers, improving the support for dump operations targeting PHYs. Tests and tooling: - Add support for classic netlink in user space C codegen, so that ynl-c can now read, create and modify links, routes addresses and qdisc layer configuration. - Add ynl sub-types for binary attributes, allowing ynl-c to output known struct instead of raw binary data, clarifying the classic netlink output. - Extend MPTCP selftests to improve the code-coverage. - Add tests for XDP tail adjustment in AF_XDP. New hardware / drivers: - OpenVPN virtual driver: offload OpenVPN data channels processing to the kernel-space, increasing the data transfer throughput WRT the user-space implementation. - Renesas glue driver for the gigabit ethernet RZ/V2H(P) SoC. - Broadcom asp-v3.0 ethernet driver. - AMD Renoir ethernet device. - ReakTek MT9888 2.5G ethernet PHY driver. - Aeonsemi 10G C45 PHYs driver. Drivers: - Ethernet high-speed NICs: - nVidia/Mellanox (mlx5): - refactor the steering table handling to significantly reduce the amount of memory used - add support for complex matches in H/W flow steering - improve flow streeing error handling - convert to netdev instance locking - Intel (100G, ice, igb, ixgbe, idpf): - ice: add switchdev support for LLDP traffic over VF - ixgbe: add firmware manipulation and regions devlink support - igb: introduce support for frame transmission premption - igb: adds persistent NAPI configuration - idpf: introduce RDMA support - idpf: add initial PTP support - Meta (fbnic): - extend hardware stats coverage - add devlink dev flash support - Broadcom (bnxt): - add support for RX-side device memory TCP - Wangxun (txgbe): - implement support for udp tunnel offload - complete PTP and SRIOV support for AML 25G/10G devices - Ethernet NICs embedded and virtual: - Google (gve): - add device memory TCP TX support - Amazon (ena): - support persistent per-NAPI config - Airoha: - add H/W support for L2 traffic offload - add per flow stats for flow offloading - RealTek (rtl8211): add support for WoL magic packet - Synopsys (stmmac): - dwmac-socfpga 1000BaseX support - add Loongson-2K3000 support - introduce support for hardware-accelerated VLAN stripping - Broadcom (bcmgenet): - expose more H/W stats - Freescale (enetc, dpaa2-eth): - enetc: add MAC filter, VLAN filter RSS and loopback support - dpaa2-eth: convert to H/W timestamping APIs - vxlan: convert FDB table to rhashtable, for better scalabilty - veth: apply qdisc backpressure on full ring to reduce TX drops - Ethernet switches: - Microchip (kzZ88x3): add ETS scheduler support - Ethernet PHYs: - RealTek (rtl8211): - add support for WoL magic packet - add support for PHY LEDs - CAN: - Adds RZ/G3E CANFD support to the rcar_canfd driver. - Preparatory work for CAN-XL support. - Add self-tests framework with support for CAN physical interfaces. - WiFi: - mac80211: - scan improvements with multi-link operation (MLO) - Qualcomm (ath12k): - enable AHB support for IPQ5332 - add monitor interface support to QCN9274 - add multi-link operation support to WCN7850 - add 802.11d scan offload support to WCN7850 - monitor mode for WCN7850, better 6 GHz regulatory - Qualcomm (ath11k): - restore hibernation support - MediaTek (mt76): - WiFi-7 improvements - implement support for mt7990 - Intel (iwlwifi): - enhanced multi-link single-radio (EMLSR) support on 5 GHz links - rework device configuration - RealTek (rtw88): - improve throughput for RTL8814AU - RealTek (rtw89): - add multi-link operation support - STA/P2P concurrency improvements - support different SAR configs by antenna - Bluetooth: - introduce HCI Driver protocol - btintel_pcie: do not generate coredump for diagnostic events - btusb: add HCI Drv commands for configuring altsetting - btusb: add RTL8851BE device 0x0bda:0xb850 - btusb: add new VID/PID 13d3/3584 for MT7922 - btusb: add new VID/PID 13d3/3630 and 13d3/3613 for MT7925 - btnxpuart: implement host-wakeup feature" * tag 'net-next-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (1611 commits) selftests/bpf: Fix bpf selftest build warning selftests: netfilter: Fix skip of wildcard interface test net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames net: openvswitch: Fix the dead loop of MPLS parse calipso: Don't call calipso functions for AF_INET sk. selftests/tc-testing: Add a test for HFSC eltree double add with reentrant enqueue behaviour on netem net_sched: hfsc: Address reentrant enqueue adding class to eltree twice octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback octeontx2-pf: QOS: Perform cache sync on send queue teardown net: mana: Add support for Multi Vports on Bare metal net: devmem: ncdevmem: remove unused variable net: devmem: ksft: upgrade rx test to send 1K data net: devmem: ksft: add 5 tuple FS support net: devmem: ksft: add exit_wait to make rx test pass net: devmem: ksft: add ipv4 support net: devmem: preserve sockc_err page_pool: fix ugly page_pool formatting net: devmem: move list_add to net_devmem_bind_dmabuf. selftests: netfilter: nft_queue.sh: include file transfer duration in log message net: phy: mscc: Fix memory leak when using one step timestamping ... commit 4d9b5146f0d9147293155b569db9a19c8f5ff0a1 Author: Ian Rogers Date: Wed May 28 14:08:58 2025 -0700 perf symbol: Move demangling code out of symbol-elf.c symbol-elf.c is used when building with libelf, symbol-minimal is used otherwise. There is no reason the demangling code with no dependencies on libelf is part of symbol-elf.c so move to symbol.c. This allows demangling tests to pass with NO_LIBELF=1. Structurally, while moving the functions rename demangle_sym() to dso__demangle_sym() which is already a function exposed in symbol.h and the only purpose of which in symbol-elf.c was to call demangle_sym(). Change the calls to demangle_sym() in symbol-elf.c to calls to dso__demangle_sym(). Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alex Gaynor Cc: Alexander Shishkin Cc: Alice Ryhl Cc: Andi Kleen Cc: Andreas Hindborg Cc: Benno Lossin Cc: Björn Roy Baron Cc: Boqun Feng Cc: Danilo Krummrich Cc: Dmitriy Vyukov Cc: Gary Guo Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiapeng Chong Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Miguel Ojeda Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephen Brennan Cc: Trevor Gross Cc: Weilin Wang Link: https://lore.kernel.org/r/20250528210858.499898-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 47cf96fbe393839b125a9b694a8cfdd3f4216baa Merge: bbff27b54e4271 217e3cbba3d661 Author: Linus Torvalds Date: Wed May 28 14:55:35 2025 -0700 Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 updates from Will Deacon: "The headline feature is the re-enablement of support for Arm's Scalable Matrix Extension (SME) thanks to a bumper crop of fixes from Mark Rutland. If matrices aren't your thing, then Ryan's page-table optimisation work is much more interesting. Summary: ACPI, EFI and PSCI: - Decouple Arm's "Software Delegated Exception Interface" (SDEI) support from the ACPI GHES code so that it can be used by platforms booted with device-tree - Remove unnecessary per-CPU tracking of the FPSIMD state across EFI runtime calls - Fix a node refcount imbalance in the PSCI device-tree code CPU Features: - Ensure register sanitisation is applied to fields in ID_AA64MMFR4 - Expose AIDR_EL1 to userspace via sysfs, primarily so that KVM guests can reliably query the underlying CPU types from the VMM - Re-enabling of SME support (CONFIG_ARM64_SME) as a result of fixes to our context-switching, signal handling and ptrace code Entry code: - Hook up TIF_NEED_RESCHED_LAZY so that CONFIG_PREEMPT_LAZY can be selected Memory management: - Prevent BSS exports from being used by the early PI code - Propagate level and stride information to the low-level TLB invalidation routines when operating on hugetlb entries - Use the page-table contiguous hint for vmap() mappings with VM_ALLOW_HUGE_VMAP where possible - Optimise vmalloc()/vmap() page-table updates to use "lazy MMU mode" and hook this up on arm64 so that the trailing DSB (used to publish the updates to the hardware walker) can be deferred until the end of the mapping operation - Extend mmap() randomisation for 52-bit virtual addresses (on par with 48-bit addressing) and remove limited support for randomisation of the linear map Perf and PMUs: - Add support for probing the CMN-S3 driver using ACPI - Minor driver fixes to the CMN, Arm-NI and amlogic PMU drivers Selftests: - Fix FPSIMD and SME tests to align with the freshly re-enabled SME support - Fix default setting of the OUTPUT variable so that tests are installed in the right location vDSO: - Replace raw counter access from inline assembly code with a call to the the __arch_counter_get_cntvct() helper function Miscellaneous: - Add some missing header inclusions to the CCA headers - Rework rendering of /proc/cpuinfo to follow the x86-approach and avoid repeated buffer expansion (the user-visible format remains identical) - Remove redundant selection of CONFIG_CRC32 - Extend early error message when failing to map the device-tree blob" * tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (83 commits) arm64: cputype: Add cputype definition for HIP12 arm64: el2_setup.h: Make __init_el2_fgt labels consistent, again perf/arm-cmn: Add CMN S3 ACPI binding arm64/boot: Disallow BSS exports to startup code arm64/boot: Move global CPU override variables out of BSS arm64/boot: Move init_pgdir[] and init_idmap_pgdir[] into __pi_ namespace perf/arm-cmn: Initialise cmn->cpu earlier kselftest/arm64: Set default OUTPUT path when undefined arm64: Update comment regarding values in __boot_cpu_mode arm64: mm: Drop redundant check in pmd_trans_huge() arm64/mm: Re-organise setting up FEAT_S1PIE registers PIRE0_EL1 and PIR_EL1 arm64/mm: Permit lazy_mmu_mode to be nested arm64/mm: Disable barrier batching in interrupt contexts arm64/cpuinfo: only show one cpu's info in c_show() arm64/mm: Batch barriers when updating kernel mappings mm/vmalloc: Enter lazy mmu mode while manipulating vmalloc ptes arm64/mm: Support huge pte-mapped pages in vmap mm/vmalloc: Gracefully unmap huge ptes mm/vmalloc: Warn on improper use of vunmap_range() arm64/mm: Hoist barriers out of set_ptes_anysz() loop ... commit 16b2da850f6f79bf9013516ce78b27a8abb10359 Author: Hans Zhang <18255117159@163.com> Date: Tue Apr 1 22:50:23 2025 +0800 PCI: cadence: Remove duplicate message code definitions The Cadence PCIe controller driver defines message codes in enum cdns_pcie_msg_code duplicating the existing PCIE_MSG_CODE_* definitions in drivers/pci/pci.h. The driver only uses ASSERT_INTA and DEASSERT_INTA codes from this enum. Remove the redundant Cadence-specific enum definitions and use the ones available in drivers/pci/pci.h. This helps in avoiding code duplication, maintaining consistency with the spec, and simplifying the code maintenance. Signed-off-by: Hans Zhang <18255117159@163.com> [mani: commit message rewording] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250401145023.22948-1-18255117159@163.com commit bbff27b54e4271a42ea1dba93a76e51165f2dbaa Merge: 408aa67404405c aa264d9511aa5b Author: Linus Torvalds Date: Wed May 28 14:52:12 2025 -0700 Merge tag 'nios2_updates_for_v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux Pull nios2 updates fromDinh Nguyen: - Use strscpy() and simply setup_cpuinfo() - Remove conflicting mappings when flushing tlb entries - Force update_mmu_cache on spurious pagefaults * tag 'nios2_updates_for_v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: nios2: Replace strcpy() with strscpy() and simplify setup_cpuinfo() nios2: do not introduce conflicting mappings when flushing tlb entries nios2: force update_mmu_cache on spurious tlb-permission--related pagefaults commit de0321bcc5fdd83631f0c2a6fdebfe0ad4e23449 Author: Niklas Cassel Date: Wed May 14 09:43:19 2025 +0200 PCI: endpoint: Align pci_epc_set_msix(), pci_epc_ops::set_msix() nr_irqs encoding The kdoc for pci_epc_set_msix() says: "Invoke to set the required number of MSI-X interrupts." The kdoc for the callback pci_epc_ops->set_msix() says: "ops to set the requested number of MSI-X interrupts in the MSI-X capability register" pci_epc_ops::set_msix() does however expect the parameter 'interrupts' to be in the encoding as defined by the Table Size field. Nowhere in the kdoc does it say that the number of interrupts should be in Table Size encoding. It is very confusing that the API pci_epc_set_msix() and the callback function pci_epc_ops::set_msix() both take a parameter named 'interrupts', but they expect completely different encodings. Clean up the API and the callback function to have the same semantics, i.e. the parameter represents the number of interrupts, regardless of the internal encoding of that value. Also rename the parameter 'interrupts' to 'nr_irqs', in both the wrapper function and the callback function, such that the name is unambiguous. [bhelgaas: more specific subject] Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Cc: stable+noautosel@kernel.org # this is simply a cleanup Link: https://patch.msgid.link/20250514074313.283156-14-cassel@kernel.org commit f62da6e7270c2db5aef8a8b14f465896961a9372 Author: Niklas Cassel Date: Wed May 14 09:43:18 2025 +0200 PCI: endpoint: Align pci_epc_set_msi(), pci_epc_ops::set_msi() nr_irqs encoding The kdoc for pci_epc_set_msi() says: "Invoke to set the required number of MSI interrupts." The kdoc for the callback pci_epc_ops::set_msi() says: "ops to set the requested number of MSI interrupts in the MSI capability register" pci_epc_ops::set_msi() does however expect the parameter 'interrupts' to be in the encoding as defined by the Multiple Message Capable (MMC) field of the MSI capability structure. Nowhere in the kdoc does it say that the number of interrupts should be in MMC encoding. It is very confusing that the API pci_epc_set_msi() and the callback function pci_epc_ops::set_msi() both take a parameter named 'interrupts', but they expect completely different encodings. Clean up the API and the callback function to have the same semantics, i.e. the parameter represents the number of interrupts, regardless of the internal encoding of that value. Also rename the parameter 'interrupts' to 'nr_irqs', in both the wrapper function and the callback function, such that the name is unambiguous. [bhelgaas: more specific subject] Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Cc: stable+noautosel@kernel.org # this is simply a cleanup Link: https://patch.msgid.link/20250514074313.283156-13-cassel@kernel.org commit 0917ed8f16b646c5e3cc481ccfa4709286b76691 Author: Niklas Cassel Date: Wed May 14 09:43:17 2025 +0200 PCI: endpoint: Align pci_epc_get_msix(), pci_epc_ops::get_msix() return value encoding The kdoc for pci_epc_get_msix() says: "Invoke to get the number of MSI-X interrupts allocated by the RC" The kdoc for the callback pci_epc_ops->get_msix() says: "ops to get the number of MSI-X interrupts allocated by the RC from the MSI-X capability register" pci_epc_ops::get_msix() does however return the number of interrupts in the encoding as defined by the Table Size field. Nowhere in the kdoc does it say that the returned number of interrupts is in Table Size encoding. It is very confusing that the API pci_epc_get_msix() and the callback function pci_epc_ops::get_msix() don't return the same value. Clean up the API and the callback function to have the same semantics, i.e. return the number of interrupts, regardless of the internal encoding of that value. [bhelgaas: more specific subject] Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Damien Le Moal Cc: stable+noautosel@kernel.org # this is simply a cleanup Link: https://patch.msgid.link/20250514074313.283156-12-cassel@kernel.org commit f7f15fc53245385e39ef0aab4310d1682fd3c079 Author: Niklas Cassel Date: Wed May 14 09:43:16 2025 +0200 PCI: endpoint: Align pci_epc_get_msi(), pci_epc_ops::get_msi() return value encoding The kdoc for API pci_epc_get_msi() says: "Invoke to get the number of MSI interrupts allocated by the RC" The kdoc for the callback pci_epc_ops::get_msi() says: "ops to get the number of MSI interrupts allocated by the RC from the MSI capability register" pci_epc_ops::get_msi() does however return the number of interrupts in the encoding as defined by the Multiple Message Enable (MME) field of the MSI Capability structure. Nowhere in the kdoc does it say that the returned number of interrupts is in MME encoding. It is very confusing that the API pci_epc_get_msi() and the callback function pci_epc_ops::get_msi() don't return the same value. Clean up the API and the callback function to have the same semantics, i.e. return the number of interrupts, regardless of the internal encoding of that value. [bhelgaas: more specific subject] Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Damien Le Moal Cc: stable+noautosel@kernel.org # this is simply a cleanup Link: https://patch.msgid.link/20250514074313.283156-11-cassel@kernel.org commit c8bcb01352a86bc5592403904109c22b66bd916e Author: Niklas Cassel Date: Wed May 14 09:43:15 2025 +0200 PCI: cadence-ep: Correct PBA offset in .set_msix() callback While cdns_pcie_ep_set_msix() writes the Table Size field correctly (N-1), the calculation of the PBA offset is wrong because it calculates space for (N-1) entries instead of N. This results in the following QEMU error when using PCI passthrough on a device which relies on the PCI endpoint subsystem: failed to add PCI capability 0x11[0x50]@0xb0: table & pba overlap, or they don't fit in BARs, or don't align Fix the calculation of PBA offset in the MSI-X capability. [bhelgaas: more specific subject and commit log] Fixes: 3ef5d16f50f8 ("PCI: cadence: Add MSI-X support to Endpoint driver") Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Wilfred Mallawa Reviewed-by: Damien Le Moal Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250514074313.283156-10-cassel@kernel.org commit 810276362bad172d063d1f6be1cc2cb425b90103 Author: Niklas Cassel Date: Wed May 14 09:43:14 2025 +0200 PCI: dwc: ep: Correct PBA offset in .set_msix() callback While dw_pcie_ep_set_msix() writes the Table Size field correctly (N-1), the calculation of the PBA offset is wrong because it calculates space for (N-1) entries instead of N. This results in the following QEMU error when using PCI passthrough on a device which relies on the PCI endpoint subsystem: failed to add PCI capability 0x11[0x50]@0xb0: table & pba overlap, or they don't fit in BARs, or don't align Fix the calculation of PBA offset in the MSI-X capability. [bhelgaas: more specific subject and commit log] Fixes: 83153d9f36e2 ("PCI: endpoint: Fix ->set_msix() to take BIR and offset as arguments") Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Wilfred Mallawa Reviewed-by: Damien Le Moal Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250514074313.283156-9-cassel@kernel.org commit e5327a655636e2ffb93d65f44777d9481aab3715 Author: Jerome Brunet Date: Thu Apr 24 10:34:05 2025 +0200 PCI: endpoint: pci-epf-vntb: Simplify ctrl/SPAD space allocation When allocating the shared ctrl/SPAD space, epf_ntb_config_spad_bar_alloc() should not try to handle the size quirks for underlying BAR, whether it is fixed size or alignment. This is already handled by pci_epf_alloc_space(). Also, when handling the alignment, this allocates more space than necessary. For example, with a SPAD size of 1024B and a ctrl size of 308B, the space necessary is 1332B. If the alignment is 1MB, epf_ntb_config_spad_bar_alloc() tries to allocate 2MB where 1MB would have been more than enough. Drop the handling of the BAR size quirks and let pci_epf_alloc_space() handle that. Just make sure the 32bits SPAD register are aligned on 32bits. Signed-off-by: Jerome Brunet Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250424-pci-ep-size-alignment-v5-2-2d4ec2af23f5@baylibre.com commit 84e2f918550e1063bd8e29faffe8ad491b7d8c52 Merge: 58ce2aec57a5d8 40493d97b329f8 Author: Dave Airlie Date: Thu May 29 07:43:02 2025 +1000 Merge tag 'drm-xe-next-fixes-2025-05-28' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next Driver Changes: - Two documentation fixes (Rodrigo) Signed-off-by: Dave Airlie From: Thomas Hellstrom Link: https://lore.kernel.org/r/aDc4Is-sQb3DPGO5@fedora commit 408aa67404405c8519ddee70bc0e6c55daa7c959 Merge: 1cbf99e47fef5a 0a84874c7e7dde Author: Linus Torvalds Date: Wed May 28 14:43:00 2025 -0700 Merge tag 'v6.16-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: "Fix a buffer overflow regression in shash" * tag 'v6.16-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: shash - Fix buffer overrun in import function commit 58ce2aec57a5d8a2e678bf184f043047340c787e Merge: f8bb3ed3197966 ed5915cfce2abb Author: Dave Airlie Date: Thu May 29 07:36:18 2025 +1000 Merge tag 'drm-intel-next-fixes-2025-05-28' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next - Fix the enabling/disabling of DP audio SDP splitting Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://lore.kernel.org/r/aDaztAmV_erxo1Am@jlahtine-mobl commit e3e3775392f3f0f3e3044f8c162bf47858e01759 Author: Tigran Mkrtchyan Date: Thu May 15 21:04:15 2025 +0200 flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes On NFS4ERR_DELAY nfs slient updates its stats, but misses for flexfiles v4.1 DSes. Signed-off-by: Tigran Mkrtchyan Signed-off-by: Anna Schumaker commit c25a89770d1f216dcedfc2d25d56b604f62ce0bd Author: NeilBrown Date: Fri May 9 10:46:43 2025 +1000 nfs_localio: change nfsd_file_put_local() to take a pointer to __rcu pointer Instead of calling xchg() and unrcu_pointer() before nfsd_file_put_local(), we now pass pointer to the __rcu pointer and call xchg() and unrcu_pointer() inside that function. Where unrcu_pointer() is currently called the internals of "struct nfsd_file" are not known and that causes older compilers such as gcc-8 to complain. In some cases we have a __kernel (aka normal) pointer not an __rcu pointer so we need to cast it to __rcu first. This is strictly a weakening so no information is lost. Somewhat surprisingly, this cast is accepted by gcc-8. This has the pleasing result that the cmpxchg() which sets ro_file and rw_file, and also the xchg() which clears them, are both now in the nfsd code. Reported-by: Pali Rohár Reported-by: Vincent Mailhol Fixes: 86e00412254a ("nfs: cache all open LOCALIO nfsd_file(s) in client") Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker commit 21fb44034695185f1dcbcb37354c842cabfe83c1 Author: NeilBrown Date: Fri May 9 10:46:42 2025 +1000 nfs_localio: protect race between nfs_uuid_put() and nfs_close_local_fh() nfs_uuid_put() and nfs_close_local_fh() can race if a "struct nfs_file_localio" is released at the same time that nfsd calls nfs_localio_invalidate_clients(). It is important that neither of these functions completes after the other has started looking at a given nfs_file_localio and before it finishes. If nfs_uuid_put() exits while nfs_close_local_fh() is closing ro_file and rw_file it could return to __nfd_file_cache_purge() while some files are still referenced so the purge may not succeed. If nfs_close_local_fh() exits while nfsd_uuid_put() is still closing the files then the "struct nfs_file_localio" could be freed while nfsd_uuid_put() is still looking at it. This side is currently handled by copying the pointers out of ro_file and rw_file before deleting from the list in nfsd_uuid. We need to preserve this while ensuring that nfsd_uuid_put() does wait for nfs_close_local_fh(). This patch use nfl->uuid and nfl->list to provide the required interlock. nfs_uuid_put() removes the nfs_file_localio from the list, then drops locks and puts the two files, then reclaims the spinlock and sets ->nfs_uuid to NULL. nfs_close_local_fh() operates in the reverse order, setting ->nfs_uuid to NULL, then closing the files, then unlinking from the list. If nfs_uuid_put() finds that ->nfs_uuid is already NULL, it waits for the nfs_file_localio to be removed from the list. If nfs_close_local_fh() find that it has already been unlinked it waits for ->nfs_uuid to become NULL. This ensure that one of the two tries to close the files, but they each waits for the other. As nfs_uuid_put() is making the list empty, change from a list_for_each_safe loop to a while that always takes the first entry. This makes the intent more clear. Also don't move the list to a temporary local list as this would defeat the guarantees required for the interlock. Fixes: 86e00412254a ("nfs: cache all open LOCALIO nfsd_file(s) in client") Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker commit 74fc55ab2a6a0c71628fcf3b9783aae7119b5199 Author: NeilBrown Date: Fri May 9 10:46:41 2025 +1000 nfs_localio: duplicate nfs_close_local_fh() nfs_close_local_fh() is called from two different places for quite different use case. It is called from nfs_uuid_put() when the nfs_uuid is being detached - possibly because the nfs server is not longer serving that filesystem. In this case there will always be an nfs_uuid and so rcu_read_lock() is not needed. It is also called when the nfs_file_localio is no longer needed. In this case there may not be an active nfs_uuid. These two can race, and handling the race properly while avoiding excessive locking will require different handling on each side. This patch prepares the way by opencoding nfs_close_local_fh() into nfs_uuid_put(), then simplifying the code there as befits the context. Fixes: 86e00412254a ("nfs: cache all open LOCALIO nfsd_file(s) in client") Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker commit e6f7e1487ab528a6c653bd0d42812ff2942846cd Author: NeilBrown Date: Fri May 9 10:46:40 2025 +1000 nfs_localio: simplify interface to nfsd for getting nfsd_file The nfsd_localio_operations structure contains nfsd_file_get() to get a reference to an nfsd_file. This is only used in one place, where nfsd_open_local_fh() is also used. This patch combines the two, calling nfsd_open_local_fh() passing a pointer to where the nfsd_file pointer might be stored. If there is a pointer there an nfsd_file_get() can get a reference, that reference is returned. If not a new nfsd_file is acquired, stored at the pointer, and returned. When we store a reference we also increase the refcount on the net, as that refcount is decrements when we clear the stored pointer. We now get an extra reference *before* storing the new nfsd_file at the given location. This avoids possible races with the nfsd_file being freed before the final reference can be taken. This patch moves the rcu_dereference() needed after fetching from ro_file or rw_file into the nfsd code where the 'struct nfs_file' is fully defined. This avoids an error reported by older versions of gcc such as gcc-8 which complain about rcu_dereference() use in contexts where the structure (which will supposedly be accessed) is not fully defined. Reported-by: Pali Rohár Reported-by: Vincent Mailhol Fixes: 86e00412254a ("nfs: cache all open LOCALIO nfsd_file(s) in client") Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker commit 77e82fb2c6c27c122e785f543ae0062f7783c886 Author: NeilBrown Date: Fri May 9 10:46:39 2025 +1000 nfs_localio: always hold nfsd net ref with nfsd_file ref Having separate nfsd_file_put and nfsd_file_put_local in struct nfsd_localio_operations doesn't make much sense. The difference is that nfsd_file_put doesn't drop a reference to the nfs_net which is what keeps nfsd from shutting down. Currently, if nfsd tries to shutdown it will invalidate the files stored in the list from the nfs_uuid and this will drop all references to the nfsd net that the client holds. But the client could still hold some references to nfsd_files for active IO. So nfsd might think is has completely shut down local IO, but hasn't and has no way to wait for those active IO requests to complete. So this patch changes nfsd_file_get to nfsd_file_get_local and has it increase the ref count on the nfsd net and it replaces all calls to ->nfsd_put_file to ->nfsd_put_file_local. It also changes ->nfsd_open_local_fh to return with the refcount on the net elevated precisely when a valid nfsd_file is returned. This means that whenever the client holds a valid nfsd_file, there will be an associated count on the nfsd net, and so the count can only reach zero when all nfsd_files have been returned. nfs_local_file_put() is changed to call nfs_to_nfsd_file_put_local() instead of replacing calls to one with calls to the other because this will help a later patch which changes nfs_to_nfsd_file_put_local() to take an __rcu pointer while nfs_local_file_put() doesn't. Fixes: 86e00412254a ("nfs: cache all open LOCALIO nfsd_file(s) in client") Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker commit ed9be317330c7390df7db9e1d046698c02001bd2 Author: NeilBrown Date: Fri May 9 10:46:38 2025 +1000 nfs_localio: use cmpxchg() to install new nfs_file_localio Rather than using nfs_uuid.lock to protect installing a new ro_file or rw_file, change to use cmpxchg(). Removing the file already uses xchg() so this improves symmetry and also makes the code a little simpler. Also remove the optimisation of not taking the lock, and not removing the nfs_file_localio from the linked list, when both ->ro_file and ->rw_file are already NULL. Given that ->nfs_uuid was not NULL, it is extremely unlikely that neither ->ro_file or ->rw_file is NULL so this optimisation can be of little value and it complicates understanding of the code - why can the list_del_init() be skipped? Finally, move the assignment of NULL to ->nfs_uuid until after the last action on the nfs_file_localio (the list_del_init). As soon as this is NULL a racing nfs_close_local_fh() can bypass all the locking and go on to free the nfs_file_localio, so we must be certain to be finished with it first. Fixes: 86e00412254a ("nfs: cache all open LOCALIO nfsd_file(s) in client") Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker commit 111f9e4b0dcdd493094dad98ecbed490887710c0 Author: Chuck Lever Date: Wed May 21 16:34:14 2025 -0400 SUNRPC: Remove dead code from xs_tcp_tls_setup_socket() xs_tcp_tls_finish_connecting() already marks the upper xprt connected, so the same code in xs_tcp_tls_setup_socket() is never executed. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker commit 0bd2f6b8996d4f1ca4573652454987826730a04a Author: Chuck Lever Date: Wed May 21 16:34:13 2025 -0400 SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls Engineers at Hammerspace noticed that sometimes mounting with "xprtsec=tls" hangs for a minute or so, and then times out, even when the NFS server is reachable and responsive. kTLS shuts off data_ready callbacks if strp->msg_ready is set to mitigate data_ready callbacks when a full TLS record is not yet ready to be read from the socket. Normally msg_ready is clear when the first TLS record arrives on a socket. However, I observed that sometimes tls_setsockopt() sets strp->msg_ready, and that prevents forward progress because tls_data_ready() becomes a no-op. Moreover, Jakub says: "If there's a full record queued at the time when [tlshd] passes the socket back to the kernel, it's up to the reader to read the already queued data out." So SunRPC cannot expect a data_ready call when ingress data is already waiting. Add an explicit poll after SunRPC's upper transport is set up to pick up any data that arrived after the TLS handshake but before transport set-up is complete. Reported-by: Steve Sears Suggested-by: Jakub Kacinski Fixes: 75eb6af7acdf ("SUNRPC: Add a TCP-with-TLS RPC transport class") Tested-by: Mike Snitzer Reviewed-by: Mike Snitzer Cc: stable@vger.kernel.org Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker commit dd862da61e91123ca745e06c03ba39ce71a929d9 Author: NeilBrown Date: Mon May 26 14:08:25 2025 +1000 nfs: fix incorrect handling of large-number NFS errors in nfs4_do_mkdir() A recent commit introduced nfs4_do_mkdir() which reports an error from nfs4_call_sync() by returning it with ERR_PTR(). This is a problem as nfs4_call_sync() can return negative NFS-specific errors with values larger than MAX_ERRNO (4095). One example is NFS4ERR_DELAY which has value 10008. This "pointer" gets to PTR_ERR_OR_ZERO() in nfs4_proc_mkdir() which chooses ZERO because it isn't in the range of value errors. Ultimately the pointer is dereferenced. This patch changes nfs4_do_mkdir() to report the dentry pointer and status separately - pointer as a return value, status in an "int *" parameter. The same separation is used for _nfs4_proc_mkdir() and the two are combined only in nfs4_proc_mkdir() after the status has passed through nfs4_handle_exception(), which ensures the error code does not exceed MAX_ERRNO. It also fixes a problem in the even when nfs4_handle_exception() updated the error value, the original 'alias' was still returned. Reported-by: Anna Schumaker Fixes: 8376583b84a1 ("nfs: change mkdir inode_operation to return alternate dentry if needed.") Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker commit 80c4de6ab44c14e910117a02f2f8241ffc6ec54a Author: Li Lingfeng Date: Tue Mar 4 21:05:33 2025 +0800 nfs: ignore SB_RDONLY when remounting nfs In some scenarios, when mounting NFS, more than one superblock may be created. The final superblock used is the last one created, but only the first superblock carries the ro flag passed from user space. If a ro flag is added to the superblock via remount, it will trigger the issue described in Link[1]. Link[2] attempted to address this by marking the superblock as ro during the initial mount. However, this introduced a new problem in scenarios where multiple mount points share the same superblock: [root@a ~]# mount /dev/sdb /mnt/sdb [root@a ~]# echo "/mnt/sdb *(rw,no_root_squash)" > /etc/exports [root@a ~]# echo "/mnt/sdb/test_dir2 *(ro,no_root_squash)" >> /etc/exports [root@a ~]# systemctl restart nfs-server [root@a ~]# mount -t nfs -o rw 127.0.0.1:/mnt/sdb/test_dir1 /mnt/test_mp1 [root@a ~]# mount | grep nfs4 127.0.0.1:/mnt/sdb/test_dir1 on /mnt/test_mp1 type nfs4 (rw,relatime,... [root@a ~]# mount -t nfs -o ro 127.0.0.1:/mnt/sdb/test_dir2 /mnt/test_mp2 [root@a ~]# mount | grep nfs4 127.0.0.1:/mnt/sdb/test_dir1 on /mnt/test_mp1 type nfs4 (ro,relatime,... 127.0.0.1:/mnt/sdb/test_dir2 on /mnt/test_mp2 type nfs4 (ro,relatime,... [root@a ~]# When mounting the second NFS, the shared superblock is marked as ro, causing the previous NFS mount to become read-only. To resolve both issues, the ro flag is no longer applied to the superblock during remount. Instead, the ro flag on the mount is used to control whether the mount point is read-only. Fixes: 281cad46b34d ("NFS: Create a submount rpc_op") Link[1]: https://lore.kernel.org/all/20240604112636.236517-3-lilingfeng@huaweicloud.com/ Link[2]: https://lore.kernel.org/all/20241130035818.1459775-1-lilingfeng3@huawei.com/ Signed-off-by: Li Lingfeng Signed-off-by: Anna Schumaker commit 8cd9b785943c57a136536250da80ba1eb6f8eb18 Author: Li Lingfeng Date: Tue Mar 4 21:05:32 2025 +0800 nfs: clear SB_RDONLY before getting superblock As described in the link, commit 52cb7f8f1778 ("nfs: ignore SB_RDONLY when mounting nfs") removed the check for the ro flag when determining whether to share the superblock, which caused issues when mounting different subdirectories under the same export directory via NFSv3. However, this change did not affect NFSv4. For NFSv3: 1) A single superblock is created for the initial mount. 2) When mounted read-only, this superblock carries the SB_RDONLY flag. 3) Before commit 52cb7f8f1778 ("nfs: ignore SB_RDONLY when mounting nfs"): Subsequent rw mounts would not share the existing ro superblock due to flag mismatch, creating a new superblock without SB_RDONLY. After the commit: The SB_RDONLY flag is ignored during superblock comparison, and this leads to sharing the existing superblock even for rw mounts. Ultimately results in write operations being rejected at the VFS layer. For NFSv4: 1) Multiple superblocks are created and the last one will be kept. 2) The actually used superblock for ro mounts doesn't carry SB_RDONLY flag. Therefore, commit 52cb7f8f1778 doesn't affect NFSv4 mounts. Clear SB_RDONLY before getting superblock when NFS_MOUNT_UNSHARED is not set to fix it. Fixes: 52cb7f8f1778 ("nfs: ignore SB_RDONLY when mounting nfs") Closes: https://lore.kernel.org/all/12d7ea53-1202-4e21-a7ef-431c94758ce5@app.fastmail.com/T/ Signed-off-by: Li Lingfeng Signed-off-by: Anna Schumaker commit 1ff4716f420b5a6e6ef095b23bb5db76f46be7fc Author: Mike Snitzer Date: Tue May 13 12:08:31 2025 -0400 NFS: always probe for LOCALIO support asynchronously It was reported that NFS client mounts of AWS Elastic File System (EFS) volumes is slow, this is because the AWS firewall disallows LOCALIO (because it doesn't consider the use of NFS_LOCALIO_PROGRAM valid), see: https://bugzilla.redhat.com/show_bug.cgi?id=2335129 Switch to performing the LOCALIO probe asynchronously to address the potential for the NFS LOCALIO protocol being disallowed and/or slowed by the remote server's response. While at it, fix nfs_local_probe_async() to always take/put a reference on the nfs_client that is using the LOCALIO protocol. Also, unexport the nfs_local_probe() symbol and make it private to fs/nfs/localio.c This change has the side-effect of initially issuing reads, writes and commits over the wire via SUNRPC until the LOCALIO probe completes. Suggested-by: Jeff Layton # to always probe async Fixes: 76d4cb6345da ("nfs: probe for LOCALIO when v4 client reconnects to server") Cc: stable@vger.kernel.org # 6.14+ Signed-off-by: Mike Snitzer Reviewed-by: Jeff Layton Signed-off-by: Anna Schumaker commit 04a15263662ab864725d8b60407e2dd5ba525514 Author: Mike Snitzer Date: Fri May 9 16:39:49 2025 -0400 pnfs/flexfiles: connect to NFSv3 DS using TLS if MDS connection uses TLS Implementation follows bones of the pattern that was established in commit a35518cae4b325 ("NFSv4.1/pnfs: fix NFS with TLS in pnfs"). Signed-off-by: Mike Snitzer Signed-off-by: Anna Schumaker commit 62d2cde203defb6702cab2c318c3346b11cdaeac Author: Mike Snitzer Date: Tue May 13 15:50:44 2025 -0400 NFS: add localio to sysfs The Linux NFS client and server added support for LOCALIO in Linux v6.12. It is useful to know if a client and server negotiated LOCALIO be used, so expose it through the 'localio' attribute. Suggested-by: Anna Schumaker Signed-off-by: Mike Snitzer Signed-off-by: Anna Schumaker commit f72a67598cd797ac33d32cd3c10f321b51c6d9df Author: Christoph Hellwig Date: Wed May 7 06:48:54 2025 +0200 nfs: use writeback_iter directly Stop using write_cache_pages and use writeback_iter directly. This removes an indirect call per written folio and makes the code easier to follow. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit 66a49813501c77700a7fe504e0d28aa126b115cb Author: Christoph Hellwig Date: Wed May 7 06:48:53 2025 +0200 nfs: refactor nfs_do_writepage Use early returns wherever possible to simplify the code. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit 66beed5acaf27137007459e7e53bf8d6f1b799cc Author: Christoph Hellwig Date: Wed May 7 06:48:52 2025 +0200 nfs: don't return AOP_WRITEPAGE_ACTIVATE from nfs_do_writepage nfs_do_writepage is a successful return that requires the caller to unlock the folio. Using it here requires special casing both in nfs_do_writepage and nfs_writepages_callback and leaves a land mine in nfs_wb_folio in case it ever set the flag. Remove it and just unconditionally unlock in nfs_writepages_callback. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit b6354e60dd01d700a99d1f8c2f20d8ed530b0f45 Author: Christoph Hellwig Date: Wed May 7 06:48:51 2025 +0200 nfs: fold nfs_page_async_flush into nfs_do_writepage Fold nfs_page_async_flush into its only caller to clean up the code a bit. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit 3a3065352f73381d3a1aa0ccab44aec3a5a9b365 Author: Han Young Date: Sun May 4 20:57:04 2025 +0800 NFSv4: Always set NLINK even if the server doesn't support it fattr4_numlinks is a recommended attribute, so the client should emulate it even if the server doesn't support it. In decode_attr_nlink function in nfs4xdr.c, nlink is initialized to 1. However, this default value isn't set to the inode due to the check in nfs_fhget. So if the server doesn't support numlinks, inode's nlink will be zero, the mount will fail with error "Stale file handle". Set the nlink to 1 if the server doesn't support it. Signed-off-by: Han Young Signed-off-by: Anna Schumaker commit 77be29b7a3f896bd96808ba6781481a1f6afa66c Author: Benjamin Coddington Date: Thu May 1 08:29:42 2025 -0400 NFSv4: Allow FREE_STATEID to clean up delegations The NFS client's list of delegations can grow quite large (well beyond the delegation watermark) if the server is revoking or there are repeated events that expire state. Once this happens, the revoked delegations can cause a performance problem for subsequent walks of the servers->delegations list when the client tries to test and free state. If we can determine that the FREE_STATEID operation has completed without error, we can prune the delegation from the list. Since the NFS client combines TEST_STATEID with FREE_STATEID in its minor version operations, there isn't an easy way to communicate success of FREE_STATEID. Rather than re-arrange quite a number of calling paths to break out the separate procedures, let's signal the success of FREE_STATEID by setting the stateid's type. Set NFS4_FREED_STATEID_TYPE for stateids that have been successfully discarded from the server, and use that type to signal that the delegation can be cleaned up. Signed-off-by: Benjamin Coddington Reviewed-by: Jeff Layton Signed-off-by: Anna Schumaker commit 4d4832ed13ff505fe0371544b4773e79be2bb964 Author: Scott Mayhew Date: Wed Apr 30 07:12:29 2025 -0400 NFSv4: Don't check for OPEN feature support in v4.1 fattr4_open_arguments is a v4.2 recommended attribute, so we shouldn't be sending it to v4.1 servers. Fixes: cb78f9b7d0c0 ("nfs: fix the fetch of FATTR4_OPEN_ARGUMENTS") Signed-off-by: Scott Mayhew Reviewed-by: Jeff Layton Reviewed-by: Benjamin Coddington Cc: stable@vger.kernel.org # 6.11+ Signed-off-by: Anna Schumaker commit 243fea134633ba3d64aceb4c16129c59541ea2c6 Author: Olga Kornievskaia Date: Fri Apr 25 14:09:21 2025 -0400 NFSv4.2: fix listxattr to return selinux security label Currently, when NFS is queried for all the labels present on the file via a command example "getfattr -d -m . /mnt/testfile", it does not return the security label. Yet when asked specifically for the label (getfattr -n security.selinux) it will be returned. Include the security label when all attributes are queried. Signed-off-by: Olga Kornievskaia Signed-off-by: Anna Schumaker commit aba41e90aadeca8d4656f90639aa5f91ce564f1c Author: Sagi Grimberg Date: Fri Apr 25 15:49:19 2025 +0300 NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps are delegated nfs_setattr will flush all pending writes before updating a file time attributes. However when the client holds delegated timestamps, it can update its timestamps locally as it is the authority for the file times attributes. The client will later set the file attributes by adding a setattr to the delegreturn compound updating the server time attributes. Fix nfs_setattr to avoid flushing pending writes when the file time attributes are delegated and the mtime/atime are set to a fixed timestamp (ATTR_[MODIFY|ACCESS]_SET. Also, when sending the setattr procedure over the wire, we need to clear the correct attribute bits from the bitmask. I was able to measure a noticable speedup when measuring untar performance. Test: $ time tar xzf ~/dir.tgz Baseline: 1m13.072s Patched: 0m49.038s Which is more than 30% latency improvement. Signed-off-by: Sagi Grimberg Signed-off-by: Anna Schumaker commit d2e1d783f2c619cf9d8242b67a0ab0d2915f2920 Author: Anna Schumaker Date: Fri Apr 11 15:47:32 2025 -0400 NFS: Add support for fallocate(FALLOC_FL_ZERO_RANGE) This implements a suggestion from Trond that we can mimic FALLOC_FL_ZERO_RANGE by sending a compound that first does a DEALLOCATE to punch a hole in a file, and then an ALLOCATE to fill the hole with zeroes. There might technically be a race here, but once the DEALLOCATE finishes any reads from the region would return zeroes anyway, so I don't expect it to cause problems. Signed-off-by: Anna Schumaker commit 4c10fa44bc5f700e2ea21de2fbae520ba21f19d9 Author: Max Kellermann Date: Wed Apr 23 15:22:50 2025 +0200 fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() Sometimes, when a file was read while it was being truncated by another NFS client, the kernel could deadlock because folio_unlock() was called twice, and the second call would XOR back the `PG_locked` flag. Most of the time (depending on the timing of the truncation), nobody notices the problem because folio_unlock() gets called three times, which flips `PG_locked` back off: 1. vfs_read, nfs_read_folio, ... nfs_read_add_folio, nfs_return_empty_folio 2. vfs_read, nfs_read_folio, ... netfs_read_collection, netfs_unlock_abandoned_read_pages 3. vfs_read, ... nfs_do_read_folio, nfs_read_add_folio, nfs_return_empty_folio The problem is that nfs_read_add_folio() is not supposed to unlock the folio if fscache is enabled, and a nfs_netfs_folio_unlock() check is missing in nfs_return_empty_folio(). Rarely this leads to a warning in netfs_read_collection(): ------------[ cut here ]------------ R=0000031c: folio 10 is not locked WARNING: CPU: 0 PID: 29 at fs/netfs/read_collect.c:133 netfs_read_collection+0x7c0/0xf00 [...] Workqueue: events_unbound netfs_read_collection_worker RIP: 0010:netfs_read_collection+0x7c0/0xf00 [...] Call Trace: netfs_read_collection_worker+0x67/0x80 process_one_work+0x12e/0x2c0 worker_thread+0x295/0x3a0 Most of the time, however, processes just get stuck forever in folio_wait_bit_common(), waiting for `PG_locked` to disappear, which never happens because nobody is really holding the folio lock. Fixes: 000dbe0bec05 ("NFS: Convert buffered read paths to use netfs when fscache is enabled") Cc: stable@vger.kernel.org Signed-off-by: Max Kellermann Reviewed-by: Dave Wysochanski Signed-off-by: Anna Schumaker commit 793908d60b8745c386b9f4e29eb702f74ceb0886 Author: Jerome Brunet Date: Thu Apr 24 10:34:04 2025 +0200 PCI: endpoint: Retain fixed-size BAR size as well as aligned size When allocating space for an endpoint function on a BAR with a fixed size, the size saved in 'struct pci_epf_bar.size' should be the fixed size as expected by pci_epc_set_bar(). However, if pci_epf_alloc_space() increased the allocation size to accommodate iATU alignment requirements, it previously saved the larger aligned size in .size, which broke pci_epc_set_bar(). To solve this, keep the fixed BAR size in .size and save the aligned size in a new .aligned_size for use when deallocating it. Fixes: 2a9a801620ef ("PCI: endpoint: Add support to specify alignment for buffers allocated to BARs") Signed-off-by: Jerome Brunet [mani: commit message fixup] Signed-off-by: Manivannan Sadhasivam [bhelgaas: more specific subject, commit log, wrap comment to match file] Signed-off-by: Bjorn Helgaas Reviewed-by: Niklas Cassel Link: https://patch.msgid.link/20250424-pci-ep-size-alignment-v5-1-2d4ec2af23f5@baylibre.com commit 1cbf99e47fef5a0a8cd421487e642283092f07b0 Merge: b1fd8bd0cc18cd 5dff41a8637756 Author: Linus Torvalds Date: Wed May 28 13:36:38 2025 -0700 Merge tag 'jfs-6.16' of github.com:kleikamp/linux-shaggy Pull jfs updates from David Kleikamp: "A few small fixes for jfs" * tag 'jfs-6.16' of github.com:kleikamp/linux-shaggy: jfs: fix array-index-out-of-bounds read in add_missing_indices jfs: Fix null-ptr-deref in jfs_ioc_trim jfs: validate AG parameters in dbMount() to prevent crashes commit 2fbdb6d8e03b70668c0876e635506540ae92ab05 Author: Pan Taixi Date: Mon May 26 09:37:31 2025 +0800 tracing: Fix compilation warning on arm32 On arm32, size_t is defined to be unsigned int, while PAGE_SIZE is unsigned long. This hence triggers a compilation warning as min() asserts the type of two operands to be equal. Casting PAGE_SIZE to size_t solves this issue and works on other target architectures as well. Compilation warning details: kernel/trace/trace.c: In function 'tracing_splice_read_pipe': ./include/linux/minmax.h:20:28: warning: comparison of distinct pointer types lacks a cast (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) ^ ./include/linux/minmax.h:26:4: note: in expansion of macro '__typecheck' (__typecheck(x, y) && __no_side_effects(x, y)) ^~~~~~~~~~~ ... kernel/trace/trace.c:6771:8: note: in expansion of macro 'min' min((size_t)trace_seq_used(&iter->seq), ^~~ Cc: stable@vger.kernel.org Link: https://lore.kernel.org/20250526013731.1198030-1-pantaixi@huaweicloud.com Fixes: f5178c41bb43 ("tracing: Fix oob write in trace_seq_to_buffer()") Reviewed-by: Jeongjun Park Signed-off-by: Pan Taixi Signed-off-by: Steven Rostedt (Google) commit d78eb800f8f5169db89a28380631aefc224a76bb Author: Aurabindo Pillai Date: Wed May 21 15:59:56 2025 -0400 drm/amd/display: Add some missing register headers for DCN401 Add some HDCP related register headers for future use. Signed-off-by: Aurabindo Pillai Reviewed-by: Leo Li Signed-off-by: Alex Deucher commit 3e9d9df850f3f93261a3259751394643f100a52a Author: Pratap Nirujogi Date: Sun Mar 9 16:53:01 2025 -0400 drm/amd/amdgpu: Add GPIO resources required for amdisp ISP is a child device to GFX, and its device specific information is not available in ACPI. Adding the 2 GPIO resources required for ISP_v4_1_1 in amdgpu_isp driver. - GPIO 0 to allow sensor driver to enable and disable sensor module. - GPIO 85 to allow ISP driver to enable and disable ISP RGB streaming mode. Signed-off-by: Pratap Nirujogi Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher commit 2c7f023219966777be0687e15b57689894304cd3 Author: Jens Axboe Date: Wed May 28 13:45:44 2025 -0600 io_uring/net: only consider msg_inq if larger than 1 Currently retry and general validity of msg_inq is gated on it being larger than zero, but it's entirely possible for this to be slightly inaccurate. In particular, if FIN is received, it'll return 1. Just use larger than 1 as the check. This covers both the FIN case, and at the same time, it doesn't make much sense to retry a recv immediately if there's even just a single 1 byte of valid data in the socket. Leave the SOCK_NONEMPTY flagging when larger than 0 still, as an app may use that for the final receive. Cc: stable@vger.kernel.org Reported-by: Christian Mazakas Fixes: 7c71a0af81ba ("io_uring/net: improve recv bundles") Signed-off-by: Jens Axboe commit b1fd8bd0cc18cd8572ac0da21418cce2ee45e04f Merge: 2c26b68cd5c516 6f8b4788266c7d Author: Linus Torvalds Date: Wed May 28 12:40:39 2025 -0700 Merge tag 'dlm-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm Pull dlm updates from David Teigland: "This fixes delays when shutting down SCTP connections, and updates dlm Kconfig for SCTP" * tag 'dlm-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm: dlm: drop SCTP Kconfig dependency dlm: reject SCTP configuration if not enabled dlm: use SHUT_RDWR for SCTP shutdown dlm: mask sk_shutdown value commit 2c26b68cd5c51689b8cee9cb6a21abb5d2ab2d0f Merge: d87d73895fcdbe 425364dc49f050 Author: Linus Torvalds Date: Wed May 28 12:21:12 2025 -0700 Merge tag 'nfsd-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd updates from Chuck Lever: "The marquee feature for this release is that the limit on the maximum rsize and wsize has been raised to 4MB. The default remains at 1MB, but risk-seeking administrators now have the ability to try larger I/O sizes with NFS clients that support them. Eventually the default setting will be increased when we have confidence that this change will not have negative impact. With v6.16, NFSD now has its own debugfs file system where we can add experimental features and make them available outside of our development community without impacting production deployments. The first experimental setting added is one that makes all NFS READ operations use vfs_iter_read() instead of the NFSD splice actor. The plan is to eventually retire the splice actor, as that will enable a number of new capabilities such as the use of struct bio_vec from the top to the bottom of the NFSD stack. Jeff Layton contributed a number of observability improvements. The use of dprintk() in a number of high-traffic code paths has been replaced with static trace points. This release sees the continuation of efforts to harden the NFSv4.2 COPY operation. Soon, the restriction on async COPY operations can be lifted. Many thanks to the contributors, reviewers, testers, and bug reporters who participated during the v6.16 development cycle" * tag 'nfsd-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: (60 commits) xdrgen: Fix code generated for counted arrays SUNRPC: Bump the maximum payload size for the server NFSD: Add a "default" block size NFSD: Remove NFSSVC_MAXBLKSIZE_V2 macro NFSD: Remove NFSD_BUFSIZE sunrpc: Remove the RPCSVC_MAXPAGES macro svcrdma: Adjust the number of entries in svc_rdma_send_ctxt::sc_pages svcrdma: Adjust the number of entries in svc_rdma_recv_ctxt::rc_pages sunrpc: Adjust size of socket's receive page array dynamically SUNRPC: Remove svc_rqst :: rq_vec SUNRPC: Remove svc_fill_write_vector() NFSD: Use rqstp->rq_bvec in nfsd_iter_write() SUNRPC: Export xdr_buf_to_bvec() NFSD: De-duplicate the svc_fill_write_vector() call sites NFSD: Use rqstp->rq_bvec in nfsd_iter_read() sunrpc: Replace the rq_bvec array with dynamically-allocated memory sunrpc: Replace the rq_pages array with dynamically-allocated memory sunrpc: Remove backchannel check in svc_init_buffer() sunrpc: Add a helper to derive maxpages from sv_max_mesg svcrdma: Reduce the number of rdma_rw contexts per-QP ... commit d87d73895fcdbe6e45813efc473544433862364f Merge: e9d712653633a0 7acd1b315cdcc0 Author: Linus Torvalds Date: Wed May 28 12:12:08 2025 -0700 Merge tag 'ext4_for_linus-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 updates from Ted Ts'o: "New ext4 features and performance improvements: - Fast commit performance improvements - Multi-fsblock atomic write support for bigalloc file systems - Large folio support for regular files This last can result in really stupendous performance for the right workloads. For example, see [1] where the Kernel Test Robot reported over 37% improvement on a large sequential I/O workload. There are also the usual bug fixes and cleanups. Of note are cleanups of the extent status tree to fix potential races that could result in the extent status tree getting corrupted under heavy simultaneous allocation and deallocation to a single file" Link: https://lore.kernel.org/all/202505161418.ec0d753f-lkp@intel.com/ [1] * tag 'ext4_for_linus-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: (52 commits) ext4: Add a WARN_ON_ONCE for querying LAST_IN_LEAF instead ext4: Simplify flags in ext4_map_query_blocks() ext4: Rename and document EXT4_EX_FILTER to EXT4_EX_QUERY_FILTER ext4: Simplify last in leaf check in ext4_map_query_blocks ext4: Unwritten to written conversion requires EXT4_EX_NOCACHE ext4: only dirty folios when data journaling regular files ext4: Add atomic block write documentation ext4: Enable support for ext4 multi-fsblock atomic write using bigalloc ext4: Add multi-fsblock atomic write support with bigalloc ext4: Add support for EXT4_GET_BLOCKS_QUERY_LEAF_BLOCKS ext4: Make ext4_meta_trans_blocks() non-static for later use ext4: Check if inode uses extents in ext4_inode_can_atomic_write() ext4: Document an edge case for overwrites jbd2: remove journal_t argument from jbd2_superblock_csum() jbd2: remove journal_t argument from jbd2_chksum() ext4: remove sb argument from ext4_superblock_csum() ext4: remove sbi argument from ext4_chksum() ext4: enable large folio for regular file ext4: make online defragmentation support large folios ext4: make the writeback path support large folios ... commit e9d712653633a05ffff19c39809a7c1820edb2bf Merge: b04f9f88936c7b eeb0819318cc0c Author: Linus Torvalds Date: Wed May 28 12:08:26 2025 -0700 Merge tag 'ntfs3_for_6.16' of https://github.com/Paragon-Software-Group/linux-ntfs3 Pull ntfs updates from Konstantin Komarov: "Added: - missing direct_IO in ntfs_aops_cmpr - handling of hdr_first_de() return value Fixed: - handling of InitializeFileRecordSegment operation. Removed: - ability to change compression on mounted volume - redundant NULL check" * tag 'ntfs3_for_6.16' of https://github.com/Paragon-Software-Group/linux-ntfs3: fs/ntfs3: remove ability to change compression on mounted volume fs/ntfs3: Fix handling of InitializeFileRecordSegment fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr fs/ntfs3: handle hdr_first_de() return value fs/ntfs3: Drop redundant NULL check commit b04f9f88936c7b1113b4a74e4b3e6b46858a4c9a Merge: c69d8e9de00995 4dc784e92d4fcf Author: Linus Torvalds Date: Wed May 28 12:05:30 2025 -0700 Merge tag 'for-linus-6.16-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux Pull orangefs update from Mike Marshall: "Convert to use the new mount API. Code from Eric Sandeen at redhat that converts orangefs over to the new mount API" * tag 'for-linus-6.16-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux: orangefs: Convert to use the new mount API commit c69d8e9de00995ebc69392a470da99256127fdf1 Merge: a56baa225308e6 46a557694b4648 Author: Linus Torvalds Date: Wed May 28 12:02:04 2025 -0700 Merge tag 'exfat-for-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat Pull exfat updates from Namjae Jeon: - Fix xfstests generic/482 test failure - Fix double free in delayed_free * tag 'exfat-for-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat: exfat: do not clear volume dirty flag during sync exfat: fix double free in delayed_free commit a56baa225308e697163e74bae0cc623a294073d4 Merge: b08494a8f7416e b83825a8f56a34 Author: Linus Torvalds Date: Wed May 28 11:59:25 2025 -0700 Merge tag 'for-6.16-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fix from David Sterba: "A fixup to the xarray conversion sent in the main 6.16 batch. It was not included because it would cause rebase/refresh of like 80 patches, right before sending the early pull request last week. It's fixing a bug when zoned mode is enabled on btrfs so it's not affecting most people" * tag 'for-6.16-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: don't drop a reference if btrfs_check_write_meta_pointer() fails commit c7a48ea9b919e2fa0e4a1d9938fdb03e9afe276c Author: Anubhav Shelat Date: Thu Apr 3 12:04:12 2025 -0400 perf trace: Always print return value for syscalls returning a pid The syscalls that were consistently observed were set_robust_list and rseq. This is because perf cannot find their child process. This change ensures that the return value is always printed. Before: 0.256 ( 0.001 ms): set_robust_list(head: 0x7f09c77dba20, len: 24) = 0.259 ( 0.001 ms): rseq(rseq: 0x7f09c77dc0e0, rseq_len: 32, sig: 1392848979) = After: 0.270 ( 0.002 ms): set_robust_list(head: 0x7f0bb14a6a20, len: 24) = 0 0.273 ( 0.002 ms): rseq(rseq: 0x7f0bb14a70e0, rseq_len: 32, sig: 1392848979) = 0 Committer notes: As discussed in the thread in the Link: tag below, these two don't return a pid, but for syscalls returning one, we need to print the result and if we manage to find the children in 'perf trace' data structures, then print its name as well. Fixes: 11c8e39f5133aed9 ("perf trace: Infrastructure to show COMM strings for syscalls returning PIDs") Reviewed-by: Howard Chu Signed-off-by: Anubhav Shelat Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Dapeng Mi Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Michael Petlan Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250403160411.159238-2-ashelat@redhat.com Signed-off-by: Arnaldo Carvalho de Melo commit df7996076b1e1ba8a0690542d0e40f703f2f9eb7 Author: meowmeowbeanz Date: Wed May 28 10:56:58 2025 -0700 ASoC: amd: yc: Add support for Lenovo Yoga 7 16ARP8 Add DMI quirk entry for Lenovo Yoga 7 16ARP8 (83BS) to enable digital microphone support via ACP driver. Fixes microphone detection on this specific model which was previously falling back to non-functional generic audio paths. Tested-by: meowmeowbeanz Signed-off-by: meowmeowbeanz Link: https://patch.msgid.link/20250528-yoga-7-16arp8-microphone-fix-v1-1-bfeed2ecd0c2@gmx.com Signed-off-by: Mark Brown commit e8718f9866e5aa25724bc85a518ed5d6ad9d4bb4 Author: Leo Yan Date: Wed May 28 16:35:19 2025 +0100 perf script: Print PERF_AUX_FLAG_COLLISION flag Print out the collision flag for AUX trace data. This is helpful for inspecting sample collisions. After: 0x217b60@/data_nvme1n1/niayan01/upstream/perf.data [0x40]: event: 11 . . ... raw event: size 64 bytes . 0000: 0b 00 00 00 00 00 40 00 d2 ef 3f 00 00 00 00 00 ......@...?..... . 0010: ff 0f 00 00 00 00 00 00 08 00 00 00 00 00 00 00 ................ . 0020: 1c 01 00 00 1c 01 00 00 10 bf 38 d6 11 01 00 00 ..........8..... . 0030: 03 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 ................ 3 1176120114960 0x217b60 [0x40]: PERF_RECORD_AUX offset: 0x3fefd2 size: 0xfff flags: 0x8 [C] The added character '[C]' indicates the collision. Signed-off-by: Leo Yan Cc: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Link: https://lore.kernel.org/r/20250528153519.188644-1-leo.yan@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 55423e9c534d6b6139f7984d59c627eb86d5ce2e Author: Dr. David Alan Gilbert Date: Sun May 4 00:40:30 2025 +0100 smb: client: Remove an unused function and variable SMB2_QFS_info() has been unused since 2018's commit 730928c8f4be ("cifs: update smb2_queryfs() to use compounding") sign_CIFS_PDUs has been unused since 2009's commit 2edd6c5b0517 ("[CIFS] NTLMSSP support moving into new file, old dead code removed") Remove them. Signed-off-by: Dr. David Alan Gilbert Signed-off-by: Steve French commit 0dad79cf81999a314affbc5a535898d30c3d8ee4 Author: Namhyung Kim Date: Fri May 23 15:21:57 2025 -0700 perf mem: Show absolute percent in mem_stat output Currently the output sums up to 100% for each entry. But it can be confusing when it's displayed with 'overhead'. Before: $ perf mem report -F overhead,sample,cache,comm ... # -------------- Cache -------------- # Overhead Samples L1 L2 L3 L1-buf Other Command # ........ ............ ................................... ............... # 25.38% 517 34.6% 0.0% 15.8% 23.3% 26.2% swapper 9.03% 239 35.4% 0.8% 9.1% 22.1% 32.6% chrome 8.61% 233 45.3% 1.2% 8.9% 22.7% 21.9% Chrome_ChildIOT 7.81% 189 33.6% 0.4% 5.5% 35.9% 24.6% Isolated Web Co 3.73% 103 40.4% 0.3% 2.7% 39.4% 17.2% gnome-shell Let's convert it to use absolute percent value so that it can add up to the overhead for that entry. After: # -------------- Cache -------------- # Overhead Samples L1 L2 L3 L1-buf Other Command # ........ ............ ................................... ............... # 25.38% 517 8.8% 0.0% 4.0% 5.9% 6.7% swapper 9.03% 239 3.2% 0.1% 0.8% 2.0% 2.9% chrome 8.61% 233 3.9% 0.1% 0.8% 2.0% 1.9% Chrome_ChildIOT 7.81% 189 2.6% 0.0% 0.4% 2.8% 1.9% Isolated Web Co 3.73% 103 1.5% 0.0% 0.1% 1.5% 0.6% gnome-shell This aligns well with the existing 'mem' sort key. $ perf mem report -s comm,mem -H ... # # Overhead Samples Command / Memory access # ......................... .......................................... # 25.38% 517 swapper 8.78% 150 L1 hit 6.66% 72 RAM hit 5.92% 137 LFB/MAB hit 4.02% 157 L3 hit 0.00% 1 L3 miss 9.03% 239 chrome 3.19% 117 L1 hit 2.94% 35 RAM hit 1.99% 48 LFB/MAB hit 0.82% 32 L3 hit 0.08% 5 L2 hit 0.00% 2 L3 miss We can add an option or a config to change the setting later. Reviewed-by: Leo Yan Signed-off-by: Namhyung Kim Cc: Adrian Hunter Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Leo Yan Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Stephane Eranian Link: https://lore.kernel.org/r/20250523222157.1259998-3-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 7a6710d01542f928ab558a0de9578d81f181caf4 Author: Namhyung Kim Date: Fri May 23 15:21:56 2025 -0700 perf mem: Display sort order only if it's available IOW it's not used when -F option is used alone. Let's make it conditional to skip printing incorrect information. Reviewed-by: Leo Yan Signed-off-by: Namhyung Kim Cc: Adrian Hunter Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Stephane Eranian Link: https://lore.kernel.org/r/20250523222157.1259998-2-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 00a23c000e13d4c66f38eefd530dc377cc90ec14 Author: Ravi Bangoria Date: Fri May 23 15:21:55 2025 -0700 perf mem: Describe overhead calculation in brief Unlike perf-report which uses sample period for overhead calculation, perf-mem overhead is calculated using sample weight. Describe perf-mem overhead calculation method in it's man page. Reviewed-by: Leo Yan Signed-off-by: Ravi Bangoria Cc: Adrian Hunter Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Peter Zijlstra Cc: Stephane Eranian Link: https://lore.kernel.org/r/20250523222157.1259998-1-namhyung@kernel.org Signed-off-by: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit e9ba21fb5dcf88a9c0dee28df16866d3824adaf1 Merge: 8e86e73626527e d6c8097803cbc3 Author: Paolo Bonzini Date: Wed May 28 13:21:16 2025 -0400 Merge tag 'kvm-s390-next-6.16-1' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD * Fix interaction between some filesystems and Secure Execution * Some cleanups and refactorings, preparing for an upcoming big series commit a4a859eb6704a8aa46aa1cec5396c8d41383a26b Author: Dapeng Mi Date: Thu Apr 3 06:08:10 2025 +0000 perf record: Fix incorrect --user-regs comments The comment of "--user-regs" option is not correct, fix it. "on interrupt," -> "in user space," Fixes: 84c417422798c897 ("perf record: Support direct --user-regs arguments") Reviewed-by: Ian Rogers Signed-off-by: Dapeng Mi Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: Kan Liang Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250403060810.196028-1-dapeng1.mi@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 74d6a606c2b39fd830d2d7a6363bc5688b4e4b56 Author: Tamir Duberstein Date: Wed Apr 9 10:43:16 2025 -0400 rust: retain pointer mut-ness in `container_of!` Avoid casting the input pointer to `*const _`, allowing the output pointer to be `*mut` if the input is `*mut`. This allows a number of `*const` to `*mut` conversions to be removed at the cost of slightly worse ergonomics when the macro is used with a reference rather than a pointer; the only example of this was in the macro's own doctest. Reviewed-by: Benno Lossin Reviewed-by: Alice Ryhl Signed-off-by: Tamir Duberstein Reviewed-by: Andreas Hindborg Link: https://lore.kernel.org/r/20250409-container-of-mutness-v1-1-64f472b94534@gmail.com Signed-off-by: Miguel Ojeda commit b08494a8f7416e5f09907318c5460ad6f6e2a548 Merge: a61e2603814372 f8bb3ed3197966 Author: Linus Torvalds Date: Wed May 28 09:46:39 2025 -0700 Merge tag 'drm-next-2025-05-28' of https://gitlab.freedesktop.org/drm/kernel Pull drm updates from Dave Airlie: "As part of building up nova-core/nova-drm pieces we've brought in some rust abstractions through this tree, aux bus being the main one, with devres changes also in the driver-core tree. Along with the drm core abstractions and enough nova-core/nova-drm to use them. This is still all stub work under construction, to build the nova driver upstream. The other big NVIDIA related one is nouveau adds support for Hopper/Blackwell GPUs, this required a new GSP firmware update to 570.144, and a bunch of rework in order to support multiple fw interfaces. There is also the introduction of an asahi uapi header file as a precursor to getting the real driver in later, but to unblock userspace mesa packages while the driver is trapped behind rust enablement. Otherwise it's the usual mixture of stuff all over, amdgpu, i915/xe, and msm being the main ones, and some changes to vsprintf. new drivers: - bring in the asahi uapi header standalone - nova-drm: stub driver rust dependencies (for nova-core): - auxiliary - bus abstractions - driver registration - sample driver - devres changes from driver-core - revocable changes core: - add Apple fourcc modifiers - add virtio capset definitions - extend EXPORT_SYNC_FILE for timeline syncobjs - convert to devm_platform_ioremap_resource - refactor shmem helper page pinning - DP powerup/down link helpers - extended %p4cc in vsprintf.c to support fourcc prints - change vsprintf %p4cn to %p4chR, remove %p4cn - Add drm_file_err function - IN_FORMATS_ASYNC property - move sitronix from tiny to their own subdir rust: - add drm core infrastructure rust abstractions (device/driver, ioctl, file, gem) dma-buf: - adjust sg handling to not cache map on attach - allow setting dma-device for import - Add a helper to sort and deduplicate dma_fence arrays docs: - updated drm scheduler docs - fbdev todo update - fb rendering - actual brightness ttm: - fix delayed destroy resv object bridge: - add kunit tests - convert tc358775 to atomic - convert drivers to devm_drm_bridge_alloc - convert rk3066_hdmi to bridge driver scheduler: - add kunit tests panel: - refcount panels to improve lifetime handling - Powertip PH128800T004-ZZA01 - NLT NL13676BC25-03F, Tianma TM070JDHG34-00 - Himax HX8279/HX8279-D DDIC - Visionox G2647FB105 - Sitronix ST7571 - ZOTAC rotation quirk vkms: - allow attaching more displays i915: - xe3lpd display updates - vrr refactor - intel_display struct conversions - xe2hpd memory type identification - add link rate/count to i915_display_info - cleanup VGA plane handling - refactor HDCP GSC - fix SLPC wait boosting reference counting - add 20ms delay to engine reset - fix fence release on early probe errors xe: - SRIOV updates - BMG PCI ID update - support separate firmware for each GT - SVM fix, prelim SVM multi-device work - export fan speed - temp disable d3cold on BMG - backup VRAM in PM notifier instead of suspend/freeze - update xe_ttm_access_memory to use GPU for non-visible access - fix guc_info debugfs for VFs - use copy_from_user instead of __copy_from_user - append PCIe gen5 limitations to xe_firmware document amdgpu: - DSC cleanup - DC Scaling updates - Fused I2C-over-AUX updates - DMUB updates - Use drm_file_err in amdgpu - Enforce isolation updates - Use new dma_fence helpers - USERQ fixes - Documentation updates - SR-IOV updates - RAS updates - PSP 12 cleanups - GC 9.5 updates - SMU 13.x updates - VCN / JPEG SR-IOV updates amdkfd: - Update error messages for SDMA - Userptr updates - XNACK fixes radeon: - CIK doorbell cleanup nouveau: - add support for NVIDIA r570 GSP firmware - enable Hopper/Blackwell support nova-core: - fix task list - register definition infrastructure - move firmware into own rust module - register auxiliary device for nova-drm nova-drm: - initial driver skeleton msm: - GPU: - ACD (adaptive clock distribution) for X1-85 - drop fictional address_space_size - improve GMU HFI response time out robustness - fix crash when throttling during boot - DPU: - use single CTL path for flushing on DPU 5.x+ - improve SSPP allocation code for better sharing - Enabled SmartDMA on SM8150, SC8180X, SC8280XP, SM8550 - Added SAR2130P support - Disabled DSC support on MSM8937, MSM8917, MSM8953, SDM660 - DP: - switch to new audio helpers - better LTTPR handling - DSI: - Added support for SA8775P - Added SAR2130P support - HDMI: - Switched to use new helpers for ACR data - Fixed old standing issue of HPD not working in some cases amdxdna: - add dma-buf support - allow empty command submits renesas: - add dma-buf support - add zpos, alpha, blend support panthor: - fail properly for NO_MMAP bos - add SET_LABEL ioctl - debugfs BO dumping support imagination: - update DT bindings - support TI AM68 GPU hibmc: - improve interrupt handling and HPD support virtio: - add panic handler support rockchip: - add RK3588 support - add DP AUX bus panel support ivpu: - add heartbeat based hangcheck mediatek: - prepares support for MT8195/99 HDMIv2/DDCv2 anx7625: - improve HPD tegra: - speed up firmware loading * tag 'drm-next-2025-05-28' of https://gitlab.freedesktop.org/drm/kernel: (1627 commits) drm/nouveau/tegra: Fix error pointer vs NULL return in nvkm_device_tegra_resource_addr() drm/xe: Default auto_link_downgrade status to false drm/xe/guc: Make creation of SLPC debugfs files conditional drm/i915/display: Add check for alloc_ordered_workqueue() and alloc_workqueue() drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read drm/i915/ptl: Use everywhere the correct DDI port clock select mask drm/nouveau/kms: add support for GB20x drm/dp: add option to disable zero sized address only transactions. drm/nouveau: add support for GB20x drm/nouveau/gsp: add hal for fifo.chan.doorbell_handle drm/nouveau: add support for GB10x drm/nouveau/gf100-: track chan progress with non-WFI semaphore release drm/nouveau/nv50-: separate CHANNEL_GPFIFO handling out from CHANNEL_DMA drm/nouveau: add helper functions for allocating pinned/cpu-mapped bos drm/nouveau: add support for GH100 drm/nouveau: improve handling of 64-bit BARs drm/nouveau/gv100-: switch to volta semaphore methods drm/nouveau/gsp: support deeper page tables in COPY_SERVER_RESERVED_PDES drm/nouveau/gsp: init client VMMs with NV0080_CTRL_DMA_SET_PAGE_DIRECTORY drm/nouveau/gsp: fetch level shift and PDE from BAR2 VMM ... commit a61e26038143727d9b0f1bc01b0370f77f2ad7e4 Merge: 3d413f0cfd7ef0 5e1ff2314797bf Author: Linus Torvalds Date: Wed May 28 09:17:20 2025 -0700 Merge tag 'media/v6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - v4l2-core fix: V4L2_BUF_TYPE_VIDEO_OVERLAY is capture, not output - New driver: Amlogic C3 ISP - New sensor drivers: ST VD55G1 and VD56G3, OmniVision OV02C10 - amlogic: c3-mipi-csi2: Handle 64-bits division - a fix for 64-bits division at the amlogic c3-mipi-csi2 driver - Changes at atomisp to support mainline mt9m114 driver and remove deprecated GPIO APIs - various cleanups, fixes and enhancements * tag 'media/v6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (314 commits) media: rkvdec: h264: Support High 10 and 4:2:2 profiles media: rkvdec: Add get_image_fmt ops media: rkvdec: Initialize the m2m context before the controls media: rkvdec: h264: Limit minimum profile to constrained baseline media: mediatek: jpeg: support 34bits media: verisilicon: Free post processor buffers on error media: platform: mtk-mdp3: Remove unused mdp_get_plat_device media: amlogic: c3-mipi-csi2: Handle 64-bits division media: uvcvideo: Use dev_err_probe for devm_gpiod_get_optional media: uvcvideo: Fix deferred probing error media: uvcvideo: Rollback non processed entities on error media: uvcvideo: Send control events for partial succeeds media: uvcvideo: Return the number of processed controls media: uvcvideo: Do not turn on the camera for some ioctls media: uvcvideo: Make power management granular media: uvcvideo: Increase/decrease the PM counter per IOCTL media: uvcvideo: Create uvc_pm_(get|put) functions media: uvcvideo: Keep streaming state in the file handle Documentation: media: Add documentation file c3-isp.rst Documentation: media: Add documentation file metafmt-c3-isp.rst ... commit 9883494c45a13dc88d27dde4f988c04823b42a2f Author: Zhiguo Niu Date: Wed May 14 16:45:49 2025 +0800 f2fs: fix to correct check conditions in f2fs_cross_rename Should be "old_dir" here. Fixes: 5c57132eaf52 ("f2fs: support project quota") Signed-off-by: Zhiguo Niu Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit a6c397a31f58a1d577c2c8d04b624e9baa31951c Author: Zhiguo Niu Date: Wed May 14 16:45:48 2025 +0800 f2fs: use d_inode(dentry) cleanup dentry->d_inode no logic changes. Signed-off-by: Zhiguo Niu Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit c836d3b8d94e3dd381e7d4bb918875084f85715e Author: Chao Yu Date: Fri May 23 11:25:45 2025 +0800 f2fs: fix to skip f2fs_balance_fs() if checkpoint is disabled Syzbot reports a f2fs bug as below: INFO: task syz-executor328:5856 blocked for more than 144 seconds. Not tainted 6.15.0-rc6-syzkaller-00208-g3c21441eeffc #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor328 state:D stack:24392 pid:5856 tgid:5832 ppid:5826 task_flags:0x400040 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5382 [inline] __schedule+0x168f/0x4c70 kernel/sched/core.c:6767 __schedule_loop kernel/sched/core.c:6845 [inline] schedule+0x165/0x360 kernel/sched/core.c:6860 io_schedule+0x81/0xe0 kernel/sched/core.c:7742 f2fs_balance_fs+0x4b4/0x780 fs/f2fs/segment.c:444 f2fs_map_blocks+0x3af1/0x43b0 fs/f2fs/data.c:1791 f2fs_expand_inode_data+0x653/0xaf0 fs/f2fs/file.c:1872 f2fs_fallocate+0x4f5/0x990 fs/f2fs/file.c:1975 vfs_fallocate+0x6a0/0x830 fs/open.c:338 ioctl_preallocate fs/ioctl.c:290 [inline] file_ioctl fs/ioctl.c:-1 [inline] do_vfs_ioctl+0x1b8f/0x1eb0 fs/ioctl.c:885 __do_sys_ioctl fs/ioctl.c:904 [inline] __se_sys_ioctl+0x82/0x170 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The root cause is after commit 84b5bb8bf0f6 ("f2fs: modify f2fs_is_checkpoint_ready logic to allow more data to be written with the CP disable"), we will get chance to allow f2fs_is_checkpoint_ready() to return true once below conditions are all true: 1. checkpoint is disabled 2. there are not enough free segments 3. there are enough free blocks Then it will cause f2fs_balance_fs() to trigger foreground GC. void f2fs_balance_fs(struct f2fs_sb_info *sbi, bool need) ... if (!f2fs_is_checkpoint_ready(sbi)) return; And the testcase mounts f2fs image w/ gc_merge,checkpoint=disable, so deadloop will happen through below race condition: - f2fs_do_shutdown - vfs_fallocate - gc_thread_func - file_start_write - __sb_start_write(SB_FREEZE_WRITE) - f2fs_fallocate - f2fs_expand_inode_data - f2fs_map_blocks - f2fs_balance_fs - prepare_to_wait - wake_up(gc_wait_queue_head) - io_schedule - bdev_freeze - freeze_super - sb->s_writers.frozen = SB_FREEZE_WRITE; - sb_wait_write(sb, SB_FREEZE_WRITE); - if (sbi->sb->s_writers.frozen >= SB_FREEZE_WRITE) continue; : cause deadloop This patch fix to add check condition in f2fs_balance_fs(), so that if checkpoint is disabled, we will just skip trigger foreground GC to avoid such deadloop issue. Meanwhile let's remove f2fs_is_checkpoint_ready() check condition in f2fs_balance_fs(), since it's redundant, due to the main logic in the function is to check: a) whether checkpoint is disabled b) there is enough free segments f2fs_balance_fs() still has all logics after f2fs_is_checkpoint_ready()'s removal. Reported-by: syzbot+aa5bb5f6860e08a60450@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-f2fs-devel/682d743a.a00a0220.29bc26.0289.GAE@google.com Fixes: 84b5bb8bf0f6 ("f2fs: modify f2fs_is_checkpoint_ready logic to allow more data to be written with the CP disable") Cc: Qi Han Signed-off-by: Chao Yu Reviewed-by: Zhiguo Niu Signed-off-by: Jaegeuk Kim commit 68e7f31eecf1d622c59ef470da24762e6550cd06 Author: Chao Yu Date: Fri May 23 15:33:04 2025 +0800 f2fs: clean up to check bi_status w/ BLK_STS_OK Check bi_status w/ BLK_STS_OK instead of 0 for cleanup. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 019a8912425e231511042a4eae48b7a9e459453c Author: Chao Yu Date: Fri May 23 15:33:03 2025 +0800 f2fs: introduce is_{meta,node}_folio Just cleanup, no changes. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 24bcc31fc75b760e7813e1c8257a7439e045e8ad Author: Arnaldo Carvalho de Melo Date: Wed May 28 12:53:08 2025 -0300 Revert "perf thread: Ensure comm_lock held for comm_list" This reverts commit 8f454c95817d15ee529d58389612ea4b34f5ffb3. 'perf top' is freezing on exit sometimes, bisected to this one, revert. Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Athira Rajeev Cc: Bill Wendling Cc: Chaitanya S Prakash Cc: Fei Lang Cc: Howard Chu Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Stephen Brennan Link: https://lore.kernel.org/r/aDcyvvOKZkRYbjul@x1 Signed-off-by: Arnaldo Carvalho de Melo commit deecd282bc39bc9b64e50a0f628a8080da27359a Author: yohan.joung Date: Mon May 12 16:36:10 2025 +0900 f2fs: add ckpt_valid_blocks to the section entry when performing buffered writes in a large section, overhead is incurred due to the iteration through ckpt_valid_blocks within the section. when SEGS_PER_SEC is 128, this overhead accounts for 20% within the f2fs_write_single_data_page routine. as the size of the section increases, the overhead also grows. to handle this problem ckpt_valid_blocks is added within the section entries. Test insmod null_blk.ko nr_devices=1 completion_nsec=1 submit_queues=8 hw_queue_depth=64 max_sectors=512 bs=4096 memory_backed=1 make_f2fs /dev/block/nullb0 make_f2fs -s 128 /dev/block/nullb0 fio --bs=512k --size=1536M --rw=write --name=1 --filename=/mnt/test_dir/seq_write --ioengine=io_uring --iodepth=64 --end_fsync=1 before SEGS_PER_SEC 1 2556MiB/s SEGS_PER_SEC 128 2145MiB/s after SEGS_PER_SEC 1 2556MiB/s SEGS_PER_SEC 128 2556MiB/s Signed-off-by: yohan.joung Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 249ad438e1d98b30b1ad9283bb4c4a37c4858294 Author: yohan.joung Date: Mon May 12 16:36:09 2025 +0900 f2fs: add a method for calculating the remaining blocks in the current segment in LFS mode. In LFS mode, the previous segment cannot use invalid blocks, so the remaining blocks from the next_blkoff of the current segment to the end of the section are calculated. Signed-off-by: yohan.joung Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit d6c8097803cbc3bb8d875baef542e6d77d10c203 Author: Claudio Imbrenda Date: Wed May 28 11:55:02 2025 +0200 KVM: s390: Simplify and move pv code All functions in kvm/gmap.c fit better in kvm/pv.c instead. Move and rename them appropriately, then delete the now empty kvm/gmap.c and kvm/gmap.h. Reviewed-by: Nina Schoetterl-Glausch Reviewed-by: Steffen Eiden Reviewed-by: Christoph Schlameuss Acked-by: Janosch Frank Link: https://lore.kernel.org/r/20250528095502.226213-5-imbrenda@linux.ibm.com Signed-off-by: Claudio Imbrenda Message-ID: <20250528095502.226213-5-imbrenda@linux.ibm.com> commit 200197908dc4afe03a75234478e6a14634a0a788 Author: Claudio Imbrenda Date: Wed May 28 11:55:01 2025 +0200 KVM: s390: Refactor and split some gmap helpers Refactor some gmap functions; move the implementation into a separate file with only helper functions. The new helper functions work on vm addresses, leaving all gmap logic in the gmap functions, which mostly become just wrappers. The whole gmap handling is going to be moved inside KVM soon, but the helper functions need to touch core mm functions, and thus need to stay in the core of kernel. Reviewed-by: Steffen Eiden Reviewed-by: Christoph Schlameuss Acked-by: Janosch Frank Link: https://lore.kernel.org/r/20250528095502.226213-4-imbrenda@linux.ibm.com Signed-off-by: Claudio Imbrenda Message-ID: <20250528095502.226213-4-imbrenda@linux.ibm.com> commit 7e42ad66fb5d0902b1f8d4d9a8fee898b685046a Author: Claudio Imbrenda Date: Wed May 28 11:55:00 2025 +0200 KVM: s390: Remove unneeded srcu lock All paths leading to handle_essa() already hold the kvm->srcu. Remove unneeded srcu locking from handle_essa(). Add lockdep assertion to make sure we will always be holding kvm->srcu when entering handle_essa(). Reviewed-by: Nina Schoetterl-Glausch Reviewed-by: Christian Borntraeger Reviewed-by: Christoph Schlameuss Reviewed-by: Steffen Eiden Link: https://lore.kernel.org/r/20250528095502.226213-3-imbrenda@linux.ibm.com Signed-off-by: Claudio Imbrenda Message-ID: <20250528095502.226213-3-imbrenda@linux.ibm.com> commit af941f3dd8d75d0f6ae911f25a1e68cdc5db2cfd Author: Claudio Imbrenda Date: Wed May 28 11:54:59 2025 +0200 s390: Remove unneeded includes Many files don't need to include asm/tlb.h or asm/gmap.h. On the other hand, asm/tlb.h does need to include asm/gmap.h. Remove all unneeded includes so that asm/tlb.h is not directly used by s390 arch code anymore. Remove asm/gmap.h from a few other files as well, so that now only KVM code, mm/gmap.c, and asm/tlb.h include it. Reviewed-by: Christoph Schlameuss Reviewed-by: Steffen Eiden Acked-by: Heiko Carstens Link: https://lore.kernel.org/r/20250528095502.226213-2-imbrenda@linux.ibm.com Signed-off-by: Claudio Imbrenda Message-ID: <20250528095502.226213-2-imbrenda@linux.ibm.com> commit ab73b29efd36f8916c6cc9954e912c4723c9a1b0 Author: David Hildenbrand Date: Fri May 16 14:39:46 2025 +0200 s390/uv: Improve splitting of large folios that cannot be split while dirty Currently, starting a PV VM on an iomap-based filesystem with large folio support, such as XFS, will not work. We'll be stuck in unpack_one()->gmap_make_secure(), because we can't seem to make progress splitting the large folio. The problem is that we require a writable PTE but a writable PTE under such filesystems will imply a dirty folio. So whenever we have a writable PTE, we'll have a dirty folio, and dirty iomap folios cannot currently get split, because split_folio()->split_huge_page_to_list_to_order()->filemap_release_folio() will fail in iomap_release_folio(). So we will not make any progress splitting such large folios. Until dirty folios can be split more reliably, let's manually trigger writeback of the problematic folio using filemap_write_and_wait_range(), and retry the split immediately afterwards exactly once, before looking up the folio again. Should this logic be part of split_folio()? Likely not; most split users don't have to split so eagerly to make any progress. For now, this seems to affect xfs, zonefs and erofs, and this patch makes it work again (tested on xfs only). While this could be considered a fix for commit 6795801366da ("xfs: Support large folios"), commit df2f9708ff1f ("zonefs: enable support for large folios") and commit ce529cc25b18 ("erofs: enable large folios for iomap mode"), before commit eef88fe45ac9 ("s390/uv: Split large folios in gmap_make_secure()"), we did not try splitting large folios at all. So it's all rather part of making SE compatible with file systems that support large folios. But to have some "Fixes:" tag, let's just use eef88fe45ac9. Not CCing stable, because there are a lot of dependencies, and it simply not working is not critical in stable kernels. Reported-by: Sebastian Mitterle Closes: https://issues.redhat.com/browse/RHEL-58218 Fixes: eef88fe45ac9 ("s390/uv: Split large folios in gmap_make_secure()") Signed-off-by: David Hildenbrand Link: https://lore.kernel.org/r/20250516123946.1648026-4-david@redhat.com Message-ID: <20250516123946.1648026-4-david@redhat.com> Reviewed-by: Claudio Imbrenda Signed-off-by: Claudio Imbrenda commit 3d413f0cfd7ef0fe478e98fafcc084209520abd0 Merge: b5628b81bd19fa 654d61b8e0e2f8 Author: Linus Torvalds Date: Wed May 28 08:34:19 2025 -0700 Merge tag 'audit-pr-20250527' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit Pull audit updates from Paul Moore: - Always record AUDIT_ANOM events when auditing is enabled. Prior to this patch we only recorded AUDIT_ANOM events if auditing was enabled and the admin/distro had explicitly configured audit beyond the defaults. Considering that AUDIT_ANOM events are anomolous events considered to be "security relevant", it seems wise to record these events as long as auditing is enabled, even if the system is running with a default audit configuration. - Mark the audit_log_vformat() function with the __printf() attribute to quiet GCC. * tag 'audit-pr-20250527' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit: record AUDIT_ANOM_* events regardless of presence of rules audit: mark audit_log_vformat() with __printf() attribute commit b5628b81bd19fa52d6a35e49336c58d7188eaf1b Merge: 1bc8c83af962a7 05f1a939225ec8 Author: Linus Torvalds Date: Wed May 28 08:28:58 2025 -0700 Merge tag 'selinux-pr-20250527' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux updates from Paul Moore: - Reduce the SELinux impact on path walks. Add a small directory access cache to the per-task SELinux state. This cache allows SELinux to cache the most recently used directory access decisions in order to avoid repeatedly querying the AVC on path walks where the majority of the directories have similar security contexts/labels. My performance measurements are crude, but prior to this patch the time spent in SELinux code on a 'make allmodconfig' run was 103% that of __d_lookup_rcu(), and with this patch the time spent in SELinux code dropped to 63% of __d_lookup_rcu(), a ~40% improvement. Additional improvments can be expected in the future, but those will require additional SELinux policy/toolchain support. - Add support for wildcards in genfscon policy statements. This patch allows for wildcards in the genfscon patch matching logic as opposed to the prefix matching that was used prior to this change. Adding wilcard support allows for more expressive and efficient path matching in the policy which is especially helpful for sysfs, and has resulted in a ~15% boot time reduction in Android. SELinux policies can opt into wilcard matching by using the "genfs_seclabel_wildcard" policy capability. - Unify the error/OOM handling of the SELinux network caches. A failure to allocate memory for the SELinux network caches isn't fatal as the object label can still be safely returned to the caller, it simply means that we cannot add the new data to the cache, at least temporarily. This patch corrects this behavior for the InfiniBand cache and does some minor cleanup. - Minor improvements around constification, 'likely' annotations, and removal of bogus comments. * tag 'selinux-pr-20250527' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: fix the kdoc header for task_avdcache_update selinux: remove a duplicated include selinux: reduce path walk overhead selinux: support wildcard match in genfscon selinux: drop copy-paste comment selinux: unify OOM handling in network hashtables selinux: add likely hints for fast paths selinux: contify network namespace pointer selinux: constify network address pointer commit 40493d97b329f8185c0f04dc0ef2b9ffc58e7f3b Author: Rodrigo Vivi Date: Wed May 21 12:51:48 2025 -0400 drm/xe: Add missing documentation of rpa_freq While at it, already adjust the rpe_freq frequency, to highlight that both are calculated by PCODE at runtime. Fixes: c6aac2fa77a3 ("drm/xe: Introduce the RPa information") Cc: Vinay Belgaumkar Cc: Lucas De Marchi Reviewed-by: Lucas De Marchi Reviewed-by: Vinay Belgaumkar Link: https://lore.kernel.org/r/20250521165146.39616-4-rodrigo.vivi@intel.com Signed-off-by: Rodrigo Vivi (cherry picked from commit 39578fa40420fb11dbe4f42225a347e945d8fd0e) Signed-off-by: Thomas Hellström commit 55f8aa083604ce098c9d6a0911c6bcde15d03a80 Author: Rodrigo Vivi Date: Wed May 21 12:51:47 2025 -0400 drm/xe: Make xe_gt_freq part of the Documentation The documentation was created with the creation of the component, however it has never been actually shown in the actual Documentation. While doing this, fixes the identation style, to avoid new warnings while building htmldocs. Fixes: bef52b5c7a19 ("drm/xe: Create a xe_gt_freq component for raw management and sysfs") Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250521165146.39616-3-rodrigo.vivi@intel.com Signed-off-by: Rodrigo Vivi (cherry picked from commit af53f0fd99c3bbb3afd29f1612c9e88c5a92cc01) Signed-off-by: Thomas Hellström commit 1bc8c83af962a7f0e52c1ee254acbcb1d9204a5e Merge: 7af6e3febb919e 74e5b13a1b0f10 Author: Linus Torvalds Date: Wed May 28 08:17:19 2025 -0700 Merge tag 'lsm-pr-20250527' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm Pull lsm update from Paul Moore: "One minor LSM framework patch to move the selinux_netlink_send() hook under the CONFIG_SECURITY_NETWORK Kconfig knob" * tag 'lsm-pr-20250527' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm: lsm: Move security_netlink_send to under CONFIG_SECURITY_NETWORK commit 7af6e3febb919e8520a5946649993f7edb0495c7 Merge: cbaed2f58c55c1 fe3aebf27dc187 Author: Linus Torvalds Date: Wed May 28 08:12:33 2025 -0700 Merge tag 'integrity-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity Pull integrity updates from Mimi Zohar: "Carrying the IMA measurement list across kexec is not a new feature, but is updated to address a couple of issues: - Carrying the IMA measurement list across kexec required knowing apriori all the file measurements between the "kexec load" and "kexec execute" in order to measure them before the "kexec load". Any delay between the "kexec load" and "kexec exec" exacerbated the problem. - Any file measurements post "kexec load" were not carried across kexec, resulting in the measurement list being out of sync with the TPM PCR. With these changes, the buffer for the IMA measurement list is still allocated at "kexec load", but copying the IMA measurement list is deferred to after quiescing the TPM. Two new kexec critical data records are defined" * tag 'integrity-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: ima: do not copy measurement list to kdump kernel ima: measure kexec load and exec events as critical data ima: make the kexec extra memory configurable ima: verify if the segment size has changed ima: kexec: move IMA log copy from kexec load to execute ima: kexec: define functions to copy IMA log at soft boot ima: kexec: skip IMA segment validation after kexec soft reboot kexec: define functions to map and unmap segments ima: define and call ima_alloc_kexec_file_buf() ima: rename variable the seq_file "file" to "ima_kexec_file" commit cbaed2f58c55c13f96250359478bd8fff3ac4c6e Merge: 48cfc5791d83b6 4b59f4fd0a36c3 Author: Linus Torvalds Date: Wed May 28 08:09:37 2025 -0700 Merge tag 'Smack-for-6.16' of https://github.com/cschaufler/smack-next Pull smack update from Casey Schaufler: "One trivial kernel doc fix" * tag 'Smack-for-6.16' of https://github.com/cschaufler/smack-next: security/smack/smackfs: small kernel-doc fixes commit 48cfc5791d83b630fd90a1b64a15a6d09c186f99 Merge: 96d40793abc653 f0cd6012c40da9 Author: Linus Torvalds Date: Wed May 28 07:47:10 2025 -0700 Merge tag 'hardening-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening updates from Kees Cook: - Update overflow helpers to ease refactoring of on-stack flex array instances (Gustavo A. R. Silva, Kees Cook) - lkdtm: Use SLAB_NO_MERGE instead of constructors (Harry Yoo) - Simplify CONFIG_CC_HAS_COUNTED_BY (Jan Hendrik Farr) - Disable u64 usercopy KUnit test on 32-bit SPARC (Thomas Weißschuh) - Add missed designated initializers now exposed by fixed randstruct (Nathan Chancellor, Kees Cook) - Document compilers versions for __builtin_dynamic_object_size - Remove ARM_SSP_PER_TASK GCC plugin - Fix GCC plugin randstruct, add selftests, and restore COMPILE_TEST builds - Kbuild: induce full rebuilds when dependencies change with GCC plugins, the Clang sanitizer .scl file, or the randstruct seed. - Kbuild: Switch from -Wvla to -Wvla-larger-than=1 - Correct several __nonstring uses for -Wunterminated-string-initialization * tag 'hardening-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (23 commits) Revert "hardening: Disable GCC randstruct for COMPILE_TEST" lib/tests: randstruct: Add deep function pointer layout test lib/tests: Add randstruct KUnit test randstruct: gcc-plugin: Remove bogus void member net: qede: Initialize qede_ll_ops with designated initializer scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops md/bcache: Mark __nonstring look-up table integer-wrap: Force full rebuild when .scl file changes randstruct: Force full rebuild when seed changes gcc-plugins: Force full rebuild when plugins change kbuild: Switch from -Wvla to -Wvla-larger-than=1 hardening: simplify CONFIG_CC_HAS_COUNTED_BY overflow: Fix direct struct member initialization in _DEFINE_FLEX() kunit/overflow: Add tests for STACK_FLEX_ARRAY_SIZE() helper overflow: Add STACK_FLEX_ARRAY_SIZE() helper input/joystick: magellan: Mark __nonstring look-up table const watchdog: exar: Shorten identity name to fit correctly mod_devicetable: Enlarge the maximum platform_device_id name length overflow: Clarify expectations for getting DEFINE_FLEX variable sizes compiler_types: Identify compiler versions for __builtin_dynamic_object_size ... commit 96d40793abc65341c4274169a4444fcfe5f0e6da Merge: feacb1774bd5ea a9b33aae79cea2 Author: Linus Torvalds Date: Wed May 28 07:45:39 2025 -0700 Merge tag 'seccomp-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull seccomp updates from Kees Cook: - selftest fixes for arm32 (Neill Kapron, Terry Tritton) - documentation typo fix (Sumanth Gavini) * tag 'seccomp-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: selftests: seccomp: Fix "performace" to "performance" selftests/seccomp: fix negative_ENOSYS tracer tests on arm32 selftests/seccomp: fix syscall_restart test for arm compat commit 89ab97de44fec8eecedd1d327d418c5781303c05 Author: Frank Li Date: Thu May 22 16:57:09 2025 -0400 dt-bindings: timer: Add fsl,vf610-pit.yaml Add binding doc fsl,vf610-pit.yaml to fix below CHECK_DTB warnings: arch/arm/boot/dts/nxp/vf/vf610m4-colibri.dtb: /soc/bus@40000000/pit@40037000: failed to match any schema with compatible: ['fsl,vf610-pit'] Signed-off-by: Frank Li Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20250522205710.502779-1-Frank.Li@nxp.com Signed-off-by: Rob Herring (Arm) commit fd03f82a026cc03cb8051a8c6487c99f96c9029f Author: Heiko Stuebner Date: Wed May 28 00:51:19 2025 +0200 drm/bridge: analogix_dp: Fix clk-disable removal Commit 6579a03e68ff ("drm/bridge: analogix_dp: Remove the unnecessary calls to clk_disable_unprepare() during probing") removed the mismatched clock_disable calls from analogix_dp_probe. But that patch was created and sent before commit e5e9fa9f7aad ("drm/bridge: analogix_dp: Add support to get panel from the DP AUX bus") was merged, so couldn't know about this change. So in the original patch the last change is if (ret) { dev_err(&pdev->dev, "failed to request irq\n"); - goto err_disable_clk; + return ERR_PTR(ret); } disable_irq(dp->irq); return dp; - -err_disable_clk: - clk_disable_unprepare(dp->clock); - return ERR_PTR(ret); } EXPORT_SYMBOL_GPL(analogix_dp_probe); the analogix_dp_core.c actually now has the runtime-pm handling between disable_irq() and return do introducing another goto err_clk_disable there. So remove that one too and return an error pointer, to not create build breakage. Fixes: 6579a03e68ff ("drm/bridge: analogix_dp: Remove the unnecessary calls to clk_disable_unprepare() during probing") Signed-off-by: Heiko Stuebner Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250527225120.3361663-1-heiko@sntech.de Signed-off-by: Dmitry Baryshkov commit b9457813016841df82eaa39f1f00ddebf385f352 Author: Tommaso Merciai Date: Wed May 28 09:30:40 2025 +0200 dt-bindings: gpu: mali-bifrost: Add compatible for RZ/G3E SoC Add a compatible string for the Renesas RZ/G3E SoC variants that include a Mali-G52 GPU. These variants share the same restrictions on interrupts, clocks, and power domains as the RZ/G2L SoC, so extend the existing schema validation accordingly. Acked-by: Krzysztof Kozlowski Reviewed-by: Geert Uytterhoeven Signed-off-by: Tommaso Merciai Link: https://lore.kernel.org/r/20250528073040.904033-1-tommaso.merciai.xr@bp.renesas.com Signed-off-by: Rob Herring (Arm) commit 6dd7a0fde91f252858f4d4cff4245577319b7b88 Author: Ian Rogers Date: Tue May 27 20:26:36 2025 -0700 perf test trace_summary: Skip --bpf-summary tests if no libbpf If perf is built without libbpf (e.g. NO_LIBBPF=1) then the --bpf-summary perf trace tests will fail. Skip the tests as this is expected behavior. Signed-off-by: Ian Rogers Acked-by: Howard Chu Cc: Adrian Hunter Cc: Alex Gaynor Cc: Alexander Shishkin Cc: Alice Ryhl Cc: Andi Kleen Cc: Andreas Hindborg Cc: Benno Lossin Cc: Björn Roy Baron Cc: Boqun Feng Cc: Danilo Krummrich Cc: Dmitriy Vyukov Cc: Gary Guo Cc: Ingo Molnar Cc: James Clark Cc: Jiapeng Chong Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Miguel Ojeda Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephen Brennan Cc: Trevor Gross Cc: Weilin Wang Link: https://lore.kernel.org/r/20250528032637.198960-7-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 8755f940a0a6c4485181708c5e82936c31250c67 Author: Ian Rogers Date: Tue May 27 20:26:35 2025 -0700 perf test intel-pt: Skip jitdump test if no libelf jitdump support is only present if building with libelf. Skip the intel-pt jitdump test if perf isn't compiled with libelf support. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alex Gaynor Cc: Alexander Shishkin Cc: Alice Ryhl Cc: Andi Kleen Cc: Andreas Hindborg Cc: Benno Lossin Cc: Björn Roy Baron Cc: Boqun Feng Cc: Danilo Krummrich Cc: Dmitriy Vyukov Cc: Gary Guo Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiapeng Chong Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Miguel Ojeda Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephen Brennan Cc: Trevor Gross Cc: Weilin Wang Link: https://lore.kernel.org/r/20250528032637.198960-6-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 040a008d0e5006123ac1b6e96b9de615e587ab7e Author: Ian Rogers Date: Tue May 27 20:26:34 2025 -0700 perf intel-tpebs: Avoid race when evlist is being deleted Reading through the evsel->evlist may seg fault if a sample arrives when the evlist is being deleted. Detect this case and ignore samples arriving when the evlist is being deleted. Fixes: bcfab08db7fb38bf ("perf intel-tpebs: Filter non-workload samples") Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alex Gaynor Cc: Alice Ryhl Cc: Andi Kleen Cc: Andreas Hindborg Cc: Benno Lossin Cc: Björn Roy Baron Cc: Boqun Feng Cc: Danilo Krummrich Cc: Dmitriy Vyukov Cc: Gary Guo Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiapeng Chong Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Miguel Ojeda Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephen Brennan Cc: Trevor Gross Cc: Weilin Wang Link: https://lore.kernel.org/r/20250528032637.198960-5-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 07f2b1287c970e0706c0e8fbb358ca4c1e7f8d4e Author: Ian Rogers Date: Tue May 27 20:26:32 2025 -0700 perf test demangle-java: Don't segv if demangling fails The buffer returned by dso__demangle_sym() may be NULL, don't segv in strcmp if this happens. Currently this happens for NO_LIBELF=1 builds. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alex Gaynor Cc: Alexander Shishkin Cc: Alice Ryhl Cc: Andi Kleen Cc: Andreas Hindborg Cc: Benno Lossin Cc: Björn Roy Baron Cc: Boqun Feng Cc: Danilo Krummrich Cc: Dmitriy Vyukov Cc: Gary Guo Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiapeng Chong Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Miguel Ojeda Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephen Brennan Cc: Trevor Gross Cc: Weilin Wang Link: https://lore.kernel.org/r/20250528032637.198960-3-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit fef8f648bb47726d96a5701fe31ed606268da73d Author: Ian Rogers Date: Tue May 27 20:26:31 2025 -0700 perf symbol: Fix use-after-free in filename__read_build_id The same buf is used for the program headers and reading notes. As the notes memory may be reallocated then this corrupts the memory pointed to by the phdr. Using the same buffer is in any case a logic error. Rather than deal with the duplicated code, introduce an elf32 boolean and a union for either the elf32 or elf64 headers that are in use. Let the program headers have their own memory and grow the buffer for notes as necessary. Before `perf list -j` compiled with asan would crash with: ``` ==4176189==ERROR: AddressSanitizer: heap-use-after-free on address 0x5160000070b8 at pc 0x555d3b15075b bp 0x7ffebb5a8090 sp 0x7ffebb5a8088 READ of size 8 at 0x5160000070b8 thread T0 #0 0x555d3b15075a in filename__read_build_id tools/perf/util/symbol-minimal.c:212:25 #1 0x555d3ae43aff in filename__sprintf_build_id tools/perf/util/build-id.c:110:8 ... 0x5160000070b8 is located 312 bytes inside of 560-byte region [0x516000006f80,0x5160000071b0) freed by thread T0 here: #0 0x555d3ab21840 in realloc (perf+0x264840) (BuildId: 12dff2f6629f738e5012abdf0e90055518e70b5e) #1 0x555d3b1506e7 in filename__read_build_id tools/perf/util/symbol-minimal.c:206:11 ... previously allocated by thread T0 here: #0 0x555d3ab21423 in malloc (perf+0x264423) (BuildId: 12dff2f6629f738e5012abdf0e90055518e70b5e) #1 0x555d3b1503a2 in filename__read_build_id tools/perf/util/symbol-minimal.c:182:9 ... ``` Note: this bug is long standing and not introduced by the other asan fix in commit fa9c4977fbfb ("perf symbol-minimal: Fix double free in filename__read_build_id"). Fixes: b691f64360ecec49 ("perf symbols: Implement poor man's ELF parser") Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250528032637.198960-2-irogers@google.com Cc: Mark Rutland Cc: Gary Guo Cc: Alex Gaynor Cc: Boqun Feng Cc: Howard Chu Cc: Alice Ryhl Cc: Dmitry Vyukov Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Weilin Wang Cc: Andreas Hindborg Cc: Arnaldo Carvalho de Melo Cc: Danilo Krummrich Cc: Jiri Olsa Cc: Namhyung Kim Cc: Miguel Ojeda Cc: James Clark Cc: Jiapeng Chong Cc: Andi Kleen Cc: Alexander Shishkin Cc: Kan Liang Cc: Stephen Brennan Cc: Benno Lossin Cc: Björn Roy Baron Cc: Ingo Molnar Cc: Trevor Gross Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 2a2a7f5e7deffa363b438308812989ded126a48a Author: Ian Rogers Date: Tue May 27 14:50:35 2025 -0700 perf pmu: Avoid segv for missing name/alias_name in wildcarding The pmu name or alias_name fields may be NULL and should be skipped if so. This is done in all loops of perf_pmu___name_match except the final wildcard loop which was an oversight. Fixes: 63e287131cf0c59b ("perf pmu: Rename name matching for no suffix or wildcard variants") Signed-off-by: Ian Rogers Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250527215035.187992-1-irogers@google.com [ Fixup the Fixes: tag to the right commit ] Signed-off-by: Arnaldo Carvalho de Melo commit 4c04654455c09b4905b84c350d88f718260a4cd4 Author: Ian Rogers Date: Wed Mar 12 22:29:51 2025 -0700 perf machine: Factor creating a "live" machine out of dwarf-unwind Factor out for use in places other than the dwarf unwinding tests for libunwind. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Anne Macedo Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Michael Petlan Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Yicong Yang Link: https://lore.kernel.org/r/20250313052952.871958-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 05e6d2ff6b6f9cc1d8dd06ee5d2b6623636b6571 Author: Luca Weiss Date: Wed May 7 10:01:37 2025 +0200 ASoC: dt-bindings: qcom,sm8250: Add Fairphone 5 sound card Document the bindings for the sound card on Fairphone 5 which uses the older non-audioreach audio architecture. Acked-by: Rob Herring (Arm) Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250507-fp5-dp-sound-v4-1-4098e918a29e@fairphone.com Signed-off-by: Rob Herring (Arm) commit bd428b8c79ed8e8658570e70c62c0092500e2eac Author: David Hildenbrand Date: Fri May 16 14:39:45 2025 +0200 s390/uv: Always return 0 from s390_wiggle_split_folio() if successful Let's consistently return 0 if the operation was successful, and just detect ourselves whether splitting is required -- folio_test_large() is a cheap operation. Update the documentation. Should we simply always return -EAGAIN instead of 0, so we don't have to handle it in the caller? Not sure, staring at the documentation, this way looks a bit cleaner. Signed-off-by: David Hildenbrand Link: https://lore.kernel.org/r/20250516123946.1648026-3-david@redhat.com Message-ID: <20250516123946.1648026-3-david@redhat.com> Reviewed-by: Claudio Imbrenda Signed-off-by: Claudio Imbrenda commit 3ec8a8330a1aa846dffbf1d64479213366c55b54 Author: David Hildenbrand Date: Fri May 16 14:39:44 2025 +0200 s390/uv: Don't return 0 from make_hva_secure() if the operation was not successful If s390_wiggle_split_folio() returns 0 because splitting a large folio succeeded, we will return 0 from make_hva_secure() even though a retry is required. Return -EAGAIN in that case. Otherwise, we'll return 0 from gmap_make_secure(), and consequently from unpack_one(). In kvm_s390_pv_unpack(), we assume that unpacking succeeded and skip unpacking this page. Later on, we run into issues and fail booting the VM. So far, this issue was only observed with follow-up patches where we split large pagecache XFS folios. Maybe it can also be triggered with shmem? We'll cleanup s390_wiggle_split_folio() a bit next, to also return 0 if no split was required. Fixes: d8dfda5af0be ("KVM: s390: pv: fix race when making a page secure") Cc: stable@vger.kernel.org Signed-off-by: David Hildenbrand Link: https://lore.kernel.org/r/20250516123946.1648026-2-david@redhat.com Message-ID: <20250516123946.1648026-2-david@redhat.com> Reviewed-by: Claudio Imbrenda Signed-off-by: Claudio Imbrenda commit bc4005ef43104da589951dba69291360c6a11ae7 Author: Bram Vlerick Date: Wed May 28 10:25:48 2025 +0200 ASoC: tas571x: fix tas5733 num_controls Commit e3de7984e451 ("ASoC: tas571x: add separate tas5733 controls") introduces a separate struct for the tas5733 controls but did not update the num_controls with the correct ARRAY_SIZE. Fixes: e3de7984e451 ("ASoC: tas571x: add separate tas5733 controls") Signed-off-by: Bram Vlerick Acked-by: Peter Korsgaard Link: https://patch.msgid.link/20250528-tas5733-fix-controls-size-v1-1-5c70595accaf@openpixelsystems.org Signed-off-by: Mark Brown commit 8e86e73626527e5a69bf5263d6bbe9c2a86b4319 Merge: 4e02d4f9734fa5 4dbe28c0fabd69 Author: Paolo Bonzini Date: Tue May 27 12:17:06 2025 -0400 Merge branch 'kvm-lockdep-common' into HEAD Introduce new mutex locking functions mutex_trylock_nest_lock() and mutex_lock_killable_nest_lock() and use them to clean up locking of all vCPUs for a VM. For x86, this removes some complex code that was used instead of lockdep's "nest_lock" feature. For ARM and RISC-V, this removes a lockdep warning when the VM is configured to have more than MAX_LOCK_DEPTH vCPUs, and removes a fair amount of duplicate code by sharing the logic across all architectures. Signed-off-by: Paolo BOnzini commit 4dbe28c0fabd69842890ba38f185b96664cba26a Author: Paolo Bonzini Date: Wed May 28 10:34:30 2025 +0200 rust: add helper for mutex_trylock After commit c5b6ababd21a ("locking/mutex: implement mutex_trylock_nested", currently in the KVM tree) mutex_trylock() will be a macro when lockdep is enabled. Rust therefore needs the corresponding helper. Just add it and the rust/bindings/bindings_helpers_generated.rs Makefile rules will do their thing. Reported-by: Stephen Rothwell Signed-off-by: Paolo Bonzini Message-ID: <20250528083431.1875345-1-pbonzini@redhat.com> Acked-by: Miguel Ojeda Reviewed-by: Alice Ryhl Signed-off-by: Paolo Bonzini commit 4557cc834712eca4eae7adbd9f0a06bdd8f79c99 Author: Karol Wachowski Date: Thu May 15 11:41:24 2025 +0200 accel/ivpu: Reorder Doorbell Unregister and Command Queue Destruction Refactor ivpu_cmdq_unregister() to ensure the doorbell is unregistered before destroying the command queue. The NPU firmware requires doorbells to be unregistered prior to command queue destruction. If doorbell remains registered when command queue destroy command is sent firmware will automatically unregister the doorbell, making subsequent unregister attempts no-operations (NOPs). Ensure compliance with firmware expectations by moving the doorbell unregister call ahead of the command queue destruction logic, thus preventing unnecessary NOP operation. Fixes: 465a3914b254 ("accel/ivpu: Add API for command queue create/destroy/submit") Signed-off-by: Karol Wachowski Reviewed-by: Jeff Hugo Signed-off-by: Jacek Lawrynowicz Link: https://lore.kernel.org/r/20250515094124.255141-1-jacek.lawrynowicz@linux.intel.com commit 1c2c0e29f24360b3130c005a3c261cb8c7b363c6 Author: Jacek Lawrynowicz Date: Tue May 6 11:20:30 2025 +0200 accel/ivpu: Use firmware names from upstream repo Use FW names from linux-firmware repo instead of deprecated ones. The vpu_37xx.bin style names were never released and were only used for internal testing, so it is safe to remove them. Fixes: c140244f0cfb ("accel/ivpu: Add initial Panther Lake support") Cc: stable@vger.kernel.org # v6.13+ Reviewed-by: Lizhi Hou Reviewed-by: Jeff Hugo Signed-off-by: Jacek Lawrynowicz Link: https://lore.kernel.org/r/20250506092030.280276-1-jacek.lawrynowicz@linux.intel.com commit a01e93ee44f7ed76f872d0ede82f8d31bf0a048a Author: Jacek Lawrynowicz Date: Tue May 6 11:13:03 2025 +0200 accel/ivpu: Improve buffer object logging - Fix missing alloc log when drm_gem_handle_create() fails in drm_vma_node_allow() and open callback is not called - Add ivpu_bo->ctx_id that enables to log the actual context id instead of using 0 as default - Add couple WARNs and errors so we can catch more memory corruption issues Fixes: 37dee2a2f433 ("accel/ivpu: Improve buffer object debug logs") Cc: stable@vger.kernel.org # v6.8+ Reviewed-by: Jeff Hugo Reviewed-by: Lizhi Hou Signed-off-by: Jacek Lawrynowicz Link: https://lore.kernel.org/r/20250506091303.262034-1-jacek.lawrynowicz@linux.intel.com commit f6bd8faeb113c8ab783466bc5bc1a5442ae85176 Merge: acea6b132d813a 57a92d14659df3 Author: Paolo Abeni Date: Wed May 28 10:03:53 2025 +0200 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Merge in late fixes to prepare for the 6.16 net-next PR. No conflicts nor adjacent changes. Signed-off-by: Paolo Abeni commit acea6b132d813a12ac414f6b1efb05921623afc0 Author: Saket Kumar Bhaskar Date: Tue May 27 11:11:38 2025 +0530 selftests/bpf: Fix bpf selftest build warning On linux-next, build for bpf selftest displays a warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/if_xdp.h' differs from latest version at 'include/uapi/linux/if_xdp.h'. Commit 8066e388be48 ("net: add UAPI to the header guard in various network headers") changed the header guard from _LINUX_IF_XDP_H to _UAPI_LINUX_IF_XDP_H in include/uapi/linux/if_xdp.h. To resolve the warning, update tools/include/uapi/linux/if_xdp.h to align with the changes in include/uapi/linux/if_xdp.h Fixes: 8066e388be48 ("net: add UAPI to the header guard in various network headers") Reported-by: Venkat Rao Bagalkote Closes: https://lore.kernel.org/all/c2bc466d-dff2-4d0d-a797-9af7f676c065@linux.ibm.com/ Tested-by: Venkat Rao Bagalkote Signed-off-by: Saket Kumar Bhaskar Acked-by: Daniel Borkmann Link: https://patch.msgid.link/20250527054138.1086006-1-skb99@linux.ibm.com Signed-off-by: Paolo Abeni commit 6da5f1b4b4a06ebd3af1510ebd3ecf60a5037936 Author: Phil Sutter Date: Tue May 27 11:41:17 2025 +0200 selftests: netfilter: Fix skip of wildcard interface test The script is supposed to skip wildcard interface testing if unsupported by the host's nft tool. The failing check caused script abort due to 'set -e' though. Fix this by running the potentially failing nft command inside the if-conditional pipe. Fixes: 73db1b5dab6f ("selftests: netfilter: Torture nftables netdev hooks") Signed-off-by: Phil Sutter Acked-by: Pablo Neira Ayuso Link: https://patch.msgid.link/20250527094117.18589-1-phil@nwl.cc Signed-off-by: Paolo Abeni commit 34ecde3c56066ba79e5ec3d93c5b14ea83e3603e Author: Jens Axboe Date: Tue May 27 17:01:31 2025 -0600 iomap: don't lose folio dropbehind state for overwrites DONTCACHE I/O must have the completion punted to a workqueue, just like what is done for unwritten extents, as the completion needs task context to perform the invalidation of the folio(s). However, if writeback is started off filemap_fdatawrite_range() off generic_sync() and it's an overwrite, then the DONTCACHE marking gets lost as iomap_add_to_ioend() don't look at the folio being added and no further state is passed down to help it know that this is a dropbehind/DONTCACHE write. Check if the folio being added is marked as dropbehind, and set IOMAP_IOEND_DONTCACHE if that is the case. Then XFS can factor this into the decision making of completion context in xfs_submit_ioend(). Additionally include this ioend flag in the NOMERGE flags, to avoid mixing it with unrelated IO. Since this is the 3rd flag that will cause XFS to punt the completion to a workqueue, add a helper so that each one of them can get appropriately commented. This fixes extra page cache being instantiated when the write performed is an overwrite, rather than newly instantiated blocks. Fixes: b2cd5ae693a3 ("iomap: make buffered writes work with RWF_DONTCACHE") Signed-off-by: Jens Axboe Link: https://lore.kernel.org/5153f6e8-274d-4546-bf55-30a5018e0d03@kernel.dk Reviewed-by: Dave Chinner Signed-off-by: Christian Brauner commit 206cc44588f72b49ad4d7e21a7472ab2a72a83df Author: Sami Uddin Date: Mon May 12 07:51:53 2025 +0930 virtio: reject shm region if length is zero Prevent usage of shared memory regions where the length is zero, as such configurations are not valid and may lead to unexpected behavior. Signed-off-by: Sami Uddin Message-Id: <20250511222153.2332-1-sami.md.ko@gmail.com> Signed-off-by: Michael S. Tsirkin commit 57a92d14659df3e7e7e0052358c8cc68bbbc3b5e Author: Horatiu Vultur Date: Fri May 23 10:27:16 2025 +0200 net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames We have noticed that when PHY timestamping is enabled, L2 frames seems to be modified by changing two 2 bytes with a value of 0. The place were these 2 bytes seems to be random(or I couldn't find a pattern). In most of the cases the userspace can ignore these frames but if for example those 2 bytes are in the correction field there is nothing to do. This seems to happen when configuring the HW for IPv4 even that the flow is not enabled. These 2 bytes correspond to the UDPv4 checksum and once we don't enable clearing the checksum when using L2 frames then the frame doesn't seem to be changed anymore. Fixes: 7d272e63e0979d ("net: phy: mscc: timestamping and PHC support") Signed-off-by: Horatiu Vultur Link: https://patch.msgid.link/20250523082716.2935895-1-horatiu.vultur@microchip.com Signed-off-by: Paolo Abeni commit 0bdc924bfb319fb10d1113cbf091fc26fb7b1f99 Author: Faicker Mo Date: Fri May 23 03:41:43 2025 +0000 net: openvswitch: Fix the dead loop of MPLS parse The unexpected MPLS packet may not end with the bottom label stack. When there are many stacks, The label count value has wrapped around. A dead loop occurs, soft lockup/CPU stuck finally. stack backtrace: UBSAN: array-index-out-of-bounds in /build/linux-0Pa0xK/linux-5.15.0/net/openvswitch/flow.c:662:26 index -1 is out of range for type '__be32 [3]' CPU: 34 PID: 0 Comm: swapper/34 Kdump: loaded Tainted: G OE 5.15.0-121-generic #131-Ubuntu Hardware name: Dell Inc. PowerEdge C6420/0JP9TF, BIOS 2.12.2 07/14/2021 Call Trace: show_stack+0x52/0x5c dump_stack_lvl+0x4a/0x63 dump_stack+0x10/0x16 ubsan_epilogue+0x9/0x36 __ubsan_handle_out_of_bounds.cold+0x44/0x49 key_extract_l3l4+0x82a/0x840 [openvswitch] ? kfree_skbmem+0x52/0xa0 key_extract+0x9c/0x2b0 [openvswitch] ovs_flow_key_extract+0x124/0x350 [openvswitch] ovs_vport_receive+0x61/0xd0 [openvswitch] ? kernel_init_free_pages.part.0+0x4a/0x70 ? get_page_from_freelist+0x353/0x540 netdev_port_receive+0xc4/0x180 [openvswitch] ? netdev_port_receive+0x180/0x180 [openvswitch] netdev_frame_hook+0x1f/0x40 [openvswitch] __netif_receive_skb_core.constprop.0+0x23a/0xf00 __netif_receive_skb_list_core+0xfa/0x240 netif_receive_skb_list_internal+0x18e/0x2a0 napi_complete_done+0x7a/0x1c0 bnxt_poll+0x155/0x1c0 [bnxt_en] __napi_poll+0x30/0x180 net_rx_action+0x126/0x280 ? bnxt_msix+0x67/0x80 [bnxt_en] handle_softirqs+0xda/0x2d0 irq_exit_rcu+0x96/0xc0 common_interrupt+0x8e/0xa0 Fixes: fbdcdd78da7c ("Change in Openvswitch to support MPLS label depth of 3 in ingress direction") Signed-off-by: Faicker Mo Acked-by: Ilya Maximets Reviewed-by: Aaron Conole Link: https://patch.msgid.link/259D3404-575D-4A6D-B263-1DF59A67CF89@zenlayer.com Signed-off-by: Paolo Abeni commit 6e9f2df1c550ead7cecb3e450af1105735020c92 Author: Kuniyuki Iwashima Date: Thu May 22 15:18:56 2025 -0700 calipso: Don't call calipso functions for AF_INET sk. syzkaller reported a null-ptr-deref in txopt_get(). [0] The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6_pinfo was NULL there. However, this never happens for IPv6 sockets as inet_sk(sk)->pinet6 is always set in inet6_create(), meaning the socket was not IPv6 one. The root cause is missing validation in netlbl_conn_setattr(). netlbl_conn_setattr() switches branches based on struct sockaddr.sa_family, which is passed from userspace. However, netlbl_conn_setattr() does not check if the address family matches the socket. The syzkaller must have called connect() for an IPv6 address on an IPv4 socket. We have a proper validation in tcp_v[46]_connect(), but security_socket_connect() is called in the earlier stage. Let's copy the validation to netlbl_conn_setattr(). [0]: Oops: general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] CPU: 2 UID: 0 PID: 12928 Comm: syz.9.1677 Not tainted 6.12.0 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:txopt_get include/net/ipv6.h:390 [inline] RIP: 0010: Code: 02 00 00 49 8b ac 24 f8 02 00 00 e8 84 69 2a fd e8 ff 00 16 fd 48 8d 7d 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 53 02 00 00 48 8b 6d 70 48 85 ed 0f 84 ab 01 00 RSP: 0018:ffff88811b8afc48 EFLAGS: 00010212 RAX: dffffc0000000000 RBX: 1ffff11023715f8a RCX: ffffffff841ab00c RDX: 000000000000000e RSI: ffffc90007d9e000 RDI: 0000000000000070 RBP: 0000000000000000 R08: ffffed1023715f9d R09: ffffed1023715f9e R10: ffffed1023715f9d R11: 0000000000000003 R12: ffff888123075f00 R13: ffff88810245bd80 R14: ffff888113646780 R15: ffff888100578a80 FS: 00007f9019bd7640(0000) GS:ffff8882d2d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f901b927bac CR3: 0000000104788003 CR4: 0000000000770ef0 PKRU: 80000000 Call Trace: calipso_sock_setattr+0x56/0x80 net/netlabel/netlabel_calipso.c:557 netlbl_conn_setattr+0x10c/0x280 net/netlabel/netlabel_kapi.c:1177 selinux_netlbl_socket_connect_helper+0xd3/0x1b0 security/selinux/netlabel.c:569 selinux_netlbl_socket_connect_locked security/selinux/netlabel.c:597 [inline] selinux_netlbl_socket_connect+0xb6/0x100 security/selinux/netlabel.c:615 selinux_socket_connect+0x5f/0x80 security/selinux/hooks.c:4931 security_socket_connect+0x50/0xa0 security/security.c:4598 __sys_connect_file+0xa4/0x190 net/socket.c:2067 __sys_connect+0x12c/0x170 net/socket.c:2088 __do_sys_connect net/socket.c:2098 [inline] __se_sys_connect net/socket.c:2095 [inline] __x64_sys_connect+0x73/0xb0 net/socket.c:2095 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xaa/0x1b0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f901b61a12d Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f9019bd6fa8 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 00007f901b925fa0 RCX: 00007f901b61a12d RDX: 000000000000001c RSI: 0000200000000140 RDI: 0000000000000003 RBP: 00007f901b701505 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f901b5b62a0 R15: 00007f9019bb7000 Modules linked in: Fixes: ceba1832b1b2 ("calipso: Set the calipso socket label to match the secattr.") Reported-by: syzkaller Reported-by: John Cheung Closes: https://lore.kernel.org/netdev/CAP=Rh=M1LzunrcQB1fSGauMrJrhL6GGps5cPAKzHJXj6GQV+-g@mail.gmail.com/ Signed-off-by: Kuniyuki Iwashima Acked-by: Paul Moore Link: https://patch.msgid.link/20250522221858.91240-1-kuniyu@amazon.com Signed-off-by: Paolo Abeni commit fc6895345fe682e68bc594a186cbf90d35b3bf7c Merge: 67af4ec948e8ce 2945ff733dee95 Author: Paolo Abeni Date: Wed May 28 08:55:37 2025 +0200 Merge branch 'net_sched-hfsc-address-reentrant-enqueue-adding-class-to-eltree-twice' Pedro Tammela says: ==================== net_sched: hfsc: Address reentrant enqueue adding class to eltree twice Savino says: "We are writing to report that this recent patch (141d34391abbb315d68556b7c67ad97885407547) can be bypassed, and a UAF can still occur when HFSC is utilized with NETEM. The patch only checks the cl->cl_nactive field to determine whether it is the first insertion or not, but this field is only incremented by init_vf. By using HFSC_RSC (which uses init_ed), it is possible to bypass the check and insert the class twice in the eltree. Under normal conditions, this would lead to an infinite loop in hfsc_dequeue for the reasons we already explained in this report. However, if TBF is added as root qdisc and it is configured with a very low rate, it can be utilized to prevent packets from being dequeued. This behavior can be exploited to perform subsequent insertions in the HFSC eltree and cause a UAF." To fix both the UAF and the infinite loop, with netem as an hfsc child, check explicitly in hfsc_enqueue whether the class is already in the eltree whenever the HFSC_RSC flag is set. Also add a TDC test to reproduce the UAF scenario. ==================== Link: https://patch.msgid.link/20250522181448.1439717-1-pctammela@mojatatu.com Signed-off-by: Paolo Abeni commit 2945ff733dee951ed64d0f13cba22348bfc1f438 Author: Pedro Tammela Date: Thu May 22 15:14:48 2025 -0300 selftests/tc-testing: Add a test for HFSC eltree double add with reentrant enqueue behaviour on netem Reproduce the UAF scenario where netem is a child of HFSC and HFSC is configured to use the eltree. In such case, this TDC test would cause the HFSC class to be added to the eltree twice resulting in a UAF. Reviewed-by: Victor Nogueira Signed-off-by: Pedro Tammela Link: https://patch.msgid.link/20250522181448.1439717-3-pctammela@mojatatu.com Signed-off-by: Paolo Abeni commit ac9fe7dd8e730a103ae4481147395cc73492d786 Author: Pedro Tammela Date: Thu May 22 15:14:47 2025 -0300 net_sched: hfsc: Address reentrant enqueue adding class to eltree twice Savino says: "We are writing to report that this recent patch (141d34391abbb315d68556b7c67ad97885407547) [1] can be bypassed, and a UAF can still occur when HFSC is utilized with NETEM. The patch only checks the cl->cl_nactive field to determine whether it is the first insertion or not [2], but this field is only incremented by init_vf [3]. By using HFSC_RSC (which uses init_ed) [4], it is possible to bypass the check and insert the class twice in the eltree. Under normal conditions, this would lead to an infinite loop in hfsc_dequeue for the reasons we already explained in this report [5]. However, if TBF is added as root qdisc and it is configured with a very low rate, it can be utilized to prevent packets from being dequeued. This behavior can be exploited to perform subsequent insertions in the HFSC eltree and cause a UAF." To fix both the UAF and the infinite loop, with netem as an hfsc child, check explicitly in hfsc_enqueue whether the class is already in the eltree whenever the HFSC_RSC flag is set. [1] https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=141d34391abbb315d68556b7c67ad97885407547 [2] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1572 [3] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L677 [4] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1574 [5] https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/T/#u Fixes: 37d9cf1a3ce3 ("sched: Fix detection of empty queues in child qdiscs") Reported-by: Savino Dicanosa Reported-by: William Liu Acked-by: Jamal Hadi Salim Tested-by: Victor Nogueira Signed-off-by: Pedro Tammela Link: https://patch.msgid.link/20250522181448.1439717-2-pctammela@mojatatu.com Signed-off-by: Paolo Abeni commit 67af4ec948e8ce3ea53a9cf614d01fddf172e56d Author: Hariprasad Kelam Date: Thu May 22 17:28:42 2025 +0530 octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback This patch addresses below issues, 1. Active traffic on the leaf node must be stopped before its send queue is reassigned to the parent. This patch resolves the issue by marking the node as 'Inner'. 2. During a system reboot, the interface receives TC_HTB_LEAF_DEL and TC_HTB_LEAF_DEL_LAST callbacks to delete its HTB queues. In the case of TC_HTB_LEAF_DEL_LAST, although the same send queue is reassigned to the parent, the current logic still attempts to update the real number of queues, leadning to below warnings New queues can't be registered after device unregistration. WARNING: CPU: 0 PID: 6475 at net/core/net-sysfs.c:1714 netdev_queue_update_kobjects+0x1e4/0x200 Fixes: 5e6808b4c68d ("octeontx2-pf: Add support for HTB offload") Signed-off-by: Hariprasad Kelam Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250522115842.1499666-1-hkelam@marvell.com Signed-off-by: Paolo Abeni commit 479c58016099d19686e36f6c50f912360839a7fa Author: Hariprasad Kelam Date: Thu May 22 15:17:41 2025 +0530 octeontx2-pf: QOS: Perform cache sync on send queue teardown QOS is designed to create a new send queue whenever a class is created, ensuring proper shaping and scheduling. However, when multiple send queues are created and deleted in a loop, SMMU errors are observed. This patch addresses the issue by performing an data cache sync during the teardown of QOS send queues. Fixes: ab6dddd2a669 ("octeontx2-pf: qos send queues management") Signed-off-by: Hariprasad Kelam Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250522094742.1498295-1-hkelam@marvell.com Signed-off-by: Paolo Abeni commit 290e5d3c49f687c1567bde634dc33d57b0674919 Author: Haiyang Zhang Date: Mon May 19 09:20:36 2025 -0700 net: mana: Add support for Multi Vports on Bare metal To support Multi Vports on Bare metal, increase the device config response version. And, skip the register HW vport, and register filter steps, when the Bare metal hostmode is set. Signed-off-by: Haiyang Zhang Link: https://patch.msgid.link/1747671636-5810-1-git-send-email-haiyangz@microsoft.com Signed-off-by: Paolo Abeni commit feacb1774bd5eac6382990d0f6d1378dc01dd78f Merge: 3b66e6b3c09864 273cc949655c70 Author: Linus Torvalds Date: Tue May 27 21:12:50 2025 -0700 Merge tag 'sched_ext-for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext updates from Tejun Heo: - More in-kernel idle CPU selection improvements. Expand topology awareness coverage add scx_bpf_select_cpu_and() to allow more flexibility. The idle CPU selection kfuncs can now be called from unlocked contexts too. - A bunch of reorganization changes to lay the foundation for multiple hierarchical scheduler support. This isn't ready yet and the included changes don't make meaningful behavior differences. One notable change is replacing some static_key tests with dynamic tests as the test results may differ depending on the scheduler instance. This isn't expected to cause meaningful performance difference. - Other minor and doc updates. - There were multiple patches in for-6.15-fixes which conflicted with changes in for-6.16. for-6.15-fixes were pulled three times into for-6.16 to resolve the conflicts. * tag 'sched_ext-for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: (49 commits) sched_ext: Call ops.update_idle() after updating builtin idle bits sched_ext, docs: convert mentions of "CFS" to "fair-class scheduler" selftests/sched_ext: Update test enq_select_cpu_fails sched_ext: idle: Consolidate default idle CPU selection kfuncs selftests/sched_ext: Add test for scx_bpf_select_cpu_and() via test_run sched_ext: idle: Allow scx_bpf_select_cpu_and() from unlocked context sched_ext: idle: Validate locking correctness in scx_bpf_select_cpu_and() sched_ext: Make scx_kf_allowed_if_unlocked() available outside ext.c sched_ext, docs: add label sched_ext: Explain the temporary situation around scx_root dereferences sched_ext: Add @sch to SCX_CALL_OP*() sched_ext: Cleanup [__]scx_exit/error*() sched_ext: Add @sch to SCX_CALL_OP*() sched_ext: Clean up scx_root usages Documentation: scheduler: Changed lowercase acronyms to uppercase sched_ext: Avoid NULL scx_root deref in __scx_exit() sched_ext: Add RCU protection to scx_root in DSQ iterator sched_ext: Clean up SCX_EXIT_NONE handling in scx_disable_workfn() sched_ext: Move disable machinery into scx_sched sched_ext: Move event_stats_cpu into scx_sched ... commit 3b66e6b3c098646f75c54e269dd963e2281c555c Merge: 91ad250cbe5785 82648b8b2ae0a0 Author: Linus Torvalds Date: Tue May 27 20:59:53 2025 -0700 Merge tag 'cgroup-for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup updates from Tejun Heo: - cgroup rstat shared the tracking tree across all controllers with the rationale being that a cgroup which is using one resource is likely to be using other resources at the same time (ie. if something is allocating memory, it's probably consuming CPU cycles). However, this turned out to not scale very well especially with memcg using rstat for internal operations which made memcg stat read and flush patterns substantially different from other controllers. JP Kobryn split the rstat tree per controller. - cgroup BPF support was hooking into cgroup init/exit paths directly. Convert them to use a notifier chain instead so that other usages can be added easily. The two of the patches which implement this are mislabeled as belonging to sched_ext instead of cgroup. Sorry. - Relatively minor cpuset updates - Documentation updates * tag 'cgroup-for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: (23 commits) sched_ext: Convert cgroup BPF support to use cgroup_lifetime_notifier sched_ext: Introduce cgroup_lifetime_notifier cgroup: Minor reorganization of cgroup_create() cgroup, docs: cpu controller's interaction with various scheduling policies cgroup, docs: convert space indentation to tab indentation cgroup: avoid per-cpu allocation of size zero rstat cpu locks cgroup, docs: be specific about bandwidth control of rt processes cgroup: document the rstat per-cpu initialization cgroup: helper for checking rstat participation of css cgroup: use subsystem-specific rstat locks to avoid contention cgroup: use separate rstat trees for each subsystem cgroup: compare css to cgroup::self in helper for distingushing css cgroup: warn on rstat usage by early init subsystems cgroup/cpuset: drop useless cpumask_empty() in compute_effective_exclusive_cpumask() cgroup/rstat: Improve cgroup_rstat_push_children() documentation cgroup: fix goto ordering in cgroup_init() cgroup: fix pointer check in css_rstat_init() cgroup/cpuset: Add warnings to catch inconsistency in exclusive CPUs cgroup/cpuset: Fix obsolete comment in cpuset_css_offline() cgroup/cpuset: Always use cpu_active_mask ... commit 91ad250cbe57855362c99642a454294e8d314c7d Merge: f1975e4765e5df 23227e71b69af9 Author: Linus Torvalds Date: Tue May 27 20:49:06 2025 -0700 Merge tag 'wq-for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue updates from Tejun Heo: "Fix statistic update race condition and a couple documentation updates" * tag 'wq-for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: fix typo in comment workqueue: Fix race condition in wq->stats incrementation workqueue: Better document teardown for delayed_work commit f1975e4765e5df2b91d400d4ac25c9243a25e92a Merge: c35328632ed89e 23b8bacf154759 Author: Linus Torvalds Date: Tue May 27 20:43:35 2025 -0700 Merge tag 'sysctl-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl Pull sysctl updates from Joel Granados: - Move kern_table members out of kernel/sysctl.c Moved a subset (tracing, panic, signal, stack_tracer and sparc) out of the kern_table array. The goal is for kern_table to only have sysctl elements. All this increases modularity by placing the ctl_tables closer to where they are used while reducing the chances of merge conflicts in kernel/sysctl.c. - Fixed sysctl unit test panic by relocating it to selftests * tag 'sysctl-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl: sysctl: Close test ctl_headers with a for loop sysctl: call sysctl tests with a for loop sysctl: Add 0012 to test the u8 range check sysctl: move u8 register test to lib/test_sysctl.c sparc: mv sparc sysctls into their own file under arch/sparc/kernel stack_tracer: move sysctl registration to kernel/trace/trace_stack.c tracing: Move trace sysctls into trace.c signal: Move signal ctl tables into signal.c panic: Move panic ctl tables into panic.c commit c35328632ed89efeb616603e7fa151ac730fafe4 Merge: 5cf5240991bcea f440518f379d22 Author: Linus Torvalds Date: Tue May 27 20:40:36 2025 -0700 Merge tag 'm68k-for-v6.16-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k updates from Geert Uytterhoeven: - One more strscpy() conversion - Fix detection of real Mac II - defconfig updates * tag 'm68k-for-v6.16-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k: defconfig: Update defconfigs for v6.15-rc1 m68k: mac: Fix macintosh_config for Mac II m68k: Replace strcpy() with strscpy() in hardware_proc_show() commit 5cf5240991bcea3c0f38e36e65e1742d6db7912c Merge: 23022f545610cc 7f9bbc1140ff87 Author: Linus Torvalds Date: Tue May 27 20:36:30 2025 -0700 Merge tag 'for-linus-6.16-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen updates from Juergen Gross: - A fix for running as a Xen dom0 on the iMX8QXP Arm platform - An update of the xen.config adding XEN_UNPOPULATED_ALLOC for better support of PVH dom0 - A fix of the Xen balloon driver when running without CONFIG_XEN_UNPOPULATED_ALLOC - A fix of the dm_op Xen hypercall on Arm needed to pass user space buffers to the hypervisor in certain configurations * tag 'for-linus-6.16-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/arm: call uaccess_ttbr0_enable for dm_op hypercall xen/x86: fix initial memory balloon target xen: enable XEN_UNPOPULATED_ALLOC as part of xen.config xen: swiotlb: Wire up map_resource callback commit c5cebb241e27ed0c3f4c1d2ce63089398e0ed17e Author: Alexei Starovoitov Date: Tue May 27 17:27:04 2025 -0700 bpf, arm64: Remove unused-but-set function and variable. Remove unused-but-set function and variable to fix the build warning: arch/arm64/net/bpf_jit_comp.c: In function 'arch_bpf_trampoline_size': 2547 | int nregs, ret; | ^~~~~ Fixes: 9014cf56f13d ("bpf, arm64: Support up to 12 function arguments") Reported-by: kernel test robot Signed-off-by: Alexei Starovoitov Signed-off-by: Andrii Nakryiko Acked-by: Xu Kuohai Link: https://lore.kernel.org/bpf/20250528002704.21197-1-alexei.starovoitov@gmail.com Closes: https://lore.kernel.org/oe-kbuild-all/202505280643.h0qYcSCM-lkp@intel.com/ commit 23022f545610cceacd765bcd6c19102fa11755e0 Merge: c89756bcf406af 3ee7d949634224 Author: Linus Torvalds Date: Tue May 27 20:09:06 2025 -0700 Merge tag 'dma-mapping-6.16-2025-05-26' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping updates from Marek Szyprowski: "New two step DMA mapping API, which is is a first step to a long path to provide alternatives to scatterlist and to remove hacks, abuses and design mistakes related to scatterlists. This new approach optimizes some calls to DMA-IOMMU layer and cache maintenance by batching them, reduces memory usage as it is no need to store mapped DMA addresses to unmap them, and reduces some function call overhead. It is a combination effort of many people, lead and developed by Christoph Hellwig and Leon Romanovsky" * tag 'dma-mapping-6.16-2025-05-26' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: docs: core-api: document the IOVA-based API dma-mapping: add a dma_need_unmap helper dma-mapping: Implement link/unlink ranges API iommu/dma: Factor out a iommu_dma_map_swiotlb helper dma-mapping: Provide an interface to allow allocate IOVA iommu: add kernel-doc for iommu_unmap_fast iommu: generalize the batched sync after map interface dma-mapping: move the PCI P2PDMA mapping helpers to pci-p2pdma.h PCI/P2PDMA: Refactor the p2pdma mapping helpers commit 375700bab5b150e876e42d894a9a7470881f8a61 Author: Jens Axboe Date: Fri May 23 13:13:11 2025 -0600 llist: make llist_add_batch() a static inline The function is small enough that it should be, and it's a (very) hot path for io_uring. Doing this actually reduces my vmlinux text size for my standard build/test box. Before: axboe@r7625 ~/g/linux (test)> size vmlinux text data bss dec hex filename 19892174 5938310 2470432 28300916 1afd674 vmlinux After: axboe@r7625 ~/g/linux (test)> size vmlinux text data bss dec hex filename 19891878 5938310 2470436 28300624 1afd550 vmlinux Link: https://lkml.kernel.org/r/f1d104c6-7ac8-457a-a53d-6bb741421b2f@kernel.dk Signed-off-by: Jens Axboe Signed-off-by: Andrew Morton commit 5ef2dccfcca8d864e2f4c5b1628a22b446bc009a Author: Wang Yaxin Date: Wed May 21 09:31:57 2025 +0800 delayacct: remove redundant code and adjust indentation Remove redundant code and adjust indentation of xxx_delay_max/min. Link: https://lkml.kernel.org/r/20250521093157668iQrhhcMjA-th5LQf4-A3c@zte.com.cn Signed-off-by: Wang Yaxin Signed-off-by: Jiang Kun Cc: Balbir Singh Cc: xu xin Cc: Yang Yang Signed-off-by: Andrew Morton commit 2e227ff5e2729b5f4e0771826e3f6b61dd6a1b6b Author: Chanho Min Date: Wed May 21 16:25:59 2025 +0900 squashfs: add optional full compressed block caching The commit 93e72b3c612adcaca1 ("squashfs: migrate from ll_rw_block usage to BIO") removed caching of compressed blocks in SquashFS, causing fio performance regression in workloads with repeated file reads. Without caching, every read triggers disk I/O, severely impacting performance in tools like fio. This patch introduces a new CONFIG_SQUASHFS_COMP_CACHE_FULL Kconfig option to enable caching of all compressed blocks, restoring performance to pre-BIO migration levels. When enabled, all pages in a BIO are cached in the page cache, reducing disk I/O for repeated reads. The fio test results with this patch confirm the performance restoration: For example, fio tests (iodepth=1, numjobs=1, ioengine=psync) show a notable performance restoration: Disable CONFIG_SQUASHFS_COMP_CACHE_FULL: IOPS=815, BW=102MiB/s (107MB/s)(6113MiB/60001msec) Enable CONFIG_SQUASHFS_COMP_CACHE_FULL: IOPS=2223, BW=278MiB/s (291MB/s)(16.3GiB/59999msec) The tradeoff is increased memory usage due to caching all compressed blocks. The CONFIG_SQUASHFS_COMP_CACHE_FULL option allows users to enable this feature selectively, balancing performance and memory usage for workloads with frequent repeated reads. Link: https://lkml.kernel.org/r/20250521072559.2389-1-chanho.min@lge.com Signed-off-by: Chanho Min Reviewed-by Phillip Lougher Signed-off-by: Andrew Morton commit 4496e1c1354bd4837bcc1414f6e1a4d042857903 Author: Arnd Bergmann Date: Wed May 21 18:03:19 2025 +0200 crash_dump, nvme: select CONFIGFS_FS as built-in Configfs can be configured as a loadable module, which causes a link-time failure for dm-crypt crash dump support: crash_dump_dm_crypt.c:(.text+0x3a4): undefined reference to `config_item_init_type_name' aarch64-linux-ld: kernel/crash_dump_dm_crypt.o: in function `configfs_dmcrypt_keys_init': crash_dump_dm_crypt.c:(.init.text+0x90): undefined reference to `config_group_init' aarch64-linux-ld: crash_dump_dm_crypt.c:(.init.text+0xb4): undefined reference to `configfs_register_subsystem' aarch64-linux-ld: crash_dump_dm_crypt.c:(.init.text+0xd8): undefined reference to `configfs_unregister_subsystem' This could be avoided with a dependency on CONFIGFS_FS=y, but the dependency has an additional problem of causing Kconfig dependency loops since most other uses select the symbol. Using a simple 'select CONFIGFS_FS' here in turn fails with CONFIG_DM_CRYPT=m, because that still only causes configfs to be a loadable module. The only version I found that fixes this reliably uses an additional Kconfig symbol to ensure the 'select' actually turns on configfs as builtin, with two additional changes to avoid dependency loops with nvme and sysfs. There is no compile-time dependency between configfs and sysfs, so selecting configfs from a driver with sysfs disabled does not cause link failures, only the default /sys/kernel/config mount point will not be created. Link: https://lkml.kernel.org/r/20250521160359.2132363-1-arnd@kernel.org Fixes: 6b23858fd63b ("crash_dump: make dm crypt keys persist for the kdump kernel") Fixes: 1fb470408497 ("nvme-loop: add configfs dependency") Signed-off-by: Arnd Bergmann Cc: Andreas Hindborg Cc: Breno Leitao Cc: Chaitanya Kulkarni Cc: Christoph Hellwig Cc: Coiby Xu Cc: Jens Axboe Cc: Sagi Grimberg Signed-off-by: Andrew Morton commit c544a952ba61b1a025455098033c17e0573ab085 Author: Nikhil Dhama Date: Mon Apr 7 16:22:19 2025 +0530 mm: pcp: increase pcp->free_count threshold to trigger free_high In old pcp design, pcp->free_factor gets incremented in nr_pcp_free() which is invoked by free_pcppages_bulk(). So, it used to increase free_factor by 1 only when we try to reduce the size of pcp list and free_high used to trigger only for order > 0 and order < costly_order and pcp->free_factor > 0. For iperf3 I noticed that with older design in kernel v6.6, pcp list was drained mostly when pcp->count > high (more often when count goes above 530). and most of the time pcp->free_factor was 0, triggering very few high order flushes. But this is changed in the current design, introduced in commit 6ccdcb6d3a74 ("mm, pcp: reduce detecting time of consecutive high order page freeing"), where pcp->free_factor is changed to pcp->free_count to keep track of the number of pages freed contiguously. In this design, pcp->free_count is incremented on every deallocation, irrespective of whether pcp list was reduced or not. And logic to trigger free_high is if pcp->free_count goes above batch (which is 63) and there are two contiguous page free without any allocation. With this design, for iperf3, pcp list is getting flushed more frequently because free_high heuristics is triggered more often now. I observed that high order pcp list is drained as soon as both count and free_count goes above 63. Due to this more aggressive high order flushing, applications doing contiguous high order allocation will require to go to global list more frequently. On a 2-node AMD machine with 384 vCPUs on each node, connected via Mellonox connectX-7, I am seeing a ~30% performance reduction if we scale number of iperf3 client/server pairs from 32 to 64. Though this new design reduced the time to detect high order flushes, but for application which are allocating high order pages more frequently it may be flushing the high order list pre-maturely. This motivates towards tuning on how late or early we should flush high order lists. So, in this patch, we increased the pcp->free_count threshold to trigger free_high from "batch" to "batch + pcp->high_min / 2" as suggested by Ying [1], In the original pcp->free_factor solution, free_high is triggered for contiguous freeing with size ranging from "batch" to "pcp->high + batch". So, the average value is "batch + pcp->high / 2". While in the pcp->free_count solution, free_high will be triggered for contiguous freeing with size "batch". So, to restore the original behavior, we can use the threshold "batch + pcp->high_min / 2" This new threshold keeps high order pages in pcp list for a longer duration which can help the application doing high order allocations frequently. With this patch performace to Iperf3 is restored and score for other benchmarks on the same machine are as follows: iperf3 lmbench3 netperf kbuild (AF_UNIX) (SCTP_STREAM_MANY) ------- --------- ----------------- ------ v6.6 vanilla (base) 100 100 100 100 v6.12 vanilla 69 113 98.5 98.8 v6.12 + this patch 100 110.3 100.2 99.3 netperf-tcp: 6.12 6.12 vanilla this_patch Hmean 64 732.14 ( 0.00%) 730.45 ( -0.23%) Hmean 128 1417.46 ( 0.00%) 1419.44 ( 0.14%) Hmean 256 2679.67 ( 0.00%) 2676.45 ( -0.12%) Hmean 1024 8328.52 ( 0.00%) 8339.34 ( 0.13%) Hmean 2048 12716.98 ( 0.00%) 12743.68 ( 0.21%) Hmean 3312 15787.79 ( 0.00%) 15887.25 ( 0.63%) Hmean 4096 17311.91 ( 0.00%) 17332.68 ( 0.12%) Hmean 8192 20310.73 ( 0.00%) 20465.09 ( 0.76%) Link: https://lore.kernel.org/all/875xjmuiup.fsf@DESKTOP-5N7EMDA/ [1] Link: https://lkml.kernel.org/r/20250407105219.55351-1-nikhil.dhama@amd.com Fixes: 6ccdcb6d3a74 ("mm, pcp: reduce detecting time of consecutive high order page freeing") Signed-off-by: Nikhil Dhama Suggested-by: Huang Ying Reviewed-by: Huang Ying Cc: Raghavendra K T Cc: Mel Gorman Cc: Bharata B Rao Signed-off-by: Andrew Morton commit 05275594a311cd7427a64b8bcc6097645c0344af Author: Fan Ni Date: Mon May 5 11:22:44 2025 -0700 mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() In __unmap_hugepage_range(), the "page" pointer always points to the first page of a huge page, which guarantees there is a folio associating with it. Convert the "page" pointer to use folio. Link: https://lkml.kernel.org/r/20250505182345.506888-6-nifan.cxl@gmail.com Signed-off-by: Fan Ni Reviewed-by: Oscar Salvador Acked-by: David Hildenbrand Cc: Matthew Wilcox (Oracle) Cc: Muchun Song Cc: Sidhartha Kumar Cc: "Vishal Moola (Oracle)" Signed-off-by: Andrew Morton commit 7f4b6065d9a842721a04632fc219aa453d1b2f5c Author: Fan Ni Date: Mon May 5 11:22:43 2025 -0700 mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page The function __unmap_hugepage_range() has two kinds of users: 1) unmap_hugepage_range(), which passes in the head page of a folio. Since unmap_hugepage_range() already takes folio and there are no other uses of the folio struct in the function, it is natural for __unmap_hugepage_range() to take folio also. 2) All other uses, which pass in NULL pointer. In both cases, we can pass in folio. Refactor __unmap_hugepage_range() to take folio. Link: https://lkml.kernel.org/r/20250505182345.506888-5-nifan.cxl@gmail.com Signed-off-by: Fan Ni Acked-by: David Hildenbrand Reviewed-by: Oscar Salvador Cc: Matthew Wilcox (Oracle) Cc: Muchun Song Cc: Sidhartha Kumar Cc: "Vishal Moola (Oracle)" Signed-off-by: Andrew Morton commit 81edb1ba3232afd45ae7f3f492a91019571b18c9 Author: Fan Ni Date: Mon May 5 11:22:42 2025 -0700 mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page The function unmap_hugepage_range() has two kinds of users: 1) unmap_ref_private(), which passes in the head page of a folio. Since unmap_ref_private() already takes folio and there are no other uses of the folio struct in the function, it is natural for unmap_hugepage_range() to take folio also. 2) All other uses, which pass in NULL pointer. In both cases, we can pass in folio. Refactor unmap_hugepage_range() to take folio. Link: https://lkml.kernel.org/r/20250505182345.506888-4-nifan.cxl@gmail.com Signed-off-by: Fan Ni Reviewed-by: Muchun Song Reviewed-by: Sidhartha Kumar Reviewed-by: Oscar Salvador Acked-by: David Hildenbrand Cc: Matthew Wilcox (Oracle) Cc: "Vishal Moola (Oracle)" Signed-off-by: Andrew Morton commit b0752f1a709740fd6ae518e969a25f90ec6a100f Author: Fan Ni Date: Mon May 5 11:22:41 2025 -0700 mm/hugetlb: pass folio instead of page to unmap_ref_private() Patch series "Let unmap_hugepage_range() and several related functions take folio instead of page", v4. This patch (of 4): unmap_ref_private() has only a single user, which passes in &folio->page. Let it take the folio directly. Link: https://lkml.kernel.org/r/20250505182345.506888-2-nifan.cxl@gmail.com Link: https://lkml.kernel.org/r/20250505182345.506888-3-nifan.cxl@gmail.com Signed-off-by: Fan Ni Reviewed-by: Muchun Song Reviewed-by: Sidhartha Kumar Reviewed-by: Oscar Salvador Reviewed-by: Matthew Wilcox (Oracle) Acked-by: David Hildenbrand Cc: "Vishal Moola (Oracle)" Signed-off-by: Andrew Morton commit 163786f71a12237841b998db39e48fa574f861fd Merge: 429d410bf9eff7 affffcbb87266b Author: Jakub Kicinski Date: Tue May 27 19:19:37 2025 -0700 Merge branch 'devmem-tcp-minor-cleanups-and-ksft-improvements' Mina Almasry says: ==================== Devmem TCP minor cleanups and ksft improvements v2: https://lore.kernel.org/20250519023517.4062941-1-almasrymina@google.com ==================== Link: https://patch.msgid.link/20250523230524.1107879-1-almasrymina@google.com Signed-off-by: Jakub Kicinski commit affffcbb87266b76b6f83edb39ae404604ffc6b5 Author: Mina Almasry Date: Fri May 23 23:05:24 2025 +0000 net: devmem: ncdevmem: remove unused variable This variable is unused and can be removed. Signed-off-by: Mina Almasry Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250523230524.1107879-9-almasrymina@google.com Signed-off-by: Jakub Kicinski commit baa18bc5353fcb99bc49944c51c6c7829cb1da55 Author: Mina Almasry Date: Fri May 23 23:05:23 2025 +0000 net: devmem: ksft: upgrade rx test to send 1K data The current test just sends "hello\nworld" and verifies that is the string received on the RX side. That is fine, but improve the test a bit by sending 1K data. The test should be improved further to send more data, but for now this should be a welcome improvement. The test will send a repeating pattern of 0x01, 0x02, ... 0x06. The ncdevmem `-v 7` flag will verify this pattern. ncdevmem will provide useful debugging info when the test fails, such as the frags received and verified fine, and which frag exactly failed, what was the expected byte pattern, and what is the actual byte pattern received. All this debug information will be useful when the test fails. Signed-off-by: Mina Almasry Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250523230524.1107879-8-almasrymina@google.com Signed-off-by: Jakub Kicinski commit 243d47a5e1e47b2b72d654d7278fc8bff0199b0c Author: Mina Almasry Date: Fri May 23 23:05:22 2025 +0000 net: devmem: ksft: add 5 tuple FS support ncdevmem supports drivers that are limited to either 3-tuple or 5-tuple FS support, but the ksft is currently 3-tuple only. Support drivers that have 5-tuple FS supported by adding a ksft arg. Signed-off-by: Mina Almasry fix 5-tuple fix 5-tuple Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250523230524.1107879-7-almasrymina@google.com Signed-off-by: Jakub Kicinski commit 57605ae8e1b61be0029b4ff39298e6eaef824948 Author: Mina Almasry Date: Fri May 23 23:05:21 2025 +0000 net: devmem: ksft: add exit_wait to make rx test pass This exit_wait seems necessary to make the rx side test pass for me. I think this is just missed from the original test add patch. Add it now. Signed-off-by: Mina Almasry Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250523230524.1107879-6-almasrymina@google.com Signed-off-by: Jakub Kicinski commit 12d31142e63a1ff78b93e998a519e22e2425cf18 Author: Mina Almasry Date: Fri May 23 23:05:20 2025 +0000 net: devmem: ksft: add ipv4 support ncdevmem supports both ipv4 and ipv6, but the ksft is currently ipv6-only. Propagate the ipv4 support to the ksft, so that folks that are limited to these networks can also test. Signed-off-by: Mina Almasry Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250523230524.1107879-5-almasrymina@google.com Signed-off-by: Jakub Kicinski commit 85cea17d15c9d6c54d6dfe27e7246337eb6a025d Author: Mina Almasry Date: Fri May 23 23:05:19 2025 +0000 net: devmem: preserve sockc_err Preserve the error code returned by sock_cmsg_send and return that on err. Signed-off-by: Mina Almasry Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250523230524.1107879-4-almasrymina@google.com Signed-off-by: Jakub Kicinski commit 170ebc60b79a5745addf7b408bce9b86bbd7c29d Author: Mina Almasry Date: Fri May 23 23:05:18 2025 +0000 page_pool: fix ugly page_pool formatting Minor cleanup; this line is badly formatted. Signed-off-by: Mina Almasry Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250523230524.1107879-3-almasrymina@google.com Signed-off-by: Jakub Kicinski commit 88e47c93b3a2a45b55f03f238b68be826917bb2e Author: Mina Almasry Date: Fri May 23 23:05:17 2025 +0000 net: devmem: move list_add to net_devmem_bind_dmabuf. It's annoying for the list_add to be outside net_devmem_bind_dmabuf, but the list_del is in net_devmem_unbind_dmabuf. Make it consistent by having both the list_add/del be inside the net_devmem_[un]bind_dmabuf. Cc: ap420073@gmail.com Signed-off-by: Mina Almasry Tested-by: Taehee Yoo Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250523230524.1107879-2-almasrymina@google.com Signed-off-by: Jakub Kicinski commit 429d410bf9eff7bc930e5850277c87ed47ceaeea Author: Florian Westphal Date: Fri May 23 14:16:57 2025 +0200 selftests: netfilter: nft_queue.sh: include file transfer duration in log message Paolo Abeni says: Recently the nipa CI infra went through some tuning, and the mentioned self-test now often fails. The failing test is the sctp+nfqueue one, where the file transfer takes too long and hits the timeout (1 minute). Because SCTP nfqueue tests had timeout related issues before (esp. on debug kernels) print the file transfer duration in the PASS/FAIL message. This would aallow us to see if there is/was an unexpected slowdown (CI keeps logs around) or 'creeping slowdown' where things got slower over time until 'fail point' was reached. Output of altered lines looks like this: PASS: tcp and nfqueue in forward chan (duration: 2s) PASS: tcp via loopback (duration: 2s) PASS: sctp and nfqueue in forward chain (duration: 42s) PASS: sctp and nfqueue in output chain with GSO (duration: 21s) Reported-by: Paolo Abeni Link: https://patch.msgid.link/20250523121700.20011-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit 7831003165d37ecb7b33843fcee05cada0359a82 Author: Nitin Rawat Date: Mon May 26 21:08:12 2025 +0530 scsi: ufs: qcom: Prevent calling phy_exit() before phy_init() Prevent calling phy_exit() before phy_init() to avoid abnormal power count and the following warning during boot up. [5.146763] phy phy-1d80000.phy.0: phy_power_on was called before phy_init Fixes: 7bac65687510 ("scsi: ufs: qcom: Power off the PHY if it was already powered on in ufs_qcom_power_up_sequence()") Signed-off-by: Nitin Rawat Link: https://lore.kernel.org/r/20250526153821.7918-2-quic_nitirawa@quicinc.com Reviewed-by: Konrad Dybcio Signed-off-by: Martin K. Petersen commit 846992645b25ec4253167e3f931e4597eb84af56 Author: Horatiu Vultur Date: Thu May 22 13:57:22 2025 +0200 net: phy: mscc: Fix memory leak when using one step timestamping Fix memory leak when running one-step timestamping. When running one-step sync timestamping, the HW is configured to insert the TX time into the frame, so there is no reason to keep the skb anymore. As in this case the HW will never generate an interrupt to say that the frame was timestamped, then the frame will never released. Fix this by freeing the frame in case of one-step timestamping. Fixes: 7d272e63e0979d ("net: phy: mscc: timestamping and PHC support") Signed-off-by: Horatiu Vultur Link: https://patch.msgid.link/20250522115722.2827199-1-horatiu.vultur@microchip.com Signed-off-by: Jakub Kicinski commit c77b37dafb81660b939f82d81b637b91b0207cfe Author: Can Guo Date: Thu May 22 10:15:37 2025 +0800 scsi: ufs: qcom: Call ufs_qcom_cfg_timers() in clock scaling path ufs_qcom_cfg_timers() is clock freq dependent like ufs_qcom_set_core_clk_ctrl(), hence move ufs_qcom_cfg_timers() call to clock scaling path. In addition, do not assume the devfreq OPP freq is always the 'core_clock' freq although 'core_clock' is the first clock phandle in device tree, use ufs_qcom_opp_freq_to_clk_freq() to find the core clk freq. Signed-off-by: Can Guo Co-developed-by: Ziqi Chen Signed-off-by: Ziqi Chen Link: https://lore.kernel.org/r/20250522021537.999107-4-quic_ziqichen@quicinc.com Reported-by: Luca Weiss Closes: https://lore.kernel.org/linux-arm-msm/D9FZ9U3AEXW4.1I12FX3YQ3JPW@fairphone.com/ Tested-by: Luca Weiss Reviewed-by: Bean Huo Tested-by: Loïc Minier Signed-off-by: Martin K. Petersen commit 8c5bcb3daeef9bc54c9939c36dca9a626126eb59 Author: Can Guo Date: Thu May 22 10:15:36 2025 +0800 scsi: ufs: qcom: Map devfreq OPP freq to UniPro Core Clock freq On some platforms, the devfreq OPP freq may be different than the unipro core clock freq. Implement ufs_qcom_opp_freq_to_clk_freq() and use it to find the unipro core clk freq. Fixes: c02fe9e222d1 ("scsi: ufs: qcom: Implement the freq_to_gear_speed() vop") Signed-off-by: Can Guo Co-developed-by: Ziqi Chen Signed-off-by: Ziqi Chen Link: https://lore.kernel.org/r/20250522021537.999107-3-quic_ziqichen@quicinc.com Reported-by: Luca Weiss Closes: https://lore.kernel.org/linux-arm-msm/D9FZ9U3AEXW4.1I12FX3YQ3JPW@fairphone.com/ Tested-by: Luca Weiss Reviewed-by: Bean Huo Tested-by: Loïc Minier Signed-off-by: Martin K. Petersen commit 663d0c19f3acc0d697f623d34b8eb3b438bf2bda Author: Ziqi Chen Date: Thu May 22 10:15:35 2025 +0800 scsi: ufs: qcom: Check gear against max gear in vop freq_to_gear() The vop freq_to_gear() may return a gear greater than the negotiated max gear. Return the negotiated max gear if the mapped gear is greater. Fixes: c02fe9e222d1 ("scsi: ufs: qcom: Implement the freq_to_gear_speed() vop") Signed-off-by: Ziqi Chen Link: https://lore.kernel.org/r/20250522021537.999107-2-quic_ziqichen@quicinc.com Reported-by: Neil Armstrong Closes: https://lore.kernel.org/all/c7f2476a-943a-4d73-ad80-802c91e5f880@linaro.org/ Tested-by: Neil Armstrong Reviewed-by: Bean Huo Tested-by: Loïc Minier Signed-off-by: Martin K. Petersen commit 0ae992637cf7011af0128e6136f3b595de54e03e Author: Tomas Henzl Date: Wed May 21 18:51:48 2025 +0200 scsi: aacraid: Remove useless code There isn't a AAC_MIN_NATIVE_SIZE defined so remove eight useless lines. When at it remove also an unused #define No functional change. Signed-off-by: Tomas Henzl Link: https://lore.kernel.org/r/20250521165148.8856-1-thenzl@redhat.com Signed-off-by: Martin K. Petersen commit c8426f258a0aa4c2fa0fb87806b73592b03dacac Author: mrigendrachaubey Date: Sat May 24 09:25:16 2025 +0530 scsi: core: devinfo: Fix typo in comment Correct a minor typo in a comment within scsi_devinfo.c, replacing "compatibile" with the correct spelling "compatible". Signed-off-by: mrigendrachaubey Link: https://lore.kernel.org/r/20250524035516.27341-1-mrigendra.chaubey@gmail.com Signed-off-by: Martin K. Petersen commit e97633492f5a3eca7b3ff03b4ef6f993017f7955 Author: Ziqi Chen Date: Thu May 22 16:12:28 2025 +0800 scsi: ufs: core: Don't perform UFS clkscaling during host async scan When preparing for UFS clock scaling, the UFS driver will quiesce all sdevs queues in the UFS SCSI host tagset list and then unquiesce them in ufshcd_clock_scaling_unprepare(). If the UFS SCSI host async scan is in progress at this time, some LUs may be added to the tagset list between UFS clkscale prepare and unprepare. This can cause two issues: 1. During clock scaling, there may be I/O requests issued through new added queues that have not been quiesced, leading to task abort issue. 2. These new added queues that have not been quiesced will be unquiesced as well when UFS clkscale is unprepared, resulting in warning prints. Therefore, use the mutex lock scan_mutex in ufshcd_clock_scaling_prepare() and ufshcd_clock_scaling_unprepare() to protect it. Co-developed-by: Can Guo Signed-off-by: Can Guo Signed-off-by: Ziqi Chen Link: https://lore.kernel.org/r/20250522081233.2358565-1-quic_ziqichen@quicinc.com Suggested-by: Bart Van Assche Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 33f1b3677a13dda60a2a59858f7916672e7f1546 Author: Christoph Hellwig Date: Mon May 26 07:47:45 2025 +0200 sctp: mark sctp_do_peeloff static sctp_do_peeloff is only used inside of net/sctp/socket.c, so mark it static. Signed-off-by: Christoph Hellwig Acked-by: Xin Long Link: https://patch.msgid.link/20250526054745.2329201-1-hch@lst.de Signed-off-by: Jakub Kicinski commit 3b9935586a9b54d2da27901b830d3cf46ad66a1e Author: Rengarajan S Date: Fri May 23 23:03:26 2025 +0530 net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices Maximum OTP and EEPROM size for hearthstone PCI1xxxx devices are 8 Kb and 64 Kb respectively. Adjust max size definitions and return correct EEPROM length based on device. Also prevent out-of-bound read/write. Signed-off-by: Rengarajan S Link: https://patch.msgid.link/20250523173326.18509-1-rengarajan.s@microchip.com Signed-off-by: Jakub Kicinski commit 7a91722e0dd47bc5d1b4b8416966bf993c93a72f Author: Jiawen Wu Date: Fri May 23 16:04:38 2025 +0800 net: txgbe: Support the FDIR rules assigned to VFs When SR-IOV is enabled, the FDIR rule is supported to filter packets to VFs. The action queue id is calculated as an absolute id. Signed-off-by: Jiawen Wu Reviewed-by: Simon Horman Link: https://patch.msgid.link/BE7EA355FDDAAA97+20250523080438.27968-2-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 06ac0776d549d93adf23c823b810118980265ad9 Author: Jiawen Wu Date: Fri May 23 16:04:37 2025 +0800 net: libwx: Fix statistics of multicast packets When SR-IOV is enabled, the number of multicast packets is mistakenly counted starting from queue 0. It would be a wrong count that includes the packets received on VF. Fix it to count from the correct offset. Fixes: c52d4b898901 ("net: libwx: Redesign flow when sriov is enabled") Signed-off-by: Jiawen Wu Reviewed-by: Simon Horman Link: https://patch.msgid.link/F70910CFE86C1F6F+20250523080438.27968-1-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 1d887d6f810dbf908da9709393c95ae1a649d587 Author: Jasjiv Singh Date: Thu Mar 13 14:51:01 2025 -0700 ipe: add errno field to IPE policy load auditing Users of IPE require a way to identify when and why an operation fails, allowing them to both respond to violations of policy and be notified of potentially malicious actions on their systems with respect to IPE. This patch introduces a new error field to the AUDIT_IPE_POLICY_LOAD event to log policy loading failures. Currently, IPE only logs successful policy loads, but not failures. Tracking failures is crucial to detect malicious attempts and ensure a complete audit trail for security events. The new error field will capture the following error codes: * -ENOKEY: Key used to sign the IPE policy not found in the keyring * -ESTALE: Attempting to update an IPE policy with an older version * -EKEYREJECTED: IPE signature verification failed * -ENOENT: Policy was deleted while updating * -EEXIST: Same name policy already deployed * -ERANGE: Policy version number overflow * -EINVAL: Policy version parsing error * -EPERM: Insufficient permission * -ENOMEM: Out of memory (OOM) * -EBADMSG: Policy is invalid Here are some examples of the updated audit record types: AUDIT_IPE_POLICY_LOAD(1422): audit: AUDIT1422 policy_name="Test_Policy" policy_version=0.0.1 policy_digest=sha256:84EFBA8FA71E62AE0A537FAB962F8A2BD1053964C4299DCA 92BFFF4DB82E86D3 auid=1000 ses=3 lsm=ipe res=1 errno=0 The above record shows a new policy has been successfully loaded into the kernel with the policy name, version, and hash with the errno=0. AUDIT_IPE_POLICY_LOAD(1422) with error: audit: AUDIT1422 policy_name=? policy_version=? policy_digest=? auid=1000 ses=3 lsm=ipe res=0 errno=-74 The above record shows a policy load failure due to an invalid policy (-EBADMSG). By adding this error field, we ensure that all policy load attempts, whether successful or failed, are logged, providing a comprehensive audit trail for IPE policy management. Signed-off-by: Jasjiv Singh Signed-off-by: Fan Wu commit 65484f9dfd3c707f0bb9a615ec987bb82d6e3e7d Merge: 3920a758800762 82d1096ca8b5db Author: Jakub Kicinski Date: Tue May 27 17:52:03 2025 -0700 Merge branch 'refactor-phy-reset-handling-and' Thangaraj Samynathan says: ==================== Refactor PHY reset handling and fix WOL This patch series refines the PHY reset and initialization logic in the lan743x driver. Enhance the robustness of the driver initialization process and prevent WOL-related issues during suspend/resume cycles. ==================== Link: https://patch.msgid.link/20250526053048.287095-1-thangaraj.s@microchip.com Signed-off-by: Jakub Kicinski commit 82d1096ca8b5dbb3158d707e6fb3ad21c3403a49 Author: Thangaraj Samynathan Date: Mon May 26 11:00:48 2025 +0530 net: lan743x: Fix PHY reset handling during initialization and WOL Remove lan743x_phy_init from lan743x_hardware_init as it resets the PHY registers, causing WOL to fail on subsequent attempts. Add a call to lan743x_hw_reset_phy in the probe function to ensure the PHY is reset during device initialization. Fixes: 23f0703c125be ("lan743x: Add main source files for new lan743x driver") Signed-off-by: Thangaraj Samynathan Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250526053048.287095-3-thangaraj.s@microchip.com Signed-off-by: Jakub Kicinski commit 68927eb52d0af04863584930db06075d2610e194 Author: Thangaraj Samynathan Date: Mon May 26 11:00:47 2025 +0530 net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy rename the function to lan743x_hw_reset_phy to better describe it operation. Fixes: 23f0703c125be ("lan743x: Add main source files for new lan743x driver") Signed-off-by: Thangaraj Samynathan Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250526053048.287095-2-thangaraj.s@microchip.com Signed-off-by: Jakub Kicinski commit 3920a758800762917177a6b5ab39707d8e376fe6 Author: Sergio Perez Gonzalez Date: Sun May 25 21:20:31 2025 -0600 net: macb: Check return value of dma_set_mask_and_coherent() Issue flagged by coverity. Add a safety check for the return value of dma_set_mask_and_coherent, go to a safe exit if it returns error. Link: https://scan7.scan.coverity.com/#/project-view/53936/11354?selectedIssue=1643754 Signed-off-by: Sergio Perez Gonzalez Reviewed-by: Claudiu Beznea Link: https://patch.msgid.link/20250526032034.84900-1-sperezglz@gmail.com Signed-off-by: Jakub Kicinski commit e9cb929670a1e98b592b30f03f06e9e20110f318 Author: Greg Kroah-Hartman Date: Thu May 22 13:21:47 2025 +0200 net: phy: fix up const issues in to_mdio_device() and to_phy_device() Both to_mdio_device() and to_phy_device() "throw away" the const pointer attribute passed to them and return a non-const pointer, which generally is not a good thing overall. Fix this up by using container_of_const() which was designed for this very problem. Cc: Alexander Lobakin Cc: Andrew Lunn Cc: Heiner Kallweit Cc: Russell King Fixes: 7eab14de73a8 ("mdio, phy: fix -Wshadow warnings triggered by nested container_of()") Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/2025052246-conduit-glory-8fc9@gregkh Signed-off-by: Jakub Kicinski commit cb575e5e9fd1cba99f1514c36375e74609f92e70 Author: Saeed Mahameed Date: Fri May 23 00:41:16 2025 +0300 net: Kconfig NET_DEVMEM selects GENERIC_ALLOCATOR GENERIC_ALLOCATOR is a non-prompt kconfig, meaning users can't enable it selectively. All kconfig users of GENERIC_ALLOCATOR select it, except of NET_DEVMEM which only depends on it, there is no easy way to turn GENERIC_ALLOCATOR on unless we select other unnecessary configs that will select it. Instead of depending on it, select it when NET_DEVMEM is enabled. Signed-off-by: Saeed Mahameed Reviewed-by: Dragos Tatulea Signed-off-by: Cosmin Ratiu Signed-off-by: Tariq Toukan Reviewed-by: Mina Almasry Link: https://patch.msgid.link/1747950086-1246773-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit d9d836bfa5e6e255c411733b4b1ce7a1f8346c54 Author: Hangbin Liu Date: Mon May 26 01:46:00 2025 +0000 selftests: net: move wait_local_port_listen to lib.sh The function wait_local_port_listen() is the only function defined in net_helper.sh. Since some tests source both lib.sh and net_helper.sh, we can simplify the setup by moving wait_local_port_listen() to lib.sh. With this change, net_helper.sh becomes redundant and can be removed. Signed-off-by: Hangbin Liu Reviewed-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250526014600.9128-1-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski commit 08f8bad0255c7319f4ffe53d0f0eab50fa2cb5e9 Author: Christophe JAILLET Date: Sun May 25 11:21:24 2025 +0200 cxgb4: Constify struct thermal_zone_device_ops 'struct thermal_zone_device_ops' are not modified in this driver. Constifying these structures moves some data to a read-only section, so increases overall security, especially when the structure holds some function pointers. On a x86_64, with allmodconfig: Before: ====== text data bss dec hex filename 2912 1064 0 3976 f88 drivers/net/ethernet/chelsio/cxgb4/cxgb4_thermal.o After: ===== text data bss dec hex filename 3040 936 0 3976 f88 drivers/net/ethernet/chelsio/cxgb4/cxgb4_thermal.o Signed-off-by: Christophe JAILLET Link: https://patch.msgid.link/e6416e0d15ea27a55fe1fb4e349928ac7bae1b95.1748164843.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jakub Kicinski commit 82fb5a369b8de625660c8c7f82e5286ec195be5e Author: Christophe JAILLET Date: Sun May 25 11:13:17 2025 +0200 mlxsw: core_thermal: Constify struct thermal_zone_device_ops 'struct thermal_zone_device_ops' are not modified in this driver. Constifying these structures moves some data to a read-only section, so increases overall security, especially when the structure holds some function pointers. While at it, also constify a struct thermal_zone_params. On a x86_64, with allmodconfig: Before: ====== text data bss dec hex filename 24899 8036 0 32935 80a7 drivers/net/ethernet/mellanox/mlxsw/core_thermal.o After: ===== text data bss dec hex filename 25379 7556 0 32935 80a7 drivers/net/ethernet/mellanox/mlxsw/core_thermal.o Signed-off-by: Christophe JAILLET Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/4516676973f5adc1cdb76db1691c0f98b6fa6614.1748164348.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jakub Kicinski commit a540ee75945a96f606c6ac955bfed5410d318f7d Author: Dan Carpenter Date: Fri May 23 19:00:12 2025 +0300 net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() This was intended to be negative -ENOMEM but the '-' character was left off accidentally. This typo doesn't affect runtime because the caller treats all non-zero returns the same. Fixes: 17e0accac577 ("net/mlx5: HWS, support complex matchers") Signed-off-by: Dan Carpenter Reviewed-by: Yevgeny Kliteynik Reviewed-by: Tariq Toukan Link: https://patch.msgid.link/aDCbjNcquNC68Hyj@stanley.mountain Signed-off-by: Jakub Kicinski commit c8ef20fe7274c5766a317f9193b70bed717b6b3d Author: Zilin Guan Date: Fri May 23 11:47:17 2025 +0000 tipc: use kfree_sensitive() for aead cleanup The tipc_aead_free() function currently uses kfree() to release the aead structure. However, this structure contains sensitive information, such as key's SALT value, which should be securely erased from memory to prevent potential leakage. To enhance security, replace kfree() with kfree_sensitive() when freeing the aead structure. This change ensures that sensitive data is explicitly cleared before memory deallocation, aligning with the approach used in tipc_aead_init() and adhering to best practices for handling confidential information. Signed-off-by: Zilin Guan Reviewed-by: Tung Nguyen Link: https://patch.msgid.link/20250523114717.4021518-1-zilin@seu.edu.cn Signed-off-by: Jakub Kicinski commit 09d7ff0694ea133c50ad905fd6e548c13f8af458 Author: Donald Hunter Date: Fri May 23 11:30:31 2025 +0100 tools: ynl: parse extack for sub-messages Extend the Python YNL extack decoding to handle sub-messages in the same way that YNL C does. This involves retaining the input values so that they are available during extack decoding. ./tools/net/ynl/pyynl/cli.py --family rt-link --do newlink --create \ --json '{ "linkinfo": {"kind": "netkit", "data": {"policy": 10} } }' Netlink error: Invalid argument nl_len = 92 (76) nl_flags = 0x300 nl_type = 2 error: -22 extack: {'msg': 'Provided default xmit policy not supported', 'bad-attr': '.linkinfo.data(netkit).policy'} Signed-off-by: Donald Hunter Link: https://patch.msgid.link/20250523103031.80236-1-donald.hunter@gmail.com Signed-off-by: Jakub Kicinski commit 126cd7852a62c6fab11a4a4cb6fa96421929ab69 Author: Jeremy Kerr Date: Mon May 26 10:44:33 2025 +0800 net: mctp: start tx queue on netdev open We stop queues in ndo_stop, so they need to be restarted in ndo_open. This allows us to resume tx after a link down/up cycle. Suggested-by: Nitin Singh Fixes: 0791c0327a6e ("net: mctp: Add MCTP USB transport driver") Signed-off-by: Jeremy Kerr Link: https://patch.msgid.link/20250526-dev-mctp-usb-v1-1-c7bd6cb75aa0@codeconstruct.com.au Signed-off-by: Jakub Kicinski commit c6bb8a21cdad8c975a3a646b9e5c8df01ad29783 Author: Wentao Liang Date: Sun May 25 00:34:25 2025 +0800 net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() The function mlx5_query_nic_vport_node_guid() calls the function mlx5_query_nic_vport_context() but does not check its return value. A proper implementation can be found in mlx5_nic_vport_query_local_lb(). Add error handling for mlx5_query_nic_vport_context(). If it fails, free the out buffer via kvfree() and return error code. Fixes: 9efa75254593 ("net/mlx5_core: Introduce access functions to query vport RoCE fields") Cc: stable@vger.kernel.org # v4.5 Signed-off-by: Wentao Liang Reviewed-by: Tariq Toukan Link: https://patch.msgid.link/20250524163425.1695-1-vulab@iscas.ac.cn Signed-off-by: Jakub Kicinski commit c59783780c8ad66f6076a9a7c74df3e006e29519 Author: Christophe JAILLET Date: Sat May 24 09:29:11 2025 +0200 net: airoha: Fix an error handling path in airoha_alloc_gdm_port() If register_netdev() fails, the error handling path of the probe will not free the memory allocated by the previous airoha_metadata_dst_alloc() call because port->dev->reg_state will not be NETREG_REGISTERED. So, an explicit airoha_metadata_dst_free() call is needed in this case to avoid a memory leak. Fixes: af3cf757d5c9 ("net: airoha: Move DSA tag in DMA descriptor") Signed-off-by: Christophe JAILLET Acked-by: Lorenzo Bianconi Reviewed-by: Simon Horman Link: https://patch.msgid.link/1b94b91345017429ed653e2f05d25620dc2823f9.1746715755.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jakub Kicinski commit 0795b05a59b1371b18ffbf09d385296b12e9f5d5 Author: Wei Fang Date: Fri May 23 16:37:59 2025 +0800 net: phy: clear phydev->devlink when the link is deleted There is a potential crash issue when disabling and re-enabling the network port. When disabling the network port, phy_detach() calls device_link_del() to remove the device link, but it does not clear phydev->devlink, so phydev->devlink is not a NULL pointer. Then the network port is re-enabled, but if phy_attach_direct() fails before calling device_link_add(), the code jumps to the "error" label and calls phy_detach(). Since phydev->devlink retains the old value from the previous attach/detach cycle, device_link_del() uses the old value, which accesses a NULL pointer and causes a crash. The simplified crash log is as follows. [ 24.702421] Call trace: [ 24.704856] device_link_put_kref+0x20/0x120 [ 24.709124] device_link_del+0x30/0x48 [ 24.712864] phy_detach+0x24/0x168 [ 24.716261] phy_attach_direct+0x168/0x3a4 [ 24.720352] phylink_fwnode_phy_connect+0xc8/0x14c [ 24.725140] phylink_of_phy_connect+0x1c/0x34 Therefore, phydev->devlink needs to be cleared when the device link is deleted. Fixes: bc66fa87d4fd ("net: phy: Add link between phy dev and mac dev") Signed-off-by: Wei Fang Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20250523083759.3741168-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 8bc3c234dcb65a018120dab96c83845cc7ff35c6 Author: Christian Marangi Date: Thu May 22 18:53:11 2025 +0200 net: phy: mediatek: Add Airoha AN7583 PHY support Add Airoha AN7583 PHY support based on Airoha AN7581 with the small difference that BMCR_PDOWN is enabled by default and needs to be cleared to make the internal PHY correctly work. Signed-off-by: Christian Marangi Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250522165313.6411-4-ansuelsmth@gmail.com Signed-off-by: Jakub Kicinski commit d76556db10bf41cd3ae1ad1d705245afe077a701 Author: Christian Marangi Date: Thu May 22 18:53:10 2025 +0200 net: dsa: mt7530: Add AN7583 support Add Airoha AN7583 Switch support. This is based on Airoha EN7581 that is based on Mediatek MT7988 Switch. Airoha AN7583 require additional tweak to the GEPHY_CONN_CFG register to make the internal PHY work. Signed-off-by: Christian Marangi Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250522165313.6411-3-ansuelsmth@gmail.com Signed-off-by: Jakub Kicinski commit fef1848809230ab6ca5338e0c02ed2ac6e786775 Author: Christian Marangi Date: Thu May 22 18:53:09 2025 +0200 dt-bindings: net: dsa: mediatek,mt7530: Add airoha,an7583-switch Add airoha,an7583-switch additional compatible to the mt7530 DSA Switch Family. This is an exact match of the airoha,en7581-switch (based on mt7988-switch) with the additional requirement of tweak on the GEPHY_CONN_CFG registers to make the internal PHY actually work. Signed-off-by: Christian Marangi Acked-by: Conor Dooley Link: https://patch.msgid.link/20250522165313.6411-2-ansuelsmth@gmail.com Signed-off-by: Jakub Kicinski commit 54ca9be0bc589a0e45959ba73c76cf3f65110c63 Author: Chao Yu Date: Tue May 13 13:57:21 2025 +0800 f2fs: introduce FAULT_VMALLOC Introduce a new fault type FAULT_VMALLOC to simulate no memory error in f2fs_vmalloc(). Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 70dd07c888451503c3e93b6821e10d1ea1ec9930 Author: Chao Yu Date: Tue May 13 13:57:20 2025 +0800 f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx .init_{,de}compress_ctx uses kvmalloc() to alloc memory, it will try to allocate physically continuous page first, it may cause more memory allocation pressure, let's use vmalloc instead to mitigate it. [Test] cd /data/local/tmp touch file f2fs_io setflags compression file f2fs_io getflags file for i in $(seq 1 10); do sync; echo 3 > /proc/sys/vm/drop_caches;\ time f2fs_io write 512 0 4096 zero osync file; truncate -s 0 file;\ done [Result] Before After Delta 21.243 21.694 -2.12% For compression, we recommend to use ioctl to compress file data in background for workaround. For decompression, only zstd will be affected. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 5827e3c720e5a881bf97451e3c280445f67cba04 Author: Chao Yu Date: Tue May 13 11:19:07 2025 +0800 f2fs: add f2fs_bug_on() in f2fs_quota_read() mapping_read_folio_gfp() will return a folio, it should always be uptodate, let's check folio uptodate status to detect any potenial bug. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 9b6fc9888e03dbe69768ace00091173b169aec39 Author: Chao Yu Date: Mon May 12 19:54:41 2025 +0800 f2fs: add f2fs_bug_on() to detect potential bug Add f2fs_bug_on() to check whether memory preallocation will fail or not after radix_tree_preload(GFP_NOFS | __GFP_NOFAIL). Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit d005af3b6756e533caf688060281a91e1dae3479 Author: Eric Biggers Date: Mon May 12 22:48:25 2025 -0700 f2fs: remove unused sbi argument from checksum functions Since __f2fs_crc32() now calls crc32() directly, it no longer uses its sbi argument. Remove that, and simplify its callers accordingly. Signed-off-by: Eric Biggers Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit c89756bcf406af313d191cfe3709e7c175c5b0cd Merge: 3702a515edec51 3e0c509fbdb106 Author: Linus Torvalds Date: Tue May 27 16:48:47 2025 -0700 Merge tag 'pm-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management updates from Rafael Wysocki: "Once again, the changes are dominated by cpufreq updates, but this time the majority of them are cpufreq core changes, mostly related to the introduction of policy locking guards and __free() usage, and fixes related to boost handling. Still, there is also a significant update of the intel_pstate driver making it register an energy model when running on a hybrid platform which is used for enabling energy-aware scheduling (EAS) if the driver operates in the passive mode (and schedutil is used as the cpufreq governor for all CPUs which is the passive mode default). There are some amd-pstate driver updates too, for a good measure, including the "Requested CPU Min frequency" BIOS option support and new online/offline callbacks. In the cpuidle space, the most significant change is the addition of a C1 demotion on/off sysfs knob to intel_idle which should help some users to configure their systems more precisely. There is also the conversion of the PSCI cpuidle driver to a faux device one and there are two small updates of cpuidle governors. Device power management is also modified quite a bit, especially the handling of devices with asynchronous suspend and resume enabled during system transitions. They are now going to be handled more asynchronously during suspend transitions and somewhat less aggressively during resume transitions. Apart from the above, the operating performance points (OPP) library is now going to use mutex locking guards and scope-based cleanup helpers and there is the usual bunch of assorted fixes and code cleanups. Specifics: - Fix potential division-by-zero error in em_compute_costs() (Yaxiong Tian) - Fix typos in energy model documentation and example driver code (Moon Hee Lee, Atul Kumar Pant) - Rearrange the energy model management code and add a new function for adjusting a CPU energy model after adjusting the capacity of the given CPU to it (Rafael Wysocki) - Refactor cpufreq_online(), add and use cpufreq policy locking guards, use __free() in policy reference counting, and clean up core cpufreq code on top of that (Rafael Wysocki) - Fix boost handling on CPU suspend/resume and sysfs updates (Viresh Kumar) - Fix des_perf clamping with max_perf in amd_pstate_update() (Dhananjay Ugwekar) - Add offline, online and suspend callbacks to the amd-pstate driver, rename and use the existing amd_pstate_epp callbacks in it (Dhananjay Ugwekar) - Add support for the "Requested CPU Min frequency" BIOS option to the amd-pstate driver (Dhananjay Ugwekar) - Reset amd-pstate driver mode after running selftests (Swapnil Sapkal) - Avoid shadowing ret in amd_pstate_ut_check_driver() (Nathan Chancellor) - Add helper for governor checks to the schedutil cpufreq governor and move cpufreq-specific EAS checks to cpufreq (Rafael Wysocki) - Populate the cpu_capacity sysfs entries from the intel_pstate driver after registering asym capacity support (Ricardo Neri) - Add support for enabling Energy-aware scheduling (EAS) to the intel_pstate driver when operating in the passive mode on a hybrid platform (Rafael Wysocki) - Drop redundant cpus_read_lock() from store_local_boost() in the cpufreq core (Seyediman Seyedarab) - Replace sscanf() with kstrtouint() in the cpufreq code and use a symbol instead of a raw number in it (Bowen Yu) - Add support for autonomous CPU performance state selection to the CPPC cpufreq driver (Lifeng Zheng) - OPP: Add dev_pm_opp_set_level() (Praveen Talari) - Introduce scope-based cleanup headers and mutex locking guards in OPP core (Viresh Kumar) - Switch OPP to use kmemdup_array() (Zhang Enpei) - Optimize bucket assignment when next_timer_ns equals KTIME_MAX in the menu cpuidle governor (Zhongqiu Han) - Convert the cpuidle PSCI driver to a faux device one (Sudeep Holla) - Add C1 demotion on/off sysfs knob to the intel_idle driver (Artem Bityutskiy) - Fix typos in two comments in the teo cpuidle governor (Atul Kumar Pant) - Fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla) - Move debug runtime PM attributes to runtime_attrs[] (Rafael Wysocki) - Add new devm_ functions for enabling runtime PM and runtime PM reference counting (Bence Csókás) - Remove size arguments from strscpy() calls in the hibernation core code (Thorsten Blum) - Adjust the handling of devices with asynchronous suspend enabled during system suspend and resume to start resuming them immediately after resuming their parents and to start suspending such a device immediately after suspending its first child (Rafael Wysocki) - Adjust messages printed during tasks freezing to avoid using pr_cont() (Andrew Sayers, Paul Menzel) - Clean up unnecessary usage of !! in pm_print_times_init() (Zihuan Zhang) - Add missing wakeup source attribute relax_count to sysfs and remove the space character at the end ofi the string produced by pm_show_wakelocks() (Zijun Hu) - Add configurable pm_test delay for hibernation (Zihuan Zhang) - Disable asynchronous suspend in ucsi_ccg_probe() to prevent the cypd4226 device on Tegra boards from suspending prematurely (Jon Hunter) - Unbreak printing PM debug messages during hibernation and clean up some related code (Rafael Wysocki) - Add a systemd service to run cpupower and change cpupower binding's Makefile to use -lcpupower (John B. Wyatt IV, Francesco Poli)" * tag 'pm-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (72 commits) cpufreq: CPPC: Add support for autonomous selection cpufreq: Update sscanf() to kstrtouint() cpufreq: Replace magic number OPP: switch to use kmemdup_array() PM: freezer: Rewrite restarting tasks log to remove stray *done.* PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() cpufreq: drop redundant cpus_read_lock() from store_local_boost() cpupower: do not install files to /etc/default/ cpupower: do not call systemctl at install time cpupower: do not write DESTDIR to cpupower.service PM: sleep: Introduce pm_sleep_transition_in_progress() cpufreq/amd-pstate: Avoid shadowing ret in amd_pstate_ut_check_driver() cpufreq: intel_pstate: Document hybrid processor support cpufreq: intel_pstate: EAS: Increase cost for CPUs using L3 cache cpufreq: intel_pstate: EAS support for hybrid platforms PM: EM: Introduce em_adjust_cpu_capacity() PM: EM: Move CPU capacity check to em_adjust_new_capacity() PM: EM: Documentation: Fix typos in example driver code cpufreq: Drop policy locking from cpufreq_policy_is_good_for_eas() PM: sleep: Introduce pm_suspend_in_progress() ... commit 3702a515edec515fcc7e085053da636fefac88d6 Merge: 049294830bfaa1 db0e4d5429c909 Author: Linus Torvalds Date: Tue May 27 16:32:30 2025 -0700 Merge tag 'acpi-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI updates from Rafael Wysocki: "The most significant part of these changes is an ACPICA update covering two upstream ACPICA releases, 20241212 and 20250404, that have not been included into the kernel code base yet. Among other things, it adds definitions needed to address GCC 15's -Wunterminated-string-initialization warnings, adds support for three new tables (MRRM, ERDT, RIMT), extends support for two tables (RAS2, DMAR), and fixes some issues. On top of the above, there is a new parser for the MRRM table, more changes related to GCC 15's -Wunterminated-string-initialization warnings, a CPPC library update including functions related to autonomous CPU performance state selection, a couple of new quirks, some assorted fixes and some code cleanups. Specifics: - Fix two ACPICA SLAB cache leaks (Seunghun Han) - Add EINJv2 get error type action and define Error Injection Actions in hex values to avoid inconsistencies between the specification and the code (Zaid Alali) - Fix typo in comments for SRAT structures (Adam Lackorzynski) - Prevent possible loss of data in ACPICA because of u32 to u8 conversions (Saket Dumbre) - Fix reading FFixedHW operation regions in ACPICA (Daniil Tatianin) - Add support for printing AML arguments when the ACPICA debug level is ACPI_LV_TRACE_POINT (Mario Limonciello) - Drop a stale comment about the file content from actbl2.h (Sudeep Holla) - Apply pack(1) to union aml_resource (Tamir Duberstein) - Fix overflow check in the ACPICA version of vsnprintf() (gldrk) - Interpret SIDP structures in DMAR added revision 3.4 of the VT-d specification (Alexey Neyman) - Add typedef and other definitions related to MRRM to ACPICA (Tony Luck) - Add definitions for RIMT to ACPICA (Sunil V L) - Fix spelling mistake "Incremement" -> "Increment" in the ACPICA utilities code (Colin Ian King) - Add typedef and other definitions for ERDT to ACPICA (Tony Luck) - Introduce ACPI_NONSTRING and use it (Kees Cook, Ahmed Salem) - Rename structure and field names of the RAS2 table in actbl2.h (Shiju Jose) - Fix up whitespace in acpica/utcache.c (Zhe Qiao) - Avoid sequence overread in a call to strncmp() in ap_get_table_length() and replace strncpy() with memcpy() in ACPICA in some places (Ahmed Salem) - Update copyright year in all ACPICA files (Saket Dumbre) - Add __nonstring annotations for unterminated strings in the static ACPI tables parsing code (Kees Cook) - Add support for parsing the MRRM ACPI table and sysfs files to describe memory regions listed in it (Tony Luck, Anil Keshavamurthy) - Remove an (explicitly) unused header file include from the VIOT ACPI table parser file (Andy Shevchenko) - Improve logging around acpi_initialize_tables() (Bartosz Szczepanek) - Clean up the initialization of CPU data structures in the ACPI processor driver (Zhang Rui) - Remove an obsolete comment regarding the C-states handling in the ACPI processor driver (Giovanni Gherdovich) - Simplify PCC shared memory region handling (Sudeep Holla) - Rework and extend functions for reading CPPC register values and for updating CPPC registers (Lifeng Zheng) - Add three functions related to autonomous CPU performance state selection to the CPPC library (Lifeng Zheng) - Turn the acpi_pci_root_remap_iospace() fwnode_handle parameter into a const pointer (Pei Xiao) - Round battery capacity percengate in the ACPI battery driver to the closest integer to avoid user confusion (shitao) - Make the ACPI battery driver report the current as a negative number to the power supply framework when the battery is discharging as documented (Peter Marheine) - Add TUXEDO InfinityBook Pro AMD Gen9 to the acpi_ec_no_wakeup[] list to prevent spurious wakeups from suspend-to-idle (Werner Sembach) - Convert the APEI EINJ driver to a faux device one (Sudeep Holla, Jon Hunter) - Remove redundant calls to einj_get_available_error_type() from the APEI EINJ driver (Zaid Alali) - Fix a typo for MECHREVO in irq1_edge_low_force_override[] (Mingcong Bai) - Add an LPS0 check() callback to the AMD pinctrl driver and fix up config symbol dependencies in it (Mario Limonciello, Rafael Wysocki) - Avoid initializing the ACPI platform profile driver on non-ACPI platforms (Alexandre Ghiti) - Document that references to ACPI data (non-device) nodes should use string-only references in hierarchical data node packages (Sakari Ailus) - Fail the ACPI bus registration if acpi_kobj registration fails (Armin Wolf)" * tag 'acpi-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (65 commits) ACPI: MRRM: Fix default max memory region ACPI: bus: Bail out if acpi_kobj registration fails ACPI: platform_profile: Avoid initializing on non-ACPI platforms pinctrl: amd: Fix hibernation support with CONFIG_SUSPEND unset ACPI: tables: Improve logging around acpi_initialize_tables() ACPI: VIOT: Remove (explicitly) unused header ACPI: Add documentation for exposing MRRM data ACPI: MRRM: Add /sys files to describe memory ranges ACPI: MRRM: Minimal parse of ACPI MRRM table ACPICA: Update copyright year ACPICA: Logfile: Changes for version 20250404 ACPICA: Replace strncpy() with memcpy() ACPICA: Apply ACPI_NONSTRING in more places ACPICA: Avoid sequence overread in call to strncmp() ACPICA: Adjust the position of code lines ACPICA: actbl2.h: ACPI 6.5: RAS2: Rename structure and field names of the RAS2 table ACPICA: Apply ACPI_NONSTRING ACPICA: Introduce ACPI_NONSTRING ACPICA: actbl2.h: ERDT: Add typedef and other definitions ACPICA: infrastructure: Add new DMT_BUF types and shorten a long name ... commit 049294830bfaa1c4b56d5ccf21075f6f9990799e Merge: 35a8b02e071a83 01daf71a4f5706 Author: Linus Torvalds Date: Tue May 27 16:28:02 2025 -0700 Merge tag 'thermal-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control updates from Rafael Wysocki: "These add support for a new feature, Platform Temperature Control (PTC), to the Intel int340x thermal driver, add support for the Airoha EN7581 thermal sensor and the IPQ5018 platform, fix up the ACPI thermal zones handling, fix other assorted issues and clean up code Specifics: - Add Platform Temperature Control (PTC) support to the Intel int340x thermal driver (Srinivas Pandruvada) - Make the Hisilicon thermal driver compile by default when ARCH_HISI is set (Krzysztof Kozlowski) - Clean up printk() format by using %pC instead of %pCn in the bcm2835 thermal driver (Luca Ceresoli) - Fix variable name coding style in the AmLogic thermal driver (Enrique Isidoro Vazquez Ramos) - Fix missing debugfs entry removal on failure by using the devm_ variant in the LVTS thermal driver (AngeloGioacchino Del Regno) - Remove the unused lvts_debugfs_exit() function as the devm_ variant introduced before takes care of removing the debugfs entry in the LVTS driver (Arnd Bergmann) - Add the Airoha EN7581 thermal sensor support along with its DT bindings (Christian Marangi) - Add ipq5018 compatible string DT binding, cleanup and add its suppot to the QCom Tsens thermal driver (Sricharan Ramabadhran, George Moussalem) - Fix comments typos in the Airoha driver (Christian Marangi, Colin Ian King) - Address a sparse warning by making a local variable static in the QCom thermal driver (George Moussalem) - Fix the usage of the _SCP control method in the driver for ACPI thermal zones (Armin Wolf)" * tag 'thermal-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: thermal: qcom: ipq5018: make ops_ipq5018 struct static thermal/drivers/airoha: Fix spelling mistake "calibrarion" -> "calibration" ACPI: thermal: Execute _SCP before reading trip points ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" thermal/drivers/airoha: Fix spelling mistake thermal/drivers/qcom/tsens: Add support for IPQ5018 tsens thermal/drivers/qcom/tsens: Add support for tsens v1 without RPM thermal/drivers/qcom/tsens: Update conditions to strictly evaluate for IP v2+ dt-bindings: thermal: qcom-tsens: Add ipq5018 compatible thermal/drivers: Add support for Airoha EN7581 thermal sensor dt-bindings: thermal: Add support for Airoha EN7581 thermal sensor thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure thermal/drivers/amlogic: Rename Uptat to uptat to follow kernel coding style vsprintf: remove redundant and unused %pCn format specifier thermal/drivers/bcm2835: Use %pC instead of %pCn thermal/drivers/hisi: Do not enable by default during compile testing thermal: int340x: processor_thermal: Platform temperature control documentation thermal: intel: int340x: Enable platform temperature control thermal: intel: int340x: Add platform temperature control interface commit 35a8b02e071a83dd2d42a8446a00a56f6147dc06 Merge: 418da6ee1ea620 d2c6acff6386f4 Author: Linus Torvalds Date: Tue May 27 16:23:25 2025 -0700 Merge tag 'mmc-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC updates from Ulf Hansson: "MMC core: - Scan the eMMC boot areas for partition table - Clarify purpose of mmc_can* functions by renaming them to mmc_card_can* - Clarify helpers for host capabilities by renaming them to mmc_host_can* - Add support for graceful host removal for SD and eMMC - Further avoid re-storing power to the eMMC before a shutdown - Add quirk to disable DDR50 tuning and use it for some Swissbit SD-cards MMC host: - mtk-sd: Add support for Dimensity 1200 MT6893 - mtk-sd: Fix condition to enable single burst type - mtk-sd: Optimize several code-paths by aggregating register-writes - renesas_sdhi: Add support for the Renesas RZ/V2N variant - sdhci-msm: Add support for the SM7150 variant - sdhci-esdhc-imx: Re-factor the system PM logic - sdhci-esdhc-imx: Lots of improvements around the tuning support - sdhci-of-arasan: Add support for the Renesas RZ/N1D variant - sdhci-of-dwcmhsc: Add Sophgo SG2044 support - sdhci-of-esdhc: Add support for the LS1021a variant - sdhci-of-k1: Add new driver to support for SpacemiT K1 controller - sdhci-pic32: Convert microchip,sdhci-pic32 DT doc to json schema - wmt-sdmmc: Convert DT doc to json schema" * tag 'mmc-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (59 commits) dt-bindings: mmc: sdhci-of-dwcmhsc: Allow use of a power-domain mmc: sdhci-esdhc-imx: fix few build warnings mmc: bcm2835: Use str_read_write() helper mmc: host: sdhci-esdhc-imx: refactor the system PM logic mmc: sdhci: export APIs for sdhci irq wakeup mmc: sdhci-of-k1: add support for SpacemiT K1 SoC dt-bindings: mmc: spacemit,sdhci: add support for K1 SoC mmc: core: Scan the eMMC boot areas for partition table dt-binding: mmc: microchip,sdhci-pic32: convert text based binding to json schema mmc: rename mmc_boot_partition_access() to mmc_host_can_access_boot() mmc: rename mmc_host_uhs() to mmc_host_can_uhs() mmc: rename mmc_host_done_complete() to mmc_host_can_done_complete() mmc: rename mmc_host_cmd23() to mmc_host_can_cmd23() mmc: sdhci-esdhc-imx: fix defined but not used warnings dt-bindings: mmc: vt8500-sdmmc: Convert to YAML dt-bindings: mmc: sdhci-msm: Add the SM7150 compatible dt-bindings: mmc: fsl,esdhc: add compatible string fsl,ls1021a-esdhc mmc: cavium-thunderx: Use non-hybrid PCI devres API dt-bindings: mmc: mtk-sd: Add support for Dimensity 1200 MT6893 dt-bindings: mmc: sdhci-of-dwcmhsc: Add Sophgo SG2044 support ... commit 418da6ee1ea62090f6b66d95b8fcf7db2f42c00f Merge: c7c18635363f06 36795548dcc841 Author: Linus Torvalds Date: Tue May 27 16:19:30 2025 -0700 Merge tag 'pmdomain-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain updates from Ulf Hansson: "pmdomain core: - Add residency reflection for domain-idlestates to debugfs - Add genpd helper to correct the usage/rejected counters pmdomain providers: - mediatek: Add support for Dimensity 1200 MT6893 - qcom: Add support for SM4450 power domains - rockchip: Add support for RK3562 SoC - sunxi: Add support for Allwinner H6/H616 PRCM PPU - ti: Fix STANDBY handling of OMAP2+ PER power domain cpuidle-psci: - Correct the domain-idlestate statistics in debugfs" * tag 'pmdomain-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: (23 commits) pmdomain: ti: Fix STANDBY handling of PER power domain pmdomain: amlogic: Constify some structures pmdomain: core: Use genpd->opp_table to simplify error/remove path pmdomain: core: Simplify return statement in genpd_power_off() pmdomain: core: Convert genpd_power_off() to void pmdomain: core: Convert to device_awake_path() pmdomain: mediatek: Add error messages for missing regmaps pmdomain: arm: Do not enable by default during compile testing pmdomain: qcom: rpmhpd: Add SM4450 power domains dt-bindings: power: qcom,rpmpd: Add SM4450 compatible pmdomain: sunxi: add H6 PRCM PPU driver dt-bindings: power: Add Allwinner H6/H616 PRCM PPU pmdomain: bcm: bcm2835-power: Use devm_clk_get_optional pmdomain: rockchip: Add support for RK3562 SoC dt-bindings: power: rockchip: Add support for RK3562 SoC pmdomain: mediatek: Add support for Dimensity 1200 MT6893 pmdomain: mediatek: Bump maximum bus protect data array elements dt-bindings: power: mediatek: Support Dimensity 1200 MT6893 MTCMOS pmdomain: core: Reset genpd->states to avoid freeing invalid data pmdomain: core: Add residency reflection for domain-idlestates to debugfs ... commit c7c18635363f06c1943514c2f4c8170b325302e8 Merge: 5722a6cecfff3e b1d8766052eb05 Author: Linus Torvalds Date: Tue May 27 16:14:56 2025 -0700 Merge tag 'for-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply and reset updates from Sebastian Reichel: "Power-supply core: - support charge_types in extensions Power-supply drivers: - new driver for Pegatron Chagall battery - new driver for Maxim MAX8971 charger - new driver for Huawei Matebook E Go - bq27xxx: retry failed I2C transmissions - bq24190: add BQ24193 support - misc small cleanups and fixes Reset drivers: - new driver for Toradex SMARC Embedded Controller - reboot-mode: add support for modes containing / in DT - atmel,at91sam9260-reset: support sama7d65 - syscon-reboot: add Google GS101 support - misc small cleanups and fixes" * tag 'for-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (28 commits) power: supply: rt9471: Simplify definition of some struct linear_range power: supply: max77976: add EXTCON dependency power: supply: Add support for Maxim MAX8971 charger dt-bindings: power: supply: Document Maxim MAX8971 charger power: supply: max17040: adjust thermal channel scaling power: reset: syscon-reboot: add gs101-specific reset dt-bindings: reset: syscon-reboot: add google,gs101-reboot power: supply: add Huawei Matebook E Go psy driver power: supply: Add driver for Pegatron Chagall battery dt-bindings: power: supply: Document Pegatron Chagall fuel gauge dt-bindings: vendor-prefixes: add prefix for Pegatron Corporation power: supply: cros_charge-control: Avoid -Wflex-array-member-not-at-end warning power: reset: add Toradex Embedded Controller dt-bindings: power: reset: add toradex,smarc-ec power: supply: support charge_types in extensions power: supply: max77705: Fix workqueue error handling in probe power: supply: wm831x: Constify struct chg_map and some arrays power: bq24190: Add BQ24193 support dt-bindings: power: supply: bq24190: Add BQ24193 compatible power: supply: sysfs: Remove duplicate NUL termination ... commit 5722a6cecfff3e381b96bbbd7e9b3911731e80d9 Merge: 350d9ab73654c4 b00d6864a4c948 Author: Linus Torvalds Date: Tue May 27 15:53:55 2025 -0700 Merge tag 'spi-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi updates from Mark Brown: "The bulk of the changes in this release are driver work, as well as new device support we have some important work on performance over several drivers, and big overhauls for maintainability on a couple too. Highlights include: - Big cleanups of the sh-msiof driver from Geert Uytterhoeven, and of the NXP FSPI driver from Haibo Chen - Performance improvements for the AXI SPI engine - Support for writes to memory mapped flashes on Renesas devices - Integrated DMA support for Tegra210 QSPI, used by the Tegra234 - DMA support for Amlogic SPI controllers - Support for AMD HID2, Qualcomm IPQ5018, Renesas RZ/G3E, Rockchip RK3528 and Samsung Exynos Autov920 An update to fix some issues with the Atmel QSPI driver runtime PM pulled in a new API from the PM core, and the Renesas memory mapped write changes pull in some code that's shared in drivers/memory" * tag 'spi-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (90 commits) spi: spi-qpic-snand: return early on error from qcom_spi_io_op() spi: loopback-test: fix up const pointer issue in rx_ranges_cmp() spi: gpio: fix const issue in spi_to_spi_gpio() spi: spi-qpic-snand: remove superfluous parameters of qcom_spi_check_error() dt-bindings: spi: samsung: add exynosautov920-spi compatible spi: spi-qpic-snand: reuse qcom_spi_check_raw_flash_errors() spi: dt-bindings: Add rk3528-spi compatible spi: spi_amd: Update Kconfig dependencies spi: spi_amd: Add HIDDMA basic write support spi: spi_amd: Remove read{q,b} usage on DMA buffer spi: sh-msiof: Move register definitions to spi: sh-msiof: Document frame start sync pulse mode spi: sh-msiof: Double maximum DMA transfer size using two groups spi: sh-msiof: Simplify BRG's Division Ratio spi: sh-msiof: Increase TX FIFO size for R-Car V4H/V4M spi: sh-msiof: Correct RX FIFO size for R-Car Gen3 spi: sh-msiof: Correct RX FIFO size for R-Car Gen2 spi: sh-msiof: Add core support for dual-group transfers spi: sh-msiof: Correct SIMDR2_GRPMASK spi: sh-msiof: SIFCTR bitfield conversion ... commit 350d9ab73654c47ea3cf6214ef2ccd159bf134ad Merge: c971f11dbf1bff dcd711021389c4 Author: Linus Torvalds Date: Tue May 27 15:49:58 2025 -0700 Merge tag 'regulator-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator updates from Mark Brown: "This is a very quiet release, there was no work on the core and a good chunk of the updates were the result of conversions to use newer GPIO APIs. We did gain support for Analog ADP5055 and TI TPS65214 devices, and there's a new restart handler for the PCA9450 which allows devices using it to be properly power cycled on reboot, but otherwise it's minor fixes and API updates" * tag 'regulator-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (24 commits) regulator: qcom_spmi: Constify struct spmi_voltage_range regulator: max8952: Correct Samsung "Electronics" spelling in copyright headers regulator: dt-bindings: mt6357: Drop fixed compatible requirement regulator: gpio: Use dev_err_probe regulator: pca9450: Add restart handler regulator: da9121: Fix Wvoid-pointer-to-enum-cast warning regulator: tps65219: Add TI TPS65214 Regulator Support regulator: tps65219: Add support for TPS65215 Regulator IRQs regulator: tps65219: Add support for TPS65215 regulator resources regulator: tps65219: Update struct names regulator: pf9453: convert to use maple tree register cache regulator: max20086: Change enable gpio to optional regulator: max20086: Fix MAX200086 chip id regulator: adp5055: Remove unneeded semicolon regulator: adp5055: remove duplicate device table regulator: adp5055: Add driver for adp5055 regulator: dt-bindings: adi,adp5055-regulator: Add adp5055 support regulator: don't compare raw GPIO descriptor pointers regulator: rpi-panel-attiny: use new GPIO line value setter callbacks regulator: rpi-panel-attiny: use lock guards for the state mutex ... commit c971f11dbf1bff3d1226b92015302326c7c292c3 Merge: aacc73ceeb8bf6 1c12fbdf40e17d Author: Linus Torvalds Date: Tue May 27 15:44:26 2025 -0700 Merge tag 'regmap-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap updates from Mark Brown: "This release we have one new feature, support for chips that report edge interrupts but don't provide distinct readback of that status per line, plus a few cleanups" * tag 'regmap-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: irq: Add support for chips without separate IRQ status regmap-irq: Use dedicated interrupt wake setters regmap: Move selecting for REGMAP_MDIO and REGMAP_IRQ regcache: Use sort()'s default swap() implementation commit aacc73ceeb8bf664426f0e53db2778a59325bd9f Merge: a9e6060bb2a6ca 8b8ef309093ff1 Author: Linus Torvalds Date: Tue May 27 15:22:01 2025 -0700 Merge tag 'gpio-updates-for-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio updates from Bartosz Golaszewski: "We have three new drivers, some refactoring in the GPIO core, lots of various changes across many drivers, new configfs interface for the virtual gpio-aggregator module and DT-bindings updates. The treewide conversion of GPIO drivers to using the new value setter callbacks is ongoing with another round of GPIO drivers updated. You will also see these commits coming in from other subsystems as with the relevant changes merged into mainline last cycle, I've started converting GPIO providers located elsewhere than drivers/gpio/. GPIO core: - use more lock guards where applicable - refactor GPIO ACPI code and shrink it in the process by 8% - move GPIO ACPI quirks into a separate file - remove unneeded #ifdef - convert GPIO devres helpers to using devm_add_action() where applicable which shrinks and simplifies the code - refactor GPIO descriptor validation in GPIO consumer interfaces - don't allow setting values on input lines in the GPIO core which will take off the burden from GPIO drivers of checking this down the line - provide gpiod_is_equal() as a way of safely comparing two GPIO descriptors (the only current user is in regulator core) New drivers: - add the GPIO module for the max77759 multifunction device - add the GPIO driver for the VeriSilicon BLZP1600 GPIO controller - add the GPIO driver for the Spacemit K1 SoC Driver improvements: - convert more drivers to using the new GPIO line value setter callbacks - convert more drivers to making the irq_chip immutable as is recommended by the interrupt subsystem - extend build testing coverage by enabling more modules to be built with COMPILE_TEST=y - extend the gpio-aggregator module with a configfs interface that makes the setup easier for user-space than the existing driver-level sysfs attributes and also adds more advanced configuration features (such as referring to aggregated lines by their original names or modifying their names as exposed by the aggregated chip) - add a missing mutex_destroy() in gpio-imx-scu - add an OF polarity quirk for s5m8767 - allow building gpio-vf610 as a loadable module - make gpio-mxc not hardcode its GPIO base number with GPIO SYSFS interface disabled (another small step towards getting rid of the global GPIO numberspace) - add support for level-triggered interrupts to gpio-pca953x - don't double-check the ngpios property in gpio-ds4520 as GPIO core already does it - don't double-check the number of GPIOs in gpio-imx-scu as GPIO core already does it - remove unused callbacks from gpio-max3191x DT bindings: - add device-tree bindings for max77759, spacemit,k1 and blzp1600 (new drivers added this cycle) - document more properties for gpio-vf610 and gpio-tegra186 - document a new pca95xx variant - fix style of examples in several GPIO DT-binding documents Misc: - TODO list updates" * tag 'gpio-updates-for-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (123 commits) gpio: timberdale: select GPIOLIB_IRQCHIP gpio: lpc18xx: select GPIOLIB_IRQCHIP gpio: grgpio: select GPIOLIB_IRQCHIP gpio: bcm-kona: select GPIOLIB_IRQCHIP dt-bindings: gpio: vf610: add ngpios and gpio-reserved-ranges gpio: davinci: select GPIOLIB_IRQCHIP gpiolib-acpi: Update file references in the Documentation and MAINTAINERS gpiolib: acpi: Move quirks to a separate file gpiolib: acpi: Add acpi_gpio_need_run_edge_events_on_boot() getter gpiolib: acpi: Handle deferred list via new API gpiolib: acpi: Make sure we fill struct acpi_gpio_info gpiolib: acpi: Switch to use enum in acpi_gpio_in_ignore_list() gpiolib: acpi: Use temporary variable for struct acpi_gpio_info gpiolib: remove unneeded #ifdef gpio: mpc8xxx: select GPIOLIB_IRQCHIP gpio: pxa: select GPIOLIB_IRQCHIP gpio: pxa: Make irq_chip immutable gpio: timberdale: Make irq_chip immutable gpio: xgene-sb: Make irq_chip immutable gpio: davinci: Make irq_chip immutable ... commit a9e6060bb2a6cae6d43a98ec0794844ad01273d3 Merge: 11147c16a6e064 534e9cf3782f1b Author: Linus Torvalds Date: Tue May 27 15:05:18 2025 -0700 Merge tag 'sound-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound updates from Takashi Iwai: "We've received a lot of activities in this cycle, mostly about leaf driver codes rather than the core part, but with a good mixture of code cleanups and new driver additions. Below are some highlights: ASoC: - Support for automatically enumerating DAIs from standards conforming SoundWire SDCA devices; not much used as of this writing, rather for future implementations - Conversion of quite a few drivers to newer GPIO APIs - Continued cleanups and helper usages in allover places - Support for a wider range of Intel AVS platforms - Support for AMD ACP 7.x platforms, Cirrus Logic CS35L63 and CS48L32 Everest Semiconductor ES8375 and ES8389, Longsoon-1 AC'97 controllers, nVidia Tegra264, Richtek ALC203 and RT9123 and Rockchip SAI controllers HD-audio: - Lots of cleanups of TAS2781 codec drivers - A new HD-audio control bound via ACPI for Nvidia - Support for Tegra264, Intel WCL, usual new codec quirks USB-audio: - Fix a race at removal of MIDI device - Pioneer DJM-V10 support, Scarlett2 driver cleanups Misc: - Cleanups of deprecated PCI functions - Removal of unused / dead function codes" * tag 'sound-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (364 commits) firmware: cs_dsp: Fix OOB memory read access in KUnit test ASoC: codecs: add support for ES8375 ASoC: dt-bindings: Add Everest ES8375 audio CODEC ALSA: hda: acpi: Make driver's match data const static ALSA: hda: acpi: Use SYSTEM_SLEEP_PM_OPS() ALSA: atmel: Replace deprecated strcpy() with strscpy() ALSA: core: fix up bus match const issues. ASoC: wm_adsp: Make cirrus_dir const ASoC: tegra: Tegra264 support in isomgr_bw ASoC: tegra: AHUB: Add Tegra264 support ASoC: tegra: ADX: Add Tegra264 support ASoC: tegra: AMX: Add Tegra264 support ASoC: tegra: I2S: Add Tegra264 support ASoC: tegra: Update PLL rate for Tegra264 ASoC: tegra: ASRC: Update ARAM address ASoC: tegra: ADMAIF: Add Tegra264 support ASoC: tegra: CIF: Add Tegra264 support dt-bindings: ASoC: Document Tegra264 APE support dt-bindings: ASoC: admaif: Add missing properties ASoC: dt-bindings: audio-graph-card2: reference audio-graph routing property ... commit 11147c16a6e0649cc95f8bb90302e4a99ece30bc Merge: d48d8380d92ba2 c0c980f237e822 Author: Linus Torvalds Date: Tue May 27 15:01:47 2025 -0700 Merge tag 'pwm/for-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux Pull pwm updates from Uwe Kleine-König: "This time around the pwm changes for the next release contain three new drivers (loongson, mc33xs2410 and rzg2l-gpt) and the usual collection of cleanups in both the core and drivers, support for new variants in existing drivers, conversion of dt bindings to yaml and documentation updates. Thanks for contributions and reviews go to Alexey Charkov, AngeloGioacchino Del Regno, Bartosz Golaszewski, Biju Das, Binbin Zhou, Dan Carpenter, Dimitri Fedrau, Geert Uytterhoeven, George Stark, Huacai Chen, Juxin Gao, Krzysztof Kozlowski, Kuninori Morimoto, Laurent Pinchart, Neil Armstrong, Nuno Sá, Rob Herring, and Trevor Gamblin" * tag 'pwm/for-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux: (39 commits) dt-bindings: timer: renesas,tpu: remove binding documentation pwm: adp5585: make sure to include mod_devicetable.h pwm: Tidyup PWM menu for Renesas pwm: Restore alphabetic ordering in Kconfig and Makefile pwm: Formally describe the procedure used to pick a hardware waveform setting pwm: Let pwm_set_waveform_might_sleep() return 0 instead of 1 after rounding up pwm: Let pwm_set_waveform_might_sleep() fail for exact but impossible requests ARM: shmobile: defconfig: Enable more support for RZN1D-DB/EB arm64: defconfig: Add Renesas MSIOF sound support arm64: defconfig: Enable Renesas RZ/G2L GPT config pwm: add support for NXPs high-side switch MC33XS2410 dt-bindings: pwm: add support for MC33XS2410 pwm: rzg2l-gpt: Accept requests for too high period length dt-bindings: pwm: vt8500-pwm: Convert to YAML dt-bindings: pwm: mediatek,pwm-disp: Add compatible for MT6893 pwm: Fix various formatting issues in kernel-doc pwm: Add support for RZ/G2L GPT dt-bindings: pwm: Add RZ/G2L GPT binding pwm: Better document return value of pwm_round_waveform_might_sleep() pwm: loongson: Fix an error code in probe() ... commit d48d8380d92ba2db4fcf81c566093276dbbb4ebc Merge: bad14b5d2c9520 3e552ccf405c0d Author: Linus Torvalds Date: Tue May 27 14:54:35 2025 -0700 Merge tag 'chrome-platform-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux Pull chrome-platform updates from Tzung-Bi Shih: "New: - Support MT8192 Spherion and MT8186 Corsola devices in of_hw_prober - Turn cros_ec_proto from bool into tristate - Support Pin Assignment E in cros_ec_typec for USB-C to DP cables Improvements: - Avoid -Wflex-array-member-not-at-end warnings Cleanups: - Remove a redundant dependency in Kconfig for cros_kbd_led_backlight" * tag 'chrome-platform-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: platform/chrome: kunit: Avoid -Wflex-array-member-not-at-end platform/chrome: cros_ec_typec: Set Pin Assignment E in DP PORT VDO platform/chrome: of_hw_prober: Support touchscreen probing on Squirtle platform/chrome: of_hw_prober: Support trackpad probing on Corsola family platform/chrome: cros_kbd_led_backlight: Fix build dependencies platform/chrome: cros_kbd_led_backlight: Remove CROS_EC dependency platform/chrome: cros_ec_proto: Allow to build as module platform/chrome: cros_ec_debugfs: Avoid -Wflex-array-member-not-at-end warnings platform/chrome: cros_kbd_led_backlight: Avoid -Wflex-array-member-not-at-end warnings platform/chrome: cros_ec_proto: Avoid -Wflex-array-member-not-at-end warnings platform/chrome: of_hw_prober: Support Google Spherion commit bad14b5d2c9520740f3411182d833ff15f130e26 Author: Linus Torvalds Date: Tue May 27 14:40:30 2025 -0700 Remove legacy 'cc-disable-warning' use from the generic build scripts This just converts the 'cc-disable-warning' uses in the generic makefile extrawarn script to use the plain 'cc-option' form instead. Partly to clean things up, and partly just to have the new form get some proper test coverage. I'll leave the various random other uses of 'cc-disable-warning' alone and let subsystem maintainers decide if they want to convert to the new unified model. Signed-off-by: Linus Torvalds commit 550ccb178de2f379f5e1a1833dd6f4bdafef4b68 Author: Linus Torvalds Date: Tue May 27 14:35:51 2025 -0700 Make 'cc-option' work correctly for the -Wno-xyzzy pattern This is the follow-up to commit a79be02bba5c ("Fix mis-uses of 'cc-option' for warning disablement") where I mentioned that the best fix would be to just make 'cc-option' a bit smarter, and work for all compiler options, including the '-Wno-xyzzy' pattern that it used to accept unknown options for. It turns out that fixing cc-option is pretty straightforward: just rewrite any '-Wno-xyzzy' option pattern to use '-Wxyzzy' instead for testing. That makes the whole artificial distinction between 'cc-option' and 'cc-disable-warning' go away, and we can happily forget about the odd build rule that you have to treat compiler options that disable warnings specially. The 'cc-disable-warning' helper remains as a backwards compatibility syntax for now, but is implemented in terms of the new and improved cc-option. Acked-by: Masahiro Yamada Cc: Greg Kroah-Hartman Cc: Arnd Bergmann Cc: Stephen Rothwell Cc: Thomas Weißschuh Cc: Nathan Chancellor Signed-off-by: Linus Torvalds commit 5ffb537e416ee22dbfb3d552102e50da33fec7f6 Author: Yonghong Song Date: Fri May 23 21:13:40 2025 -0700 selftests/bpf: Add tests with stack ptr register in conditional jmp Add two tests: - one test has 'rX r10' where rX is not r10, and - another test has 'rX rY' where rX and rY are not r10 but there is an early insn 'rX = r10'. Without previous verifier change, both tests will fail. Signed-off-by: Yonghong Song Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250524041340.4046304-1-yonghong.song@linux.dev commit e2d2115e56c4a02377189bfc3a9a7933552a7b0f Author: Yonghong Song Date: Fri May 23 21:13:35 2025 -0700 bpf: Do not include stack ptr register in precision backtracking bookkeeping Yi Lai reported an issue ([1]) where the following warning appears in kernel dmesg: [ 60.643604] verifier backtracking bug [ 60.643635] WARNING: CPU: 10 PID: 2315 at kernel/bpf/verifier.c:4302 __mark_chain_precision+0x3a6c/0x3e10 [ 60.648428] Modules linked in: bpf_testmod(OE) [ 60.650471] CPU: 10 UID: 0 PID: 2315 Comm: test_progs Tainted: G OE 6.15.0-rc4-gef11287f8289-dirty #327 PREEMPT(full) [ 60.654385] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE [ 60.656682] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 60.660475] RIP: 0010:__mark_chain_precision+0x3a6c/0x3e10 [ 60.662814] Code: 5a 30 84 89 ea e8 c4 d9 01 00 80 3d 3e 7d d8 04 00 0f 85 60 fa ff ff c6 05 31 7d d8 04 01 48 c7 c7 00 58 30 84 e8 c4 06 a5 ff <0f> 0b e9 46 fa ff ff 48 ... [ 60.668720] RSP: 0018:ffff888116cc7298 EFLAGS: 00010246 [ 60.671075] RAX: 54d70e82dfd31900 RBX: ffff888115b65e20 RCX: 0000000000000000 [ 60.673659] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 00000000ffffffff [ 60.676241] RBP: 0000000000000400 R08: ffff8881f6f23bd3 R09: 1ffff1103ede477a [ 60.678787] R10: dffffc0000000000 R11: ffffed103ede477b R12: ffff888115b60ae8 [ 60.681420] R13: 1ffff11022b6cbc4 R14: 00000000fffffff2 R15: 0000000000000001 [ 60.684030] FS: 00007fc2aedd80c0(0000) GS:ffff88826fa8a000(0000) knlGS:0000000000000000 [ 60.686837] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 60.689027] CR2: 000056325369e000 CR3: 000000011088b002 CR4: 0000000000370ef0 [ 60.691623] Call Trace: [ 60.692821] [ 60.693960] ? __pfx_verbose+0x10/0x10 [ 60.695656] ? __pfx_disasm_kfunc_name+0x10/0x10 [ 60.697495] check_cond_jmp_op+0x16f7/0x39b0 [ 60.699237] do_check+0x58fa/0xab10 ... Further analysis shows the warning is at line 4302 as below: 4294 /* static subprog call instruction, which 4295 * means that we are exiting current subprog, 4296 * so only r1-r5 could be still requested as 4297 * precise, r0 and r6-r10 or any stack slot in 4298 * the current frame should be zero by now 4299 */ 4300 if (bt_reg_mask(bt) & ~BPF_REGMASK_ARGS) { 4301 verbose(env, "BUG regs %x\n", bt_reg_mask(bt)); 4302 WARN_ONCE(1, "verifier backtracking bug"); 4303 return -EFAULT; 4304 } With the below test (also in the next patch): __used __naked static void __bpf_jmp_r10(void) { asm volatile ( "r2 = 2314885393468386424 ll;" "goto +0;" "if r2 <= r10 goto +3;" "if r1 >= -1835016 goto +0;" "if r2 <= 8 goto +0;" "if r3 <= 0 goto +0;" "exit;" ::: __clobber_all); } SEC("?raw_tp") __naked void bpf_jmp_r10(void) { asm volatile ( "r3 = 0 ll;" "call __bpf_jmp_r10;" "r0 = 0;" "exit;" ::: __clobber_all); } The following is the verifier failure log: 0: (18) r3 = 0x0 ; R3_w=0 2: (85) call pc+2 caller: R10=fp0 callee: frame1: R1=ctx() R3_w=0 R10=fp0 5: frame1: R1=ctx() R3_w=0 R10=fp0 ; asm volatile (" \ @ verifier_precision.c:184 5: (18) r2 = 0x20202000256c6c78 ; frame1: R2_w=0x20202000256c6c78 7: (05) goto pc+0 8: (bd) if r2 <= r10 goto pc+3 ; frame1: R2_w=0x20202000256c6c78 R10=fp0 9: (35) if r1 >= 0xffe3fff8 goto pc+0 ; frame1: R1=ctx() 10: (b5) if r2 <= 0x8 goto pc+0 mark_precise: frame1: last_idx 10 first_idx 0 subseq_idx -1 mark_precise: frame1: regs=r2 stack= before 9: (35) if r1 >= 0xffe3fff8 goto pc+0 mark_precise: frame1: regs=r2 stack= before 8: (bd) if r2 <= r10 goto pc+3 mark_precise: frame1: regs=r2,r10 stack= before 7: (05) goto pc+0 mark_precise: frame1: regs=r2,r10 stack= before 5: (18) r2 = 0x20202000256c6c78 mark_precise: frame1: regs=r10 stack= before 2: (85) call pc+2 BUG regs 400 The main failure reason is due to r10 in precision backtracking bookkeeping. Actually r10 is always precise and there is no need to add it for the precision backtracking bookkeeping. One way to fix the issue is to prevent bt_set_reg() if any src/dst reg is r10. Andrii suggested to go with push_insn_history() approach to avoid explicitly checking r10 in backtrack_insn(). This patch added push_insn_history() support for cond_jmp like 'rX rY' operations. In check_cond_jmp_op(), if any of rX or rY is a stack pointer, push_insn_history() will record such information, and later backtrack_insn() will do bt_set_reg() properly for those register(s). [1] https://lore.kernel.org/bpf/Z%2F8q3xzpU59CIYQE@ly-workstation/ Reported by: Yi Lai Fixes: 407958a0e980 ("bpf: encapsulate precision backtracking bookkeeping") Signed-off-by: Yonghong Song Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250524041335.4046126-1-yonghong.song@linux.dev commit 0e71bcdcf1f0b10b435932907fb0d205deecf7a0 Author: Namhyung Kim Date: Fri May 23 17:27:54 2025 -0700 perf test: Add AMD IBS sw filter test The kernel v6.14 added 'swfilt' to support privilege filtering in software so that IBS can be used by regular users. Add a test case in x86 to verify the behavior. $ sudo perf test -vv 'IBS software filter' 113: AMD IBS software filtering: --- start --- test child forked, pid 178826 check availability of IBS swfilt run perf record with modifier and swfilt [ perf record: Woken up 3 times to write data ] [ perf record: Captured and wrote 0.000 MB /dev/null ] [ perf record: Woken up 3 times to write data ] [ perf record: Captured and wrote 0.000 MB /dev/null ] [ perf record: Woken up 3 times to write data ] [ perf record: Captured and wrote 0.000 MB /dev/null ] [ perf record: Woken up 0 times to write data ] [ perf record: Captured and wrote 0.000 MB /dev/null ] check number of samples with swfilt [ perf record: Woken up 3 times to write data ] [ perf record: Captured and wrote 0.037 MB - ] [ perf record: Woken up 3 times to write data ] [ perf record: Captured and wrote 0.041 MB - ] ---- end(0) ---- 113: AMD IBS software filtering : Ok Reviewed-by: Ravi Bangoria Signed-off-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo # On a 9950x3d Cc: Adrian Hunter Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250524002754.1266681-1-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit fa9b3578ed628641504ab74958bbe36a42c2615a Author: Yicong Yang Date: Fri Apr 25 11:38:45 2025 +0800 perf mem: Count L2 HITM for c2c statistic L2 HITM is not counted in c2c statistic decoding. Count it for lcl_hitm like how we handle L2 Peer snoop. Reviewed-by: Leo Yan Signed-off-by: Yicong Yang Cc: CaiJingtao Cc: Catalin Marinas Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Jonathan Cameron Cc: Junhao He Cc: Leo Yan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Cc: Yushan Wang Cc: Zeng Tao Cc: xueshan2@huawei.com Link: https://lore.kernel.org/r/20250425033845.57671-4-yangyicong@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit 846b62b3433d2e87018576ab386f7a96390f66e4 Author: Yicong Yang Date: Fri Apr 25 11:38:44 2025 +0800 perf arm-spe: Add support for SPE Data Source packet on HiSilicon HIP12 Add data source encoding for HiSilicon HIP12 and coresponding mapping to the perf's memory data source. This will help to synthesize the data and support upper layer tools like perf-mem and perf-c2c. Reviewed-by: Leo Yan Signed-off-by: Yicong Yang Cc: CaiJingtao Cc: Catalin Marinas Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Jonathan Cameron Cc: Junhao He Cc: Leo Yan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Cc: Yushan Wang Cc: Zeng Tao Cc: xueshan2@huawei.com Link: https://lore.kernel.org/r/20250425033845.57671-3-yangyicong@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit a39a3fbe312619fe2ccef0b17e5f53dff011fb1a Author: Rob Herring (Arm) Date: Tue May 27 15:21:09 2025 -0500 dt-bindings: arm/cpus: Allow 2 power-domains entries Some platforms have both "perf" and "psci" power domains, so allow 2 entries. Signed-off-by: Rob Herring (Arm) commit 6579a03e68ffa5feb2d2823dea16ca7466f6de16 Author: Damon Ding Date: Sun Mar 2 16:30:43 2025 +0800 drm/bridge: analogix_dp: Remove the unnecessary calls to clk_disable_unprepare() during probing With the commit f37952339cc2 ("drm/bridge: analogix_dp: handle clock via runtime PM"), the PM operations can help enable/disable the clock. The err_disable_clk label and clk_disable_unprepare() operations are no longer necessary because the analogix_dp_resume() will not be called during probing. Fixes: f37952339cc2 ("drm/bridge: analogix_dp: handle clock via runtime PM") Suggested-by: Douglas Anderson Reviewed-by: Douglas Anderson Signed-off-by: Damon Ding Reviewed-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250302083043.3197235-1-damon.ding@rock-chips.com Signed-off-by: Dmitry Baryshkov commit be9b3f9a54101c19226c25ba7163d291183777a0 Author: Nicolas Frattaroli Date: Tue May 27 19:57:08 2025 +0200 drm/connector: only call HDMI audio helper plugged cb if non-null On driver remove, sound/soc/codecs/hdmi-codec.c calls the plugged_cb with NULL as the callback function and codec_dev, as seen in its hdmi_remove function. The HDMI audio helper then happily tries calling said null function pointer, and produces an Oops as a result. Fix this by only executing the callback if fn is non-null. This means the .plugged_cb and .plugged_cb_dev members still get appropriately cleared. Fixes: baf616647fe6 ("drm/connector: implement generic HDMI audio helpers") Signed-off-by: Nicolas Frattaroli Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250527-hdmi-audio-helper-remove-fix-v1-1-6cf77de364d8@collabora.com Signed-off-by: Dmitry Baryshkov commit c98cc9797b7009308fff73d41bc1d08642dab77a Author: Steven Rostedt Date: Tue May 27 10:58:20 2025 -0400 ring-buffer: Move cpus_read_lock() outside of buffer->mutex Running a modified trace-cmd record --nosplice where it does a mmap of the ring buffer when '--nosplice' is set, caused the following lockdep splat: ====================================================== WARNING: possible circular locking dependency detected 6.15.0-rc7-test-00002-gfb7d03d8a82f #551 Not tainted ------------------------------------------------------ trace-cmd/1113 is trying to acquire lock: ffff888100062888 (&buffer->mutex){+.+.}-{4:4}, at: ring_buffer_map+0x11c/0xe70 but task is already holding lock: ffff888100a5f9f8 (&cpu_buffer->mapping_lock){+.+.}-{4:4}, at: ring_buffer_map+0xcf/0xe70 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #5 (&cpu_buffer->mapping_lock){+.+.}-{4:4}: __mutex_lock+0x192/0x18c0 ring_buffer_map+0xcf/0xe70 tracing_buffers_mmap+0x1c4/0x3b0 __mmap_region+0xd8d/0x1f70 do_mmap+0x9d7/0x1010 vm_mmap_pgoff+0x20b/0x390 ksys_mmap_pgoff+0x2e9/0x440 do_syscall_64+0x79/0x1c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e -> #4 (&mm->mmap_lock){++++}-{4:4}: __might_fault+0xa5/0x110 _copy_to_user+0x22/0x80 _perf_ioctl+0x61b/0x1b70 perf_ioctl+0x62/0x90 __x64_sys_ioctl+0x134/0x190 do_syscall_64+0x79/0x1c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e -> #3 (&cpuctx_mutex){+.+.}-{4:4}: __mutex_lock+0x192/0x18c0 perf_event_init_cpu+0x325/0x7c0 perf_event_init+0x52a/0x5b0 start_kernel+0x263/0x3e0 x86_64_start_reservations+0x24/0x30 x86_64_start_kernel+0x95/0xa0 common_startup_64+0x13e/0x141 -> #2 (pmus_lock){+.+.}-{4:4}: __mutex_lock+0x192/0x18c0 perf_event_init_cpu+0xb7/0x7c0 cpuhp_invoke_callback+0x2c0/0x1030 __cpuhp_invoke_callback_range+0xbf/0x1f0 _cpu_up+0x2e7/0x690 cpu_up+0x117/0x170 cpuhp_bringup_mask+0xd5/0x120 bringup_nonboot_cpus+0x13d/0x170 smp_init+0x2b/0xf0 kernel_init_freeable+0x441/0x6d0 kernel_init+0x1e/0x160 ret_from_fork+0x34/0x70 ret_from_fork_asm+0x1a/0x30 -> #1 (cpu_hotplug_lock){++++}-{0:0}: cpus_read_lock+0x2a/0xd0 ring_buffer_resize+0x610/0x14e0 __tracing_resize_ring_buffer.part.0+0x42/0x120 tracing_set_tracer+0x7bd/0xa80 tracing_set_trace_write+0x132/0x1e0 vfs_write+0x21c/0xe80 ksys_write+0xf9/0x1c0 do_syscall_64+0x79/0x1c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e -> #0 (&buffer->mutex){+.+.}-{4:4}: __lock_acquire+0x1405/0x2210 lock_acquire+0x174/0x310 __mutex_lock+0x192/0x18c0 ring_buffer_map+0x11c/0xe70 tracing_buffers_mmap+0x1c4/0x3b0 __mmap_region+0xd8d/0x1f70 do_mmap+0x9d7/0x1010 vm_mmap_pgoff+0x20b/0x390 ksys_mmap_pgoff+0x2e9/0x440 do_syscall_64+0x79/0x1c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e other info that might help us debug this: Chain exists of: &buffer->mutex --> &mm->mmap_lock --> &cpu_buffer->mapping_lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&cpu_buffer->mapping_lock); lock(&mm->mmap_lock); lock(&cpu_buffer->mapping_lock); lock(&buffer->mutex); *** DEADLOCK *** 2 locks held by trace-cmd/1113: #0: ffff888106b847e0 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x192/0x390 #1: ffff888100a5f9f8 (&cpu_buffer->mapping_lock){+.+.}-{4:4}, at: ring_buffer_map+0xcf/0xe70 stack backtrace: CPU: 5 UID: 0 PID: 1113 Comm: trace-cmd Not tainted 6.15.0-rc7-test-00002-gfb7d03d8a82f #551 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: dump_stack_lvl+0x6e/0xa0 print_circular_bug.cold+0x178/0x1be check_noncircular+0x146/0x160 __lock_acquire+0x1405/0x2210 lock_acquire+0x174/0x310 ? ring_buffer_map+0x11c/0xe70 ? ring_buffer_map+0x11c/0xe70 ? __mutex_lock+0x169/0x18c0 __mutex_lock+0x192/0x18c0 ? ring_buffer_map+0x11c/0xe70 ? ring_buffer_map+0x11c/0xe70 ? function_trace_call+0x296/0x370 ? __pfx___mutex_lock+0x10/0x10 ? __pfx_function_trace_call+0x10/0x10 ? __pfx___mutex_lock+0x10/0x10 ? _raw_spin_unlock+0x2d/0x50 ? ring_buffer_map+0x11c/0xe70 ? ring_buffer_map+0x11c/0xe70 ? __mutex_lock+0x5/0x18c0 ring_buffer_map+0x11c/0xe70 ? do_raw_spin_lock+0x12d/0x270 ? find_held_lock+0x2b/0x80 ? _raw_spin_unlock+0x2d/0x50 ? rcu_is_watching+0x15/0xb0 ? _raw_spin_unlock+0x2d/0x50 ? trace_preempt_on+0xd0/0x110 tracing_buffers_mmap+0x1c4/0x3b0 __mmap_region+0xd8d/0x1f70 ? ring_buffer_lock_reserve+0x99/0xff0 ? __pfx___mmap_region+0x10/0x10 ? ring_buffer_lock_reserve+0x99/0xff0 ? __pfx_ring_buffer_lock_reserve+0x10/0x10 ? __pfx_ring_buffer_lock_reserve+0x10/0x10 ? bpf_lsm_mmap_addr+0x4/0x10 ? security_mmap_addr+0x46/0xd0 ? lock_is_held_type+0xd9/0x130 do_mmap+0x9d7/0x1010 ? 0xffffffffc0370095 ? __pfx_do_mmap+0x10/0x10 vm_mmap_pgoff+0x20b/0x390 ? __pfx_vm_mmap_pgoff+0x10/0x10 ? 0xffffffffc0370095 ksys_mmap_pgoff+0x2e9/0x440 do_syscall_64+0x79/0x1c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fb0963a7de2 Code: 00 00 00 0f 1f 44 00 00 41 f7 c1 ff 0f 00 00 75 27 55 89 cd 53 48 89 fb 48 85 ff 74 3b 41 89 ea 48 89 df b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 76 5b 5d c3 0f 1f 00 48 8b 05 e1 9f 0d 00 64 RSP: 002b:00007ffdcc8fb878 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb0963a7de2 RDX: 0000000000000001 RSI: 0000000000001000 RDI: 0000000000000000 RBP: 0000000000000001 R08: 0000000000000006 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffdcc8fbe68 R14: 00007fb096628000 R15: 00005633e01a5c90 The issue is that cpus_read_lock() is taken within buffer->mutex. The memory mapped pages are taken with the mmap_lock held. The buffer->mutex is taken within the cpu_buffer->mapping_lock. There's quite a chain with all these locks, where the deadlock can be fixed by moving the cpus_read_lock() outside the taking of the buffer->mutex. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Vincent Donnefort Link: https://lore.kernel.org/20250527105820.0f45d045@gandalf.local.home Fixes: 117c39200d9d7 ("ring-buffer: Introducing ring-buffer mapping functions") Signed-off-by: Steven Rostedt (Google) commit 577ce77c84189bb227813bc43e26a37a8d0b316d Author: Radhey Shyam Pandey Date: Fri May 16 18:48:36 2025 +0530 dt-bindings: usb: dwc3-xilinx: allow dma-coherent On Versal Gen 2 SoC the LPD USB DMA controller is coherent with the CPU so allow specifying the information. Signed-off-by: Radhey Shyam Pandey Link: https://lore.kernel.org/r/1747401516-286356-1-git-send-email-radhey.shyam.pandey@amd.com Signed-off-by: Rob Herring (Arm) commit 08fbd355be3d60c98dbab082df70f9d8d252a298 Author: Alexander Stein Date: Thu May 15 16:29:42 2025 +0200 media: dt-bindings: sony,imx219: Allow props from video-interface-devices Allow properties from video-interface-devices. The change is identical to commit b6339ecfd0865 ("media: dt-bindings: sony,imx290: Allow props from video-interface-devices") Signed-off-by: Alexander Stein Reviewed-by: Jai Luthra Link: https://lore.kernel.org/r/20250515142945.1348722-1-alexander.stein@ew.tq-group.com Signed-off-by: Rob Herring (Arm) commit 3e188f8f68be1bdc97936051d34bb88172d0254e Author: Krzysztof Kozlowski Date: Mon May 19 10:04:54 2025 +0200 dt-bindings: soundwire: qcom: Document v2.1.0 version of IP block All Qualcomm SoC Soundwire controllers are version-detectable (even 1.x), however certain unidentified quirks might be potentially needed, so document v2.1 version used on Qualcomm SM8650 and SM8750 SoCs, fallbacking to v2.0. Suggested-by: Konrad Dybcio Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250519080453.29858-2-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring (Arm) commit 368556dd234dc4a506a35a0c99c0eee2ab475c77 Author: Kees Cook Date: Mon Apr 21 13:41:57 2025 -0700 wifi: iwlwifi: mld: Work around Clang loop unrolling bug The nested loop in iwl_mld_send_proto_offload() confuses Clang into thinking there could be a final loop iteration past the end of the "nsc" array (which is only 4 entries). The FORTIFY checking in memcmp() (via ipv6_addr_cmp()) notices this (due to the available bytes in the out-of-bounds position of &nsc[4] being 0), and errors out, failing the build. For some reason (likely due to architectural loop unrolling configurations), this is only exposed on ARM builds currently. Due to Clang's lack of inline tracking[1], the warning is not very helpful: include/linux/fortify-string.h:719:4: error: call to '__read_overflow' declared with 'error' attribute: detected read beyond size of object (1st parameter) 719 | __read_overflow(); | ^ 1 error generated. But this was tracked down to iwl_mld_send_proto_offload()'s ipv6_addr_cmp() call. An upstream Clang bug has been filed[2] to track this. For now fix the build by explicitly bounding the inner loop by "n_nsc", which is what "c" is already limited to. Reported-by: Nathan Chancellor Closes: https://github.com/ClangBuiltLinux/linux/issues/2076 Link: https://github.com/llvm/llvm-project/pull/73552 [1] Link: https://github.com/llvm/llvm-project/issues/136603 [2] Link: https://lore.kernel.org/r/20250421204153.work.935-kees@kernel.org Signed-off-by: Kees Cook commit cf0da5b0e00ed24e39b7ee64537e530c6cf7fc77 Author: Frank Li Date: Thu May 22 15:47:31 2025 -0400 dt-bindings: watchdog: fsl-imx-wdt: add compatible string fsl,ls1021a-wdt Add compatible string fsl,ls1021a-wdt for ls1021a SoC. fsl,ls1021a-wdt allow big-endian property. Signed-off-by: Frank Li Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250522194732.493624-1-Frank.Li@nxp.com Signed-off-by: Rob Herring (Arm) commit b18d797fa4e85b3a4a3a3e0a3c712210f88698ae Author: Rob Herring (Arm) Date: Wed May 7 16:58:51 2025 -0500 dt-bindings: pinctrl: amlogic,pinctrl-a4: Add missing constraint on allowed 'group' node properties The "^group-[0-9a-z-]+$" nodes schema doesn't constrain the allowed properties as the referenced common schemas don't have constraints. Add the missing "unevaluatedProperties" constraint. Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250507215852.2748420-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 5722bcd7d373768f9a20517ce271f661bb9bb258 Merge: 015a99fa76650e a1d98e4ffb972a Author: Christian Brauner Date: Tue May 27 21:06:30 2025 +0200 Merge patch series "dropbehind fixes and cleanups" Jens Axboe says: As per the thread here: https://lore.kernel.org/linux-fsdevel/20250525083209.GS2023217@ZenIV/ there was an issue with the dropbehind support, and hence it got reverted (effectively) for the 6.15 kernel release. The problem stems from the fact that the folio can get redirtied and/or scheduled for writeback after the initial dropbehind test, and before we have it locked again for invalidation. Patches 1+2 add a generic helper that both the read and write side can use, and which checks for !dirty && !writeback before going ahead with the invalidation. Patch 3 reverts the FOP_DONTCACHE disable, and patches 4 and 5 do a bit of cleanup work to further unify how the read and write side handling works. This can reasonably be considered a 2 part series, as 1-3 fix the issue and could go to stable, while 4-5 just cleanup the code. * patches from https://lore.kernel.org/20250527133255.452431-1-axboe@kernel.dk: mm/filemap: unify dropbehind flag testing and clearing mm/filemap: unify read/write dropbehind naming Revert "Disable FOP_DONTCACHE for now due to bugs" mm/filemap: use filemap_end_dropbehind() for read invalidation mm/filemap: gate dropbehind invalidate on folio !dirty && !writeback Link: https://lore.kernel.org/20250527133255.452431-1-axboe@kernel.dk Signed-off-by: Christian Brauner commit a1d98e4ffb972ab007f5de850ef53c2a46cacf15 Author: Jens Axboe Date: Tue May 27 07:28:56 2025 -0600 mm/filemap: unify dropbehind flag testing and clearing The read and write side does this a bit differently, unify it such that the _{read,write} helpers check the bit before locking, and the generic handler is in charge of clearing the bit and invalidating, once under the folio lock. Signed-off-by: Jens Axboe Link: https://lore.kernel.org/20250527133255.452431-6-axboe@kernel.dk Signed-off-by: Christian Brauner commit 1da7a06d9ce4edea3370945af8bfcc71b7744788 Author: Jens Axboe Date: Tue May 27 07:28:55 2025 -0600 mm/filemap: unify read/write dropbehind naming The read side is filemap_end_dropbehind_read(), while the write side used folio_ as the prefix rather than filemap_. The read side makes more sense, unify the naming such that the write side follows that. Signed-off-by: Jens Axboe Link: https://lore.kernel.org/20250527133255.452431-5-axboe@kernel.dk Signed-off-by: Christian Brauner commit 7b2b67dbd449afd00fc7279b1ab7ffa3d26fe0c9 Author: Jens Axboe Date: Tue May 27 07:28:54 2025 -0600 Revert "Disable FOP_DONTCACHE for now due to bugs" This reverts commit 478ad02d6844217cc7568619aeb0809d93ade43d. Both the read and write side dirty && writeback races should be resolved now, revert the commit that disabled FOP_DONTCACHE for filesystems. Link: https://lore.kernel.org/linux-fsdevel/20250525083209.GS2023217@ZenIV/ Signed-off-by: Jens Axboe Link: https://lore.kernel.org/20250527133255.452431-4-axboe@kernel.dk Signed-off-by: Christian Brauner commit 25b065a744ff0c1099bb357be1c40030b5a14c07 Author: Jens Axboe Date: Tue May 27 07:28:53 2025 -0600 mm/filemap: use filemap_end_dropbehind() for read invalidation Use the filemap_end_dropbehind() helper rather than calling folio_unmap_invalidate() directly, as we need to check if the folio has been redirtied or marked for writeback once the folio lock has been re-acquired. Cc: stable@vger.kernel.org Reported-by: Trond Myklebust Fixes: 8026e49bff9b ("mm/filemap: add read support for RWF_DONTCACHE") Link: https://lore.kernel.org/linux-fsdevel/ba8a9805331ce258a622feaca266b163db681a10.camel@hammerspace.com/ Signed-off-by: Jens Axboe Link: https://lore.kernel.org/20250527133255.452431-3-axboe@kernel.dk Signed-off-by: Christian Brauner commit 095f627add86a6ddda2c2cfd563b0ee05d0172b2 Author: Jens Axboe Date: Tue May 27 07:28:52 2025 -0600 mm/filemap: gate dropbehind invalidate on folio !dirty && !writeback It's possible for the folio to either get marked for writeback or redirtied. Add a helper, filemap_end_dropbehind(), which guards the folio_unmap_invalidate() call behind check for the folio being both non-dirty and not under writeback AFTER the folio lock has been acquired. Use this helper folio_end_dropbehind_write(). Cc: stable@vger.kernel.org Reported-by: Al Viro Fixes: fb7d3bc41493 ("mm/filemap: drop streaming/uncached pages when writeback completes") Link: https://lore.kernel.org/linux-fsdevel/20250525083209.GS2023217@ZenIV/ Signed-off-by: Jens Axboe Link: https://lore.kernel.org/20250527133255.452431-2-axboe@kernel.dk Signed-off-by: Christian Brauner commit 0ec33c81d9c7342f03864101ddb2e717a0cce03e Author: Pavel Begunkov Date: Tue May 27 18:07:33 2025 +0100 io_uring/zcrx: fix area release on registration failure On area registration failure there might be no ifq set and it's not safe to access area->ifq in the release path without checking it first. Cc: stable@vger.kernel.org Fixes: f12ecf5e1c5ec ("io_uring/zcrx: fix late dma unmap for a dead dev") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/bc02878678a5fec28bc77d33355cdba735418484.1748365640.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 015a99fa76650e7d6efa3e36f20c0f5b346fe9ce Merge: 3e443d167327b1 869c788909b93a Author: Linus Torvalds Date: Tue May 27 11:27:09 2025 -0700 Merge tag 'nolibc-20250526-for-6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/nolibc/linux-nolibc Pull nolibc updates from Thomas Weißschuh: - New supported architectures: m68k, SPARC (32 and 64 bit) - Compatibility with kselftest_harness.h - A more robust mechanism to include all of nolibc from each header - Split existing features into new headers to simplify adoption - Compatibility with UBSAN and it is used in the testsuite - Many small new features focussing on usage in kselftests * tag 'nolibc-20250526-for-6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/nolibc/linux-nolibc: (83 commits) selftests: harness: Stop using setjmp()/longjmp() selftests: harness: Add "variant" and "self" to test metadata selftests: harness: Add teardown callback to test metadata selftests: harness: Move teardown conditional into test metadata selftests: harness: Don't set setup_completed for fixtureless tests selftests: harness: Implement test timeouts through pidfd selftests: harness: Remove dependency on libatomic selftests: harness: Remove inline qualifier for wrappers selftests: harness: Mark functions without prototypes static selftests: harness: Ignore unused variant argument warning selftests: harness: Use C89 comment style selftests: harness: Add kselftest harness selftest selftests/nolibc: drop include guards around standard headers tools/nolibc: move NULL and offsetof() to sys/stddef.h tools/nolibc: move uname() and friends to sys/utsname.h tools/nolibc: move makedev() and friends to sys/sysmacros.h tools/nolibc: move getrlimit() and friends to sys/resource.h tools/nolibc: move reboot() to sys/reboot.h tools/nolibc: move prctl() to sys/prctl.h tools/nolibc: move mount() to sys/mount.h ... commit 3e443d167327b10966166c1953631936547b03d0 Merge: 95bf3760eb9cee d6d886005d32e4 Author: Linus Torvalds Date: Tue May 27 11:22:19 2025 -0700 Merge tag 'docs-6.16' of git://git.lwn.net/linux Pull documentation updates from Jonathan Corbet: "A moderately busy cycle for documentation this time around: - The most significant change is the replacement of the old kernel-doc script (a monstrous collection of Perl regexes that predates the Git era) with a Python reimplementation. That, too, is a horrifying collection of regexes, but in a much cleaner and more maintainable structure that integrates far better with the Sphinx build system. This change has been in linux-next for the full 6.15 cycle; the small number of problems that turned up have been addressed, seemingly to everybody's satisfaction. The Perl kernel-doc script remains in tree (as scripts/kernel-doc.pl) and can be used with a command-line option if need be. Unless some reason to keep it around materializes, it will probably go away in 6.17. Credit goes to Mauro Carvalho Chehab for doing all this work. - Some RTLA documentation updates - A handful of Chinese translations - The usual collection of typo fixes, general updates, etc" * tag 'docs-6.16' of git://git.lwn.net/linux: (85 commits) Docs: doc-guide: update sphinx.rst Sphinx version number docs: doc-guide: clarify latest theme usage Documentation/scheduler: Fix typo in sched-stats domain field description scripts: kernel-doc: prevent a KeyError when checking output docs: kerneldoc.py: simplify exception handling logic MAINTAINERS: update linux-doc entry to cover new Python scripts docs: align with scripts/syscall.tbl migration Documentation: NTB: Fix typo Documentation: ioctl-number: Update table intro docs: conf.py: drop backward support for old Sphinx versions Docs: driver-api/basics: add kobject_event interfaces Docs: relay: editing cleanups docs: fix "incase" typo in coresight/panic.rst Fix spelling error for 'parallel' docs: admin-guide: fix typos in reporting-issues.rst docs: dmaengine: add explanation for DMA_ASYNC_TX capability Documentation: leds: improve readibility of multicolor doc docs: fix typo in firmware-related section docs: Makefile: Inherit PYTHONPYCACHEPREFIX setting as env variable Documentation: ioctl-number: Update outdated submission info ... commit 95bf3760eb9ceeb93febdc280695347b1e0a89c1 Merge: 97851c601636a0 5c9e0062989e5d Author: Linus Torvalds Date: Tue May 27 11:17:45 2025 -0700 Merge tag 'lkmm.2025.05.25a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull lkmm updates from Paul McKenney: "Update LKMM documentation: - Cross-references, typos, broken URLs (Akira Yokosawa) - Clarify SRCU explanation (Uladzislau Rezki)" * tag 'lkmm.2025.05.25a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: tools/memory-model/Documentation: Fix SRCU section in explanation.txt tools/memory-model: docs/references: Remove broken link to imgtec.com tools/memory-model: docs/ordering: Fix trivial typos tools/memory-model: docs/simple.txt: Fix trivial typos tools/memory-model: docs/README: Update introduction of locking.txt commit a3b2347343e077e81d3c169f32c9b2cb1364f4cc Author: Miguel Ojeda Date: Fri May 2 23:51:32 2025 +0200 Documentation: rust: testing: add docs on the new KUnit `#[test]` tests There was no documentation yet on the KUnit-based `#[test]`s. Thus add it now. It includes an explanation about the `assert*!` macros being mapped to KUnit and the support for `-> Result` introduced in these series. Reviewed-by: David Gow Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250502215133.1923676-8-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 0a8d4eab17e6f94d83e1ee4c58c21e613934ac66 Author: Miguel Ojeda Date: Fri May 2 23:51:31 2025 +0200 Documentation: rust: rename `#[test]`s to "`rusttest` host tests" Now that `rusttest`s are not really used much, clarify the section of the documentation that describes them. In addition, free the section name for the KUnit-based `#[test]`s that will be added afterwards. To do so, rename the section into `rusttest` host tests. Reviewed-by: David Gow Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250502215133.1923676-7-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 2d6c87d0d6a0c0acf6b4dd9eec9ed44a82886836 Author: Miguel Ojeda Date: Fri May 2 23:51:30 2025 +0200 rust: str: take advantage of the `-> Result` support in KUnit `#[test]`'s Since now we have support for returning `-> Result`s, we can convert some of these tests to use the feature, and serve as a first user for it too. Thus convert them, which allows us to remove some `unwrap()`s. We keep the actual assertions we want to make as explicit ones with `assert*!`s. Reviewed-by: David Gow Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250502215133.1923676-6-ojeda@kernel.org [ Split the `CString` simplification into a new commit. - Miguel ] Signed-off-by: Miguel Ojeda commit 1486554392e242da5cbe95092d8dfec887bb8cca Author: Miguel Ojeda Date: Mon May 26 20:01:42 2025 +0200 rust: str: simplify KUnit tests `format!` macro Simplify the `format!` macro used in the tests by using `CString::try_from_fmt` and directly `unwrap()`ing. This will allow us to change both `unwrap()`s here in order to showcase the `?` operator support now that the tests are KUnit ones. Reviewed-by: David Gow Acked-by: Danilo Krummrich [ Split from the next commit as suggested by Tamir. - Miguel ] Signed-off-by: Miguel Ojeda commit 028df914e5466a02326829427bb8e26a31a05545 Author: Miguel Ojeda Date: Fri May 2 23:51:29 2025 +0200 rust: str: convert `rusttest` tests into KUnit In general, we should aim to test as much as possible within the actual kernel, and not in the build host. Thus convert these `rusttest` tests into KUnit tests. Reviewed-by: David Gow Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250502215133.1923676-5-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 897d1df6532f05814acd364af9055cd6628fd1b3 Author: Miguel Ojeda Date: Fri May 2 23:51:28 2025 +0200 rust: add `kunit_tests` to the prelude It is convenient to have certain things in the `kernel` prelude, and means kernel developers will find it even easier to start writing tests. And, anyway, nobody should need to use this identifier for anything else. Thus add it to the prelude. Reviewed-by: David Gow Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250502215133.1923676-4-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 950b306c296ec1e90d2d76f1974d2de2375a3d82 Author: Miguel Ojeda Date: Fri May 2 23:51:27 2025 +0200 rust: kunit: support checked `-> Result`s in KUnit `#[test]`s Currently, return values of KUnit `#[test]` functions are ignored. Thus introduce support for `-> Result` functions by checking their returned values. At the same time, require that test functions return `()` or `Result`, which should avoid mistakes, especially with non-`#[must_use]` types. Other types can be supported in the future if needed. With this, a failing test like: #[test] fn my_test() -> Result { f()?; Ok(()) } will output: [ 3.744214] KTAP version 1 [ 3.744287] # Subtest: my_test_suite [ 3.744378] # speed: normal [ 3.744399] 1..1 [ 3.745817] # my_test: ASSERTION FAILED at rust/kernel/lib.rs:321 [ 3.745817] Expected is_test_result_ok(my_test()) to be true, but is false [ 3.747152] # my_test.speed: normal [ 3.747199] not ok 1 my_test [ 3.747345] not ok 4 my_test_suite Reviewed-by: David Gow Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250502215133.1923676-3-ojeda@kernel.org [ Used `::kernel` for paths. - Miguel ] Signed-off-by: Miguel Ojeda commit 36174d16f3ec072f9e07b6c6d59ba91b2d52f9e2 Author: Miguel Ojeda Date: Fri May 2 23:51:26 2025 +0200 rust: kunit: support KUnit-mapped `assert!` macros in `#[test]`s The KUnit `#[test]` support that landed recently is very basic and does not map the `assert*!` macros into KUnit like the doctests do, so they panic at the moment. Thus implement the custom mapping in a similar way to doctests, reusing the infrastructure there. In Rust 1.88.0, the `file()` method in `Span` may be stable [1]. However, it was changed recently (from `SourceFile`), so we need to do something different in previous versions. Thus create a helper for it and use it to get the path. With this, a failing test suite like: #[kunit_tests(my_test_suite)] mod tests { use super::*; #[test] fn my_first_test() { assert_eq!(42, 43); } #[test] fn my_second_test() { assert!(42 >= 43); } } will properly map back to KUnit, printing something like: [ 1.924325] KTAP version 1 [ 1.924421] # Subtest: my_test_suite [ 1.924506] # speed: normal [ 1.924525] 1..2 [ 1.926385] # my_first_test: ASSERTION FAILED at rust/kernel/lib.rs:251 [ 1.926385] Expected 42 == 43 to be true, but is false [ 1.928026] # my_first_test.speed: normal [ 1.928075] not ok 1 my_first_test [ 1.928723] # my_second_test: ASSERTION FAILED at rust/kernel/lib.rs:256 [ 1.928723] Expected 42 >= 43 to be true, but is false [ 1.929834] # my_second_test.speed: normal [ 1.929868] not ok 2 my_second_test [ 1.930032] # my_test_suite: pass:0 fail:2 skip:0 total:2 [ 1.930153] # Totals: pass:0 fail:2 skip:0 total Link: https://github.com/rust-lang/rust/pull/140514 [1] Reviewed-by: David Gow Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250502215133.1923676-2-ojeda@kernel.org [ Required `KUNIT=y` like for doctests. Used the `cfg_attr` from the TODO comment and clarified its comment now that the stabilization is in beta and thus quite likely stable in Rust 1.88.0. Simplified the `new_body` code by introducing a new variable. Added `#[allow(clippy::incompatible_msrv)]`. - Miguel ] Signed-off-by: Miguel Ojeda commit ca56fbd5081e1c4340799040ee9cb849ee45249d Merge: d4965578267e2e 149ead9d7e3de7 Author: Alexei Starovoitov Date: Tue May 27 10:50:32 2025 -0700 Merge branch 'bpf-arm64-support-up-to-12-arguments' Alexis Lothoré says: ==================== this is the v2 of the many args series for arm64, being itself a revival of Xu Kuhoai's work to enable larger arguments count for BPF programs on ARM64 ([1]). The discussions in v1 shed some light on some issues around specific cases, for example with functions passing struct on stack with custom packing/alignment attributes: those cases can not be properly detected with the current BTF info. So this new revision aims to separate concerns with a simpler implementation, just accepting additional args on stack if we can make sure about the alignment constraints (and so, refusing attachment to functions passing structs on stacks). I then checked if the specific alignment constraints could be checked with larger scalar types rather than structs, but it appears that this use case is in fact rejected at the verifier level (see a9b59159d338 ("bpf: Do not allow btf_ctx_access with __int128 types")). So in the end the specific alignment corner cases raised in [1] can not really happen in the kernel in its current state. This new revision still brings support for the standard cases as a first step, it will then be possible to iterate on top of it to add the more specific cases like struct passed on stack and larger types. [1] https://lore.kernel.org/all/20230917150752.69612-1-xukuohai@huaweicloud.com/#t Changes in v3: - switch back -EOPNOTSUPP to -ENOTSUPP - fix comment style - group intializations for arg_aux - remove some unneeded round_up - Link to v2: https://lore.kernel.org/r/20250522-many_args_arm64-v2-0-d6afdb9cf819@bootlin.com Changes in v2: - remove alignment computation from btf.c - deduce alignment constraints directly in jit compiler for simple types - deny attachment to functions with "corner-cases" arguments (ie: structs on stack) - remove custom tests, as the corresponding use cases are locked either by the JIT comp or the verifier - drop RFC - Link to v1: https://lore.kernel.org/r/20250411-many_args_arm64-v1-0-0a32fe72339e@bootlin.com ==================== Signed-off-by: Alexis Lothoré (eBPF Foundation) Acked-by: Xu Kuohai Link: https://patch.msgid.link/20250527-many_args_arm64-v3-0-3faf7bb8e4a2@bootlin.com Signed-off-by: Alexei Starovoitov commit 149ead9d7e3de786786ce496133325b3f358ec8a Author: Alexis Lothoré (eBPF Foundation) Date: Tue May 27 12:06:04 2025 +0200 selftests/bpf: enable many-args tests for arm64 Now that support for up to 12 args is enabled for tracing programs on ARM64, enable the existing tests for this feature on this architecture. Signed-off-by: Alexis Lothoré (eBPF Foundation) Link: https://lore.kernel.org/r/20250527-many_args_arm64-v3-2-3faf7bb8e4a2@bootlin.com Signed-off-by: Alexei Starovoitov commit 9014cf56f13d8ce21329837c148f723490950e28 Author: Xu Kuohai Date: Tue May 27 12:06:03 2025 +0200 bpf, arm64: Support up to 12 function arguments Currently ARM64 bpf trampoline supports up to 8 function arguments. According to the statistics from commit 473e3150e30a ("bpf, x86: allow function arguments up to 12 for TRACING"), there are about 200 functions accept 9 to 12 arguments, so adding support for up to 12 function arguments. Due to bpf only supporting function arguments up to 16 bytes, according to AAPCS64, starting from the first argument, each argument is first attempted to be loaded to 1 or 2 smallest registers from x0-x7, if there are no enough registers to hold the entire argument, then all remaining arguments starting from this one are pushed to the stack for passing. There are some non-trivial cases for which it is not possible to correctly read arguments from/write arguments to the stack: for example struct variables may have custom packing/alignment attributes that are invisible in BTF info. Such cases are denied for now to make sure not to read incorrect values. Signed-off-by: Xu Kuohai Co-developed-by: Alexis Lothoré (eBPF Foundation) Signed-off-by: Alexis Lothoré (eBPF Foundation) Link: https://lore.kernel.org/r/20250527-many_args_arm64-v3-1-3faf7bb8e4a2@bootlin.com Signed-off-by: Alexei Starovoitov commit 97851c601636a0e40f8237b83a6b70fc5e231e0c Merge: dd3922cf9d4d14 ba575cea29fd82 Author: Linus Torvalds Date: Tue May 27 10:48:36 2025 -0700 Merge tag 'ratelimit.2025.05.25a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull rate-limit updates from Paul McKenney: "lib/ratelimit: Reduce false-positive and silent misses: - Reduce open-coded use of ratelimit_state structure fields. - Convert the ->missed field to atomic_t. - Count misses that are due to lock contention. - Eliminate jiffies=0 special case. - Reduce ___ratelimit() false-positive rate limiting (Petr Mladek). - Allow zero ->burst to hard-disable rate limiting. - Optimize away atomic operations when a miss is guaranteed. - Warn if ->interval or ->burst are negative (Petr Mladek). - Simplify the resulting code. A smoke test and stress test have been created, but they are not yet ready for mainline. With luck, we will offer them for the v6.17 merge window" * tag 'ratelimit.2025.05.25a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: ratelimit: Drop redundant accesses to burst ratelimit: Use nolock_ret restructuring to collapse common case code ratelimit: Use nolock_ret label to collapse lock-failure code ratelimit: Use nolock_ret label to save a couple of lines of code ratelimit: Simplify common-case exit path ratelimit: Warn if ->interval or ->burst are negative ratelimit: Avoid atomic decrement under lock if already rate-limited ratelimit: Avoid atomic decrement if already rate-limited ratelimit: Don't flush misses counter if RATELIMIT_MSG_ON_RELEASE ratelimit: Force re-initialization when rate-limiting re-enabled ratelimit: Allow zero ->burst to disable ratelimiting ratelimit: Reduce ___ratelimit() false-positive rate limiting ratelimit: Avoid jiffies=0 special case ratelimit: Count misses due to lock contention ratelimit: Convert the ->missed field to atomic_t drm/amd/pm: Avoid open-coded use of ratelimit_state structure's internals drm/i915: Avoid open-coded use of ratelimit_state structure's ->missed field random: Avoid open-coded use of ratelimit_state structure's ->missed field ratelimit: Create functions to handle ratelimit_state internals commit d4965578267e2e81f67c86e2608481e77e9c8569 Author: Hou Tao Date: Mon May 26 14:25:34 2025 +0800 bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() bpf_map_lookup_percpu_elem() helper is also available for sleepable bpf program. When BPF JIT is disabled or under 32-bit host, bpf_map_lookup_percpu_elem() will not be inlined. Using it in a sleepable bpf program will trigger the warning in bpf_map_lookup_percpu_elem(), because the bpf program only holds rcu_read_lock_trace lock. Therefore, add the missed check. Reported-by: syzbot+dce5aae19ae4d6399986@syzkaller.appspotmail.com Closes: https://lore.kernel.org/bpf/000000000000176a130617420310@google.com/ Signed-off-by: Hou Tao Link: https://lore.kernel.org/r/20250526062534.1105938-1-houtao@huaweicloud.com Signed-off-by: Alexei Starovoitov commit 86bc9c742426a16b52a10ef61f5b721aecca2344 Author: KaFai Wan Date: Mon May 26 21:33:58 2025 +0800 bpf: Avoid __bpf_prog_ret0_warn when jit fails syzkaller reported an issue: WARNING: CPU: 3 PID: 217 at kernel/bpf/core.c:2357 __bpf_prog_ret0_warn+0xa/0x20 kernel/bpf/core.c:2357 Modules linked in: CPU: 3 UID: 0 PID: 217 Comm: kworker/u32:6 Not tainted 6.15.0-rc4-syzkaller-00040-g8bac8898fe39 RIP: 0010:__bpf_prog_ret0_warn+0xa/0x20 kernel/bpf/core.c:2357 Call Trace: bpf_dispatcher_nop_func include/linux/bpf.h:1316 [inline] __bpf_prog_run include/linux/filter.h:718 [inline] bpf_prog_run include/linux/filter.h:725 [inline] cls_bpf_classify+0x74a/0x1110 net/sched/cls_bpf.c:105 ... When creating bpf program, 'fp->jit_requested' depends on bpf_jit_enable. This issue is triggered because of CONFIG_BPF_JIT_ALWAYS_ON is not set and bpf_jit_enable is set to 1, causing the arch to attempt JIT the prog, but jit failed due to FAULT_INJECTION. As a result, incorrectly treats the program as valid, when the program runs it calls `__bpf_prog_ret0_warn` and triggers the WARN_ON_ONCE(1). Reported-by: syzbot+0903f6d7f285e41cdf10@syzkaller.appspotmail.com Closes: https://lore.kernel.org/bpf/6816e34e.a70a0220.254cdc.002c.GAE@google.com Fixes: fa9dd599b4da ("bpf: get rid of pure_initcall dependency to enable jits") Signed-off-by: KaFai Wan Link: https://lore.kernel.org/r/20250526133358.2594176-1-mannkafai@gmail.com Signed-off-by: Alexei Starovoitov commit 1ae7a84ed85317b12a3395470f0cfcc900b2a61a Author: Jiayuan Chen Date: Fri May 16 22:47:02 2025 +0800 bpftool: Add support for custom BTF path in prog load/loadall This patch exposes the btf_custom_path feature to bpftool, allowing users to specify a custom BTF file when loading BPF programs using prog load or prog loadall commands. The argument 'btf_custom_path' in libbpf is used for those kernels that don't have CONFIG_DEBUG_INFO_BTF enabled but still want to perform CO-RE relocations. Suggested-by: Quentin Monnet Reviewed-by: Quentin Monnet Signed-off-by: Jiayuan Chen Link: https://lore.kernel.org/r/20250516144708.298652-1-jiayuan.chen@linux.dev Signed-off-by: Alexei Starovoitov commit 92de53d247dffdf29d2abecf7deb4760dde98d6c Author: Yonghong Song Date: Fri May 23 13:53:31 2025 -0700 selftests/bpf: Add unit tests with __bpf_trap() kfunc Add some inline-asm tests and C tests where __bpf_trap() or __builtin_trap() is used in the code. The __builtin_trap() test is guarded with llvm21 ([1]) since otherwise the compilation failure will happen. [1] https://github.com/llvm/llvm-project/pull/131731 Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20250523205331.1291734-1-yonghong.song@linux.dev Tested-by: Eduard Zingerman Signed-off-by: Alexei Starovoitov commit dd3922cf9d4d1421e5883614d1a6add912131c00 Merge: 350a604221d252 e396dd85172c60 Author: Linus Torvalds Date: Tue May 27 10:21:04 2025 -0700 Merge tag 'x86_sev_for_v6.16_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull AMD SEV update from Borislav Petkov: "Add a virtual TPM driver glue which allows a guest kernel to talk to a TPM device emulated by a Secure VM Service Module (SVSM) - a helper module of sorts which runs at a different privilege level in the SEV-SNP VM stack. The intent being that a TPM device is emulated by a trusted entity and not by the untrusted host which is the default assumption in the confidential computing scenarios" * tag 'x86_sev_for_v6.16_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/sev: Register tpm-svsm platform device tpm: Add SNP SVSM vTPM driver svsm: Add header with SVSM_VTPM_CMD helpers x86/sev: Add SVSM vTPM probe/send_command functions commit 350a604221d252e7431649353dd600e42bc9e944 Merge: ada1b0436b5a29 824c6384e8d927 Author: Linus Torvalds Date: Tue May 27 10:17:03 2025 -0700 Merge tag 'x86_mtrr_for_v6.16_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull mtrr update from Borislav Petkov: "A single change to verify the presence of fixed MTRR ranges before accessing the respective MSRs" * tag 'x86_mtrr_for_v6.16_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() commit ada1b0436b5a290923b072b2eb0368a7869bf680 Merge: 664a231d90aa45 ea3b0b7f541b95 Author: Linus Torvalds Date: Tue May 27 10:13:06 2025 -0700 Merge tag 'edac_updates_for_v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC updates from Borislav Petkov: - ie31200: Add support for Raptor Lake-S and Alder Lake-S compute dies - Rework how RRL registers per channel tracking is done in order to support newer hardware with different RRL configurations and refactor that code. Add support for Granite Rapids server - i10nm: explicitly set RRL modes to fix any wrong BIOS programming - Properly save and restore Retry Read error Log channel configuration info on Intel drivers - igen6: Handle correctly the case of fused off memory controllers on Arizona Beach and Amston Lake SoCs before adding support for them - the usual set of fixes and cleanups * tag 'edac_updates_for_v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/bluefield: Don't use bluefield_edac_readl() result on error EDAC/i10nm: Fix the bitwise operation between variables of different sizes EDAC/ie31200: Add two Intel SoCs for EDAC support EDAC/{skx_common,i10nm}: Add RRL support for Intel Granite Rapids server EDAC/{skx_common,i10nm}: Refactor show_retry_rd_err_log() EDAC/{skx_common,i10nm}: Refactor enable_retry_rd_err_log() EDAC/{skx_common,i10nm}: Structure the per-channel RRL registers EDAC/i10nm: Explicitly set the modes of the RRL register sets EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0 EDAC/skx_common: Fix general protection fault EDAC/igen6: Add Intel Amston Lake SoCs support EDAC/igen6: Add Intel Arizona Beach SoCs support EDAC/igen6: Skip absent memory controllers commit f95695f2c46592b4260032736a9bfc6e2a01c77c Author: Yonghong Song Date: Fri May 23 13:53:26 2025 -0700 bpf: Warn with __bpf_trap() kfunc maybe due to uninitialized variable Marc Suñé (Isovalent, part of Cisco) reported an issue where an uninitialized variable caused generating bpf prog binary code not working as expected. The reproducer is in [1] where the flags “-Wall -Werror” are enabled, but there is no warning as the compiler takes advantage of uninitialized variable to do aggressive optimization. The optimized code looks like below: ; { 0: bf 16 00 00 00 00 00 00 r6 = r1 ; bpf_printk("Start"); 1: 18 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r1 = 0x0 ll 0000000000000008: R_BPF_64_64 .rodata 3: b4 02 00 00 06 00 00 00 w2 = 0x6 4: 85 00 00 00 06 00 00 00 call 0x6 ; DEFINE_FUNC_CTX_POINTER(data) 5: 61 61 4c 00 00 00 00 00 w1 = *(u32 *)(r6 + 0x4c) ; bpf_printk("pre ipv6_hdrlen_offset"); 6: 18 01 00 00 06 00 00 00 00 00 00 00 00 00 00 00 r1 = 0x6 ll 0000000000000030: R_BPF_64_64 .rodata 8: b4 02 00 00 17 00 00 00 w2 = 0x17 9: 85 00 00 00 06 00 00 00 call 0x6 The verifier will report the following failure: 9: (85) call bpf_trace_printk#6 last insn is not an exit or jmp The above verifier log does not give a clear hint about how to fix the problem and user may take quite some time to figure out that the issue is due to compiler taking advantage of uninitialized variable. In llvm internals, uninitialized variable usage may generate 'unreachable' IR insn and these 'unreachable' IR insns may indicate uninitialized variable impact on code optimization. So far, llvm BPF backend ignores 'unreachable' IR hence the above code is generated. With clang21 patch [2], those 'unreachable' IR insn are converted to func __bpf_trap(). In order to maintain proper control flow graph for bpf progs, [2] also adds an 'exit' insn after bpf_trap() if __bpf_trap() is the last insn in the function. The new code looks like: ; { 0: bf 16 00 00 00 00 00 00 r6 = r1 ; bpf_printk("Start"); 1: 18 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r1 = 0x0 ll 0000000000000008: R_BPF_64_64 .rodata 3: b4 02 00 00 06 00 00 00 w2 = 0x6 4: 85 00 00 00 06 00 00 00 call 0x6 ; DEFINE_FUNC_CTX_POINTER(data) 5: 61 61 4c 00 00 00 00 00 w1 = *(u32 *)(r6 + 0x4c) ; bpf_printk("pre ipv6_hdrlen_offset"); 6: 18 01 00 00 06 00 00 00 00 00 00 00 00 00 00 00 r1 = 0x6 ll 0000000000000030: R_BPF_64_64 .rodata 8: b4 02 00 00 17 00 00 00 w2 = 0x17 9: 85 00 00 00 06 00 00 00 call 0x6 10: 85 10 00 00 ff ff ff ff call -0x1 0000000000000050: R_BPF_64_32 __bpf_trap 11: 95 00 00 00 00 00 00 00 exit In kernel, a new kfunc __bpf_trap() is added. During insn verification, any hit with __bpf_trap() will result in verification failure. The kernel is able to provide better log message for debugging. With llvm patch [2] and without this patch (no __bpf_trap() kfunc for existing kernel), e.g., for old kernels, the verifier outputs 10: kfunc '__bpf_trap' is referenced but wasn't resolved Basically, kernel does not support __bpf_trap() kfunc. This still didn't give clear signals about possible reason. With llvm patch [2] and with this patch, the verifier outputs 10: (85) call __bpf_trap#74479 unexpected __bpf_trap() due to uninitialized variable? It gives much better hints for verification failure. [1] https://github.com/msune/clang_bpf/blob/main/Makefile#L3 [2] https://github.com/llvm/llvm-project/pull/131731 Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20250523205326.1291640-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov commit 664a231d90aa450f9f6f029bee3a94dd08e1aac6 Merge: b1456f6dc167f7 54d14f25664bbb Author: Linus Torvalds Date: Tue May 27 09:53:02 2025 -0700 Merge tag 'x86_cache_for_v6.16_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 resource control updates from Borislav Petkov: "Carve out the resctrl filesystem-related code into fs/resctrl/ so that multiple architectures can share the fs API for manipulating their respective hw resource control implementation. This is the second step in the work towards sharing the resctrl filesystem interface, the next one being plugging ARM's MPAM into the aforementioned fs API" * tag 'x86_cache_for_v6.16_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (25 commits) MAINTAINERS: Add reviewers for fs/resctrl x86,fs/resctrl: Move the resctrl filesystem code to live in /fs/resctrl x86/resctrl: Always initialise rid field in rdt_resources_all[] x86/resctrl: Relax some asm #includes x86/resctrl: Prefer alloc(sizeof(*foo)) idiom in rdt_init_fs_context() x86/resctrl: Squelch whitespace anomalies in resctrl core code x86/resctrl: Move pseudo lock prototypes to include/linux/resctrl.h x86/resctrl: Fix types in resctrl_arch_mon_ctx_{alloc,free}() stubs x86/resctrl: Move enum resctrl_event_id to resctrl.h x86/resctrl: Move the filesystem bits to headers visible to fs/resctrl fs/resctrl: Add boiler plate for external resctrl code x86/resctrl: Add 'resctrl' to the title of the resctrl documentation x86/resctrl: Split trace.h x86/resctrl: Expand the width of domid by replacing mon_data_bits x86/resctrl: Add end-marker to the resctrl_event_id enum x86/resctrl: Move is_mba_sc() out of core.c x86/resctrl: Drop __init/__exit on assorted symbols x86/resctrl: Resctrl_exit() teardown resctrl but leave the mount point x86/resctrl: Check all domains are offline in resctrl_exit() x86/resctrl: Rename resctrl_sched_in() to begin with "resctrl_arch_" ... commit d848bba68034847e39b82694be7fabed0e9d0d1e Author: Yonghong Song Date: Fri May 23 13:53:21 2025 -0700 bpf: Remove special_kfunc_set from verifier Currently, the verifier has both special_kfunc_set and special_kfunc_list. When adding a new kfunc usage to the verifier, it is often confusing about whether special_kfunc_set or special_kfunc_list or both should add that kfunc. For example, some kfuncs, e.g., bpf_dynptr_from_skb, bpf_dynptr_clone, bpf_wq_set_callback_impl, does not need to be in special_kfunc_set. To avoid potential future confusion, special_kfunc_set is deleted and btf_id_set_contains(&special_kfunc_set, ...) is removed. The code is refactored with a new func check_special_kfunc(), which contains all codes covered by original branch meta.btf == btf_vmlinux && btf_id_set_contains(&special_kfunc_set, meta.func_id) There is no functionality change. Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20250523205321.1291431-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov commit db22b1382b96450967a7289900a22a70f073c9da Merge: 079e5c56a5c41d 7594dcb71ff87f Author: Alexei Starovoitov Date: Tue May 27 09:51:26 2025 -0700 Merge branch 'replace-config_dmabuf_sysfs_stats-with-bpf' T.J. Mercier says: ==================== Replace CONFIG_DMABUF_SYSFS_STATS with BPF Until CONFIG_DMABUF_SYSFS_STATS was added [1] it was only possible to perform per-buffer accounting with debugfs which is not suitable for production environments. Eventually we discovered the overhead with per-buffer sysfs file creation/removal was significantly impacting allocation and free times, and exacerbated kernfs lock contention. [2] dma_buf_stats_setup() is responsible for 39% of single-page buffer creation duration, or 74% of single-page dma_buf_export() duration when stressing dmabuf allocations and frees. I prototyped a change from per-buffer to per-exporter statistics with a RCU protected list of exporter allocations that accommodates most (but not all) of our use-cases and avoids almost all of the sysfs overhead. While that adds less overhead than per-buffer sysfs, and less even than the maintenance of the dmabuf debugfs_list, it's still *additional* overhead on top of the debugfs_list and doesn't give us per-buffer info. This series uses the existing dmabuf debugfs_list to implement a BPF dmabuf iterator, which adds no overhead to buffer allocation/free and provides per-buffer info. The list has been moved outside of CONFIG_DEBUG_FS scope so that it is always populated. The BPF program loaded by userspace that extracts per-buffer information gets to define its own interface which avoids the lack of ABI stability with debugfs. This will allow us to replace our use of CONFIG_DMABUF_SYSFS_STATS, and the plan is to remove it from the kernel after the next longterm stable release. [1] https://lore.kernel.org/linux-media/20201210044400.1080308-1-hridya@google.com [2] https://lore.kernel.org/all/20220516171315.2400578-1-tjmercier@google.com v1: https://lore.kernel.org/all/20250414225227.3642618-1-tjmercier@google.com v1 -> v2: Make the DMA buffer list independent of CONFIG_DEBUG_FS per Christian König Add CONFIG_DMA_SHARED_BUFFER check to kernel/bpf/Makefile per kernel test robot Use BTF_ID_LIST_SINGLE instead of BTF_ID_LIST_GLOBAL_SINGLE per Song Liu Fixup comment style, mixing code/declarations, and use ASSERT_OK_FD in selftest per Song Liu Add BPF_ITER_RESCHED feature to bpf_dmabuf_reg_info per Alexei Starovoitov Add open-coded iterator and selftest per Alexei Starovoitov Add a second test buffer from the system dmabuf heap to selftests Use the BPF program we'll use in production for selftest per Alexei Starovoitov https://r.android.com/c/platform/system/bpfprogs/+/3616123/2/dmabufIter.c https://r.android.com/c/platform/system/memory/libmeminfo/+/3614259/1/libdmabufinfo/dmabuf_bpf_stats.cpp v2: https://lore.kernel.org/all/20250504224149.1033867-1-tjmercier@google.com v2 -> v3: Rebase onto bpf-next/master Move get_next_dmabuf() into drivers/dma-buf/dma-buf.c, along with the new get_first_dmabuf(). This avoids having to expose the dmabuf list and mutex to the rest of the kernel, and keeps the dmabuf mutex operations near each other in the same file. (Christian König) Add Christian's RB to dma-buf: Rename debugfs symbols Drop RFC: dma-buf: Remove DMA-BUF statistics v3: https://lore.kernel.org/all/20250507001036.2278781-1-tjmercier@google.com v3 -> v4: Fix selftest BPF program comment style (not kdoc) per Alexei Starovoitov Fix dma-buf.c kdoc comment style per Alexei Starovoitov Rename get_first_dmabuf / get_next_dmabuf to dma_buf_iter_begin / dma_buf_iter_next per Christian König Add Christian's RB to bpf: Add dmabuf iterator v4: https://lore.kernel.org/all/20250508182025.2961555-1-tjmercier@google.com v4 -> v5: Add Christian's Acks to all patches Add Song Liu's Acks Move BTF_ID_LIST_SINGLE and DEFINE_BPF_ITER_FUNC closer to usage per Song Liu Fix open-coded iterator comment style per Song Liu Move iterator termination check to its own subtest per Song Liu Rework selftest buffer creation per Song Liu Fix spacing in sanitize_string per BPF CI v5: https://lore.kernel.org/all/20250512174036.266796-1-tjmercier@google.com v5 -> v6: Song Liu: Init test buffer FDs to -1 Zero-init udmabuf_create for future proofing Bail early for iterator fd/FILE creation failure Dereference char ptr to check for NUL in sanitize_string() Move map insertion from create_test_buffers() to test_dmabuf_iter() Add ACK to selftests/bpf: Add test for open coded dmabuf_iter v6: https://lore.kernel.org/all/20250513163601.812317-1-tjmercier@google.com v6 -> v7: Zero uninitialized name bytes following the end of name strings per s390x BPF CI Reorder sanitize_string bounds checks per Song Liu Add Song's Ack to: selftests/bpf: Add test for dmabuf_iter Rebase onto bpf-next/master per BPF CI ==================== Link: https://patch.msgid.link/20250522230429.941193-1-tjmercier@google.com Signed-off-by: Alexei Starovoitov commit 7594dcb71ff87f9f0b11a13b32309c96960f880a Author: T.J. Mercier Date: Thu May 22 23:04:29 2025 +0000 selftests/bpf: Add test for open coded dmabuf_iter Use the same test buffers as the traditional iterator and a new BPF map to verify the test buffers can be found with the open coded dmabuf iterator. Signed-off-by: T.J. Mercier Acked-by: Christian König Acked-by: Song Liu Link: https://lore.kernel.org/r/20250522230429.941193-6-tjmercier@google.com Signed-off-by: Alexei Starovoitov commit ae5d2c59ecd78df65254f4a40178b34f752bc1a9 Author: T.J. Mercier Date: Thu May 22 23:04:28 2025 +0000 selftests/bpf: Add test for dmabuf_iter This test creates a udmabuf, and a dmabuf from the system dmabuf heap, and uses a BPF program that prints dmabuf metadata with the new dmabuf_iter to verify they can be found. Signed-off-by: T.J. Mercier Acked-by: Christian König Acked-by: Song Liu Link: https://lore.kernel.org/r/20250522230429.941193-5-tjmercier@google.com Signed-off-by: Alexei Starovoitov commit 6eab7ac7c5eea7628b92cd5f9427bbd963a954ec Author: T.J. Mercier Date: Thu May 22 23:04:27 2025 +0000 bpf: Add open coded dmabuf iterator This open coded iterator allows for more flexibility when creating BPF programs. It can support output in formats other than text. With an open coded iterator, a single BPF program can traverse multiple kernel data structures (now including dmabufs), allowing for more efficient analysis of kernel data compared to multiple reads from procfs, sysfs, or multiple traditional BPF iterator invocations. Signed-off-by: T.J. Mercier Acked-by: Christian König Acked-by: Song Liu Link: https://lore.kernel.org/r/20250522230429.941193-4-tjmercier@google.com Signed-off-by: Alexei Starovoitov commit 76ea95534995adde1aa3cb1aa97ef33f50a617a9 Author: T.J. Mercier Date: Thu May 22 23:04:26 2025 +0000 bpf: Add dmabuf iterator The dmabuf iterator traverses the list of all DMA buffers. DMA buffers are refcounted through their associated struct file. A reference is taken on each buffer as the list is iterated to ensure each buffer persists for the duration of the bpf program execution without holding the list mutex. Signed-off-by: T.J. Mercier Reviewed-by: Christian König Acked-by: Song Liu Link: https://lore.kernel.org/r/20250522230429.941193-3-tjmercier@google.com Signed-off-by: Alexei Starovoitov commit 89f9dba365e1b85caef556d28654c6d336629eef Author: T.J. Mercier Date: Thu May 22 23:04:25 2025 +0000 dma-buf: Rename debugfs symbols Rename the debugfs list and mutex so it's clear they are now usable without the need for CONFIG_DEBUG_FS. The list will always be populated to support the creation of a BPF iterator for dmabufs. Signed-off-by: T.J. Mercier Reviewed-by: Christian König Acked-by: Song Liu Link: https://lore.kernel.org/r/20250522230429.941193-2-tjmercier@google.com Signed-off-by: Alexei Starovoitov commit a784d606acbb22cd63d03d653f59f446d09df57d Merge: e3de7984e45155 63fe298652d4ed Author: Mark Brown Date: Tue May 27 17:33:01 2025 +0100 ASoC: codecs: wcd93xx: Few regulator supplies fixes Merge series from Krzysztof Kozlowski : Fix cleanup paths in wcd9335 and wcd937x codec drivers. commit 8f56770d114b0261bc8d69bbc7ce8ce0c196d630 Author: Maxim Levitsky Date: Mon May 12 14:04:07 2025 -0400 RISC-V: KVM: use kvm_trylock_all_vcpus when locking all vCPUs Use kvm_trylock_all_vcpus instead of a custom implementation when locking all vCPUs of a VM. Compile tested only. Suggested-by: Paolo Bonzini Signed-off-by: Maxim Levitsky Acked-by: Peter Zijlstra (Intel) Reviewed-by: Anup Patel Tested-by: Anup Patel Message-ID: <20250512180407.659015-7-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini commit b586c5d21954f203ba40c6120307d2e370c668d7 Author: Maxim Levitsky Date: Mon May 12 14:04:06 2025 -0400 KVM: arm64: use kvm_trylock_all_vcpus when locking all vCPUs Use kvm_trylock_all_vcpus instead of a custom implementation when locking all vCPUs of a VM, to avoid triggering a lockdep warning, in the case in which the VM is configured to have more than MAX_LOCK_DEPTH vCPUs. This fixes the following false lockdep warning: [ 328.171264] BUG: MAX_LOCK_DEPTH too low! [ 328.175227] turning off the locking correctness validator. [ 328.180726] Please attach the output of /proc/lock_stat to the bug report [ 328.187531] depth: 48 max: 48! [ 328.190678] 48 locks held by qemu-kvm/11664: [ 328.194957] #0: ffff800086de5ba0 (&kvm->lock){+.+.}-{3:3}, at: kvm_ioctl_create_device+0x174/0x5b0 [ 328.204048] #1: ffff0800e78800b8 (&vcpu->mutex){+.+.}-{3:3}, at: lock_all_vcpus+0x16c/0x2a0 [ 328.212521] #2: ffff07ffeee51e98 (&vcpu->mutex){+.+.}-{3:3}, at: lock_all_vcpus+0x16c/0x2a0 [ 328.220991] #3: ffff0800dc7d80b8 (&vcpu->mutex){+.+.}-{3:3}, at: lock_all_vcpus+0x16c/0x2a0 [ 328.229463] #4: ffff07ffe0c980b8 (&vcpu->mutex){+.+.}-{3:3}, at: lock_all_vcpus+0x16c/0x2a0 [ 328.237934] #5: ffff0800a3883c78 (&vcpu->mutex){+.+.}-{3:3}, at: lock_all_vcpus+0x16c/0x2a0 [ 328.246405] #6: ffff07fffbe480b8 (&vcpu->mutex){+.+.}-{3:3}, at: lock_all_vcpus+0x16c/0x2a0 Suggested-by: Paolo Bonzini Signed-off-by: Maxim Levitsky Acked-by: Marc Zyngier Acked-by: Peter Zijlstra (Intel) Message-ID: <20250512180407.659015-6-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini commit c560bc9286e66713819c2f30b9ff32ee79d7f75e Author: Maxim Levitsky Date: Mon May 12 14:04:05 2025 -0400 x86: KVM: SVM: use kvm_lock_all_vcpus instead of a custom implementation Use kvm_lock_all_vcpus instead of sev's own implementation. Because kvm_lock_all_vcpus uses the _nest_lock feature of lockdep, which ignores subclasses, there is no longer a need to use separate subclasses for source and target VMs. No functional change intended. Suggested-by: Paolo Bonzini Signed-off-by: Maxim Levitsky Acked-by: Peter Zijlstra (Intel) Message-ID: <20250512180407.659015-5-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini commit e4a454ced74c0ac97c8bd32f086ee3ad74528780 Author: Maxim Levitsky Date: Mon May 12 14:04:04 2025 -0400 KVM: add kvm_lock_all_vcpus and kvm_trylock_all_vcpus In a few cases, usually in the initialization code, KVM locks all vCPUs of a VM to ensure that userspace doesn't do funny things while KVM performs an operation that affects the whole VM. Until now, all these operations were implemented using custom code, and all of them share the same problem: Lockdep can't cope with simultaneous locking of a large number of locks of the same class. However if these locks are taken while another lock is already held, which is luckily the case, it is possible to take advantage of little known _nest_lock feature of lockdep which allows in this case to have an unlimited number of locks of same class to be taken. To implement this, create two functions: kvm_lock_all_vcpus() and kvm_trylock_all_vcpus() Both functions are needed because some code that will be replaced in the subsequent patches, uses mutex_trylock, instead of regular mutex_lock. Suggested-by: Paolo Bonzini Signed-off-by: Maxim Levitsky Acked-by: Marc Zyngier Acked-by: Peter Zijlstra (Intel) Message-ID: <20250512180407.659015-4-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini commit fb49f07ba1d9d8c9bd8854878ae6b5b21ff9ac45 Author: Maxim Levitsky Date: Mon May 12 14:04:03 2025 -0400 locking/mutex: implement mutex_lock_killable_nest_lock KVM's SEV intra-host migration code needs to lock all vCPUs of the source and the target VM, before it proceeds with the migration. The number of vCPUs that belong to each VM is not bounded by anything except a self-imposed KVM limit of CONFIG_KVM_MAX_NR_VCPUS vCPUs which is significantly larger than the depth of lockdep's lock stack. Luckily, the locks in both of the cases mentioned above, are held under the 'kvm->lock' of each VM, which means that we can use the little known lockdep feature called a "nest_lock" to support this use case in a cleaner way, compared to the way it's currently done. Implement and expose 'mutex_lock_killable_nest_lock' for this purpose. Signed-off-by: Maxim Levitsky Acked-by: Peter Zijlstra (Intel) Message-ID: <20250512180407.659015-3-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini commit c5b6ababd21ab6bb251e5a2b4db110e76fb00a26 Author: Maxim Levitsky Date: Mon May 12 14:04:02 2025 -0400 locking/mutex: implement mutex_trylock_nested Despite the fact that several lockdep-related checks are skipped when calling trylock* versions of the locking primitives, for example mutex_trylock, each time the mutex is acquired, a held_lock is still placed onto the lockdep stack by __lock_acquire() which is called regardless of whether the trylock* or regular locking API was used. This means that if the caller successfully acquires more than MAX_LOCK_DEPTH locks of the same class, even when using mutex_trylock, lockdep will still complain that the maximum depth of the held lock stack has been reached and disable itself. For example, the following error currently occurs in the ARM version of KVM, once the code tries to lock all vCPUs of a VM configured with more than MAX_LOCK_DEPTH vCPUs, a situation that can easily happen on modern systems, where having more than 48 CPUs is common, and it's also common to run VMs that have vCPU counts approaching that number: [ 328.171264] BUG: MAX_LOCK_DEPTH too low! [ 328.175227] turning off the locking correctness validator. [ 328.180726] Please attach the output of /proc/lock_stat to the bug report [ 328.187531] depth: 48 max: 48! [ 328.190678] 48 locks held by qemu-kvm/11664: [ 328.194957] #0: ffff800086de5ba0 (&kvm->lock){+.+.}-{3:3}, at: kvm_ioctl_create_device+0x174/0x5b0 [ 328.204048] #1: ffff0800e78800b8 (&vcpu->mutex){+.+.}-{3:3}, at: lock_all_vcpus+0x16c/0x2a0 [ 328.212521] #2: ffff07ffeee51e98 (&vcpu->mutex){+.+.}-{3:3}, at: lock_all_vcpus+0x16c/0x2a0 [ 328.220991] #3: ffff0800dc7d80b8 (&vcpu->mutex){+.+.}-{3:3}, at: lock_all_vcpus+0x16c/0x2a0 [ 328.229463] #4: ffff07ffe0c980b8 (&vcpu->mutex){+.+.}-{3:3}, at: lock_all_vcpus+0x16c/0x2a0 [ 328.237934] #5: ffff0800a3883c78 (&vcpu->mutex){+.+.}-{3:3}, at: lock_all_vcpus+0x16c/0x2a0 [ 328.246405] #6: ffff07fffbe480b8 (&vcpu->mutex){+.+.}-{3:3}, at: lock_all_vcpus+0x16c/0x2a0 Luckily, in all instances that require locking all vCPUs, the 'kvm->lock' is taken a priori, and that fact makes it possible to use the little known feature of lockdep, called a 'nest_lock', to avoid this warning and subsequent lockdep self-disablement. The action of 'nested lock' being provided to lockdep's lock_acquire(), causes the lockdep to detect that the top of the held lock stack contains a lock of the same class and then increment its reference counter instead of pushing a new held_lock item onto that stack. See __lock_acquire for more information. Signed-off-by: Maxim Levitsky Acked-by: Peter Zijlstra (Intel) Message-ID: <20250512180407.659015-2-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini commit 4e02d4f9734fa55e3eb18be9b759cd42d93497ec Merge: 3e89d5fdc70fa9 72df72e1c6ddfb Author: Paolo Bonzini Date: Tue May 27 12:15:49 2025 -0400 Merge tag 'kvm-x86-svm-6.16' of https://github.com/kvm-x86/linux into HEAD KVM SVM changes for 6.16: - Wait for target vCPU to acknowledge KVM_REQ_UPDATE_PROTECTED_GUEST_STATE to fix a race between AP destroy and VMRUN. - Decrypt and dump the VMSA in dump_vmcb() if debugging enabled for the VM. - Add support for ALLOWED_SEV_FEATURES. - Add #VMGEXIT to the set of handlers special cased for CONFIG_RETPOLINE=y. - Treat DEBUGCTL[5:2] as reserved to pave the way for virtualizing features that utilize those bits. - Don't account temporary allocations in sev_send_update_data(). - Add support for KVM_CAP_X86_BUS_LOCK_EXIT on SVM, via Bus Lock Threshold. commit 3e89d5fdc70fa92710ca581a6df96dcb2c8bf9e1 Merge: 3e0797f6dd7817 907092bf7cbdde Author: Paolo Bonzini Date: Tue May 27 12:15:38 2025 -0400 Merge tag 'kvm-x86-vmx-6.16' of https://github.com/kvm-x86/linux into HEAD KVM VMX changes for 6.16: - Explicitly check MSR load/store list counts to fix a potential overflow on 32-bit kernels. - Flush shadow VMCSes on emergency reboot. - Revert mem_enc_ioctl() back to an optional hook, as it's nullified when SEV or TDX is disabled via Kconfig. - Macrofy the handling of vt_x86_ops to eliminate a pile of boilerplate code needed for TDX, and to optimize CONFIG_KVM_INTEL_TDX=n builds. commit 3e0797f6dd78178758ea33c3e82fc079079cf772 Merge: db44dcbdf814fa d166453ebd2925 Author: Paolo Bonzini Date: Tue May 27 12:15:26 2025 -0400 Merge tag 'kvm-x86-selftests-6.16' of https://github.com/kvm-x86/linux into HEAD KVM selftests changes for 6.16: - Add support for SNP to the various SEV selftests. - Add a selftest to verify fastops instructions via forced emulation. - Add MGLRU support to the access tracking perf test. commit db44dcbdf814fa035a9c7a8d7485a963b8001578 Merge: 5d816c13995872 edaf3eded38625 Author: Paolo Bonzini Date: Tue May 27 12:15:01 2025 -0400 Merge tag 'kvm-x86-pir-6.16' of https://github.com/kvm-x86/linux into HEAD KVM x86 posted interrupt changes for 6.16: Refine and optimize KVM's software processing of the PIR, and ultimately share PIR harvesting code between KVM and the kernel's Posted MSI handler commit 5d816c139958725a738ca8a39d9979c707d0d8ae Merge: ebd38b26ecb52b 6a3d704959bd04 Author: Paolo Bonzini Date: Tue May 27 12:14:47 2025 -0400 Merge tag 'kvm-x86-mmu-6.16' of https://github.com/kvm-x86/linux into HEAD KVM x86 MMU changes for 6.16: - Refine and harden handling of spurious faults. - Use kvm_x86_call() instead of open coding static_call(). commit ebd38b26ecb52bc000e794cc6fef8f8af673ab48 Merge: cd1be30b44d930 37d8bad41d2b0a Author: Paolo Bonzini Date: Tue May 27 12:14:36 2025 -0400 Merge tag 'kvm-x86-misc-6.16' of https://github.com/kvm-x86/linux into HEAD KVM x86 misc changes for 6.16: - Unify virtualization of IBRS on nested VM-Exit, and cross-vCPU IBPB, between SVM and VMX. - Advertise support to userspace for WRMSRNS and PREFETCHI. - Rescan I/O APIC routes after handling EOI that needed to be intercepted due to the old/previous routing, but not the new/current routing. - Add a module param to control and enumerate support for device posted interrupts. - Misc cleanups. commit 39d86db34e41b96bd86f1955cd0ce6cd9c5fca4c Author: Ming Lei Date: Tue May 27 23:34:05 2025 +0800 loop: add file_start_write() and file_end_write() file_start_write() and file_end_write() should be added around ->write_iter(). Recently we switch to ->write_iter() from vfs_iter_write(), and the implied file_start_write() and file_end_write() are lost. Also we never add them for dio code path, so add them back for covering both. Cc: Jeff Moyer Fixes: f2fed441c69b ("loop: stop using vfs_iter_{read,write} for buffered I/O") Fixes: bc07c10a3603 ("block: loop: support DIO & AIO") Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250527153405.837216-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit cd1be30b44d930d8082618cd8f8c57e87758fe33 Author: Edward Adam Davis Date: Tue May 27 16:44:37 2025 +0800 KVM: VMX: use __always_inline for is_td_vcpu and is_td is_td() and is_td_vcpu() are used in no-instrumentation sections; use __always_inline instead of inline. vmlinux.o: error: objtool: vmx_handle_nmi+0x47: call to is_td_vcpu.isra.0() leaves .noinstr.text section Fixes: 7172c753c26a ("KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct") Signed-off-by: Edward Adam Davis Message-ID: Signed-off-by: Paolo Bonzini commit eda4623cf989d033c07355be1469e44f321ce8ae Author: Pavel Begunkov Date: Tue May 27 16:27:57 2025 +0100 io_uring/zcrx: init id for xa_find xa_find() interprets id as the lower bound and thus expects it initialised. Reported-by: syzbot+c3ff04150c30d3df0f57@syzkaller.appspotmail.com Fixes: 76f1cc98b23ce ("io_uring/zcrx: add support for multiple ifqs") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/faea44ef63131e6968f635e1b6b7ca6056f1f533.1748359655.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit b1456f6dc167f7f101746e495bede2bac3d0e19f Merge: 6376c0770656f3 6c58d2791d6046 Author: Linus Torvalds Date: Tue May 27 09:04:15 2025 -0700 Merge tag 'timers-core-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer core updates from Thomas Gleixner: "Updates for the time/timer core code: - Rework the initialization of the posix-timer kmem_cache and move the cache pointer into the timer_data structure to prevent false sharing - Switch the alarmtimer code to lock guards - Improve the CPU selection criteria in the per CPU validation of the clocksource watchdog to avoid arbitrary selections (or omissions) on systems with a small number of CPUs - The usual cleanups and improvements" * tag 'timers-core-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: tick/nohz: Remove unused tick_nohz_full_add_cpus_to() clocksource: Fix the CPUs' choice in the watchdog per CPU verification alarmtimer: Switch spin_{lock,unlock}_irqsave() to guards alarmtimer: Remove dead return value in clock2alarm() time/jiffies: Change register_refined_jiffies() to void __init timers: Remove unused __round_jiffies(_up) posix-timers: Initialize cache early and move pointer into __timer_data commit 6376c0770656f3bdf7f411faf068371b6932aeca Merge: 5e8bbb2caa4e67 29857e6f4e30b4 Author: Linus Torvalds Date: Tue May 27 09:01:26 2025 -0700 Merge tag 'timers-clocksource-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull clocksource updates from Thomas Gleixner: "Updates for clocksource/clockevent drivers: - The final conversion of text formatted device tree binding to schemas - A new driver fot the System Timer Module on S32G NXP SoCs - A new driver fot the Econet HPT timer - The usual improvements and device tree binding updates" * tag 'timers-clocksource-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (31 commits) clocksource/drivers/renesas-ostm: Unconditionally enable reprobe support dt-bindings: timer: renesas,ostm: Document RZ/V2N (R9A09G056) support dt-bindings: timer: Convert marvell,armada-370-timer to DT schema dt-bindings: timer: Convert ti,keystone-timer to DT schema dt-bindings: timer: Convert st,spear-timer to DT schema dt-bindings: timer: Convert socionext,milbeaut-timer to DT schema dt-bindings: timer: Convert snps,arc-timer to DT schema dt-bindings: timer: Convert snps,archs-rtc to DT schema dt-bindings: timer: Convert snps,archs-gfrc to DT schema dt-bindings: timer: Convert lsi,zevio-timer to DT schema dt-bindings: timer: Convert jcore,pit to DT schema dt-bindings: timer: Convert img,pistachio-gptimer to DT schema dt-bindings: timer: Convert ezchip,nps400-timer to DT schema dt-bindings: timer: Convert cirrus,clps711x-timer to DT schema dt-bindings: timer: Convert altr,timer-1.0 to DT schema dt-bindings: timer: Add ESWIN EIC7700 CLINT clocksource/drivers: Add EcoNet Timer HPT driver dt-bindings: timer: Add EcoNet EN751221 "HPT" CPU Timer dt-bindings: timer: Convert arm,mps2-timer to DT schema dt-bindings: timer: Add Sophgo SG2044 ACLINT timer ... commit 5e8bbb2caa4e679c8e3d4815ed8515d825af6fab Merge: 44ed0f35df343d aad823aa3a7d67 Author: Linus Torvalds Date: Tue May 27 08:31:21 2025 -0700 Merge tag 'timers-cleanups-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer cleanups from Thomas Gleixner: "Another set of timer API cleanups: - Convert init_timer*(), try_to_del_timer_sync() and destroy_timer_on_stack() over to the canonical timer_*() namespace convention. There is another large conversion pending, which has not been included because it would have caused a gazillion of merge conflicts in next. The conversion scripts will be run towards the end of the merge window and a pull request sent once all conflict dependencies have been merged" * tag 'timers-cleanups-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: treewide, timers: Rename destroy_timer_on_stack() as timer_destroy_on_stack() treewide, timers: Rename try_to_del_timer_sync() as timer_delete_sync_try() timers: Rename init_timers() as timers_init() timers: Rename NEXT_TIMER_MAX_DELTA as TIMER_NEXT_MAX_DELTA timers: Rename __init_timer_on_stack() as __timer_init_on_stack() timers: Rename __init_timer() as __timer_init() timers: Rename init_timer_on_stack_key() as timer_init_key_on_stack() timers: Rename init_timer_key() as timer_init_key() commit dc3e0f17f74558e8a2fce00608855f050de10230 Author: Namjae Jeon Date: Tue May 27 11:23:01 2025 +0900 ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension If client send SMB2_CREATE_POSIX_CONTEXT to ksmbd, Allow a filename to contain special characters. Reported-by: Philipp Kerling Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 571781eb7ffefa65b0e922c8031e42b4411a40d4 Author: Namjae Jeon Date: Wed May 21 09:02:29 2025 +0900 ksmbd: provide zero as a unique ID to the Mac client The Mac SMB client code seems to expect the on-disk file identifier to have the semantics of HFS+ Catalog Node Identifier (CNID). ksmbd provides the inode number as a unique ID to the client, but in the case of subvolumes of btrfs, there are cases where different files have the same inode number, so the mac smb client treats it as an error. There is a report that a similar problem occurs when the share is ZFS. Returning UniqueId of zero will make the Mac client to stop using and trusting the file id returned from the server. Reported-by: Justin Turner Arthur Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 44ed0f35df343d00b8d38006854f96e333104a66 Merge: 2bd1bea5fa6aa7 4e7bca76e3fed5 Author: Linus Torvalds Date: Tue May 27 08:15:26 2025 -0700 Merge tag 'irq-msi-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull MSI updates from Thomas Gleixner: "Updates for the MSI subsystem (core code and PCI): - Switch the MSI descriptor locking to lock guards - Replace a broken and naive implementation of PCI/MSI-X control word updates in the PCI/TPH driver with a properly serialized variant in the PCI/MSI core code. - Remove the MSI descriptor abuse in the SCCI/UFS/QCOM driver by replacing the direct access to the MSI descriptors with the proper API function calls. People will never understand that APIs exist for a reason... - Provide core infrastructre for the upcoming PCI endpoint library extensions. Currently limited to ARM GICv3+, but in theory extensible to other architectures. - Provide a MSI domain::teardown() callback, which allows drivers to undo the effects of the prepare() callback. - Move the MSI domain::prepare() callback invocation to domain creation time to avoid redundant (and in case of ARM/GIC-V3-ITS confusing) invocations on every allocation. In combination with the new teardown callback this removes some ugly hacks in the GIC-V3-ITS driver, which pretended to work around the short comings of the core code so far. With this update the code is correct by design and implementation. - Make the irqchip MSI library globally available, provide a MSI parent domain creation helper and convert a bunch of (PCI/)MSI drivers over to the modern MSI parent mechanism. This is the first step to get rid of at least one incarnation of the three PCI/MSI management schemes. - The usual small cleanups and improvements" * tag 'irq-msi-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (33 commits) PCI/MSI: Use bool for MSI enable state tracking PCI: tegra: Convert to MSI parent infrastructure PCI: xgene: Convert to MSI parent infrastructure PCI: apple: Convert to MSI parent infrastructure irqchip/msi-lib: Honour the MSI_FLAG_NO_AFFINITY flag irqchip/mvebu: Convert to msi_create_parent_irq_domain() helper irqchip/gic: Convert to msi_create_parent_irq_domain() helper genirq/msi: Add helper for creating MSI-parent irq domains irqchip: Make irq-msi-lib.h globally available irqchip/gic-v3-its: Use allocation size from the prepare call genirq/msi: Engage the .msi_teardown() callback on domain removal genirq/msi: Move prepare() call to per-device allocation irqchip/gic-v3-its: Implement .msi_teardown() callback genirq/msi: Add .msi_teardown() callback as the reverse of .msi_prepare() irqchip/gic-v3-its: Add support for device tree msi-map and msi-mask dt-bindings: PCI: pci-ep: Add support for iommu-map and msi-map irqchip/gic-v3-its: Set IRQ_DOMAIN_FLAG_MSI_IMMUTABLE for ITS irqdomain: Add IRQ_DOMAIN_FLAG_MSI_IMMUTABLE and irq_domain_is_msi_immutable() platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() genirq/msi: Rename msi_[un]lock_descs() ... commit 2bd1bea5fa6aa79bc563a57919730eb809651b28 Merge: c0f182c979cfea 38c1e73fdeb379 Author: Linus Torvalds Date: Tue May 27 08:07:32 2025 -0700 Merge tag 'irq-cleanups-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq cleanups from Thomas Gleixner: "A set of cleanups for the generic interrupt subsystem: - Consolidate on one set of functions for the interrupt domain code to get rid of pointlessly duplicated code with only marginal different semantics. - Update the documentation accordingly and consolidate the coding style of the irqdomain header" * tag 'irq-cleanups-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (46 commits) irqdomain: Consolidate coding style irqdomain: Fix kernel-doc and add it to Documentation Documentation: irqdomain: Update it Documentation: irq-domain.rst: Simple improvements Documentation: irq/concepts: Minor improvements Documentation: irq/concepts: Add commas and reflow irqdomain: Improve kernel-docs of functions irqdomain: Make struct irq_domain_info variables const irqdomain: Use irq_domain_instantiate()'s return value as initializers irqdomain: Drop irq_linear_revmap() pinctrl: keembay: Switch to irq_find_mapping() irqchip/armada-370-xp: Switch to irq_find_mapping() gpu: ipu-v3: Switch to irq_find_mapping() gpio: idt3243x: Switch to irq_find_mapping() sh: Switch to irq_find_mapping() powerpc: Switch to irq_find_mapping() irqdomain: Drop irq_domain_add_*() functions powerpc: Switch irq_domain_add_nomap() to use fwnode thermal: Switch to irq_domain_create_linear() soc: Switch to irq_domain_create_*() ... commit c0f182c979cfead8fff08108a11fbd2fe885dd33 Merge: 60c1d948f79dc6 3e402acd5c4f9d Author: Linus Torvalds Date: Tue May 27 08:00:46 2025 -0700 Merge tag 'irq-drivers-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq controller updates from Thomas Gleixner: "Update for interrupt chip drivers: - Convert the generic interrupt chip to lock guards to remove copy & pasta boilerplate code and gotos. - A new driver fot the interrupt controller in the EcoNet EN751221 MIPS SoC. - Extend the SG2042-MSI driver to support the new SG2044 SoC - Updates and cleanups for the (ancient) VT8500 driver - Improve the scalability of the ARM GICV4.1 ITS driver by utilizing node local copies a VM's interrupt translation table when possible. This results in a 12% reduction of VM IPI latency in certain workloads. - The usual cleanups and improvements all over the place" * tag 'irq-drivers-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (25 commits) irqchip/irq-pruss-intc: Simplify chained interrupt handler setup irqchip/gic-v4.1: Use local 4_1 ITS to generate VSGI irqchip/econet-en751221: Switch to of_fwnode_handle() irqchip/irq-vt8500: Switch to irq_domain_create_*() irqchip/econet-en751221: Switch to irq_domain_create_linear() irqchip/irq-vt8500: Use fewer global variables and add error handling irqchip/irq-vt8500: Use a dedicated chained handler function irqchip/irq-vt8500: Don't require 8 interrupts from a chained controller irqchip/irq-vt8500: Drop redundant copy of the device node pointer irqchip/irq-vt8500: Split up ack/mask functions irqchip/sg2042-msi: Fix wrong type cast in sg2044_msi_irq_ack() irqchip/sg2042-msi: Add the Sophgo SG2044 MSI interrupt controller irqchip/sg2042-msi: Introduce configurable chipinfo for SG2042 irqchip/sg2042-msi: Rename functions and data structures to be SG2042 agnostic dt-bindings: interrupt-controller: Add Sophgo SG2044 MSI controller genirq/generic-chip: Fix incorrect lock guard conversions genirq/generic-chip: Remove unused lock wrappers irqchip: Convert generic irqchip locking to guards gpio: mvebu: Convert generic irqchip locking to guard() ARM: orion/gpio:: Convert generic irqchip locking to guard() ... commit 60c1d948f79dc6626bf2fe4f2d2fba51e18a1e04 Merge: 0c1494015fea09 a510bb87da72aa Author: Linus Torvalds Date: Tue May 27 07:46:58 2025 -0700 Merge tag 'irq-core-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq core updates from Thomas Gleixner: "Updates for the generic interrupt subsystem core code: - Address a long standing subtle problem in the CPU hotplug code for affinity-managed interrupts. Affinity-managed interrupts are shut down by the core code when the last CPU in the affinity set goes offline and started up again when the first CPU in the affinity set becomes online again. This unfortunately does not take into account whether an interrupt has been disabled before the last CPU goes offline and starts up the interrupt unconditionally when the first CPU becomes online again. That's obviously not what drivers expect. Address this by preserving the disabled state for affinity-managed interrupts accross these CPU hotplug operations. All non-managed interrupts are not affected by this because startup/shutdown is coupled to request/free_irq() which obviously has to reset state. - Support three-cell scheme interrupts to allow GPIO drivers to specify interrupts from an already existing scheme - Switch the interrupt subsystem core to lock guards. This gets rid of quite some copy & pasta boilerplate code all over the place. - The usual small cleanups and improvements all over the place" * tag 'irq-core-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (59 commits) genirq/irqdesc: Remove double locking in hwirq_show() genirq: Retain disable depth for managed interrupts across CPU hotplug genirq: Bump the size of the local variable for sprintf() genirq/manage: Use the correct lock guard in irq_set_irq_wake() genirq: Consistently use '%u' format specifier for unsigned int variables genirq: Ensure flags in lock guard is consistently initialized genirq: Fix inverted condition in handle_nested_irq() genirq/cpuhotplug: Fix up lock guards conversion brainf..t genirq: Use scoped_guard() to shut clang up genirq: Remove unused remove_percpu_irq() genirq: Remove irq_[get|put]_desc*() genirq/manage: Rework irq_set_irqchip_state() genirq/manage: Rework irq_get_irqchip_state() genirq/manage: Rework teardown_percpu_nmi() genirq/manage: Rework prepare_percpu_nmi() genirq/manage: Rework disable_percpu_irq() genirq/manage: Rework irq_percpu_is_enabled() genirq/manage: Rework enable_percpu_irq() genirq/manage: Rework irq_set_parent() genirq/manage: Rework can_request_irq() ... commit 0c1494015fea0935fbf6cd9d99c008fcbe1e4165 Merge: 914873bc7df913 8278fd6006a02e Author: Linus Torvalds Date: Tue May 27 07:44:22 2025 -0700 Merge tag 'core-entry-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull core entry code updates from Thomas Gleixner: "Updates for the generic and architecture entry code: - Move LoongArch and RISC-V ret_from_fork() implementations to C code so that syscall_exit_user_mode() can be inlined - Split the RISC-V ret_from_fork() implementation into return to user and return to kernel, which gives a measurable performance improvement - Inline syscall_exit_user_mode() which benefits all architectures by avoiding a function call and letting the compiler do better optimizations" * tag 'core-entry-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: LoongArch: entry: Fix include order entry: Inline syscall_exit_to_user_mode() LoongArch: entry: Migrate ret_from_fork() to C riscv: entry: Split ret_from_fork() into user and kernel riscv: entry: Convert ret_from_fork() to C commit 9d4f22fd563e0cd02e8448e84d057e7c0132a586 Author: Peter Hilber Date: Fri May 9 18:07:25 2025 +0200 virtio_rtc: Add RTC class driver Expose the virtio-rtc UTC-like clock as an RTC clock to userspace - if it is present, and if it does not step on leap seconds. The RTC class enables the virtio-rtc device to resume the system from sleep states on RTC alarm. Support RTC alarm if the virtio-rtc alarm feature is present. The virtio-rtc device signals an alarm by marking an alarmq buffer as used. Peculiarities ------------- A virtio-rtc clock is a bit special for an RTC clock in that - the clock may step (also backwards) autonomously at any time and - the device, and its notification mechanism, will be reset during boot or resume from sleep. The virtio-rtc device avoids that the driver might miss an alarm. The device signals an alarm whenever the clock has reached or passed the alarm time, and also when the device is reset (on boot or resume from sleep), if the alarm time is in the past. Open Issue ---------- The CLOCK_BOOTTIME_ALARM will use the RTC clock to wake up from sleep, and implicitly assumes that no RTC clock steps will occur during sleep. The RTC class driver does not know whether the current alarm is a real-time alarm or a boot-time alarm. Perhaps this might be handled by the driver also setting a virtio-rtc monotonic alarm (which uses a clock similar to CLOCK_BOOTTIME_ALARM). The virtio-rtc monotonic alarm would just be used to wake up in case it was a CLOCK_BOOTTIME_ALARM alarm. Otherwise, the behavior should not differ from other RTC class drivers. Signed-off-by: Peter Hilber Acked-by: Alexandre Belloni Message-Id: <20250509160734.1772-5-quic_philber@quicinc.com> Signed-off-by: Michael S. Tsirkin commit e2ef16757bbe1d4566093179944e9ebe730b2701 Author: Peter Hilber Date: Fri May 9 18:07:24 2025 +0200 virtio_rtc: Add Arm Generic Timer cross-timestamping For platforms using the Arm Generic Timer, add precise cross-timestamping support to virtio_rtc. Always report the CP15 virtual counter as the HW counter in use by arm_arch_timer, since the Linux kernel's usage of the Arm Generic Timer should always be compatible with this. Signed-off-by: Peter Hilber Message-Id: <20250509160734.1772-4-quic_philber@quicinc.com> Signed-off-by: Michael S. Tsirkin commit 9a17125a18f9ae1e1233a8e2d919059445b9d6fd Author: Peter Hilber Date: Fri May 9 18:07:23 2025 +0200 virtio_rtc: Add PTP clocks Expose the virtio_rtc clocks as PTP clocks to userspace, similar to ptp_kvm. virtio_rtc can expose multiple clocks, e.g. a UTC clock and a monotonic clock. Userspace should distinguish different clocks through the name assigned by the driver. In particular, UTC-like clocks can also be distinguished by if and how leap seconds are smeared. udev rules such as the following can be used to get different symlinks for different clock types: SUBSYSTEM=="ptp", ATTR{clock_name}=="Virtio PTP type 0/variant 0", SYMLINK += "ptp_virtio" SUBSYSTEM=="ptp", ATTR{clock_name}=="Virtio PTP type 1/variant 0", SYMLINK += "ptp_virtio_tai" SUBSYSTEM=="ptp", ATTR{clock_name}=="Virtio PTP type 2/variant 0", SYMLINK += "ptp_virtio_monotonic" SUBSYSTEM=="ptp", ATTR{clock_name}=="Virtio PTP type 3/variant 0", SYMLINK += "ptp_virtio_smear_unspecified" SUBSYSTEM=="ptp", ATTR{clock_name}=="Virtio PTP type 3/variant 1", SYMLINK += "ptp_virtio_smear_noon_linear" SUBSYSTEM=="ptp", ATTR{clock_name}=="Virtio PTP type 3/variant 2", SYMLINK += "ptp_virtio_smear_sls" SUBSYSTEM=="ptp", ATTR{clock_name}=="Virtio PTP type 4/variant 0", SYMLINK += "ptp_virtio_maybe_smeared" The preferred PTP clock reading method is ioctl PTP_SYS_OFFSET_PRECISE2, through the ptp_clock_info.getcrosststamp() op. For now, PTP_SYS_OFFSET_PRECISE2 will return -EOPNOTSUPP through a weak function. PTP_SYS_OFFSET_PRECISE2 requires cross-timestamping support for specific clocksources, which will be added in the following. If the clocksource specific code is enabled, check that the Virtio RTC device supports the respective HW counter before obtaining an actual cross-timestamp from the Virtio device. The Virtio RTC device response time may be higher than the timekeeper seqcount increment interval. Therefore, obtain the cross-timestamp before calling get_device_system_crosststamp(). As a fallback, support the ioctl PTP_SYS_OFFSET_EXTENDED2 for all platforms. Assume that concurrency issues during PTP clock removal are avoided by the posix_clock framework. Kconfig recursive dependencies prevent virtio_rtc from implicitly enabling PTP_1588_CLOCK, therefore just warn the user if PTP_1588_CLOCK is not available. Since virtio_rtc should in the future also expose clocks as RTC class devices, do not depend VIRTIO_RTC on PTP_1588_CLOCK. Signed-off-by: Peter Hilber Message-Id: <20250509160734.1772-3-quic_philber@quicinc.com> Signed-off-by: Michael S. Tsirkin commit 0623c759276885c3ae88197ba6fb5c9c6ba8612f Author: Peter Hilber Date: Fri May 9 18:07:22 2025 +0200 virtio_rtc: Add module and driver core Add the virtio_rtc module and driver core. The virtio_rtc module implements a driver compatible with the proposed Virtio RTC device specification. The Virtio RTC (Real Time Clock) device provides information about current time. The device can provide different clocks, e.g. for the UTC or TAI time standards, or for physical time elapsed since some past epoch. The driver can read the clocks with simple or more accurate methods. Implement the core, which interacts with the Virtio RTC device. Apart from this, the core does not expose functionality outside of the virtio_rtc module. Follow-up patches will expose PTP clocks and an RTC Class device. Provide synchronous messaging, which is enough for the expected time synchronization use cases through PTP clocks (similar to ptp_kvm) or RTC Class device. Signed-off-by: Peter Hilber Message-Id: <20250509160734.1772-2-quic_philber@quicinc.com> Signed-off-by: Michael S. Tsirkin commit 169294a14b3f80ce184fe832ff640b67a1b9eb3b Author: Christoph Hellwig Date: Thu May 1 09:22:30 2025 -0500 vringh: use bvec_kmap_local Use the bvec_kmap_local helper rather than digging into the bvec internals. Signed-off-by: Christoph Hellwig Message-Id: <20250501142244.2888227-1-hch@lst.de> Signed-off-by: Michael S. Tsirkin Reviewed-by: Chaitanya Kulkarni commit 8b3f9967b1fd481ed932f453c38aec99f3c90d95 Author: Kees Cook Date: Fri Apr 25 23:22:15 2025 -0700 vhost: vringh: Use matching allocation type in resize_iovec() In preparation for making the kmalloc family of allocators type aware, we need to make sure that the returned type from the allocation matches the type of the variable being assigned. (Before, the allocator would always return "void *", which can be implicitly cast to any pointer type.) The assigned type is "struct kvec *", but the returned type will be "struct iovec *". These have the same allocation size, so there is no bug: struct kvec { void *iov_base; /* and that should *never* hold a userland pointer */ size_t iov_len; }; struct iovec { void __user *iov_base; /* BSD uses caddr_t (1003.1g requires void *) */ __kernel_size_t iov_len; /* Must be size_t (1003.1g) */ }; Adjust the allocation type to match the assignment. Signed-off-by: Kees Cook Message-Id: <20250426062214.work.334-kees@kernel.org> Signed-off-by: Michael S. Tsirkin commit 9ef41ebf787fcbde99ac404ae473f8467641f983 Author: Israel Rukshin Date: Tue Apr 22 13:33:45 2025 +0300 virtio-pci: Fix result size returned for the admin command completion The result size returned by virtio_pci_admin_dev_parts_get() is 8 bytes larger than the actual result data size. This occurs because the result_sg_size field of the command is filled with the result length from virtqueue_get_buf(), which includes both the data size and an additional 8 bytes of status. This oversized result size causes two issues: 1. The state transferred to the destination includes 8 bytes of extra data at the end. 2. The allocated buffer in the kernel may be smaller than the returned size, leading to failures when reading beyond the allocated size. The commit fixes this by subtracting the status size from the result of virtqueue_get_buf(). This fix has been tested through live migrations with virtio-net, virtio-net-transitional, and virtio-blk devices. Fixes: 704806ca400e ("virtio: Extend the admin command to include the result size") Signed-off-by: Israel Rukshin Reviewed-by: Parav Pandit Reviewed-by: Max Gurtovoy Message-Id: <1745318025-23103-1-git-send-email-israelr@nvidia.com> Signed-off-by: Michael S. Tsirkin commit eec812774d307f0beee12f7129a440ad314a544a Author: Philipp Stanner Date: Thu May 8 10:51:35 2025 +0200 vdpa/octeon_ep: Control PCI dev enabling manually PCI region request functions such as pci_request_region() currently have the problem of becoming sometimes managed functions, if pcim_enable_device() instead of pci_enable_device() was called. The PCI subsystem wants to remove this deprecated behavior from its interfaces. octeopn_ep enables its device with pcim_enable_device() (for VF. PF uses manual management), but does so only to get automatic disablement. The driver wants to manage its PCI resources for VF manually, without devres. The easiest way not to use automatic resource management at all is by also handling device enable- and disablement manually. Replace pcim_enable_device() with pci_enable_device(). Add the necessary calls to pci_disable_device(). Signed-off-by: Philipp Stanner Acked-by: Vamsi Attunuru Message-Id: <20250508085134.24084-2-phasta@kernel.org> Signed-off-by: Michael S. Tsirkin Tested-by: Lei Yang Signed-off-by: Philipp Stanner <phasta@kernel.org>
Acked-by: Vamsi Attunuru <vattunuru@marvell.com>
commit ed5915cfce2abb9a553c3737badebd4a11d6c9c7 Author: Joonas Lahtinen Date: Thu May 22 09:41:27 2025 +0300 Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1" This reverts commit d6e020819612a4a06207af858e0978be4d3e3140. The IS_DGFX check was put in place because error capture of buffer objects is expected to be broken on devices with VRAM. Userspace fix[1] to the impacted media driver has been submitted, merged and a new driver release is out as 25.2.3 where the capture flag is dropped on DG1 thus unblocking the usage of media driver on DG1. [1] https://github.com/intel/media-driver/commit/93c07d9b4b96a78bab21f6acd4eb863f4313ea4a Cc: stable@vger.kernel.org # v6.0+ Cc: Ville Syrjälä Cc: Andi Shyti Cc: Matthew Auld Cc: Thomas Hellström Cc: Tvrtko Ursulin Acked-by: Tvrtko Ursulin Reviewed-by: Andi Shyti Link: https://lore.kernel.org/r/20250522064127.24293-1-joonas.lahtinen@linux.intel.com [Joonas: Update message to point out the merged userspace fix] Signed-off-by: Joonas Lahtinen (cherry picked from commit d2dc30e0aa252830f908c8e793d3139d51321370) Signed-off-by: Joonas Lahtinen commit 25eeba495b2fc16037647c1a51bcdf6fc157af5c Author: Ville Syrjälä Date: Mon May 12 21:22:15 2025 +0200 drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1 The intel-media-driver is currently broken on DG1 because it uses EXEC_CAPTURE with recovarable contexts. Relax the check to allow that. I've also submitted a fix for the intel-media-driver: https://github.com/intel/media-driver/pull/1920 Cc: stable@vger.kernel.org # v6.0+ Cc: Matthew Auld Cc: Thomas Hellström Testcase: igt/gem_exec_capture/capture-invisible Fixes: 71b1669ea9bd ("drm/i915/uapi: tweak error capture on recoverable contexts") Reviewed-by: Andi Shyti Signed-off-by: Ville Syrjälä Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250411144313.11660-2-ville.syrjala@linux.intel.com (cherry picked from commit d6e020819612a4a06207af858e0978be4d3e3140) Signed-off-by: Joonas Lahtinen commit 208c1559c5b18894e3380b3807b6364bd14f7584 Author: Mingzhe Zou Date: Tue May 27 13:16:01 2025 +0800 bcache: reserve more RESERVE_BTREE buckets to prevent allocator hang Reported an IO hang and unrecoverable error in our testing environment. After careful research, we found that bch_allocator_thread is stuck, the call stack is as follows: [<0>] __switch_to+0xbc/0x108 [<0>] __closure_sync+0x7c/0xbc [bcache] [<0>] bch_prio_write+0x430/0x448 [bcache] [<0>] bch_allocator_thread+0xb44/0xb70 [bcache] [<0>] kthread+0x124/0x130 [<0>] ret_from_fork+0x10/0x18 Moreover, the RESERVE_BTREE type bucket slot are empty and journal_full occurs at the same time. When the cache disk is first used, the sb.nJournal_buckets defaults to 0. So, only 8 RESERVE_BTREE type buckets are reserved. If RESERVE_BTREE type buckets used up or btree_check_reserve() failed when request handle btree split, the request will be repeatedly retried and wait for alloc thread to fill in. After the alloc thread fills the buckets, it will call bch_prio_write(). If journal_full occurs simultaneously at this time, journal_reclaim() and btree_flush_write() will be called sequentially, journal_write cannot be completed. This is a low probability event, we believe that reserve more RESERVE_BTREE buckets can avoid the worst situation. Fixes: 682811b3ce1a ("bcache: fix for allocator and register thread race") Signed-off-by: Mingzhe Zou Signed-off-by: Coly Li Link: https://lore.kernel.org/r/20250527051601.74407-4-colyli@kernel.org Signed-off-by: Jens Axboe commit 5a08e49f2359a14629f27da99aaf0f1c3a68b850 Author: Robert Pang Date: Tue May 27 13:16:00 2025 +0800 bcache: remove unused constants Remove constants MAX_NEED_GC and MAX_SAVE_PRIO in btree.c that have been unused since initial commit. Signed-off-by: Robert Pang Signed-off-by: Coly Li Link: https://lore.kernel.org/r/20250527051601.74407-3-colyli@kernel.org Signed-off-by: Jens Axboe commit 1e46ed947ec658f89f1a910d880cd05e42d3763e Author: Linggang Zeng Date: Tue May 27 13:15:59 2025 +0800 bcache: fix NULL pointer in cache_set_flush() 1. LINE#1794 - LINE#1887 is some codes about function of bch_cache_set_alloc(). 2. LINE#2078 - LINE#2142 is some codes about function of register_cache_set(). 3. register_cache_set() will call bch_cache_set_alloc() in LINE#2098. 1794 struct cache_set *bch_cache_set_alloc(struct cache_sb *sb) 1795 { ... 1860 if (!(c->devices = kcalloc(c->nr_uuids, sizeof(void *), GFP_KERNEL)) || 1861 mempool_init_slab_pool(&c->search, 32, bch_search_cache) || 1862 mempool_init_kmalloc_pool(&c->bio_meta, 2, 1863 sizeof(struct bbio) + sizeof(struct bio_vec) * 1864 bucket_pages(c)) || 1865 mempool_init_kmalloc_pool(&c->fill_iter, 1, iter_size) || 1866 bioset_init(&c->bio_split, 4, offsetof(struct bbio, bio), 1867 BIOSET_NEED_BVECS|BIOSET_NEED_RESCUER) || 1868 !(c->uuids = alloc_bucket_pages(GFP_KERNEL, c)) || 1869 !(c->moving_gc_wq = alloc_workqueue("bcache_gc", 1870 WQ_MEM_RECLAIM, 0)) || 1871 bch_journal_alloc(c) || 1872 bch_btree_cache_alloc(c) || 1873 bch_open_buckets_alloc(c) || 1874 bch_bset_sort_state_init(&c->sort, ilog2(c->btree_pages))) 1875 goto err; ^^^^^^^^ 1876 ... 1883 return c; 1884 err: 1885 bch_cache_set_unregister(c); ^^^^^^^^^^^^^^^^^^^^^^^^^^^ 1886 return NULL; 1887 } ... 2078 static const char *register_cache_set(struct cache *ca) 2079 { ... 2098 c = bch_cache_set_alloc(&ca->sb); 2099 if (!c) 2100 return err; ^^^^^^^^^^ ... 2128 ca->set = c; 2129 ca->set->cache[ca->sb.nr_this_dev] = ca; ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ... 2138 return NULL; 2139 err: 2140 bch_cache_set_unregister(c); 2141 return err; 2142 } (1) If LINE#1860 - LINE#1874 is true, then do 'goto err'(LINE#1875) and call bch_cache_set_unregister()(LINE#1885). (2) As (1) return NULL(LINE#1886), LINE#2098 - LINE#2100 would return. (3) As (2) has returned, LINE#2128 - LINE#2129 would do *not* give the value to c->cache[], it means that c->cache[] is NULL. LINE#1624 - LINE#1665 is some codes about function of cache_set_flush(). As (1), in LINE#1885 call bch_cache_set_unregister() ---> bch_cache_set_stop() ---> closure_queue() -.-> cache_set_flush() (as below LINE#1624) 1624 static void cache_set_flush(struct closure *cl) 1625 { ... 1654 for_each_cache(ca, c, i) 1655 if (ca->alloc_thread) ^^ 1656 kthread_stop(ca->alloc_thread); ... 1665 } (4) In LINE#1655 ca is NULL(see (3)) in cache_set_flush() then the kernel crash occurred as below: [ 846.712887] bcache: register_cache() error drbd6: cannot allocate memory [ 846.713242] bcache: register_bcache() error : failed to register device [ 846.713336] bcache: cache_set_free() Cache set 2f84bdc1-498a-4f2f-98a7-01946bf54287 unregistered [ 846.713768] BUG: unable to handle kernel NULL pointer dereference at 00000000000009f8 [ 846.714790] PGD 0 P4D 0 [ 846.715129] Oops: 0000 [#1] SMP PTI [ 846.715472] CPU: 19 PID: 5057 Comm: kworker/19:16 Kdump: loaded Tainted: G OE --------- - - 4.18.0-147.5.1.el8_1.5es.3.x86_64 #1 [ 846.716082] Hardware name: ESPAN GI-25212/X11DPL-i, BIOS 2.1 06/15/2018 [ 846.716451] Workqueue: events cache_set_flush [bcache] [ 846.716808] RIP: 0010:cache_set_flush+0xc9/0x1b0 [bcache] [ 846.717155] Code: 00 4c 89 a5 b0 03 00 00 48 8b 85 68 f6 ff ff a8 08 0f 84 88 00 00 00 31 db 66 83 bd 3c f7 ff ff 00 48 8b 85 48 ff ff ff 74 28 <48> 8b b8 f8 09 00 00 48 85 ff 74 05 e8 b6 58 a2 e1 0f b7 95 3c f7 [ 846.718026] RSP: 0018:ffffb56dcf85fe70 EFLAGS: 00010202 [ 846.718372] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 846.718725] RDX: 0000000000000001 RSI: 0000000040000001 RDI: 0000000000000000 [ 846.719076] RBP: ffffa0ccc0f20df8 R08: ffffa0ce1fedb118 R09: 000073746e657665 [ 846.719428] R10: 8080808080808080 R11: 0000000000000000 R12: ffffa0ce1fee8700 [ 846.719779] R13: ffffa0ccc0f211a8 R14: ffffa0cd1b902840 R15: ffffa0ccc0f20e00 [ 846.720132] FS: 0000000000000000(0000) GS:ffffa0ce1fec0000(0000) knlGS:0000000000000000 [ 846.720726] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 846.721073] CR2: 00000000000009f8 CR3: 00000008ba00a005 CR4: 00000000007606e0 [ 846.721426] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 846.721778] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 846.722131] PKRU: 55555554 [ 846.722467] Call Trace: [ 846.722814] process_one_work+0x1a7/0x3b0 [ 846.723157] worker_thread+0x30/0x390 [ 846.723501] ? create_worker+0x1a0/0x1a0 [ 846.723844] kthread+0x112/0x130 [ 846.724184] ? kthread_flush_work_fn+0x10/0x10 [ 846.724535] ret_from_fork+0x35/0x40 Now, check whether that ca is NULL in LINE#1655 to fix the issue. Signed-off-by: Linggang Zeng Signed-off-by: Mingzhe Zou Signed-off-by: Coly Li Link: https://lore.kernel.org/r/20250527051601.74407-2-colyli@kernel.org Signed-off-by: Jens Axboe commit 15bc5c00d10fb643df7939d34438d50ffa732cb2 Author: Viresh Kumar Date: Tue May 27 11:03:26 2025 +0530 rust: opp: Move `cfg(CONFIG_OF)` attribute to the top of doc test Move the `#[cfg(CONFIG_OF)]` attribute to the top of the documentation test block and hide it. This applies the condition to the entire test and improves readability. Placing configuration flags like `CONFIG_OF` at the top serves as a clear indicator of the conditions under which the example is valid, effectively acting like configuration metadata for the example itself. Suggested-by: Miguel Ojeda Signed-off-by: Viresh Kumar Link: https://patch.msgid.link/9d93c783cc4419f16dd8942a4359d74bc0149203.1748323971.git.viresh.kumar@linaro.org Signed-off-by: Rafael J. Wysocki commit e3de7984e45155888eebbca5a32c1cc5f29fa859 Author: Bram Vlerick Date: Tue May 27 13:08:49 2025 +0200 ASoC: tas571x: add separate tas5733 controls The controls between the tas5717 and tas5733 should not be shared since the biquad and register setup is not identical. For example, writing to 0x5c on the tas5717 modifies ch2_bq[10] while on the tas5733 this is ch1_cross_bq[3]. see https://www.ti.com/lit/ds/symlink/tas5733l.pdf and https://www.ti.com/lit/ds/symlink/tas5717.pdf for more details on the register maps. Signed-off-by: Bram Vlerick Link: https://patch.msgid.link/20250527-tas5733-biquad-fix-v1-1-0d3d941700bb@openpixelsystems.org Signed-off-by: Mark Brown commit 39cdf87a97fdab067e82138ad4611b764f3eae15 Author: Dan Carpenter Date: Tue May 27 08:45:21 2025 +0300 cpuidle: psci: Fix uninitialized variable in dt_idle_state_present() If the first cpu_node = of_cpu_device_node_get() fails then the cleanup.h code will try to free "state_node" but it hasn't been initialized yet. Declare the device_nodes where they are initialized to fix this. Fixes: 5836ebeb4a2b ("cpuidle: psci: Avoid initializing faux device if no DT idle states are present") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aDVRcfU8O8sez1x7@stanley.mountain Signed-off-by: Rafael J. Wysocki commit 9375e5e3557bf98e9c293aa32a9d2985eed16b5e Author: Dan Carpenter Date: Tue May 27 08:54:04 2025 +0300 ACPI: MRRM: Silence error code static checker warning The error code is not set correctly on if kasprintf() fails. On the first iteration it would return -EINVAL and subsequent iterations would return success. Set it to -ENOMEM. In real life, this allocation will not fail and if it did the system will not boot so this change is mostly to silence static checker warnings more than anything else. Fixes: 04f53540f791 ("ACPI: MRRM: Add /sys files to describe memory ranges") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aDVTfEm-Jch7FuHG@stanley.mountain Signed-off-by: Rafael J. Wysocki commit ce57cc1269c580abfca5b79cb40243b01aac357c Author: Dan Carpenter Date: Tue May 27 08:43:34 2025 +0300 ACPI: APEI: EINJ: Clean up on error in einj_probe() Call acpi_put_table() before returning the error code. Fixes: e54b1dc1c4f0 ("ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type()") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aDVRBok33LZhXcId@stanley.mountain Signed-off-by: Rafael J. Wysocki commit 8450f1e0d3d0e0b200eb14d14dfb8ef5ddb9bda9 Author: Zixian Zeng Date: Sun May 25 22:58:41 2025 +0800 spi: dt-bindings: spi-sg2044-nor: Add SOPHGO SG2042 Add bindings for the SOPHGO SG2042 SPI-NOR flash controller, which is compatible with SOPHGO SG2044. Signed-off-by: Zixian Zeng Acked-by: Conor Dooley Reviewed-by: Chen Wang Link: https://patch.msgid.link/20250525-sfg-spifmc-v2-1-a3732b6f5ab4@gmail.com Signed-off-by: Mark Brown commit b83825a8f56a34e7352e424aae64ffe6b88247d1 Author: Josef Bacik Date: Mon May 19 14:03:01 2025 -0400 btrfs: don't drop a reference if btrfs_check_write_meta_pointer() fails In the zoned mode there's a bug in the extent buffer tree conversion to xarray. The reference for eb is dropped and code continues but the references get dropped by releasing the batch. Reported-by: Johannes Thumshirn Reported-by: kernel test robot Link: https://lore.kernel.org/linux-btrfs/202505191521.435b97ac-lkp@intel.com/ Fixes: 19d7f65f032f ("btrfs: convert the buffer_radix to an xarray") Reviewed-by: Johannes Thumshirn Tested-by: Johannes Thumshirn Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 217e3cbba3d6613bee9ac33ddc330f8676eb9eca Merge: 53a087046ad9a9 00b39d150986c7 Author: Will Deacon Date: Tue May 27 12:26:54 2025 +0100 Merge branch 'for-next/vdso' into for-next/core * for-next/vdso: arm64: vdso: Use __arch_counter_get_cntvct() commit 53a087046ad9a9b3cea2e92f9c5a06011f6e78b0 Merge: f92f17a7bbe731 33c4618d0ac041 Author: Will Deacon Date: Tue May 27 12:26:43 2025 +0100 Merge branch 'for-next/sme-fixes' into for-next/core * for-next/sme-fixes: (35 commits) arm64/fpsimd: Allow CONFIG_ARM64_SME to be selected arm64/fpsimd: ptrace: Gracefully handle errors arm64/fpsimd: ptrace: Mandate SVE payload for streaming-mode state arm64/fpsimd: ptrace: Do not present register data for inactive mode arm64/fpsimd: ptrace: Save task state before generating SVE header arm64/fpsimd: ptrace/prctl: Ensure VL changes leave task in a valid state arm64/fpsimd: ptrace/prctl: Ensure VL changes do not resurrect stale data arm64/fpsimd: Make clone() compatible with ZA lazy saving arm64/fpsimd: Clear PSTATE.SM during clone() arm64/fpsimd: Consistently preserve FPSIMD state during clone() arm64/fpsimd: Remove redundant task->mm check arm64/fpsimd: signal: Use SMSTOP behaviour in setup_return() arm64/fpsimd: Add task_smstop_sm() arm64/fpsimd: Factor out {sve,sme}_state_size() helpers arm64/fpsimd: Clarify sve_sync_*() functions arm64/fpsimd: ptrace: Consistently handle partial writes to NT_ARM_(S)SVE arm64/fpsimd: signal: Consistently read FPSIMD context arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state arm64/fpsimd: signal: Clear PSTATE.SM when restoring FPSIMD frame only arm64/fpsimd: Do not discard modified SVE state ... commit f92f17a7bbe73141dee58b7ef59aa16f6b9468e7 Merge: 3b9552cf340ef4 b225219a4002aa Author: Will Deacon Date: Tue May 27 12:26:30 2025 +0100 Merge branch 'for-next/selftests' into for-next/core * for-next/selftests: kselftest/arm64: Set default OUTPUT path when undefined kselftest/arm64: fp-ptrace: Adjust to new inactive mode behaviour kselftest/arm64: fp-ptrace: Adjust to new VL change behaviour kselftest/arm64: tpidr2: Adjust to new clone() behaviour kselftest/arm64: fp-ptrace: Fix expected FPMR value when PSTATE.SM is changed commit 4db7384ce55c4d7bfb9876fabd8d8778b2ff90ff Author: Josef Bacik Date: Mon May 19 14:03:01 2025 -0400 btrfs: don't drop a reference if btrfs_check_write_meta_pointer() fails In the zoned mode there's a bug in the extent buffer tree conversion to xarray. The reference for eb is dropped and code continues but the references get dropped by releasing the batch. Reported-by: Johannes Thumshirn Fixes: 19d7f65f032f ("btrfs: convert the buffer_radix to an xarray") Reviewed-by: Johannes Thumshirn Tested-by: Johannes Thumshirn Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3b9552cf340ef4f6e2ff8b612f3e47c31a86aa1f Merge: 3557a45d2ab892 7ff37d29fd5c27 Author: Will Deacon Date: Tue May 27 12:26:22 2025 +0100 Merge branch 'for-next/psci' into for-next/core * for-next/psci: firmware: psci: Fix refcount leak in psci_dt_init commit 3557a45d2ab89211de1d367ff30af9e69c859aab Merge: c73497194ad539 8c138a189f6db2 Author: Will Deacon Date: Tue May 27 12:26:15 2025 +0100 Merge branch 'for-next/perf' into for-next/core * for-next/perf: perf/arm-cmn: Add CMN S3 ACPI binding perf/arm-cmn: Initialise cmn->cpu earlier perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create() perf/arm-cmn: Fix REQ2/SNP2 mixup perf: Do not enable by default during compile testing perf: arm-ni: Fix missing platform_set_drvdata() perf: arm-ni: Unregister PMUs on probe failure perf/arm-cmn: Remove CMN-600 DTC domain special case commit c73497194ad5390ec095af3dcdc5f9fc4c23789b Merge: 9d27622f7d0cd1 90530521079eec Author: Will Deacon Date: Tue May 27 12:26:06 2025 +0100 Merge branch 'for-next/mm' into for-next/core * for-next/mm: arm64/boot: Disallow BSS exports to startup code arm64/boot: Move global CPU override variables out of BSS arm64/boot: Move init_pgdir[] and init_idmap_pgdir[] into __pi_ namespace arm64: mm: Drop redundant check in pmd_trans_huge() arm64/mm: Permit lazy_mmu_mode to be nested arm64/mm: Disable barrier batching in interrupt contexts arm64/mm: Batch barriers when updating kernel mappings mm/vmalloc: Enter lazy mmu mode while manipulating vmalloc ptes arm64/mm: Support huge pte-mapped pages in vmap mm/vmalloc: Gracefully unmap huge ptes mm/vmalloc: Warn on improper use of vunmap_range() arm64/mm: Hoist barriers out of set_ptes_anysz() loop arm64: hugetlb: Use __set_ptes_anysz() and __ptep_get_and_clear_anysz() arm64/mm: Refactor __set_ptes() and __ptep_get_and_clear() mm/page_table_check: Batch-check pmds/puds just like ptes arm64: hugetlb: Refine tlb maintenance scope arm64: hugetlb: Cleanup huge_pte size discovery mechanisms arm64: pageattr: Explicitly bail out when changing permissions for vmalloc_huge mappings arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX arm64/mm: Remove randomization of the linear map commit 9d27622f7d0cd146283de47b0a2bcebd0879469f Merge: dc64de40339bc1 7bb797757bf572 Author: Will Deacon Date: Tue May 27 12:25:58 2025 +0100 Merge branch 'for-next/misc' into for-next/core * for-next/misc: arm64/cpuinfo: only show one cpu's info in c_show() arm64: Extend pr_crit message on invalid FDT arm64: Kconfig: remove unnecessary selection of CRC32 arm64: Add missing includes for mem_encrypt commit dc64de40339bc1a7d7c52f5d3b42094e596dac12 Merge: 48055fb8823bb5 363cd2b81cfdf7 Author: Will Deacon Date: Tue May 27 12:24:18 2025 +0100 Merge branch 'for-next/fixes' into for-next/core Merge in for-next/fixes, as subsequent improvements to our early PI code that disallow BSS exports depend on the 'arm64_use_ng_mappings' fix here. * for-next/fixes: arm64: cpufeature: Move arm64_use_ng_mappings to the .data section to prevent wrong idmap generation arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays commit 48055fb8823bb5e8266096ee13bc23112a02585f Merge: b5b6910f83b80e 80834997154271 Author: Will Deacon Date: Tue May 27 12:24:12 2025 +0100 Merge branch 'for-next/entry' into for-next/core * for-next/entry: arm64: el2_setup.h: Make __init_el2_fgt labels consistent, again arm64: Update comment regarding values in __boot_cpu_mode arm64/mm: Re-organise setting up FEAT_S1PIE registers PIRE0_EL1 and PIR_EL1 arm64: enable PREEMPT_LAZY commit b5b6910f83b80e2f088f529538352907605f0407 Merge: 328d35b755ffab e04796c8b59807 Author: Will Deacon Date: Tue May 27 12:24:02 2025 +0100 Merge branch 'for-next/efi' into for-next/core * for-next/efi: arm64/fpsimd: Avoid unnecessary per-CPU buffers for EFI runtime calls commit 328d35b755ffab37fd74ced2c5795e45de466241 Merge: 9bd2e7c65c8977 226ff35039d058 Author: Will Deacon Date: Tue May 27 12:23:50 2025 +0100 Merge branch 'for-next/cpufeature' into for-next/core * for-next/cpufeature: arm64: cputype: Add cputype definition for HIP12 arm64: Expose AIDR_EL1 via sysfs arm64/cpufeature: Add missing id_aa64mmfr4 feature reg update commit 9bd2e7c65c8977c2a06e4c144a59a7ef24a017ce Merge: 0af2f6be1b4281 59529bbe642de4 Author: Will Deacon Date: Tue May 27 12:23:32 2025 +0100 Merge branch 'for-next/acpi' into for-next/core * for-next/acpi: firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES commit b4608e944177531334a79f3df2cd14275b47808c Author: Thangaraj Samynathan Date: Tue May 27 16:02:44 2025 +0530 spi: spi-pci1xxxx: Fix Probe failure with Dual SPI instance with INTx interrupts Fixes a probe failure that occurs when dual SPI controllers are enabled and INTx interrupts are used. Reduces the minimum required number of interrupt vectors to 1 and registers a shared ISR when the allocated vectors are fewer than the number of controllers. This change ensures that the probe succeeds even with limited vectors, restoring INTx functionality when multiple SPI controllers are present. Signed-off-by: Thangaraj Samynathan Link: https://patch.msgid.link/20250527103244.26861-1-thangaraj.s@microchip.com Signed-off-by: Mark Brown commit 16719d48197bbd8cff121b32acec67d954335437 Author: Qasim Ijaz Date: Mon May 26 20:18:20 2025 +0100 ASoC: codecs: fix out-of-bounds access on invalid clock config get_coeff() returns –EINVAL when no table entry matches. The driver then uses that value as an index into coeff_div[], causing an OOB access. To fix lets abort the hw_params call instead. Fixes: de2b3119f9f7 ("ASoC: codecs: add support for ES8375") Signed-off-by: Qasim Ijaz Link: https://patch.msgid.link/20250526191820.72577-1-qasdev00@gmail.com Signed-off-by: Mark Brown commit 63fe298652d4eda07d738bfcbbc59d1343a675ef Author: Krzysztof Kozlowski Date: Mon May 26 11:47:03 2025 +0200 ASoC: codecs: wcd9375: Fix double free of regulator supplies Driver gets regulator supplies in probe path with devm_regulator_bulk_get(), so should not call regulator_bulk_free() in error and remove paths to avoid double free. Fixes: 216d04139a6d ("ASoC: codecs: wcd937x: Remove separate handling for vdd-buck supply") Cc: stable@vger.kernel.org Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250526-b4-b4-asoc-wcd9395-vdd-px-fixes-v1-3-0b8a2993b7d3@linaro.org Signed-off-by: Mark Brown commit dc59189d32fc3dbddcf418fd4b418fb61f24ade6 Author: Krzysztof Kozlowski Date: Mon May 26 11:47:02 2025 +0200 ASoC: codecs: wcd937x: Drop unused buck_supply Last user of wcd937x_priv->buck_supply was removed in commit 216d04139a6d ("ASoC: codecs: wcd937x: Remove separate handling for vdd-buck supply"). Fixes: 216d04139a6d ("ASoC: codecs: wcd937x: Remove separate handling for vdd-buck supply") Cc: stable@vger.kernel.org Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250526-b4-b4-asoc-wcd9395-vdd-px-fixes-v1-2-0b8a2993b7d3@linaro.org Signed-off-by: Mark Brown commit 9079db287fc3e38e040b0edeb0a25770bb679c8e Author: Krzysztof Kozlowski Date: Mon May 26 11:47:01 2025 +0200 ASoC: codecs: wcd9335: Fix missing free of regulator supplies Driver gets and enables all regulator supplies in probe path (wcd9335_parse_dt() and wcd9335_power_on_reset()), but does not cleanup in final error paths and in unbind (missing remove() callback). This leads to leaked memory and unbalanced regulator enable count during probe errors or unbind. Fix this by converting entire code into devm_regulator_bulk_get_enable() which also greatly simplifies the code. Fixes: 20aedafdf492 ("ASoC: wcd9335: add support to wcd9335 codec") Cc: stable@vger.kernel.org Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250526-b4-b4-asoc-wcd9395-vdd-px-fixes-v1-1-0b8a2993b7d3@linaro.org Signed-off-by: Mark Brown commit 6682bfc1b227fecedc6dad064ef240ec8abfe32d Author: Alok Tiwari Date: Thu May 22 00:43:55 2025 -0700 Doc: networking: Fix various typos in rds.rst Corrected "sages" to "messages" in the bitmap allocation description. Fixed "competed" to "completed" in the recv path datagram handling section. Corrected "privatee" to "private" in the multipath RDS section. Fixed "mutlipath" to "multipath" in the transport capabilities description. These changes improve documentation clarity and maintain consistency. Signed-off-by: Alok Tiwari Acked-by: Randy Dunlap Reviewed-by: Allison Henderson Link: https://patch.msgid.link/20250522074413.3634446-1-alok.a.tiwari@oracle.com Signed-off-by: Paolo Abeni commit f95633adc177416ac21f16db9ce1e75c74db805a Author: Mark Bloch Date: Thu May 22 10:13:56 2025 +0300 net/mlx5e: Allow setting MAC address of representors A representor netdev does not correspond to real hardware that needs to be updated when setting the MAC address. The default eth_mac_addr() is sufficient for simply updating the netdev's MAC address with validation. Signed-off-by: Mark Bloch Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1747898036-1121904-1-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 08ae62e1729fac589aae0be2ace848464760fd77 Merge: 28fcb4b56f929f 5fa6f024596016 Author: Paolo Abeni Date: Tue May 27 11:54:55 2025 +0200 Merge branch 'octeontx2-pf-do-not-detect-macsec-block-based-on-silicon' Subbaraya Sundeep says: ==================== octeontx2-pf: Do not detect MACSEC block based on silicon Out of various silicon variants of CN10K series some have hardware MACSEC block for offloading MACSEC operations and some do not. AF driver already has the information of whether MACSEC is present or not on running silicon. Hence fetch that information from AF via mailbox message. ==================== Link: https://patch.msgid.link/1747894516-4565-1-git-send-email-sbhatta@marvell.com Signed-off-by: Paolo Abeni commit 5fa6f024596016edaed72c664fd3b4338529df73 Author: Subbaraya Sundeep Date: Thu May 22 11:45:48 2025 +0530 octeontx2-pf: macsec: Get MACSEC capability flag from AF The presence of MACSEC block is currently figured out based on the running silicon variant. This may not be correct all the times since the MACSEC block can be fused out. Hence get the macsec info from AF via mailbox. Signed-off-by: Subbaraya Sundeep Reviewed-by: Simon Horman Link: https://patch.msgid.link/1747894548-4657-1-git-send-email-sbhatta@marvell.com Signed-off-by: Paolo Abeni commit 732038370e5546169899dcb1feb1e955e5d8b4ba Author: Subbaraya Sundeep Date: Thu May 22 11:45:28 2025 +0530 octeontx2-af: Add MACSEC capability flag MACSEC block may be fused out on some silicons hence modify get_hw_cap mailbox message to set a capability flag in its response message based on MACSEC block availability. Signed-off-by: Subbaraya Sundeep Reviewed-by: Simon Horman Link: https://patch.msgid.link/1747894528-4611-1-git-send-email-sbhatta@marvell.com Signed-off-by: Paolo Abeni commit 28fcb4b56f929f4627f3c4c6c6dc61b292b8e55d Author: Bui Quang Minh Date: Thu May 22 11:01:15 2025 +0700 xsk: add missing virtual address conversion for page In commit 7ead4405e06f ("xsk: convert xdp_copy_frags_from_zc() to use page_pool_dev_alloc()"), when converting from netmem to page, I missed a call to page_address() around skb_frag_page(frag) to get the virtual address of the page. This commit uses skb_frag_address() helper to fix the issue. Fixes: 7ead4405e06f ("xsk: convert xdp_copy_frags_from_zc() to use page_pool_dev_alloc()") Reviewed-by: Alexander Lobakin Signed-off-by: Bui Quang Minh Link: https://patch.msgid.link/20250522040115.5057-1-minhquangbui99@gmail.com Signed-off-by: Paolo Abeni commit d8d85ef0a631df9127f202e6371bb33a0b589952 Author: Stanislav Fomichev Date: Wed May 21 20:11:28 2025 -0700 af_packet: move notifier's packet_dev_mc out of rcu critical section Syzkaller reports the following issue: BUG: sleeping function called from invalid context at kernel/locking/mutex.c:578 __mutex_lock+0x106/0xe80 kernel/locking/mutex.c:746 team_change_rx_flags+0x38/0x220 drivers/net/team/team_core.c:1781 dev_change_rx_flags net/core/dev.c:9145 [inline] __dev_set_promiscuity+0x3f8/0x590 net/core/dev.c:9189 netif_set_promiscuity+0x50/0xe0 net/core/dev.c:9201 dev_set_promiscuity+0x126/0x260 net/core/dev_api.c:286 packet_dev_mc net/packet/af_packet.c:3698 [inline] packet_dev_mclist_delete net/packet/af_packet.c:3722 [inline] packet_notifier+0x292/0xa60 net/packet/af_packet.c:4247 notifier_call_chain+0x1b3/0x3e0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2214 [inline] call_netdevice_notifiers net/core/dev.c:2228 [inline] unregister_netdevice_many_notify+0x15d8/0x2330 net/core/dev.c:11972 rtnl_delete_link net/core/rtnetlink.c:3522 [inline] rtnl_dellink+0x488/0x710 net/core/rtnetlink.c:3564 rtnetlink_rcv_msg+0x7cf/0xb70 net/core/rtnetlink.c:6955 netlink_rcv_skb+0x219/0x490 net/netlink/af_netlink.c:2534 Calling `PACKET_ADD_MEMBERSHIP` on an ops-locked device can trigger the `NETDEV_UNREGISTER` notifier, which may require disabling promiscuous and/or allmulti mode. Both of these operations require acquiring the netdev instance lock. Move the call to `packet_dev_mc` outside of the RCU critical section. The `mclist` modifications (add, del, flush, unregister) are protected by the RTNL, not the RCU. The RCU only protects the `sklist` and its associated `sks`. The delayed operation on the `mclist` entry remains within the RTNL. Reported-by: syzbot+b191b5ccad8d7a986286@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b191b5ccad8d7a986286 Fixes: ad7c7b2172c3 ("net: hold netdev instance lock during sysfs operations") Signed-off-by: Stanislav Fomichev Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250522031129.3247266-1-stfomichev@gmail.com Signed-off-by: Paolo Abeni commit 35a7a2f55504eaf2356de6e213ba9902e9bc5065 Merge: b2908a989c594f 393d070135ad01 Author: Paolo Abeni Date: Tue May 27 11:05:25 2025 +0200 Merge branch 'vsock-sock_linger-rework' Michal Luczaj says: ==================== vsock: SOCK_LINGER rework Change vsock's lingerning to wait on close() until all data is sent, i.e. until workers picked all the packets for processing. v5: https://lore.kernel.org/r/20250521-vsock-linger-v5-0-94827860d1d6@rbox.co v4: https://lore.kernel.org/r/20250501-vsock-linger-v4-0-beabbd8a0847@rbox.co v3: https://lore.kernel.org/r/20250430-vsock-linger-v3-0-ddbe73b53457@rbox.co v2: https://lore.kernel.org/r/20250421-vsock-linger-v2-0-fe9febd64668@rbox.co v1: https://lore.kernel.org/r/20250407-vsock-linger-v1-0-1458038e3492@rbox.co Signed-off-by: Michal Luczaj ==================== Link: https://patch.msgid.link/20250522-vsock-linger-v6-0-2ad00b0e447e@rbox.co Signed-off-by: Paolo Abeni commit 393d070135ad01f954ca8289c3ee134950e2d0c8 Author: Michal Luczaj Date: Thu May 22 01:18:25 2025 +0200 vsock/test: Add test for an unexpectedly lingering close() There was an issue with SO_LINGER: instead of blocking until all queued messages for the socket have been successfully sent (or the linger timeout has been reached), close() would block until packets were handled by the peer. Add a test to alert on close() lingering when it should not. Signed-off-by: Michal Luczaj Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20250522-vsock-linger-v6-5-2ad00b0e447e@rbox.co Signed-off-by: Paolo Abeni commit 8b07b7e5c253981ccbab2f2506e07f5ef1082181 Author: Michal Luczaj Date: Thu May 22 01:18:24 2025 +0200 vsock/test: Introduce enable_so_linger() helper Add a helper function that sets SO_LINGER. Adapt the caller. Signed-off-by: Michal Luczaj Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20250522-vsock-linger-v6-4-2ad00b0e447e@rbox.co Signed-off-by: Paolo Abeni commit e78e0596c762609ee5a92bd9d38351694b52f249 Author: Michal Luczaj Date: Thu May 22 01:18:23 2025 +0200 vsock/test: Introduce vsock_wait_sent() helper Distill the virtio_vsock_sock::bytes_unsent checking loop (ioctl SIOCOUTQ) and move it to utils. Tweak the comment. Signed-off-by: Michal Luczaj Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20250522-vsock-linger-v6-3-2ad00b0e447e@rbox.co Signed-off-by: Paolo Abeni commit 5ec40864aaecc4bd66fe67541d4a41091ed664a5 Author: Michal Luczaj Date: Thu May 22 01:18:22 2025 +0200 vsock: Move lingering logic to af_vsock core Lingering should be transport-independent in the long run. In preparation for supporting other transports, as well as the linger on shutdown(), move code to core. Generalize by querying vsock_transport::unsent_bytes(), guard against the callback being unimplemented. Do not pass sk_lingertime explicitly. Pull SOCK_LINGER check into vsock_linger(). Flatten the function. Remove the nested block by inverting the condition: return early on !timeout. Suggested-by: Stefano Garzarella Reviewed-by: Stefano Garzarella Signed-off-by: Michal Luczaj Link: https://patch.msgid.link/20250522-vsock-linger-v6-2-2ad00b0e447e@rbox.co Signed-off-by: Paolo Abeni commit 1c39f5dbbfd2b44602d46936fe55361205196257 Author: Michal Luczaj Date: Thu May 22 01:18:21 2025 +0200 vsock/virtio: Linger on unsent data Currently vsock's lingering effectively boils down to waiting (or timing out) until packets are consumed or dropped by the peer; be it by receiving the data, closing or shutting down the connection. To align with the semantics described in the SO_LINGER section of man socket(7) and to mimic AF_INET's behaviour more closely, change the logic of a lingering close(): instead of waiting for all data to be handled, block until data is considered sent from the vsock's transport point of view. That is until worker picks the packets for processing and decrements virtio_vsock_sock::bytes_unsent down to 0. Note that (some interpretation of) lingering was always limited to transports that called virtio_transport_wait_close() on transport release. This does not change, i.e. under Hyper-V and VMCI no lingering would be observed. The implementation does not adhere strictly to man page's interpretation of SO_LINGER: shutdown() will not trigger the lingering. This follows AF_INET. Reviewed-by: Stefano Garzarella Signed-off-by: Michal Luczaj Link: https://patch.msgid.link/20250522-vsock-linger-v6-1-2ad00b0e447e@rbox.co Signed-off-by: Paolo Abeni commit b2908a989c594f9eb1c93016abc1382f97ee02b1 Author: Stefano Radaelli Date: Wed May 21 23:28:15 2025 +0200 net: phy: add driver for MaxLinear MxL86110 PHY Add support for the MaxLinear MxL86110 Gigabit Ethernet PHY, a low-power, cost-optimized transceiver supporting 10/100/1000 Mbps over twisted-pair copper, compliant with IEEE 802.3. The driver implements basic features such as: - Device initialization - RGMII interface timing configuration - Wake-on-LAN support - LED initialization and control via /sys/class/leds This driver has been tested on multiple Variscite boards, including: - VAR-SOM-MX93 (i.MX93) - VAR-SOM-MX8M-PLUS (i.MX8MP) Example boot log showing driver probe: [ 7.692101] imx-dwmac 428a0000.ethernet eth0: PHY [stmmac-0:00] driver [MXL86110 Gigabit Ethernet] (irq=POLL) Signed-off-by: Stefano Radaelli Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250521212821.593057-1-stefano.radaelli21@gmail.com Signed-off-by: Paolo Abeni commit f484a3029a261ce96b36131825479683879ffe22 Merge: 358bea91ce6b4f ca8bf8f38334b8 Author: Paolo Abeni Date: Tue May 27 09:10:05 2025 +0200 Merge branch 'wireguard-updates-for-6-16' Jason A. Donenfeld says: ==================== wireguard updates for 6.16 This small series contains mostly cleanups and one new feature: 1) Kees' __nonstring annotation comes to wireguard. 2) Two selftest fixes, one to help with compilation on gcc 15, and one removing stale config options. 3) Adoption of NLA_POLICY_MASK. 4) Jordan has added the ability to run: # wg set ... peer ... allowed-ips -192.168.1.0/24 Which will remove the allowed IP for that peer. Previously you had to replace all the IPs non-atomically, or move it to a dummy peer atomically, which wasn't very clean. ==================== Link: https://patch.msgid.link/20250521212707.1767879-1-Jason@zx2c4.com Signed-off-by: Paolo Abeni commit ca8bf8f38334b8855738a6d1222904668e593f2a Author: Jason A. Donenfeld Date: Wed May 21 23:27:07 2025 +0200 wireguard: selftests: specify -std=gnu17 for bash GCC 15 defaults to C23, which bash can't compile under, so specify gnu17 explicitly. Signed-off-by: Jason A. Donenfeld Link: https://patch.msgid.link/20250521212707.1767879-6-Jason@zx2c4.com Signed-off-by: Paolo Abeni commit ba3d7b93dbe3202bf8ead473d75885af773068bc Author: Jordan Rife Date: Wed May 21 23:27:06 2025 +0200 wireguard: allowedips: add WGALLOWEDIP_F_REMOVE_ME flag The current netlink API for WireGuard does not directly support removal of allowed ips from a peer. A user can remove an allowed ip from a peer in one of two ways: 1. By using the WGPEER_F_REPLACE_ALLOWEDIPS flag and providing a new list of allowed ips which omits the allowed ip that is to be removed. 2. By reassigning an allowed ip to a "dummy" peer then removing that peer with WGPEER_F_REMOVE_ME. With the first approach, the driver completely rebuilds the allowed ip list for a peer. If my current configuration is such that a peer has allowed ips 192.168.0.2 and 192.168.0.3 and I want to remove 192.168.0.2 the actual transition looks like this. [192.168.0.2, 192.168.0.3] <-- Initial state [] <-- Step 1: Allowed ips removed for peer [192.168.0.3] <-- Step 2: Allowed ips added back for peer This is true even if the allowed ip list is small and the update does not need to be batched into multiple WG_CMD_SET_DEVICE requests, as the removal and subsequent addition of ips is non-atomic within a single request. Consequently, wg_allowedips_lookup_dst and wg_allowedips_lookup_src may return NULL while reconfiguring a peer even for packets bound for ips a user did not intend to remove leading to unintended interruptions in connectivity. This presents in userspace as failed calls to sendto and sendmsg for UDP sockets. In my case, I ran netperf while repeatedly reconfiguring the allowed ips for a peer with wg. /usr/local/bin/netperf -H 10.102.73.72 -l 10m -t UDP_STREAM -- -R 1 -m 1024 send_data: data send error: No route to host (errno 113) netperf: send_omni: send_data failed: No route to host While this may not be of particular concern for environments where peers and allowed ips are mostly static, systems like Cilium manage peers and allowed ips in a dynamic environment where peers (i.e. Kubernetes nodes) and allowed ips (i.e. pods running on those nodes) can frequently change making WGPEER_F_REPLACE_ALLOWEDIPS problematic. The second approach avoids any possible connectivity interruptions but is hacky and less direct, requiring the creation of a temporary peer just to dispose of an allowed ip. Introduce a new flag called WGALLOWEDIP_F_REMOVE_ME which in the same way that WGPEER_F_REMOVE_ME allows a user to remove a single peer from a WireGuard device's configuration allows a user to remove an ip from a peer's set of allowed ips. This enables incremental updates to a device's configuration without any connectivity blips or messy workarounds. A corresponding patch for wg extends the existing `wg set` interface to leverage this feature. $ wg set wg0 peer allowed-ips +192.168.88.0/24,-192.168.0.1/32 When '+' or '-' is prepended to any ip in the list, wg clears WGPEER_F_REPLACE_ALLOWEDIPS and sets the WGALLOWEDIP_F_REMOVE_ME flag on any ip prefixed with '-'. Signed-off-by: Jordan Rife [Jason: minor style nits, fixes to selftest, bump of wireguard-tools version] Signed-off-by: Jason A. Donenfeld Link: https://patch.msgid.link/20250521212707.1767879-5-Jason@zx2c4.com Signed-off-by: Paolo Abeni commit c8529020070cdb8d0739d07f2ebc27a0c1f186f7 Author: Jason A. Donenfeld Date: Wed May 21 23:27:05 2025 +0200 wireguard: netlink: use NLA_POLICY_MASK where possible Rather than manually validating flags against the various __ALL_* constants, put this in the netlink policy description and have the upper layer machinery check it for us. Signed-off-by: Jason A. Donenfeld Link: https://patch.msgid.link/20250521212707.1767879-4-Jason@zx2c4.com Signed-off-by: Paolo Abeni commit 71e5da46e78c1cd24e2feed251a2845327447ad8 Author: Kees Cook Date: Wed May 21 23:27:04 2025 +0200 wireguard: global: add __nonstring annotations for unterminated strings When a character array without a terminating NUL character has a static initializer, GCC 15's -Wunterminated-string-initialization will only warn if the array lacks the "nonstring" attribute[1]. Mark the arrays with __nonstring to correctly identify the char array as "not a C string" and thereby eliminate the warning: ../drivers/net/wireguard/cookie.c:29:56: warning: initializer-string for array of 'unsigned char' truncates NUL terminator but destination lacks 'nonstring' attribute (9 chars into 8 available) [-Wunterminated-string-initialization] 29 | static const u8 mac1_key_label[COOKIE_KEY_LABEL_LEN] = "mac1----"; | ^~~~~~~~~~ ../drivers/net/wireguard/cookie.c:30:58: warning: initializer-string for array of 'unsigned char' truncates NUL terminator but destination lacks 'nonstring' attribute (9 chars into 8 available) [-Wunterminated-string-initialization] 30 | static const u8 cookie_key_label[COOKIE_KEY_LABEL_LEN] = "cookie--"; | ^~~~~~~~~~ ../drivers/net/wireguard/noise.c:28:38: warning: initializer-string for array of 'unsigned char' truncates NUL terminator but destination lacks 'nonstring' attribute (38 chars into 37 available) [-Wunterminated-string-initialization] 28 | static const u8 handshake_name[37] = "Noise_IKpsk2_25519_ChaChaPoly_BLAKE2s"; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ../drivers/net/wireguard/noise.c:29:39: warning: initializer-string for array of 'unsigned char' truncates NUL terminator but destination lacks 'nonstring' attribute (35 chars into 34 available) [-Wunterminated-string-initialization] 29 | static const u8 identifier_name[34] = "WireGuard v1 zx2c4 Jason@zx2c4.com"; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The arrays are always used with their fixed size, so use __nonstring. Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=117178 [1] Signed-off-by: Kees Cook Signed-off-by: Jason A. Donenfeld Link: https://patch.msgid.link/20250521212707.1767879-3-Jason@zx2c4.com Signed-off-by: Paolo Abeni commit e74e9ee2c80080f7492dd188da6794b45578ea41 Author: WangYuli Date: Wed May 21 23:27:03 2025 +0200 wireguard: selftests: cleanup CONFIG_UBSAN_SANITIZE_ALL Commit 918327e9b7ff ("ubsan: Remove CONFIG_UBSAN_SANITIZE_ALL") removed the CONFIG_UBSAN_SANITIZE_ALL configuration option. Eliminate invalid configurations to improve code readability. Reviewed-by: Simon Horman Signed-off-by: WangYuli Signed-off-by: Jason A. Donenfeld Link: https://patch.msgid.link/20250521212707.1767879-2-Jason@zx2c4.com Signed-off-by: Paolo Abeni commit 358bea91ce6b4f02e5df0143382c96d7083504bc Merge: 5bccdc51f90c31 ae9fcd5a0f8ab7 Author: Paolo Abeni Date: Tue May 27 08:25:45 2025 +0200 Merge branch 'net-convert-dev_set_mac_address-to-struct-sockaddr_storage' Kees Cook says: ==================== net: Convert dev_set_mac_address() to struct sockaddr_storage As part of the effort to allow the compiler to reason about object sizes, we need to deal with the problematic variably sized struct sockaddr, which has no internal runtime size tracking. In much of the network stack the use of struct sockaddr_storage has been adopted. Continue the transition toward this for more of the internal APIs. Specifically: - inet_addr_is_any() - netif_set_mac_address() - dev_set_mac_address() - dev_set_mac_address_user() Only a few callers of dev_set_mac_address() needed adjustment; all others were already using struct sockaddr_storage internally. v1: https://lore.kernel.org/all/20250520222452.work.063-kees@kernel.org/ ==================== Link: https://patch.msgid.link/20250521204310.it.500-kees@kernel.org Signed-off-by: Paolo Abeni commit ae9fcd5a0f8ab7e12619e1c66312a03b842935c3 Author: Kees Cook Date: Wed May 21 13:46:16 2025 -0700 net: core: Convert dev_set_mac_address_user() to use struct sockaddr_storage Convert callers of dev_set_mac_address_user() to use struct sockaddr_storage. Add sanity checks on dev->addr_len usage. Signed-off-by: Kees Cook Acked-by: Gustavo A. R. Silva Link: https://patch.msgid.link/20250521204619.2301870-8-kees@kernel.org Signed-off-by: Paolo Abeni commit 6b12e0a3c3c9565c7dc106e2a8b1d433b1aa8eb6 Author: Kees Cook Date: Wed May 21 13:46:15 2025 -0700 rtnetlink: do_setlink: Use struct sockaddr_storage Instead of a heap allocating a variably sized struct sockaddr and lying about the type in the call to netif_set_mac_address(), use a stack allocated struct sockaddr_storage. This lets us drop the cast and avoid the allocation. Putting "ss" on the stack means it will get a reused stack slot since it is the same size (128B) as other existing single-scope stack variables, like the vfinfo array (128B), so no additional stack space is used by this function. Acked-by: Gustavo A. R. Silva Signed-off-by: Kees Cook Link: https://patch.msgid.link/20250521204619.2301870-7-kees@kernel.org Signed-off-by: Paolo Abeni commit 9ca6804ab7c34f65fcf2e29333a39e7807c30b60 Author: Kees Cook Date: Wed May 21 13:46:14 2025 -0700 net: core: Convert dev_set_mac_address() to struct sockaddr_storage All users of dev_set_mac_address() are now using a struct sockaddr_storage. Convert the internal data type to struct sockaddr_storage, drop the casts, and update pointer types. Acked-by: Gustavo A. R. Silva Signed-off-by: Kees Cook Link: https://patch.msgid.link/20250521204619.2301870-6-kees@kernel.org Signed-off-by: Paolo Abeni commit 79deac8d538d2835abe5677d42aeb237c618af92 Author: Kees Cook Date: Wed May 21 13:46:13 2025 -0700 net: usb: r8152: Convert to use struct sockaddr_storage internally To support coming API type changes, switch to sockaddr_storage usage internally. Acked-by: Gustavo A. R. Silva Signed-off-by: Kees Cook Link: https://patch.msgid.link/20250521204619.2301870-5-kees@kernel.org Signed-off-by: Paolo Abeni commit 7da6117ea144517e46f4f4b248eb22751224cac7 Author: Kees Cook Date: Wed May 21 13:46:12 2025 -0700 ieee802154: Use struct sockaddr_storage with dev_set_mac_address() Switch to struct sockaddr_storage for calling dev_set_mac_address(). Add a temporary cast to struct sockaddr, which will be removed in a subsequent patch. Acked-by: Gustavo A. R. Silva Signed-off-by: Kees Cook Link: https://patch.msgid.link/20250521204619.2301870-4-kees@kernel.org Signed-off-by: Paolo Abeni commit db586cad6f451504ec2b14ec812e1e92effe40db Author: Kees Cook Date: Wed May 21 13:46:11 2025 -0700 net/ncsi: Use struct sockaddr_storage for pending_mac To avoid future casting with coming API type changes, switch struct ncsi_dev_priv::pending_mac to a full struct sockaddr_storage. Acked-by: Gustavo A. R. Silva Signed-off-by: Kees Cook Link: https://patch.msgid.link/20250521204619.2301870-3-kees@kernel.org Signed-off-by: Paolo Abeni commit 161972650d6795ea00f8b72557cf3c3e593ed250 Author: Kees Cook Date: Wed May 21 13:46:10 2025 -0700 net: core: Switch netif_set_mac_address() to struct sockaddr_storage In order to avoid passing around struct sockaddr that has a size the compiler cannot reason about (nor track at runtime), convert netif_set_mac_address() to take struct sockaddr_storage. This is just a cast conversion, so there is are no binary changes. Following patches will make actual allocation changes. Acked-by: Gustavo A. R. Silva Signed-off-by: Kees Cook Link: https://patch.msgid.link/20250521204619.2301870-2-kees@kernel.org Signed-off-by: Paolo Abeni commit ed449ddbd867f2cc02d6890c231431f264a876eb Author: Kees Cook Date: Wed May 21 13:46:09 2025 -0700 net: core: Convert inet_addr_is_any() to sockaddr_storage All the callers of inet_addr_is_any() have a sockaddr_storage-backed sockaddr. Avoid casts and switch prototype to the actual object being used. Reviewed-by: Kuniyuki Iwashima Reviewed-by: Martin K. Petersen # SCSI Signed-off-by: Kees Cook Link: https://patch.msgid.link/20250521204619.2301870-1-kees@kernel.org Signed-off-by: Paolo Abeni commit 32374234ab0101881e7d0c6a8ef7ebce566c46c9 Author: Suraj Gupta Date: Wed May 21 23:46:08 2025 +0530 net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in dmaengine xmit In Dmaengine flow, driver maintains struct skbuf_dma_descriptor rings each element of which corresponds to a skb. In Tx datapath, compare available space in skb ring with number of skbs instead of skb fragments. Replace x * (MAX_SKB_FRAGS) in netif_txq_completed_wake() and netif_txq_maybe_stop() with x * (1 skb) to fix the comparison. Fixes: 6a91b846af85 ("net: axienet: Introduce dmaengine support") Signed-off-by: Suraj Gupta Reviewed-by: Sean Anderson Link: https://patch.msgid.link/20250521181608.669554-1-suraj.gupta2@amd.com Signed-off-by: Paolo Abeni commit 0a84874c7e7dde5cdddc80a82093120e924a348b Author: Herbert Xu Date: Mon May 26 16:56:46 2025 +0800 crypto: shash - Fix buffer overrun in import function Only set the partial block length to zero if the algorithm is block-only. Otherwise the descriptor context could be empty, e.g., for digest_null. Reported-by: syzbot+4851c19615d35f0e4d68@syzkaller.appspotmail.com Fixes: 7650f826f7b2 ("crypto: shash - Handle partial blocks in API") Signed-off-by: Herbert Xu commit 914873bc7df913db988284876c16257e6ab772c6 Merge: 24244df067c551 ad9b861824ac55 Author: Linus Torvalds Date: Mon May 26 21:41:14 2025 -0700 Merge tag 'x86-build-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 build updates from Ingo Molnar: "Add the CONFIG_X86_NATIVE_CPU=y build option to locally optimize the kernel build with '-march=native'" * tag 'x86-build-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/kbuild/64: Restrict clang versions that can use '-march=native' x86/kbuild/64: Test for the availability of the -mtune=native compiler flag x86/kbuild/64: Add the CONFIG_X86_NATIVE_CPU option to locally optimize the kernel with '-march=native' commit 24244df067c5514ad72b8ad371208b1139dfd0f0 Merge: 0aee0617267866 bdb30d565f4b53 Author: Linus Torvalds Date: Mon May 26 21:21:12 2025 -0700 Merge tag 'x86-entry-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 vdso updates from Ingo Molnar: "Two changes to simplify the x86 vDSO code a bit" * tag 'x86-entry-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/vdso: Remove redundant #ifdeffery around in_ia32_syscall() x86/vdso: Remove #ifdeffery around page setup variants commit 0aee0617267866555b4e35bd11e1fbb291fa9743 Merge: 020fca04c689b0 06aa9378df017e Author: Linus Torvalds Date: Mon May 26 21:18:59 2025 -0700 Merge tag 'x86-debug-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 debug updates from Ingo Molnar: "Move the x86 page fault tracepoints to generic code, because other architectures would like to make use of them as well" * tag 'x86-debug-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/tracing, x86/mm: Move page fault tracepoints to generic x86/tracing, x86/mm: Remove redundant trace_pagefault_key commit 020fca04c689b0405899c8532e1d8748e49a2152 Merge: 785cdec46e9227 f449bf98b7b637 Author: Linus Torvalds Date: Mon May 26 21:15:06 2025 -0700 Merge tag 'x86-cleanups-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cleanups from Ingo Molnar: "Misc x86 cleanups: kernel-doc updates and a string API transition patch" * tag 'x86-cleanups-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/power: hibernate: Fix W=1 build kernel-doc warnings x86/mm/pat: Fix W=1 build kernel-doc warning x86/CPU/AMD: Replace strcpy() with strscpy() commit 72ab5136e86fcbccebb4a423d83332f41a7bd697 Author: Kent Overstreet Date: Mon May 26 11:12:53 2025 -0400 bcachefs: Don't rewind to run a recovery pass we already ran Fix a small regression from the "run recovery passes" rewrite, which enabled async recovery passes. This fixes getting stuck in a loop in recovery. Signed-off-by: Kent Overstreet commit 686db67a8ebecdc6eb7b9ca8ef8eddb99bdf1083 Author: Kent Overstreet Date: Sun May 25 11:51:33 2025 -0400 bcachefs: Move unicode message to after the startup message Signed-off-by: Kent Overstreet commit 1cda5b88e6d13ebf42078253abbb2ed0efe9ab0a Author: Kent Overstreet Date: Sat May 24 19:53:03 2025 -0400 bcachefs: Fix missing commit in check_dirents Other repair code seems to be doing commits themselves, but check_key_has_snapshot() does not. Signed-off-by: Kent Overstreet commit 9e2c3c2ed4772cb0e2ad5b0def08c2c943483445 Author: Kent Overstreet Date: Sat May 24 15:29:50 2025 -0400 bcachefs: Fix lost rebalance wakeups Fix a missing wakeup in 'bcachefs set-file-option' -> xattr option update -> inode_write this was missing because the wakeup needs to happen after transaction commit. Also, add a 'kick' counter, to make sure we don't miss a wakeup that occured right after we finished checking the rebalance_work btree. Signed-off-by: Kent Overstreet commit dc37dcca8cb71d7ddddfd5035619eeb27c5aab8d Author: Kent Overstreet Date: Sat May 24 15:24:00 2025 -0400 bcachefs: bch2_kthread_io_clock_wait_once() Add a version of bch2_kthread_io_clock_wait() that only schedules once - behaving more like schedule_timeout(). This will be used for fixing rebalance wakeups. Signed-off-by: Kent Overstreet commit ff875d4b474739662d7fefece7532ff77c8b3b70 Author: Kent Overstreet Date: Sat May 24 14:37:20 2025 -0400 bcachefs: Ensure we print output of run_recovery_pass if it errors Also, don't error out in bucket_ref_update_err(): we don't want to return -BCH_ERR_cannot_rewind_recovery if it's not an insert, if it's an overwrite we continue. Signed-off-by: Kent Overstreet commit 785cdec46e9227f9433884ed3b436471e944007c Merge: ddddf9d64f7361 6a7c3c2606105a Author: Linus Torvalds Date: Mon May 26 16:04:17 2025 -0700 Merge tag 'x86-core-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull core x86 updates from Ingo Molnar: "Boot code changes: - A large series of changes to reorganize the x86 boot code into a better isolated and easier to maintain base of PIC early startup code in arch/x86/boot/startup/, by Ard Biesheuvel. Motivation & background: | Since commit | | c88d71508e36 ("x86/boot/64: Rewrite startup_64() in C") | | dated Jun 6 2017, we have been using C code on the boot path in a way | that is not supported by the toolchain, i.e., to execute non-PIC C | code from a mapping of memory that is different from the one provided | to the linker. It should have been obvious at the time that this was a | bad idea, given the need to sprinkle fixup_pointer() calls left and | right to manipulate global variables (including non-pointer variables) | without crashing. | | This C startup code has been expanding, and in particular, the SEV-SNP | startup code has been expanding over the past couple of years, and | grown many of these warts, where the C code needs to use special | annotations or helpers to access global objects. This tree includes the first phase of this work-in-progress x86 boot code reorganization. Scalability enhancements and micro-optimizations: - Improve code-patching scalability (Eric Dumazet) - Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR (Andrew Cooper) CPU features enumeration updates: - Thorough reorganization and cleanup of CPUID parsing APIs (Ahmed S. Darwish) - Fix, refactor and clean up the cacheinfo code (Ahmed S. Darwish, Thomas Gleixner) - Update CPUID bitfields to x86-cpuid-db v2.3 (Ahmed S. Darwish) Memory management changes: - Allow temporary MMs when IRQs are on (Andy Lutomirski) - Opt-in to IRQs-off activate_mm() (Andy Lutomirski) - Simplify choose_new_asid() and generate better code (Borislav Petkov) - Simplify 32-bit PAE page table handling (Dave Hansen) - Always use dynamic memory layout (Kirill A. Shutemov) - Make SPARSEMEM_VMEMMAP the only memory model (Kirill A. Shutemov) - Make 5-level paging support unconditional (Kirill A. Shutemov) - Stop prefetching current->mm->mmap_lock on page faults (Mateusz Guzik) - Predict valid_user_address() returning true (Mateusz Guzik) - Consolidate initmem_init() (Mike Rapoport) FPU support and vector computing: - Enable Intel APX support (Chang S. Bae) - Reorgnize and clean up the xstate code (Chang S. Bae) - Make task_struct::thread constant size (Ingo Molnar) - Restore fpu_thread_struct_whitelist() to fix CONFIG_HARDENED_USERCOPY=y (Kees Cook) - Simplify the switch_fpu_prepare() + switch_fpu_finish() logic (Oleg Nesterov) - Always preserve non-user xfeatures/flags in __state_perm (Sean Christopherson) Microcode loader changes: - Help users notice when running old Intel microcode (Dave Hansen) - AMD: Do not return error when microcode update is not necessary (Annie Li) - AMD: Clean the cache if update did not load microcode (Boris Ostrovsky) Code patching (alternatives) changes: - Simplify, reorganize and clean up the x86 text-patching code (Ingo Molnar) - Make smp_text_poke_batch_process() subsume smp_text_poke_batch_finish() (Nikolay Borisov) - Refactor the {,un}use_temporary_mm() code (Peter Zijlstra) Debugging support: - Add early IDT and GDT loading to debug relocate_kernel() bugs (David Woodhouse) - Print the reason for the last reset on modern AMD CPUs (Yazen Ghannam) - Add AMD Zen debugging document (Mario Limonciello) - Fix opcode map (!REX2) superscript tags (Masami Hiramatsu) - Stop decoding i64 instructions in x86-64 mode at opcode (Masami Hiramatsu) CPU bugs and bug mitigations: - Remove X86_BUG_MMIO_UNKNOWN (Borislav Petkov) - Fix SRSO reporting on Zen1/2 with SMT disabled (Borislav Petkov) - Restructure and harmonize the various CPU bug mitigation methods (David Kaplan) - Fix spectre_v2 mitigation default on Intel (Pawan Gupta) MSR API: - Large MSR code and API cleanup (Xin Li) - In-kernel MSR API type cleanups and renames (Ingo Molnar) PKEYS: - Simplify PKRU update in signal frame (Chang S. Bae) NMI handling code: - Clean up, refactor and simplify the NMI handling code (Sohil Mehta) - Improve NMI duration console printouts (Sohil Mehta) Paravirt guests interface: - Restrict PARAVIRT_XXL to 64-bit only (Kirill A. Shutemov) SEV support: - Share the sev_secrets_pa value again (Tom Lendacky) x86 platform changes: - Introduce the header namespace (Ingo Molnar) - i2c: piix4, x86/platform: Move the SB800 PIIX4 FCH definitions to (Mario Limonciello) Fixes and cleanups: - x86 assembly code cleanups and fixes (Uros Bizjak) - Misc fixes and cleanups (Andi Kleen, Andy Lutomirski, Andy Shevchenko, Ard Biesheuvel, Bagas Sanjaya, Baoquan He, Borislav Petkov, Chang S. Bae, Chao Gao, Dan Williams, Dave Hansen, David Kaplan, David Woodhouse, Eric Biggers, Ingo Molnar, Josh Poimboeuf, Juergen Gross, Malaya Kumar Rout, Mario Limonciello, Nathan Chancellor, Oleg Nesterov, Pawan Gupta, Peter Zijlstra, Shivank Garg, Sohil Mehta, Thomas Gleixner, Uros Bizjak, Xin Li)" * tag 'x86-core-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (331 commits) x86/bugs: Fix spectre_v2 mitigation default on Intel x86/bugs: Restructure ITS mitigation x86/xen/msr: Fix uninitialized variable 'err' x86/msr: Remove a superfluous inclusion of x86/paravirt: Restrict PARAVIRT_XXL to 64-bit only x86/mm/64: Make 5-level paging support unconditional x86/mm/64: Make SPARSEMEM_VMEMMAP the only memory model x86/mm/64: Always use dynamic memory layout x86/bugs: Fix indentation due to ITS merge x86/cpuid: Rename hypervisor_cpuid_base()/for_each_possible_hypervisor_cpuid_base() to cpuid_base_hypervisor()/for_each_possible_cpuid_base_hypervisor() x86/cpu/intel: Rename CPUID(0x2) descriptors iterator parameter x86/cacheinfo: Rename CPUID(0x2) descriptors iterator parameter x86/cpuid: Rename cpuid_get_leaf_0x2_regs() to cpuid_leaf_0x2() x86/cpuid: Rename have_cpuid_p() to cpuid_feature() x86/cpuid: Set as the main CPUID header x86/cpuid: Move CPUID(0x2) APIs into x86/msr: Add rdmsrl_on_cpu() compatibility wrapper x86/mm: Fix kernel-doc descriptions of various pgtable methods x86/asm-offsets: Export certain 'struct cpuinfo_x86' fields for 64-bit asm use too x86/boot: Defer initialization of VM space related global variables ... commit ddddf9d64f7361323da663637adb4a02466bfc99 Merge: eaed94d1f68c34 e7d952cc39fca3 Author: Linus Torvalds Date: Mon May 26 15:40:23 2025 -0700 Merge tag 'perf-core-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf events updates from Ingo Molnar: "Core & generic-arch updates: - Add support for dynamic constraints and propagate it to the Intel driver (Kan Liang) - Fix & enhance driver-specific throttling support (Kan Liang) - Record sample last_period before updating on the x86 and PowerPC platforms (Mark Barnett) - Make perf_pmu_unregister() usable (Peter Zijlstra) - Unify perf_event_free_task() / perf_event_exit_task_context() (Peter Zijlstra) - Simplify perf_event_release_kernel() and perf_event_free_task() (Peter Zijlstra) - Allocate non-contiguous AUX pages by default (Yabin Cui) Uprobes updates: - Add support to emulate NOP instructions (Jiri Olsa) - selftests/bpf: Add 5-byte NOP uprobe trigger benchmark (Jiri Olsa) x86 Intel PMU enhancements: - Support Intel Auto Counter Reload [ACR] (Kan Liang) - Add PMU support for Clearwater Forest (Dapeng Mi) - Arch-PEBS preparatory changes: (Dapeng Mi) - Parse CPUID archPerfmonExt leaves for non-hybrid CPUs - Decouple BTS initialization from PEBS initialization - Introduce pairs of PEBS static calls x86 AMD PMU enhancements: - Use hrtimer for handling overflows in the AMD uncore driver (Sandipan Das) - Prevent UMC counters from saturating (Sandipan Das) Fixes and cleanups: - Fix put_ctx() ordering (Frederic Weisbecker) - Fix irq work dereferencing garbage (Frederic Weisbecker) - Misc fixes and cleanups (Changbin Du, Frederic Weisbecker, Ian Rogers, Ingo Molnar, Kan Liang, Peter Zijlstra, Qing Wang, Sandipan Das, Thorsten Blum)" * tag 'perf-core-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (60 commits) perf/headers: Clean up a bit perf/uapi: Clean up a bit perf/uapi: Fix PERF_RECORD_SAMPLE comments in mips/perf: Remove driver-specific throttle support xtensa/perf: Remove driver-specific throttle support sparc/perf: Remove driver-specific throttle support loongarch/perf: Remove driver-specific throttle support csky/perf: Remove driver-specific throttle support arc/perf: Remove driver-specific throttle support alpha/perf: Remove driver-specific throttle support perf/apple_m1: Remove driver-specific throttle support perf/arm: Remove driver-specific throttle support s390/perf: Remove driver-specific throttle support powerpc/perf: Remove driver-specific throttle support perf/x86/zhaoxin: Remove driver-specific throttle support perf/x86/amd: Remove driver-specific throttle support perf/x86/intel: Remove driver-specific throttle support perf: Only dump the throttle log for the leader perf: Fix the throttle logic for a group perf/core: Add the is_event_in_freq_mode() helper to simplify the code ... commit eaed94d1f68c3476834e07409f5fc9bd8efd6395 Merge: 3ba121c9f36f0c 90ca9410dab21c Author: Linus Torvalds Date: Mon May 26 15:19:58 2025 -0700 Merge tag 'sched-core-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler updates from Ingo Molnar: "Core & fair scheduler changes: - Tweak wait_task_inactive() to force dequeue sched_delayed tasks (John Stultz) - Adhere to place_entity() constraints (Peter Zijlstra) - Allow decaying util_est when util_avg > CPU capacity (Pierre Gondois) - Fix up wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan) Energy management: - Introduce sched_update_asym_prefer_cpu() (K Prateek Nayak) - cpufreq/amd-pstate: Update asym_prefer_cpu when core rankings change (K Prateek Nayak) - Align uclamp and util_est and call before freq update (Xuewen Yan) CPU isolation: - Make use of more than one housekeeping CPU (Phil Auld) RT scheduler: - Fix race in push_rt_task() (Harshit Agarwal) - Add kernel cmdline option for rt_group_sched (Michal Koutný) Scheduler topology support: - Improve topology_span_sane speed (Steve Wahl) Scheduler debugging: - Move and extend the sched_process_exit() tracepoint (Andrii Nakryiko) - Add RT_GROUP WARN checks for non-root task_groups (Michal Koutný) - Fix trace_sched_switch(.prev_state) (Peter Zijlstra) - Untangle cond_resched() and live-patching (Peter Zijlstra) Fixes and cleanups: - Misc fixes and cleanups (K Prateek Nayak, Michal Koutný, Peter Zijlstra, Xuewen Yan)" * tag 'sched-core-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (26 commits) sched/uclamp: Align uclamp and util_est and call before freq update sched/util_est: Simplify condition for util_est_{en,de}queue() sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE sched,livepatch: Untangle cond_resched() and live-patching sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks sched/fair: Adhere to place_entity() constraints sched/debug: Print the local group's asym_prefer_cpu cpufreq/amd-pstate: Update asym_prefer_cpu when core rankings change sched/topology: Introduce sched_update_asym_prefer_cpu() sched/fair: Use READ_ONCE() to read sg->asym_prefer_cpu sched/isolation: Make use of more than one housekeeping cpu sched/rt: Fix race in push_rt_task sched: Add annotations to RT_GROUP_SCHED fields sched: Add RT_GROUP WARN checks for non-root task_groups sched: Do not construct nor expose RT_GROUP_SCHED structures if disabled sched: Bypass bandwitdh checks with runtime disabled RT_GROUP_SCHED sched: Skip non-root task_groups with disabled RT_GROUP_SCHED sched: Add commadline option for RT_GROUP_SCHED toggling sched: Always initialize rt_rq's task_group sched: Remove unneeed macro wrap ... commit 3ba121c9f36f0c2734147365e5aeccf759a40b63 Merge: b3570b00dc3062 4ed9d82bf5b21d Author: Linus Torvalds Date: Mon May 26 15:13:53 2025 -0700 Merge tag 'objtool-core-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool updates from Ingo Molnar: - Speed up SHT_GROUP reindexing (Josh Poimboeuf) - Fix up st_info in COMDAT group section (Rong Xu) * tag 'objtool-core-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: objtool: Speed up SHT_GROUP reindexing objtool: Fix up st_info in COMDAT group section commit b3570b00dc3062c5a5e8d9602b923618d679636a Merge: 3349ada3cffdbe 94ec70880fd376 Author: Linus Torvalds Date: Mon May 26 14:42:07 2025 -0700 Merge tag 'locking-core-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking updates from Ingo Molnar: "Futexes: - Add support for task local hash maps (Sebastian Andrzej Siewior, Peter Zijlstra) - Implement the FUTEX2_NUMA ABI, which feature extends the futex interface to be NUMA-aware. On NUMA-aware futexes a second u32 word containing the NUMA node is added to after the u32 futex value word (Peter Zijlstra) - Implement the FUTEX2_MPOL ABI, which feature extends the futex interface to be mempolicy-aware as well, to further refine futex node mappings and lookups (Peter Zijlstra) Locking primitives: - Misc cleanups (Andy Shevchenko, Borislav Petkov, Colin Ian King, Ingo Molnar, Nam Cao, Peter Zijlstra) Lockdep: - Prevent abuse of lockdep subclasses (Waiman Long) - Add number of dynamic keys to /proc/lockdep_stats (Waiman Long) Plus misc cleanups and fixes" * tag 'locking-core-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (35 commits) selftests/futex: Fix spelling mistake "unitiliazed" -> "uninitialized" futex: Correct the kernedoc return value for futex_wait_setup(). tools headers: Synchronize prctl.h ABI header futex: Use RCU_INIT_POINTER() in futex_mm_init(). selftests/futex: Use TAP output in futex_numa_mpol selftests/futex: Use TAP output in futex_priv_hash futex: Fix kernel-doc comments futex: Relax the rcu_assign_pointer() assignment of mm->futex_phash in futex_mm_init() futex: Fix outdated comment in struct restart_block locking/lockdep: Add number of dynamic keys to /proc/lockdep_stats locking/lockdep: Prevent abuse of lockdep subclass locking/lockdep: Move hlock_equal() to the respective #ifdeffery futex,selftests: Add another FUTEX2_NUMA selftest selftests/futex: Add futex_numa_mpol selftests/futex: Add futex_priv_hash selftests/futex: Build without headers nonsense tools/perf: Allow to select the number of hash buckets tools headers: Synchronize prctl.h ABI header futex: Implement FUTEX2_MPOL futex: Implement FUTEX2_NUMA ... commit 3349ada3cffdbe4579872a004360daa31938f683 Merge: d8cb068359f621 8682a5749a3d2b Author: Linus Torvalds Date: Mon May 26 14:38:57 2025 -0700 Merge tag 'powerpc-6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc updates from Madhavan Srinivasan: - Support for dynamic preemption - Migrate powerpc boards GPIO driver to new setter API - Added new PMU for KVM host-wide measurement - Enhancement to htmdump driver to support more functions - Added character device for couple RTAS supported APIs - Minor fixes and cleanup Thanks to Amit Machhiwal, Athira Rajeev, Bagas Sanjaya, Bartosz Golaszewski, Christophe Leroy, Eddie James, Gaurav Batra, Gautam Menghani, Geert Uytterhoeven, Haren Myneni, Hari Bathini, Jiri Slaby (SUSE), Linus Walleij, Michal Suchanek, Naveen N Rao (AMD), Nilay Shroff, Ricardo B. Marlière, Ritesh Harjani (IBM), Sathvika Vasireddy, Shrikanth Hegde, Stephen Rothwell, Sourabh Jain, Thorsten Blum, Vaibhav Jain, Venkat Rao Bagalkote, and Viktor Malik. * tag 'powerpc-6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (52 commits) MAINTAINERS: powerpc: Remove myself as a reviewer powerpc/iommu: Use str_disabled_enabled() helper powerpc/powermac: Use str_enabled_disabled() and str_on_off() helpers powerpc/mm/fault: Use str_write_read() helper function powerpc: Replace strcpy() with strscpy() in proc_ppc64_init() powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view powerpc/kernel: Fix ppc_save_regs inclusion in build powerpc: Transliterate author name and remove FIXME powerpc/pseries/htmdump: Include header file to get is_kvm_guest() definition KVM: PPC: Book3S HV: Fix IRQ map warnings with XICS on pSeries KVM Guest powerpc/8xx: Reduce alignment constraint for kernel memory powerpc/boot: Fix build with gcc 15 powerpc/pseries/htmdump: Add documentation for H_HTM debugfs interface powerpc/pseries/htmdump: Add htm capabilities support to htmdump module powerpc/pseries/htmdump: Add htm flags support to htmdump module powerpc/pseries/htmdump: Add htm setup support to htmdump module powerpc/pseries/htmdump: Add htm info support to htmdump module powerpc/pseries/htmdump: Add htm status support to htmdump module powerpc/pseries/htmdump: Add htm start support to htmdump module powerpc/pseries/htmdump: Add htm configure support to htmdump module ... commit d8cb068359f6210d790828714081d4ccb47014ff Merge: ba450370980aea 774a1fa880bc94 Author: Linus Torvalds Date: Mon May 26 14:36:05 2025 -0700 Merge tag 's390-6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Heiko Carstens: - Large rework of the protected key crypto code to allow for asynchronous handling without memory allocation - Speed up system call entry/exit path by re-implementing lazy ASCE handling - Add module autoload support for the diag288_wdt watchdog device driver - Get rid of s390 specific strcpy() and strncpy() implementations, and switch all remaining users to strscpy() when possible - Various other small fixes and improvements * tag 's390-6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (51 commits) s390/pci: Serialize device addition and removal s390/pci: Allow re-add of a reserved but not yet removed device s390/pci: Prevent self deletion in disable_slot() s390/pci: Remove redundant bus removal and disable from zpci_release_device() s390/crypto: Extend protected key conversion retry loop s390/pci: Fix __pcilg_mio_inuser() inline assembly s390/ptrace: Always inline regs_get_kernel_stack_nth() and regs_get_register() s390/thread_info: Cleanup header includes s390/extmem: Add workaround for DCSS unload diag s390/crypto: Rework protected key AES for true asynch support s390/cpacf: Rework cpacf_pcc() to return condition code s390/mm: Fix potential use-after-free in __crst_table_upgrade() s390/mm: Add mmap_assert_write_locked() check to crst_table_upgrade() s390/string: Remove strcpy() implementation s390/con3270: Use strscpy() instead of strcpy() s390/boot: Use strspcy() instead of strcpy() s390: Simple strcpy() to strscpy() conversions s390/pkey/crypto: Introduce xflags param for pkey in-kernel API s390/pkey: Provide and pass xflags within pkey and zcrypt layers s390/uv: Remove uv_get_secret_metadata function ... commit 3b5260d12b1fe76b566fe182de8abc586b827ed0 Author: Al Viro Date: Fri May 23 19:20:36 2025 -0400 Don't propagate mounts into detached trees All versions up to 6.14 did not propagate mount events into detached tree. Shortly after 6.14 a merge of vfs-6.15-rc1.mount.namespace (130e696aa68b) has changed that. Unfortunately, that has caused userland regressions (reported in https://lore.kernel.org/all/CAOYeF9WQhFDe+BGW=Dp5fK8oRy5AgZ6zokVyTj1Wp4EUiYgt4w@mail.gmail.com/) Straight revert wouldn't be an option - in particular, the variant in 6.14 had a bug that got fixed in d1ddc6f1d9f0 ("fix IS_MNT_PROPAGATING uses") and we don't want to bring the bug back. This is a modification of manual revert posted by Christian, with changes needed to avoid reintroducing the breakage in scenario described in d1ddc6f1d9f0. Cc: stable@vger.kernel.org Reported-by: Allison Karlitskaya Tested-by: Allison Karlitskaya Acked-by: Christian Brauner Co-developed-by: Christian Brauner Signed-off-by: Al Viro commit ba450370980aeae32197b74c27e4563281cd3aaa Merge: 2d2435e1c843ce 772e50a76ee664 Author: Linus Torvalds Date: Mon May 26 14:29:44 2025 -0700 Merge tag 'linux_kselftest-kunit-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kunit updates from Shuah Khan: - Enable qemu_config for riscv32, sparc 64-bit, PowerPC 32-bit BE and 64-bit LE - Enable CONFIG_SPARC32 to clearly differentiate between sparc 32-bit and 64-bit configurations - Enable CONFIG_CPU_BIG_ENDIAN to clearly differentiate between powerpc LE and BE configurations - Add feature to list available architectures to kunit tool - Fixes to bugs and changes to documentation * tag 'linux_kselftest-kunit-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kunit: Fix wrong parameter to kunit_deactivate_static_stub() kunit: tool: add test counts to JSON output Documentation: kunit: improve example on testing static functions kunit: executor: Remove const from kunit_filter_suites() allocation type kunit: qemu_configs: Disable faulting tests on 32-bit SPARC kunit: qemu_configs: Add 64-bit SPARC configuration kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y kunit: qemu_configs: Add PowerPC 32-bit BE and 64-bit LE kunit: qemu_configs: powerpc: Explicitly enable CONFIG_CPU_BIG_ENDIAN=y kunit: tool: Implement listing of available architectures kunit: qemu_configs: Add riscv32 config kunit: configs: Enable CONFIG_INIT_STACK_ALL_PATTERN in all_tests commit 2d2435e1c843ced85e55885282c866208ff9f676 Merge: 07046958f6ddaa 1107dc4c5b0618 Author: Linus Torvalds Date: Mon May 26 14:25:23 2025 -0700 Merge tag 'linux_kselftest-next-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull Kselftest updates from Shuah Khan: "Fixes: - cpufreq test to not double suspend in rtcwake case - compile error in pid_namespace test - run_kselftest.sh to use readlink if realpath is not available - cpufreq basic read and update testcases - ftrace to add poll to a gen_file so test can find it at run-time - spelling errors in perf_events test" * tag 'linux_kselftest-next-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests/run_kselftest.sh: Use readlink if realpath is not available selftests/timens: timerfd: Use correct clockid type in tclock_gettime() selftests/timens: Make run_tests() functions static selftests/timens: Print TAP headers selftests: pid_namespace: add missing sys/mount.h include in pid_max.c kselftest: cpufreq: Get rid of double suspend in rtcwake case selftests/cpufreq: Fix cpufreq basic read and update testcases selftests/ftrace: Convert poll to a gen_file selftests/perf_events: Fix spelling mistake "sycnhronize" -> "synchronize" commit 02e66dacb5b7ae21518fb24f8cb69295302bbfad Author: David Wronek Date: Tue Apr 22 23:17:05 2025 +0300 dt-bindings: mailbox: qcom: Add the SM7150 APCS compatible Add compatible for the Qualcomm SM7150 APCS block to the Qualcomm APCS binding. Signed-off-by: David Wronek Signed-off-by: Danila Tikhonov Signed-off-by: Jassi Brar commit 529015a0e77a57e17801e4a3338d74674e1f5704 Author: Yuntao Dai Date: Tue May 20 15:44:24 2025 +0800 mailbox: sophgo: add mailbox driver for CV18XX series SoC Add mailbox controller driver for CV18XX SoCs, which provides 8 channels and each channel has an 8-byte FIFO. Signed-off-by: Yuntao Dai Signed-off-by: Junhui Liu Signed-off-by: Jassi Brar commit fca8d64001fcfb26f7698c2052e1fc6634133ebc Author: Yuntao Dai Date: Tue May 20 15:44:23 2025 +0800 dt-bindings: mailbox: add Sophgo CV18XX series SoC Introduce the mailbox module for CV18XX series SoC, which is responsible for interchanging messages between asymmetric processors. Signed-off-by: Yuntao Dai Signed-off-by: Junhui Liu Signed-off-by: Jassi Brar commit 2149ec83ef7d273d35998903617422f1b3bd4846 Author: Peng Fan Date: Fri Apr 11 21:14:14 2025 +0800 mailbox: Use guard/scoped_guard for spinlock Use guard and scoped_guard for chan->lock and mbox->poll_hrt_lock to simplify code. Signed-off-by: Peng Fan Signed-off-by: Jassi Brar commit 16da9a653c5bf5d97fb296420899fe9735aa9c3c Author: Peng Fan Date: Fri Apr 11 21:14:13 2025 +0800 mailbox: Use guard/scoped_guard for con_mutex Use guard and scoped_guard for con_mutex to simplify code. Signed-off-by: Peng Fan Signed-off-by: Jassi Brar commit 9be022476fea62b32aa05d9d370e0175155731e6 Author: Peng Fan Date: Fri Apr 11 21:14:12 2025 +0800 mailbox: Remove devm_mbox_controller_unregister Commit e898d9cdd3a9("mailbox: Add device-managed registration functions") introduced device-managed API for mailbox, but in the past 7 years, there is no user for devm_mbox_controller_unregister. So remove it. Signed-off-by: Peng Fan Signed-off-by: Jassi Brar commit cb7e2ec3706f7ddedde2504b1b4342046c9a92e3 Author: Peng Fan Date: Fri Apr 11 21:14:11 2025 +0800 mailbox: Propagate correct error return value In case of_property_match_string fails, it makes more sense to return its error value to caller, not force the value to ERR_PTR(-EINVAL). Signed-off-by: Peng Fan Signed-off-by: Jassi Brar commit dddbd233e67e792bb0a3f9694a4707e6be29b2c6 Author: Peng Fan Date: Fri Apr 11 21:14:10 2025 +0800 mailbox: Not protect module_put with spin_lock_irqsave &chan->lock is not supposed to protect 'chan->mbox'. And in __mbox_bind_client, try_module_get is also not protected by &chan->lock. So move module_put out of the lock protected region. Signed-off-by: Peng Fan Signed-off-by: Jassi Brar commit 8da4988b6e645f3eaa590ea16f433583364fd09c Author: Peng Fan Date: Fri Apr 11 21:14:09 2025 +0800 mailbox: Use dev_err when there is error Use dev_err to show the error log instead of using dev_dbg. Signed-off-by: Peng Fan Signed-off-by: Jassi Brar commit 9fcebcb37c3e0a4b6eb40768cc5a5faebf166fbe Author: Jason-JH Lin Date: Mon Apr 21 11:55:47 2025 +0800 mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting Add cmdq_gctl_value_toggle() to configure GCE_CTRL_BY_SW and GCE_DDR_EN together in the same GCE_GCTL_VALUE register. For the SoCs whose GCE is located in MMINFRA and uses MMINFRA_AO power, this allows it to be written without enabling the clocks. Otherwise, all GCE registers should be written after the GCE clocks are enabled. Move this function into cmdq_runtime_resume() and cmdq_runtime_suspend() to ensure it is called when the GCE clock is enabled. Fixes: 7abd037aa581 ("mailbox: mtk-cmdq: add gce ddr enable support flow") Signed-off-by: Jason-JH Lin Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Jassi Brar commit f5cb07ec6aabd1bb56adbdeb5f0d70cb524db2cd Author: Peng Fan Date: Sun May 25 16:47:24 2025 +0800 mailbox: imx: Fix TXDB_V2 sending i.MX95 features several processing domains, Cortex-M7, Cortex-A55 secure, Cortex-A55 non-secure. Each domain could communicate with SCMI firmware with a dedicated MU. But the current NXP SCMI firmware is not a RTOS, all processing logic codes are in interrupt context. So if high priority Cortex-M7 is communicating with SCMI firmware and requires a bit more time to handle the SCMI call, Linux MU TXDB_V2 will be timeout with high possiblity in 1000us(the current value in imx-mailbox.c). Per NXP SCMI firmware design, if timeout, there is no recover logic, so SCMI agents should never timeout and always wait until the check condition met. Based on the upper reason, enlarge the timeout value to 10ms which is less chance to timeout, and retry if timeout really happends. Fixes: 5bfe4067d350 ("mailbox: imx: support channel type tx doorbell v2") Signed-off-by: Peng Fan Signed-off-by: Jassi Brar commit d635ba4207c31940398c41caa0cedd80f3b9c9c7 Author: Yue Haibing Date: Fri Apr 11 15:57:47 2025 +0800 mailbox: mchp-ipc-sbi: Fix COMPILE_TEST build error If COMPILE_TEST is y but RISCV_SBI is n, build fails: drivers/mailbox/mailbox-mchp-ipc-sbi.c: In function 'mchp_ipc_sbi_chan_send': drivers/mailbox/mailbox-mchp-ipc-sbi.c:119:23: error: storage size of 'ret' isn't known struct sbiret ret; ^~~ CC drivers/nvmem/lpc18xx_otp.o drivers/mailbox/mailbox-mchp-ipc-sbi.c:121:15: error: implicit declaration of function 'sbi_ecall' [-Werror=implicit-function-declaration] ret = sbi_ecall(SBI_EXT_MICROCHIP_TECHNOLOGY, command, channel, ^~~~~~~~~ move COMPILE_TEST to ARCH_MICROCHIP dependency as other drivers. Fixes: e4b1d67e7141 ("mailbox: add Microchip IPC support") Signed-off-by: Yue Haibing Signed-off-by: Jassi Brar commit 07046958f6ddaa1e05ac64d1e11e77b6db9a00ce Merge: 66fd704da45429 9c80e443379861 Author: Linus Torvalds Date: Mon May 26 14:20:50 2025 -0700 Merge tag 'next.2025.05.17a' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux Pull RCU updates from Joel Fernandes: - Removed swake_up_one_online() workaround - Reverted an incorrect rcuog wake-up fix from offline softirq - Rust RCU Guard methods marked as inline - Updated MAINTAINERS with Joel’s and Zqiang's new email address - Replaced magic constant in rcu_seq_done_exact() with named constant - Added warning mechanism to validate rcu_seq_done_exact() - Switched SRCU polling API to use rcu_seq_done_exact() - Commented on redundant delta check in rcu_seq_done_exact() - Made ->gpwrap tests in rcutorture more frequent - Fixed reuse of ARM64 images in rcutorture - rcutorture improved to check Kconfig and reader conflict handling - Extracted logic from rcu_torture_one_read() for clarity - Updated LWN RCU API documentation links - Enabled --do-rt in torture.sh for CONFIG_PREEMPT_RT - Added tests for SRCU up/down reader primitives - Added comments and delays checks in rcutorture - Deprecated srcu_read_lock_lite() and srcu_read_unlock_lite() via checkpatch - Added --do-normal and --do-no-normal to torture.sh - Added RCU Rust binding tests to torture.sh - Reduced CPU overcommit and removed MAXSMP/CPUMASK_OFFSTACK in TREE01 - Replaced kmalloc() with kcalloc() in rcuscale - Refined listRCU example code for stale data elimination - Fixed hardirq count bug for x86 in cpu_stall_cputime - Added safety checks in rcu/nocb for offloaded rdp access - Other miscellaneous changes * tag 'next.2025.05.17a' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux: (27 commits) rcutorture: Fix issue with re-using old images on ARM64 rcutorture: Remove MAXSMP and CPUMASK_OFFSTACK from TREE01 rcutorture: Reduce TREE01 CPU overcommit torture: Check for "Call trace:" as well as "Call Trace:" rcutorture: Perform more frequent testing of ->gpwrap torture: Add testing of RCU's Rust bindings to torture.sh torture: Add --do-{,no-}normal to torture.sh checkpatch: Deprecate srcu_read_lock_lite() and srcu_read_unlock_lite() rcutorture: Comment invocations of tick_dep_set_task() rcu/nocb: Add Safe checks for access offloaded rdp rcuscale: using kcalloc() to relpace kmalloc() doc/RCU/listRCU: refine example code for eliminating stale data doc: Update LWN RCU API links in whatisRCU.rst Revert "rcu/nocb: Fix rcuog wake-up from offline softirq" rust: sync: rcu: Mark Guard methods as inline rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture rcu: Remove swake_up_one_online() bandaid MAINTAINERS: Update Zqiang's email address rcutorture: Make torture.sh --do-rt use CONFIG_PREEMPT_RT srcu: Use rcu_seq_done_exact() for polling API ... commit 66fd704da45429e40aca6b4b09ca0267e27b29de Merge: 14418ddcc2c205 ecc1ca9185c377 Author: Linus Torvalds Date: Mon May 26 14:12:31 2025 -0700 Merge tag 'tpmdd-next-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm updates from Jarkko Sakkinen: "This is only a small pull request with fixes, as possible features moved to +1 release" * tag 'tpmdd-next-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm_crb: ffa_tpm: fix/update comments describing the CRB over FFA ABI tpm_crb_ffa: use dev_xx() macro to print log tpm_ffa_crb: access tpm service over FF-A direct message request v2 tpm: remove kmalloc failure error message commit 14418ddcc2c2055743ac7ee53d5ac2cf8a8660a7 Merge: 15d90a5e552453 2297554f01df6d Author: Linus Torvalds Date: Mon May 26 13:47:28 2025 -0700 Merge tag 'v6.16-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto updates from Herbert Xu: "API: - Fix memcpy_sglist to handle partially overlapping SG lists - Use memcpy_sglist to replace null skcipher - Rename CRYPTO_TESTS to CRYPTO_BENCHMARK - Flip CRYPTO_MANAGER_DISABLE_TEST into CRYPTO_SELFTESTS - Hide CRYPTO_MANAGER - Add delayed freeing of driver crypto_alg structures Compression: - Allocate large buffers on first use instead of initialisation in scomp - Drop destination linearisation buffer in scomp - Move scomp stream allocation into acomp - Add acomp scatter-gather walker - Remove request chaining - Add optional async request allocation Hashing: - Remove request chaining - Add optional async request allocation - Move partial block handling into API - Add ahash support to hmac - Fix shash documentation to disallow usage in hard IRQs Algorithms: - Remove unnecessary SIMD fallback code on x86 and arm/arm64 - Drop avx10_256 xts(aes)/ctr(aes) on x86 - Improve avx-512 optimisations for xts(aes) - Move chacha arch implementations into lib/crypto - Move poly1305 into lib/crypto and drop unused Crypto API algorithm - Disable powerpc/poly1305 as it has no SIMD fallback - Move sha256 arch implementations into lib/crypto - Convert deflate to acomp - Set block size correctly in cbcmac Drivers: - Do not use sg_dma_len before mapping in sun8i-ss - Fix warm-reboot failure by making shutdown do more work in qat - Add locking in zynqmp-sha - Remove cavium/zip - Add support for PCI device 0x17D8 to ccp - Add qat_6xxx support in qat - Add support for RK3576 in rockchip-rng - Add support for i.MX8QM in caam Others: - Fix irq_fpu_usable/kernel_fpu_begin inconsistency during CPU bring-up - Add new SEV/SNP platform shutdown API in ccp" * tag 'v6.16-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (382 commits) x86/fpu: Fix irq_fpu_usable() to return false during CPU onlining crypto: qat - add missing header inclusion crypto: api - Redo lookup on EEXIST Revert "crypto: testmgr - Add hash export format testing" crypto: marvell/cesa - Do not chain submitted requests crypto: powerpc/poly1305 - add depends on BROKEN for now Revert "crypto: powerpc/poly1305 - Add SIMD fallback" crypto: ccp - Add missing tee info reg for teev2 crypto: ccp - Add missing bootloader info reg for pspv5 crypto: sun8i-ce - move fallback ahash_request to the end of the struct crypto: octeontx2 - Use dynamic allocated memory region for lmtst crypto: octeontx2 - Initialize cptlfs device info once crypto: xts - Only add ecb if it is not already there crypto: lrw - Only add ecb if it is not already there crypto: testmgr - Add hash export format testing crypto: testmgr - Use ahash for generic tfm crypto: hmac - Add ahash support crypto: testmgr - Ignore EEXIST on shash allocation crypto: algapi - Add driver template support to crypto_inst_setname crypto: shash - Set reqsize in shash_alg ... commit e9f17038d814c0185e017a3fa62305a12d52f45c Author: Paolo Bonzini Date: Mon May 26 16:31:13 2025 -0400 x86/tdx: mark tdh_vp_enter() as __flatten In some cases tdx_tdvpr_pa() is not fully inlined into tdh_vp_enter(), which causes the following warning: vmlinux.o: warning: objtool: tdh_vp_enter+0x8: call to tdx_tdvpr_pa() leaves .noinstr.text section This happens if the compiler considers tdx_tdvpr_pa() to be "large", for example because CONFIG_SPARSEMEM adds two function calls to page_to_section() and __section_mem_map_addr(): ({ const struct page *__pg = (pg); \ int __sec = page_to_section(__pg); \ (unsigned long)(__pg - __section_mem_map_addr(__nr_to_section(__sec))); \ }) Because exiting the noinstr section is a no-no, just mark tdh_vp_enter() for full inlining. Reported-by: kernel test robot Analyzed-by: Xiaoyao Li Closes: https://lore.kernel.org/oe-kbuild-all/202505240530.5KktQ5mX-lkp@intel.com/ Signed-off-by: Paolo Bonzini commit 15d90a5e5524532b7456a24f4626cf28c1629c4c Merge: 14f19dc6440f23 289c99bec7eed9 Author: Linus Torvalds Date: Mon May 26 13:32:06 2025 -0700 Merge tag 'crc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull CRC updates from Eric Biggers: "Cleanups for the kernel's CRC (cyclic redundancy check) code: - Use __ro_after_init where appropriate - Remove unnecessary static_key on s390 - Rename some source code files - Rename the crc32 and crc32c crypto API modules - Use subsys_initcall instead of arch_initcall - Restore maintainers for crc_kunit.c - Fold crc16_byte() into crc16.c - Add some SPDX license identifiers" * tag 'crc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: lib/crc32: add SPDX license identifier lib/crc16: unexport crc16_table and crc16_byte() w1: ds2406: use crc16() instead of crc16_byte() loop MAINTAINERS: add crc_kunit.c back to CRC LIBRARY lib/crc: make arch-optimized code use subsys_initcall crypto: crc32 - remove "generic" from file and module names x86/crc: drop "glue" from filenames sparc/crc: drop "glue" from filenames s390/crc: drop "glue" from filenames powerpc/crc: rename crc32-vpmsum_core.S to crc-vpmsum-template.S powerpc/crc: drop "glue" from filenames arm64/crc: drop "glue" from filenames arm/crc: drop "glue" from filenames s390/crc32: Remove no-op module init and exit functions s390/crc32: Remove have_vxrs static key lib/crc: make the CPU feature static keys __ro_after_init commit 5bccdc51f90c3194fda4bab92c521c2e2eb4e887 Author: Baris Can Goral Date: Wed May 21 19:10:37 2025 +0300 replace strncpy with strscpy_pad The strncpy() function is actively dangerous to use since it may not NULL-terminate the destination string, resulting in potential memory content exposures, unbounded reads, or crashes. Link: https://github.com/KSPP/linux/issues/90 In addition, strscpy_pad is more appropriate because it also zero-fills any remaining space in the destination if the source is shorter than the provided buffer size. Signed-off-by: Baris Can Goral Reviewed-by: Allison Henderson Link: https://patch.msgid.link/20250521161036.14489-1-goralbaris@gmail.com Signed-off-by: Paolo Abeni commit 14f19dc6440f23f417c83207c117b54698aa3934 Merge: f83fcb87f824b0 c07d3aede2b268 Author: Linus Torvalds Date: Mon May 26 13:27:40 2025 -0700 Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux Pull fscrypt update from Eric Biggers: "Add support for 'hardware-wrapped inline encryption keys' to fscrypt. When enabled on supported platforms, this feature protects file contents keys from certain attacks, such as cold boot attacks. This feature uses the block layer support for wrapped keys which was merged in 6.15. Wrapped key support has existed out-of-tree in Android for a long time, and it's finally ready for upstream now that there is a platform on which it works end-to-end with upstream. Specifically, it works on the Qualcomm SM8650 HDK, using the Qualcomm ICE (Inline Crypto Engine) and HWKM (Hardware Key Manager). The corresponding driver support is included in the SCSI tree for 6.16. Validation for this feature includes two new tests that were already merged into xfstests (generic/368 and generic/369)" * tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux: fscrypt: add support for hardware-wrapped keys commit 1f7c9d52b12ded6c99b5623d1e81bba7bb76c2f4 Merge: 4d526b02df59ef 7917be17092818 Author: Paolo Bonzini Date: Mon May 26 16:27:00 2025 -0400 Merge tag 'kvm-riscv-6.16-1' of https://github.com/kvm-riscv/linux into HEAD KVM/riscv changes for 6.16 - Add vector registers to get-reg-list selftest - VCPU reset related improvements - Remove scounteren initialization from VCPU reset - Support VCPU reset from userspace using set_mpstate() ioctl commit 4d526b02df59efb9b966f66e6cace836c4cfc5d8 Merge: 85502b2214d50b 1b85d923ba8c9e Author: Paolo Bonzini Date: Mon May 26 16:19:46 2025 -0400 Merge tag 'kvmarm-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 updates for 6.16 * New features: - Add large stage-2 mapping support for non-protected pKVM guests, clawing back some performance. - Add UBSAN support to the standalone EL2 object used in nVHE/hVHE and protected modes. - Enable nested virtualisation support on systems that support it (yes, it has been a long time coming), though it is disabled by default. * Improvements, fixes and cleanups: - Large rework of the way KVM tracks architecture features and links them with the effects of control bits. This ensures correctness of emulation (the data is automatically extracted from the published JSON files), and helps dealing with the evolution of the architecture. - Significant changes to the way pKVM tracks ownership of pages, avoiding page table walks by storing the state in the hypervisor's vmemmap. This in turn enables the THP support described above. - New selftest checking the pKVM ownership transition rules - Fixes for FEAT_MTE_ASYNC being accidentally advertised to guests even if the host didn't have it. - Fixes for the address translation emulation, which happened to be rather buggy in some specific contexts. - Fixes for the PMU emulation in NV contexts, decoupling PMCR_EL0.N from the number of counters exposed to a guest and addressing a number of issues in the process. - Add a new selftest for the SVE host state being corrupted by a guest. - Keep HCR_EL2.xMO set at all times for systems running with the kernel at EL2, ensuring that the window for interrupts is slightly bigger, and avoiding a pretty bad erratum on the AmpereOne HW. - Add workaround for AmpereOne's erratum AC04_CPU_23, which suffers from a pretty bad case of TLB corruption unless accesses to HCR_EL2 are heavily synchronised. - Add a per-VM, per-ITS debugfs entry to dump the state of the ITS tables in a human-friendly fashion. - and the usual random cleanups. commit 85502b2214d50ba0ddf2a5fb454e4d28a160d175 Merge: 2bb0e398852fa3 a867688c8cbb1b Author: Paolo Bonzini Date: Mon May 26 16:12:13 2025 -0400 Merge tag 'loongarch-kvm-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson into HEAD LoongArch KVM changes for v6.16 1. Don't flush tlb if HW PTW supported. 2. Add LoongArch KVM selftests support. commit 2bb0e398852fa3f3ac9e1a6a6f756c09fe4997f6 Author: Paolo Bonzini Date: Mon May 26 16:12:01 2025 -0400 Documentation: virt/kvm: remove unreferenced footnote Replace it with just the URL. Reported-by: Stephen Rothwell Signed-off-by: Paolo Bonzini commit f83fcb87f824b0bfbf1200590cc80f05e66488a7 Merge: 79b98edf918e81 f3e2e53823b98d Author: Linus Torvalds Date: Mon May 26 12:56:01 2025 -0700 Merge tag 'xfs-merge-6.16' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs updates from Carlos Maiolino: - Atomic writes for XFS - Remove experimental warnings for pNFS, scrub and parent pointers * tag 'xfs-merge-6.16' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (26 commits) xfs: add inode to zone caching for data placement xfs: free the item in xfs_mru_cache_insert on failure xfs: remove the EXPERIMENTAL warning for pNFS xfs: remove some EXPERIMENTAL warnings xfs: Remove deprecated xfs_bufd sysctl parameters xfs: stop using set_blocksize xfs: allow sysadmins to specify a maximum atomic write limit at mount time xfs: update atomic write limits xfs: add xfs_calc_atomic_write_unit_max() xfs: add xfs_file_dio_write_atomic() xfs: commit CoW-based atomic writes atomically xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() xfs: add xfs_atomic_write_cow_iomap_begin() xfs: refine atomic write size check in xfs_file_write_iter() xfs: refactor xfs_reflink_end_cow_extent() xfs: allow block allocator to take an alignment hint xfs: ignore HW which cannot atomic write a single block xfs: add helpers to compute transaction reservation for finishing intent items xfs: add helpers to compute log item overhead xfs: separate out setting buftarg atomic writes limits ... commit f0b50730bdd8f2734e548de541e845c0d40dceb6 Author: Wentao Liang Date: Wed May 21 21:36:20 2025 +0800 net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() The function mlx5_query_nic_vport_qkey_viol_cntr() calls the function mlx5_query_nic_vport_context() but does not check its return value. This could lead to undefined behavior if the query fails. A proper implementation can be found in mlx5_nic_vport_query_local_lb(). Add error handling for mlx5_query_nic_vport_context(). If it fails, free the out buffer via kvfree() and return error code. Fixes: 9efa75254593 ("net/mlx5_core: Introduce access functions to query vport RoCE fields") Cc: stable@vger.kernel.org # v4.5 Signed-off-by: Wentao Liang Reviewed-by: Tariq Toukan Link: https://patch.msgid.link/20250521133620.912-1-vulab@iscas.ac.cn Signed-off-by: Paolo Abeni commit 79b98edf918e8146047e08817e2a42937428be02 Merge: 522544fc71c27b b4a29efc51461e Author: Linus Torvalds Date: Mon May 26 12:47:41 2025 -0700 Merge tag 'erofs-for-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs updates from Gao Xiang: "In this cycle, Intel QAT hardware accelerators are supported to improve DEFLATE decompression performance. I've tested it with the enwik9 dataset of 1 MiB pclusters on our Intel Sapphire Rapids bare-metal server and a PL0 ESSD, and the sequential read performance even surpasses LZ4 software decompression on this setup. In addition, a `fsoffset` mount option is introduced for file-backed mounts to specify the filesystem offset in order to adapt customized container formats. And other improvements and minor cleanups. Summary: - Add a `fsoffset` mount option to specify the filesystem offset - Support Intel QAT accelerators to boost up the DEFLATE algorithm - Initialize per-CPU workers and CPU hotplug hooks lazily to avoid unnecessary overhead when EROFS is not mounted - Fix file handle encoding for 64-bit NIDs - Minor cleanups" * tag 'erofs-for-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: support DEFLATE decompression by using Intel QAT erofs: clean up erofs_{init,exit}_sysfs() erofs: add 'fsoffset' mount option to specify filesystem offset erofs: lazily initialize per-CPU workers and CPU hotplug hooks erofs: refine readahead tracepoint erofs: avoid using multiple devices with different type erofs: fix file handle encoding for 64-bit NIDs commit 57ee9584fd8606deef66d7b65fa4dcf94f6843aa Author: Horatiu Vultur Date: Wed May 21 14:41:59 2025 +0200 net: lan966x: Fix 1-step timestamping over ipv4 or ipv6 When enabling 1-step timestamping for ptp frames that are over udpv4 or udpv6 then the inserted timestamp is added at the wrong offset in the frame, meaning that will modify the frame at the wrong place, so the frame will be malformed. To fix this, the HW needs to know which kind of frame it is to know where to insert the timestamp. For that there is a field in the IFH that says the PDU_TYPE, which can be NONE which is the default value, IPV4 or IPV6. Therefore make sure to set the PDU_TYPE so the HW knows where to insert the timestamp. Like I mention before the issue is not seen with L2 frames because by default the PDU_TYPE has a value of 0, which represents the L2 frames. Fixes: 77eecf25bd9d2f ("net: lan966x: Update extraction/injection for timestamping") Signed-off-by: Horatiu Vultur Link: https://patch.msgid.link/20250521124159.2713525-1-horatiu.vultur@microchip.com Signed-off-by: Paolo Abeni commit 522544fc71c27b4b432386c7919f71ecc79a3bfb Merge: 8fdabcd9c01d9a 9caea9208fc3fb Author: Linus Torvalds Date: Mon May 26 12:43:30 2025 -0700 Merge tag 'bcachefs-2025-05-24' of git://evilpiepirate.org/bcachefs Pull bcachefs updates from Kent Overstreet: - Poisoned extents can now be moved: this lets us handle bitrotted data without deleting it. For now, reading from poisoned extents only returns -EIO: in the future we'll have an API for specifying "read this data even if there were bitflips". - Incompatible features may now be enabled at runtime, via "opts/version_upgrade" in sysfs. Toggle it to incompatible, and then toggle it back - option changes via the sysfs interface are persistent. - Various changes to support deployable disk images: - RO mounts now use less memory - Images may be stripped of alloc info, particularly useful for slimming them down if they will primarily be mounted RO. Alloc info will be automatically regenerated on first RW mount, and this is quite fast - Filesystem images generated with 'bcachefs image' will be automatically resized the first time they're mounted on a larger device The images 'bcachefs image' generates with compression enabled have been comparable in size to those generated by squashfs and erofs - but you get a full RW capable filesystem - Major error message improvements for btree node reads, data reads, and elsewhere. We now build up a single error message that lists all the errors encountered, actions taken to repair, and success/failure of the IO. This extends to other error paths that may kick off other actions, e.g. scheduling recovery passes: actions we took because of an error are included in that error message, with grouping/indentation so we can see what caused what. - New option, 'rebalance_on_ac_only'. Does exactly what the name suggests, quite handy with background compression. - Repair/self healing: - We can now kick off recovery passes and run them in the background if we detect errors. Currently, this is just used by code that walks backpointers. We now also check for missing backpointers at runtime and run check_extents_to_backpointers if required. The messy 6.14 upgrade left missing backpointers for some users, and this will correct that automatically instead of requiring a manual fsck - some users noticed this as copygc spinning and not making progress. In the future, as more recovery passes come online, we'll be able to repair and recover from nearly anything - except for unreadable btree nodes, and that's why you're using replication, of course - without shutting down the filesystem. - There's a new recovery pass, for checking the rebalance_work btree, which tracks extents that rebalance will process later. - Hardening: - Close the last known hole in btree iterator/btree locking assertions: path->should_be_locked paths must stay locked until the end of the transaction. This shook out a few bugs, including a performance issue that was causing unnecessary path_upgrade transaction restarts. - Performance: - Faster snapshot deletion: this is an incompatible feature, as it requires new sentinal values, for safety. Snapshot deletion no longer has to do a full metadata scan, it now just scans the inodes btree: if an extent/dirent/xattr is present for a given snapshot ID, we already require that an inode be present with that same snapshot ID. If/when users hit scalability limits again (ridiculously huge filesystems with lots of inodes, and many sparse snapshots), let me know - the next step will be to add an index from snapshot ID -> inode number, which won't be too hard. - Faster device removal: the "scan for pointers to this device" no longer does a full metadata scan, instead it walks backpointers. Like fast snapshot deletion this is another incompat feature: it also requires a new sentinal value, because we don't want to reuse these device IDs until after a fsck. - We're now coalescing redundant accounting updates prior to transaction commit, taking some pressure off the journal. Shortly we'll also be doing multiple extent updates in a transaction in the main write path, which combined with the previous should drastically cut down on the amount of metadata updates we have to journal. - Stack usage improvements: All allocator state has been moved off the stack - Debug improvements: - enumerated refcounts: The debug code previously used for filesystem write refs is now a small library, and used for other heavily used refcounts. Different users of a refcount are enumerated, making it much easier to debug refcount issues. - Async object debugging: There's a new kconfig option that makes various async objects (different types of bios, data updates, write ops, etc.) visible in debugfs, and it should be fast enough to leave on in production. - Various sets of assertions no longer require CONFIG_BCACHEFS_DEBUG, instead they're controlled by module parameters and static keys, meaning users won't need to compile custom kernels as often to help debug issues. - bch2_trans_kmalloc() calls can be tracked (there's a new kconfig option). With it on you can check the btree_transaction_stats in debugfs to see the bch2_trans_kmalloc() calls a transaction did when it used the most memory. * tag 'bcachefs-2025-05-24' of git://evilpiepirate.org/bcachefs: (218 commits) bcachefs: Don't mount bs > ps without TRANSPARENT_HUGEPAGE bcachefs: Fix btree_iter_next_node() for new locking asserts bcachefs: Ensure we don't use a blacklisted journal seq bcachefs: Small check_fix_ptr fixes bcachefs: Fix opts.recovery_pass_last bcachefs: Fix allocate -> self healing path bcachefs: Fix endianness in casefold check/repair bcachefs: Path must be locked if trans->locked && should_be_locked bcachefs: Simplify bch2_path_put() bcachefs: Plumb btree_trans for more locking asserts bcachefs: Clear trans->locked before unlock bcachefs: Clear should_be_locked before unlock in key_cache_drop() bcachefs: bch2_path_get() reuses paths if upgrade_fails & !should_be_locked bcachefs: Give out new path if upgrade fails bcachefs: Fix btree_path_get_locks when not doing trans restart bcachefs: btree_node_locked_type_nowrite() bcachefs: Kill bch2_path_put_nokeep() bcachefs: bch2_journal_write_checksum() bcachefs: Reduce stack usage in data_update_index_update() bcachefs: bch2_trans_log_str() ... commit 8fdabcd9c01d9ac585d8109a921e0734a69479fb Merge: a56d3133bd875d e320050eb75e91 Author: Linus Torvalds Date: Mon May 26 12:35:08 2025 -0700 Merge tag 'gfs2-for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 updates from Andreas Gruenbacher: - Fix the long-standing warnings in inode_to_wb() when CONFIG_LOCKDEP is enabled: gfs2 doesn't support cgroup writeback and so inode->i_wb will never change. This is the counterpart of commit 9e888998ea4d ("writeback: fix false warning in inode_to_wb()") - Fix a hang introduced by commit 8d391972ae2d ("gfs2: Remove __gfs2_writepage()"): prevent gfs2_logd from creating transactions for jdata pages while trying to flush the log - Fix a race between gfs2_create_inode() and gfs2_evict_inode() by deallocating partially created inodes on the gfs2_create_inode() error path - Fix a bug in the journal head lookup code that could cause mount to fail after successful recovery - Various smaller fixes and cleanups from various people * tag 'gfs2-for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: (23 commits) gfs2: No more gfs2_find_jhead caching gfs2: Get rid of duplicate log head lookup gfs2: Simplify clean_journal gfs2: Simplify gfs2_log_pointers_init gfs2: Move gfs2_log_pointers_init gfs2: Minor comments fix gfs2: Don't start unnecessary transactions during log flush gfs2: Move gfs2_trans_add_databufs gfs2: Rename jdata_dirty_folio to gfs2_jdata_dirty_folio gfs2: avoid inefficient use of crc32_le_shift() gfs2: Do not call iomap_zero_range beyond eof gfs: don't check for AOP_WRITEPAGE_ACTIVATE in gfs2_write_jdata_batch gfs2: Fix usage of bio->bi_status in gfs2_end_log_write gfs2: deallocate inodes in gfs2_create_inode gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc gfs2: Move gfs2_dinode_dealloc gfs2: Don't reread inodes unnecessarily gfs2: gfs2_create_inode error handling fix gfs2: Remove unnecessary NULL check before free_percpu() gfs2: check sb_min_blocksize return value ... commit a56d3133bd875d90ef3237f24e37b75b6d0326a9 Merge: 5e82ed5ca4b510 c6b1908224593d Author: Linus Torvalds Date: Mon May 26 12:28:55 2025 -0700 Merge tag 'configfs-for-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/a.hindborg/linux Pull configfs updates from Andreas Hindborg: - Allow creation of rw files with custom permissions. This allows drivers to better protect secrets written through configfs - Fix a bug where an error condition did not cause an early return while populating attributes - Report ENOMEM rather than EFAULT when kvasprintf() fails in config_item_set_name() - Add a Rust API for configfs. This allows Rust drivers to use configfs through a memory safe interface * tag 'configfs-for-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/a.hindborg/linux: MAINTAINERS: add configfs Rust abstractions rust: configfs: add a sample demonstrating configfs usage rust: configfs: introduce rust support for configfs configfs: Correct error value returned by API config_item_set_name() configfs: Do not override creating attribute file failure in populate_attrs() configfs: Delete semicolon from macro type_print() definition configfs: Add CONFIGFS_ATTR_PERM helper commit 5e82ed5ca4b510e0ff53af1e12e94e6aa1fe5a93 Merge: 49fffac983ac52 eeb133a6341280 Author: Linus Torvalds Date: Mon May 26 12:24:43 2025 -0700 Merge tag 'for-6.16-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs updates from David Sterba: "Apart from numerous cleanups, there are some performance improvements and one minor mount option update. There's one more radix-tree conversion (one remaining), and continued work towards enabling large folios (almost finished). Performance: - extent buffer conversion to xarray gains throughput and runtime improvements on metadata heavy operations doing writeback (sample test shows +50% throughput, -33% runtime) - extent io tree cleanups lead to performance improvements by avoiding unnecessary searches or repeated searches - more efficient extent unpinning when committing transaction (estimated run time improvement 3-5%) User visible changes: - remove standalone mount option 'nologreplay', deprecated in 5.9, replacement is 'rescue=nologreplay' - in scrub, update reporting, add back device stats message after detected errors (accidentally removed during recent refactoring) Core: - convert extent buffer radix tree to xarray - in subpage mode, move block perfect compression out of experimental build - in zoned mode, introduce sub block groups to allow managing special block groups, like the one for relocation or tree-log, to handle some corner cases of ENOSPC - in scrub, simplify bitmaps for block tracking status - continued preparations for large folios: - remove assertions for folio order 0 - add support where missing: compression, buffered write, defrag, hole punching, subpage, send - fix fsync of files with no hard links not persisting deletion - reject tree blocks which are not nodesize aligned, a precaution from 4.9 times - move transaction abort calls closer to the error sites - remove usage of some struct bio_vec internals - simplifications in extent map - extent IO cleanups and optimizations - error handling improvements - enhanced ASSERT() macro with optional format strings - cleanups: - remove unused code - naming unifications, dropped __, added prefix - merge similar functions - use common helpers for various data structures" * tag 'for-6.16-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: (198 commits) btrfs: move misplaced comment of btrfs_path::keep_locks btrfs: remove standalone "nologreplay" mount option btrfs: use a single variable to track return value at btrfs_page_mkwrite() btrfs: don't return VM_FAULT_SIGBUS on failure to set delalloc for mmap write btrfs: simplify early error checking in btrfs_page_mkwrite() btrfs: pass true to btrfs_delalloc_release_space() at btrfs_page_mkwrite() btrfs: fix wrong start offset for delalloc space release during mmap write btrfs: fix harmless race getting delayed ref head count when running delayed refs btrfs: log error codes during failures when writing super blocks btrfs: simplify error return logic when getting folio at prepare_one_folio() btrfs: return real error from __filemap_get_folio() calls btrfs: remove superfluous return value check at btrfs_dio_iomap_begin() btrfs: fix invalid data space release when truncating block in NOCOW mode btrfs: update Kconfig option descriptions btrfs: update list of features built under experimental config btrfs: send: remove btrfs_debug() calls btrfs: use boolean for delalloc argument to btrfs_free_reserved_extent() btrfs: use boolean for delalloc argument to btrfs_free_reserved_bytes() btrfs: fold error checks when allocating ordered extent and update comments btrfs: check we grabbed inode reference when allocating an ordered extent ... commit 3e0c509fbdb106ba2d2fa13beafe58f4ba11e13d Merge: 76524ffd103833 6cfb07e61b7ba5 Author: Rafael J. Wysocki Date: Mon May 26 21:24:27 2025 +0200 Merge branch 'pm-tools' Merge a cpupower utility update for 6.16-rc1 that adds a systemd service to run cpupower and changes binding's Makefile to use -lcpupower (John B. Wyatt IV, Francesco Poli). * pm-tools: cpupower: do not install files to /etc/default/ cpupower: do not call systemctl at install time cpupower: do not write DESTDIR to cpupower.service cpupower: change binding's makefile to use -lcpupower cpupower: add a systemd service to run cpupower commit 76524ffd103833a8189ca4b5998ee0ce4a000591 Merge: af86d7e88e3069 40d3b40dce375d eca64130413421 Author: Rafael J. Wysocki Date: Mon May 26 21:21:58 2025 +0200 Merge branches 'pm-runtime' and 'pm-sleep' Merge updates related to system sleep handling and runtime PM for 6.16-rc1: - Fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla). - Move debug runtime PM attributes to runtime_attrs[] (Rafael Wysocki). - Add new devm_ functions for enabling runtime PM and runtime PM reference counting (Bence Csókás). - Remove size arguments from strscpy() calls in the hibernation core code (Thorsten Blum). - Adjust the handling of devices with asynchronous suspend enabled during system suspend and resume to start resuming them immediately after resuming their parents and to start suspending such a device immediately after suspending its first child (Rafael Wysocki). - Adjust messages printed during tasks freezing to avoid using pr_cont() (Andrew Sayers, Paul Menzel). - Clean up unnecessary usage of !! in pm_print_times_init() (Zihuan Zhang). - Add missing wakeup source attribute relax_count to sysfs and remove the space character at the end ofi the string produced by pm_show_wakelocks() (Zijun Hu). - Add configurable pm_test delay for hibernation (Zihuan Zhang). - Disable asynchronous suspend in ucsi_ccg_probe() to prevent the cypd4226 device on Tegra boards from suspending prematurely (Jon Hunter). - Unbreak printing PM debug messages during hibernation and clean up some related code (Rafael Wysocki). * pm-runtime: PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() PM: sysfs: Move debug runtime PM attributes to runtime_attrs[] PM: runtime: Add new devm functions * pm-sleep: PM: freezer: Rewrite restarting tasks log to remove stray *done.* PM: sleep: Introduce pm_sleep_transition_in_progress() PM: sleep: Introduce pm_suspend_in_progress() PM: sleep: Print PM debug messages during hibernation ucsi_ccg: Disable async suspend in ucsi_ccg_probe() PM: hibernate: add configurable delay for pm_test PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() PM: wakeup: Add missing wakeup source attribute relax_count PM: sleep: Remove unnecessary !! PM: sleep: Use two lines for "Restarting..." / "done" messages PM: sleep: Make suspend of devices more asynchronous PM: sleep: Suspend async parents after suspending children PM: sleep: Resume children after resuming the parent PM: hibernate: Remove size arguments when calling strscpy() commit af86d7e88e3069f19138cabb3d32dd1e39bf3f9e Merge: f34dc283434730 5836ebeb4a2b7e Author: Rafael J. Wysocki Date: Mon May 26 21:18:34 2025 +0200 Merge branch 'pm-cpuidle' Merge cpuidle updates for 6.16-rc1: - Optimize bucket assignment when next_timer_ns equals KTIME_MAX in the menu cpuidle governor (Zhongqiu Han). - Convert the cpuidle PSCI driver to a faux device one (Sudeep Holla). - Add C1 demotion on/off sysfs knob to the intel_idle driver (Artem Bityutskiy). - Fix typos in two comments in the teo cpuidle governor (Atul Kumar Pant). * pm-cpuidle: cpuidle: psci: Avoid initializing faux device if no DT idle states are present Documentation: ABI: testing: document the new cpuidle sysfs file Documentation: admin-guide: pm: Document intel_idle C1 demotion intel_idle: Add C1 demotion on/off sysfs knob cpuidle: psci: Transition to the faux device interface cpuidle: menu: Optimize bucket assignment when next_timer_ns equals KTIME_MAX cpuidle: teo: Fix typos in two comments commit 49fffac983ac52aea0ab94914be3f56bcf92d5dc Merge: 6f59de9bc0d576 6faaf6e0faf1cc Author: Linus Torvalds Date: Mon May 26 12:13:22 2025 -0700 Merge tag 'for-6.16/io_uring-20250523' of git://git.kernel.dk/linux Pull io_uring updates from Jens Axboe: - Avoid indirect function calls in io-wq for executing and freeing work. The design of io-wq is such that it can be a generic mechanism, but as it's just used by io_uring now, may as well avoid these indirect calls - Clean up registered buffers for networking - Add support for IORING_OP_PIPE. Pretty straight forward, allows creating pipes with io_uring, particularly useful for having these be instantiated as direct descriptors - Clean up the coalescing support fore registered buffers - Add support for multiple interface queues for zero-copy rx networking. As this feature was merged for 6.15 it supported just a single ifq per ring - Clean up the eventfd support - Add dma-buf support to zero-copy rx - Clean up and improving the request draining support - Clean up provided buffer support, most notably with an eye toward making the legacy support less intrusive - Minor fdinfo cleanups, dropping support for dumping what credentials are registered - Improve support for overflow CQE handling, getting rid of GFP_ATOMIC for allocating overflow entries where possible - Improve detection of cases where io-wq doesn't need to spawn a new worker unnecessarily - Various little cleanups * tag 'for-6.16/io_uring-20250523' of git://git.kernel.dk/linux: (59 commits) io_uring/cmd: warn on reg buf imports by ineligible cmds io_uring/io-wq: only create a new worker if it can make progress io_uring/io-wq: ignore non-busy worker going to sleep io_uring/io-wq: move hash helpers to the top trace/io_uring: fix io_uring_local_work_run ctx documentation io_uring: finish IOU_OK -> IOU_COMPLETE transition io_uring: add new helpers for posting overflows io_uring: pass in struct io_big_cqe to io_alloc_ocqe() io_uring: make io_alloc_ocqe() take a struct io_cqe pointer io_uring: split alloc and add of overflow io_uring: open code io_req_cqe_overflow() io_uring/fdinfo: get rid of dumping credentials io_uring/fdinfo: only compile if CONFIG_PROC_FS is set io_uring/kbuf: unify legacy buf provision and removal io_uring/kbuf: refactor __io_remove_buffers io_uring/kbuf: don't compute size twice on prep io_uring/kbuf: drop extra vars in io_register_pbuf_ring io_uring/kbuf: use mem_is_zero() io_uring/kbuf: account ring io_buffer_list memory io_uring: drain based on allocates reqs ... commit 6f59de9bc0d576eb5a5edfea470527902315e924 Merge: 3e406741b19890 533c87e2ed7424 Author: Linus Torvalds Date: Mon May 26 11:39:36 2025 -0700 Merge tag 'for-6.16/block-20250523' of git://git.kernel.dk/linux Pull block updates from Jens Axboe: - ublk updates: - Add support for updating the size of a ublk instance - Zero-copy improvements - Auto-registering of buffers for zero-copy - Series simplifying and improving GET_DATA and request lookup - Series adding quiesce support - Lots of selftests additions - Various cleanups - NVMe updates via Christoph: - add per-node DMA pools and use them for PRP/SGL allocations (Caleb Sander Mateos, Keith Busch) - nvme-fcloop refcounting fixes (Daniel Wagner) - support delayed removal of the multipath node and optionally support the multipath node for private namespaces (Nilay Shroff) - support shared CQs in the PCI endpoint target code (Wilfred Mallawa) - support admin-queue only authentication (Hannes Reinecke) - use the crc32c library instead of the crypto API (Eric Biggers) - misc cleanups (Christoph Hellwig, Marcelo Moreira, Hannes Reinecke, Leon Romanovsky, Gustavo A. R. Silva) - MD updates via Yu: - Fix that normal IO can be starved by sync IO, found by mkfs on newly created large raid5, with some clean up patches for bdev inflight counters - Clean up brd, getting rid of atomic kmaps and bvec poking - Add loop driver specifically for zoned IO testing - Eliminate blk-rq-qos calls with a static key, if not enabled - Improve hctx locking for when a plug has IO for multiple queues pending - Remove block layer bouncing support, which in turn means we can remove the per-node bounce stat as well - Improve blk-throttle support - Improve delay support for blk-throttle - Improve brd discard support - Unify IO scheduler switching. This should also fix a bunch of lockdep warnings we've been seeing, after enabling lockdep support for queue freezing/unfreezeing - Add support for block write streams via FDP (flexible data placement) on NVMe - Add a bunch of block helpers, facilitating the removal of a bunch of duplicated boilerplate code - Remove obsolete BLK_MQ pci and virtio Kconfig options - Add atomic/untorn write support to blktrace - Various little cleanups and fixes * tag 'for-6.16/block-20250523' of git://git.kernel.dk/linux: (186 commits) selftests: ublk: add test for UBLK_F_QUIESCE ublk: add feature UBLK_F_QUIESCE selftests: ublk: add test case for UBLK_U_CMD_UPDATE_SIZE traceevent/block: Add REQ_ATOMIC flag to block trace events ublk: run auto buf unregisgering in same io_ring_ctx with registering io_uring: add helper io_uring_cmd_ctx_handle() ublk: remove io argument from ublk_auto_buf_reg_fallback() ublk: handle ublk_set_auto_buf_reg() failure correctly in ublk_fetch() selftests: ublk: add test for covering UBLK_AUTO_BUF_REG_FALLBACK selftests: ublk: support UBLK_F_AUTO_BUF_REG ublk: support UBLK_AUTO_BUF_REG_FALLBACK ublk: register buffer to local io_uring with provided buf index via UBLK_F_AUTO_BUF_REG ublk: prepare for supporting to register request buffer automatically ublk: convert to refcount_t selftests: ublk: make IO & device removal test more stressful nvme: rename nvme_mpath_shutdown_disk to nvme_mpath_remove_disk nvme: introduce multipath_always_on module param nvme-multipath: introduce delayed removal of the multipath head node nvme-pci: derive and better document max segments limits nvme-pci: use struct_size for allocation struct nvme_dev ... commit 92a251c3df8ea1991cd9fe00f1ab0cfce18d7711 Author: Jack Morgenstein Date: Wed May 21 14:36:02 2025 +0300 RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work The cited commit fixed a crash when cma_netevent_callback was called for a cma_id while work on that id from a previous call had not yet started. The work item was re-initialized in the second call, which corrupted the work item currently in the work queue. However, it left a problem when queue_work fails (because the item is still pending in the work queue from a previous call). In this case, cma_id_put (which is called in the work handler) is therefore not called. This results in a userspace process hang (zombie process). Fix this by calling cma_id_put() if queue_work fails. Fixes: 45f5dcdd0497 ("RDMA/cma: Fix workqueue crash in cma_netevent_work_handler") Link: https://patch.msgid.link/r/4f3640b501e48d0166f312a64fdadf72b059bd04.1747827103.git.leon@kernel.org Signed-off-by: Jack Morgenstein Signed-off-by: Feng Liu Reviewed-by: Vlad Dumitrescu Signed-off-by: Leon Romanovsky Reviewed-by: Sharath Srinivasan Reviewed-by: Kalesh AP Signed-off-by: Jason Gunthorpe commit ef2233850edc4cc0d5fc6136fcdb004a1ddfa7db Merge: 260ce16e579d37 0ff41df1cb268f Author: Jason Gunthorpe Date: Mon May 26 15:32:29 2025 -0300 Merge tag 'v6.15' into rdma.git for-next Following patches need the RDMA rc branch since we are past the RC cycle now. Merge conflicts resolved based on Linux-next: - For RXE odp changes keep for-next version and fixup new places that need to call is_odp_mr() https://lore.kernel.org/r/20250422143019.500201bd@canb.auug.org.au https://lore.kernel.org/r/20250514122455.3593b083@canb.auug.org.au - irdma is keeping the while/kfree bugfix from -rc and the pf/cdev_info change from for-next https://lore.kernel.org/r/20250513130630.280ee6c5@canb.auug.org.au Signed-off-by: Jason Gunthorpe commit 3e406741b19890c3d8a2ed126aa7c23b106ca9e1 Merge: a2e43397e57e94 7ec091c5598642 Author: Linus Torvalds Date: Mon May 26 11:32:28 2025 -0700 Merge tag 'vfs-6.16-rc1.selftests' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs selftests updates from Christian Brauner: "This contains various cleanups, fixes, and extensions for out filesystem selftests" * tag 'vfs-6.16-rc1.selftests' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: selftests/fs/mount-notify: add a test variant running inside userns selftests/filesystems: create setup_userns() helper selftests/filesystems: create get_unique_mnt_id() helper selftests/fs/mount-notify: build with tools include dir selftests/mount_settattr: remove duplicate syscall definitions selftests/pidfd: move syscall definitions into wrappers.h selftests/fs/statmount: build with tools include dir selftests/filesystems: move wrapper.h out of overlayfs subdir selftests/mount_settattr: ensure that ext4 filesystem can be created selftests/mount_settattr: add missing STATX_MNT_ID_UNIQUE define selftests/mount_settattr: don't define sys_open_tree() twice commit a2e43397e57e9451954b2a1d3bf4ac195ac185ad Merge: c5bfc48d5472fc 2cb0e96cb01b4d Author: Linus Torvalds Date: Mon May 26 11:28:42 2025 -0700 Merge tag 'vfs-6.16-rc1.iomap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull iomap updates from Christian Brauner: - More fallout and preparatory work associated with the folio batch prototype posted a while back. Mainly this just cleans up some of the helpers and pushes some pos/len trimming further down in the write begin path. - Add missing flag descriptions to the iomap documentation * tag 'vfs-6.16-rc1.iomap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: iomap: rework iomap_write_begin() to return folio offset and length iomap: push non-large folio check into get folio path iomap: helper to trim pos/bytes to within folio iomap: drop pos param from __iomap_[get|put]_folio() iomap: drop unnecessary pos param from iomap_write_[begin|end] iomap: resample iter->pos after iomap_write_begin() calls iomap: trace: Add missing flags to [IOMAP_|IOMAP_F_]FLAGS_STRINGS Documentation: iomap: Add missing flags description commit f34dc2834347301d4652464867f096048df546ff Merge: e481e10ab59c73 922607a2b462b8 Author: Rafael J. Wysocki Date: Mon May 26 20:19:40 2025 +0200 Merge branch 'pm-cpufreq' Merge cpufreq updates for 6.16-rc1: - Refactor cpufreq_online(), add and use cpufreq policy locking guards, use __free() in policy reference counting, and clean up core cpufreq code on top of that (Rafael Wysocki). - Fix boost handling on CPU suspend/resume and sysfs updates (Viresh Kumar). - Fix des_perf clamping with max_perf in amd_pstate_update() (Dhananjay Ugwekar). - Add offline, online and suspend callbacks to the amd-pstate driver, rename and use the existing amd_pstate_epp callbacks in it (Dhananjay Ugwekar). - Add support for the "Requested CPU Min frequency" BIOS option to the amd-pstate driver (Dhananjay Ugwekar). - Reset amd-pstate driver mode after running selftests (Swapnil Sapkal). - Add helper for governor checks to the schedutil cpufreq governor and move cpufreq-specific EAS checks to cpufreq (Rafael Wysocki). - Populate the cpu_capacity sysfs entries from the intel_pstate driver after registering asym capacity support (Ricardo Neri). - Add support for enabling Energy-aware scheduling (EAS) to the intel_pstate driver when operating in the passive mode on a hybrid platform (Rafael Wysocki). - Avoid shadowing ret in amd_pstate_ut_check_driver() (Nathan Chancellor). - Drop redundant cpus_read_lock() from store_local_boost() in the cpufreq core (Seyediman Seyedarab). - Replace sscanf() with kstrtouint() in the cpufreq code and use a symbol instead of a raw number in it (Bowen Yu). - Add support for autonomous CPU performance state selection to the CPPC cpufreq driver (Lifeng Zheng). * pm-cpufreq: (31 commits) cpufreq: CPPC: Add support for autonomous selection cpufreq: Update sscanf() to kstrtouint() cpufreq: Replace magic number cpufreq: drop redundant cpus_read_lock() from store_local_boost() cpufreq/amd-pstate: Avoid shadowing ret in amd_pstate_ut_check_driver() cpufreq: intel_pstate: Document hybrid processor support cpufreq: intel_pstate: EAS: Increase cost for CPUs using L3 cache cpufreq: intel_pstate: EAS support for hybrid platforms cpufreq: Drop policy locking from cpufreq_policy_is_good_for_eas() cpufreq: intel_pstate: Populate the cpu_capacity sysfs entries arch_topology: Relocate cpu_scale to topology.[h|c] cpufreq/sched: Move cpufreq-specific EAS checks to cpufreq cpufreq/sched: schedutil: Add helper for governor checks amd-pstate-ut: Reset amd-pstate driver mode after running selftests cpufreq/amd-pstate: Add support for the "Requested CPU Min frequency" BIOS option cpufreq/amd-pstate: Add offline, online and suspend callbacks for amd_pstate_driver cpufreq: Force sync policy boost with global boost on sysfs update cpufreq: Preserve policy's boost state after resume cpufreq: Introduce policy_set_boost() cpufreq: Don't unnecessarily call set_boost() ... commit c5bfc48d5472fc60abafb510668d7bc3b5ecb401 Merge: 7d7a103d299eb5 4e83ae6ec87ddd Author: Linus Torvalds Date: Mon May 26 11:17:01 2025 -0700 Merge tag 'vfs-6.16-rc1.coredump' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull coredump updates from Christian Brauner: "This adds support for sending coredumps over an AF_UNIX socket. It also makes (implicit) use of the new SO_PEERPIDFD ability to hand out pidfds for reaped peer tasks The new coredump socket will allow userspace to not have to rely on usermode helpers for processing coredumps and provides a saf way to handle them instead of relying on super privileged coredumping helpers This will also be significantly more lightweight since the kernel doens't have to do a fork()+exec() for each crashing process to spawn a usermodehelper. Instead the kernel just connects to the AF_UNIX socket and userspace can process it concurrently however it sees fit. Support for userspace is incoming starting with systemd-coredump There's more work coming in that direction next cycle. The rest below goes into some details and background Coredumping currently supports two modes: (1) Dumping directly into a file somewhere on the filesystem. (2) Dumping into a pipe connected to a usermode helper process spawned as a child of the system_unbound_wq or kthreadd For simplicity I'm mostly ignoring (1). There's probably still some users of (1) out there but processing coredumps in this way can be considered adventurous especially in the face of set*id binaries The most common option should be (2) by now. It works by allowing userspace to put a string into /proc/sys/kernel/core_pattern like: |/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h The "|" at the beginning indicates to the kernel that a pipe must be used. The path following the pipe indicator is a path to a binary that will be spawned as a usermode helper process. Any additional parameters pass information about the task that is generating the coredump to the binary that processes the coredump In the example the core_pattern shown causes the kernel to spawn systemd-coredump as a usermode helper. There's various conceptual consequences of this (non-exhaustive list): - systemd-coredump is spawned with file descriptor number 0 (stdin) connected to the read-end of the pipe. All other file descriptors are closed. That specifically includes 1 (stdout) and 2 (stderr). This has already caused bugs because userspace assumed that this cannot happen (Whether or not this is a sane assumption is irrelevant) - systemd-coredump will be spawned as a child of system_unbound_wq. So it is not a child of any userspace process and specifically not a child of PID 1. It cannot be waited upon and is in a weird hybrid upcall which are difficult for userspace to control correctly - systemd-coredump is spawned with full kernel privileges. This necessitates all kinds of weird privilege dropping excercises in userspace to make this safe - A new usermode helper has to be spawned for each crashing process This adds a new mode: (3) Dumping into an AF_UNIX socket Userspace can set /proc/sys/kernel/core_pattern to: @/path/to/coredump.socket The "@" at the beginning indicates to the kernel that an AF_UNIX coredump socket will be used to process coredumps The coredump socket must be located in the initial mount namespace. When a task coredumps it opens a client socket in the initial network namespace and connects to the coredump socket: - The coredump server uses SO_PEERPIDFD to get a stable handle on the connected crashing task. The retrieved pidfd will provide a stable reference even if the crashing task gets SIGKILLed while generating the coredump. That is a huge attack vector right now - By setting core_pipe_limit non-zero userspace can guarantee that the crashing task cannot be reaped behind it's back and thus process all necessary information in /proc/. The SO_PEERPIDFD can be used to detect whether /proc/ still refers to the same process The core_pipe_limit isn't used to rate-limit connections to the socket. This can simply be done via AF_UNIX socket directly - The pidfd for the crashing task will contain information how the task coredumps. The PIDFD_GET_INFO ioctl gained a new flag PIDFD_INFO_COREDUMP which can be used to retreive the coredump information If the coredump gets a new coredump client connection the kernel guarantees that PIDFD_INFO_COREDUMP information is available. Currently the following information is provided in the new @coredump_mask extension to struct pidfd_info: * PIDFD_COREDUMPED is raised if the task did actually coredump * PIDFD_COREDUMP_SKIP is raised if the task skipped coredumping (e.g., undumpable) * PIDFD_COREDUMP_USER is raised if this is a regular coredump and doesn't need special care by the coredump server * PIDFD_COREDUMP_ROOT is raised if the generated coredump should be treated as sensitive and the coredump server should restrict access to the generated coredump to sufficiently privileged users" * tag 'vfs-6.16-rc1.coredump' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: mips, net: ensure that SOCK_COREDUMP is defined selftests/coredump: add tests for AF_UNIX coredumps selftests/pidfd: add PIDFD_INFO_COREDUMP infrastructure coredump: validate socket name as it is written coredump: show supported coredump modes pidfs, coredump: add PIDFD_INFO_COREDUMP coredump: add coredump socket coredump: reflow dump helpers a little coredump: massage do_coredump() coredump: massage format_corename() commit e481e10ab59c73571595230fa2ca44f9ad1e0e17 Merge: ba09aae9400a1b 4a6b1cf0d4c02d Author: Rafael J. Wysocki Date: Mon May 26 20:14:58 2025 +0200 Merge branch 'pm-em' Merge energy model management code updates for 6.16-rc1: - Fix potential division-by-zero error in em_compute_costs() (Yaxiong Tian). - Fix typos in energy model documentation and example driver code (Moon Hee Lee, Atul Kumar Pant). - Rearrange the energy model management code and add a new function for adjusting a CPU energy model after adjusting the capacity of the given CPU to it (Rafael Wysocki). * pm-em: PM: EM: Introduce em_adjust_cpu_capacity() PM: EM: Move CPU capacity check to em_adjust_new_capacity() PM: EM: Documentation: Fix typos in example driver code PM: EM: Documentation: fix typo in energy-model.rst PM: EM: Fix potential division-by-zero error in em_compute_costs() commit db0e4d5429c909db9c252be59bd872ab628c78c6 Merge: f5b4df96ee890a 113e04276018bd dc918c34e2ac86 dd133162c9cff5 6db0261f3776bd Author: Rafael J. Wysocki Date: Mon May 26 19:42:29 2025 +0200 Merge branches 'acpi-resource', 'acpi-pm', 'acpi-platform-profile' and 'acpi-docs' Merge an ACPI resources management update, ACPI power management updates, an ACPI platform profile driver fix and an ACPI documentation update related to device properties for 6.16-rc1: - Fix a typo for MECHREVO in irq1_edge_low_force_override[] (Mingcong Bai). - Add an LPS0 check() callback to the AMD pinctrl driver and fix up config symbol dependencies in it (Mario Limonciello, Rafael Wysocki). - Avoid initializing the ACPI platform profile driver on non-ACPI platforms (Alexandre Ghiti). - Document that references to ACPI data (non-device) nodes should use string-only references in hierarchical data node packages (Sakari Ailus). * acpi-resource: ACPI: resource: fix a typo for MECHREVO in irq1_edge_low_force_override[] * acpi-pm: pinctrl: amd: Fix hibernation support with CONFIG_SUSPEND unset pinctrl: amd: Fix use of undeclared identifier 'pinctrl_amd_s2idle_dev_ops' pinctrl: amd: Add an LPS0 check() callback ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case * acpi-platform-profile: ACPI: platform_profile: Avoid initializing on non-ACPI platforms * acpi-docs: Documentation: ACPI: Use all-string data node references commit f5b4df96ee890a075b3004f913fea8d2143df7ca Merge: 0a17adc6be08c5 eba614b8280a97 234f71555019d3 9cd51eefae3c87 e54b1dc1c4f083 Author: Rafael J. Wysocki Date: Mon May 26 19:31:50 2025 +0200 Merge branches 'acpi-pci', 'acpi-battery', 'acpi-ec' and 'acpi-apei' Merge an ACPI PCI root driver update, ACPI battery driver updates, an ACPI EC driver update and APEI updates for 6.16-rc1: - Turn the acpi_pci_root_remap_iospace() fwnode_handle parameter into a const pointer (Pei Xiao). - Round battery capacity percengate in the ACPI battery driver to the closest integer to avoid user confusion (shitao). - Make the ACPI battery driver report the current as a negative number to the power supply framework when the battery is discharging as documented (Peter Marheine). - Add TUXEDO InfinityBook Pro AMD Gen9 to the acpi_ec_no_wakeup[] list to prevent spurious wakeups from suspend-to-idle (Werner Sembach). - Convert the APEI EINJ driver to a faux device one (Sudeep Holla, Jon Hunter). - Remove redundant calls to einj_get_available_error_type() from the APEI EINJ driver (Zaid Alali). * acpi-pci: ACPI: PCI: Constify fwnode_handle in acpi_pci_root_remap_iospace() * acpi-battery: ACPI: battery: negate current when discharging ACPI: battery: Round capacity percengate to closest integer * acpi-ec: ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list * acpi-apei: ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() ACPI: APEI: EINJ: Fix probe error message ACPI: APEI: EINJ: Transition to the faux device interface commit 7d7a103d299eb5b95d67873c5ea7db419eaaebc0 Merge: 2ca3534623f41d db56723ceaec87 Author: Linus Torvalds Date: Mon May 26 10:30:02 2025 -0700 Merge tag 'vfs-6.16-rc1.pidfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull pidfs updates from Christian Brauner: "Features: - Allow handing out pidfds for reaped tasks for AF_UNIX SO_PEERPIDFD socket option SO_PEERPIDFD is a socket option that allows to retrieve a pidfd for the process that called connect() or listen(). This is heavily used to safely authenticate clients in userspace avoiding security bugs due to pid recycling races (dbus, polkit, systemd, etc.) SO_PEERPIDFD currently doesn't support handing out pidfds if the sk->sk_peer_pid thread-group leader has already been reaped. In this case it currently returns EINVAL. Userspace still wants to get a pidfd for a reaped process to have a stable handle it can pass on. This is especially useful now that it is possible to retrieve exit information through a pidfd via the PIDFD_GET_INFO ioctl()'s PIDFD_INFO_EXIT flag Another summary has been provided by David Rheinsberg: > A pidfd can outlive the task it refers to, and thus user-space > must already be prepared that the task underlying a pidfd is > gone at the time they get their hands on the pidfd. For > instance, resolving the pidfd to a PID via the fdinfo must be > prepared to read `-1`. > > Despite user-space knowing that a pidfd might be stale, several > kernel APIs currently add another layer that checks for this. In > particular, SO_PEERPIDFD returns `EINVAL` if the peer-task was > already reaped, but returns a stale pidfd if the task is reaped > immediately after the respective alive-check. > > This has the unfortunate effect that user-space now has two ways > to check for the exact same scenario: A syscall might return > EINVAL/ESRCH/... *or* the pidfd might be stale, even though > there is no particular reason to distinguish both cases. This > also propagates through user-space APIs, which pass on pidfds. > They must be prepared to pass on `-1` *or* the pidfd, because > there is no guaranteed way to get a stale pidfd from the kernel. > > Userspace must already deal with a pidfd referring to a reaped > task as the task may exit and get reaped at any time will there > are still many pidfds referring to it In order to allow handing out reaped pidfd SO_PEERPIDFD needs to ensure that PIDFD_INFO_EXIT information is available whenever a pidfd for a reaped task is created by PIDFD_INFO_EXIT. The uapi promises that reaped pidfds are only handed out if it is guaranteed that the caller sees the exit information: TEST_F(pidfd_info, success_reaped) { struct pidfd_info info = { .mask = PIDFD_INFO_CGROUPID | PIDFD_INFO_EXIT, }; /* * Process has already been reaped and PIDFD_INFO_EXIT been set. * Verify that we can retrieve the exit status of the process. */ ASSERT_EQ(ioctl(self->child_pidfd4, PIDFD_GET_INFO, &info), 0); ASSERT_FALSE(!!(info.mask & PIDFD_INFO_CREDS)); ASSERT_TRUE(!!(info.mask & PIDFD_INFO_EXIT)); ASSERT_TRUE(WIFEXITED(info.exit_code)); ASSERT_EQ(WEXITSTATUS(info.exit_code), 0); } To hand out pidfds for reaped processes we thus allocate a pidfs entry for the relevant sk->sk_peer_pid at the time the sk->sk_peer_pid is stashed and drop it when the socket is destroyed. This guarantees that exit information will always be recorded for the sk->sk_peer_pid task and we can hand out pidfds for reaped processes - Hand a pidfd to the coredump usermode helper process Give userspace a way to instruct the kernel to install a pidfd for the crashing process into the process started as a usermode helper. There's still tricky race-windows that cannot be easily or sometimes not closed at all by userspace. There's various ways like looking at the start time of a process to make sure that the usermode helper process is started after the crashing process but it's all very very brittle and fraught with peril The crashed-but-not-reaped process can be killed by userspace before coredump processing programs like systemd-coredump have had time to manually open a PIDFD from the PID the kernel provides them, which means they can be tricked into reading from an arbitrary process, and they run with full privileges as they are usermode helper processes Even if that specific race-window wouldn't exist it's still the safest and cleanest way to let the kernel provide the pidfd directly instead of requiring userspace to do it manually. In parallel with this commit we already have systemd adding support for this in [1] When the usermode helper process is forked we install a pidfd file descriptor three into the usermode helper's file descriptor table so it's available to the exec'd program Since usermode helpers are either children of the system_unbound_wq workqueue or kthreadd we know that the file descriptor table is empty and can thus always use three as the file descriptor number Note, that we'll install a pidfd for the thread-group leader even if a subthread is calling do_coredump(). We know that task linkage hasn't been removed yet and even if this @current isn't the actual thread-group leader we know that the thread-group leader cannot be reaped until @current has exited - Allow telling when a task has not been found from finding the wrong task when creating a pidfd We currently report EINVAL whenever a struct pid has no tasked attached anymore thereby conflating two concepts: (1) The task has already been reaped (2) The caller requested a pidfd for a thread-group leader but the pid actually references a struct pid that isn't used as a thread-group leader This is causing issues for non-threaded workloads as in where they expect ESRCH to be reported, not EINVAL So allow userspace to reliably distinguish between (1) and (2) - Make it possible to detect when a pidfs entry would outlive the struct pid it pinned - Add a range of new selftests Cleanups: - Remove unneeded NULL check from pidfd_prepare() for passed struct pid - Avoid pointless reference count bump during release_task() Fixes: - Various fixes to the pidfd and coredump selftests - Fix error handling for replace_fd() when spawning coredump usermode helper" * tag 'vfs-6.16-rc1.pidfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: pidfs: detect refcount bugs coredump: hand a pidfd to the usermode coredump helper coredump: fix error handling for replace_fd() pidfs: move O_RDWR into pidfs_alloc_file() selftests: coredump: Raise timeout to 2 minutes selftests: coredump: Fix test failure for slow machines selftests: coredump: Properly initialize pointer net, pidfs: enable handing out pidfds for reaped sk->sk_peer_pid pidfs: get rid of __pidfd_prepare() net, pidfs: prepare for handing out pidfds for reaped sk->sk_peer_pid pidfs: register pid in pidfs net, pidfd: report EINVAL for ESRCH release_task: kill the no longer needed get/put_pid(thread_pid) pidfs: ensure consistent ENOENT/ESRCH reporting exit: move wake_up_all() pidfd waiters into __unhash_process() selftest/pidfd: add test for thread-group leader pidfd open for thread pidfd: improve uapi when task isn't found pidfd: remove unneeded NULL check from pidfd_prepare() selftests/pidfd: adapt to recent changes commit 45ca7e9f0730ae36fc610e675b990e9cc9ca0714 Author: Stefano Garzarella Date: Wed May 21 14:17:05 2025 +0200 vsock/virtio: fix `rx_bytes` accounting for stream sockets In `struct virtio_vsock_sock`, we maintain two counters: - `rx_bytes`: used internally to track how many bytes have been read. This supports mechanisms like .stream_has_data() and sock_rcvlowat(). - `fwd_cnt`: used for the credit mechanism to inform available receive buffer space to the remote peer. These counters are updated via virtio_transport_inc_rx_pkt() and virtio_transport_dec_rx_pkt(). Since the beginning with commit 06a8fc78367d ("VSOCK: Introduce virtio_vsock_common.ko"), we call virtio_transport_dec_rx_pkt() in virtio_transport_stream_do_dequeue() only when we consume the entire packet, so partial reads, do not update `rx_bytes` and `fwd_cnt`. This is fine for `fwd_cnt`, because we still have space used for the entire packet, and we don't want to update the credit for the other peer until we free the space of the entire packet. However, this causes `rx_bytes` to be stale on partial reads. Previously, this didn’t cause issues because `rx_bytes` was used only by .stream_has_data(), and any unread portion of a packet implied data was still available. However, since commit 93b808876682 ("virtio/vsock: fix logic which reduces credit update messages"), we now rely on `rx_bytes` to determine if a credit update should be sent when the data in the RX queue drops below SO_RCVLOWAT value. This patch fixes the accounting by updating `rx_bytes` with the number of bytes actually read, even on partial reads, while leaving `fwd_cnt` untouched until the packet is fully consumed. Also introduce a new `buf_used` counter to check that the remote peer is honoring the given credit; this was previously done via `rx_bytes`. Fixes: 93b808876682 ("virtio/vsock: fix logic which reduces credit update messages") Signed-off-by: Stefano Garzarella Link: https://patch.msgid.link/20250521121705.196379-1-sgarzare@redhat.com Signed-off-by: Paolo Abeni commit 2ca3534623f41dd0398c9f1cbc47fb874653c7cf Merge: 8dd53535f1e129 2b3c61b87519ff Author: Linus Torvalds Date: Mon May 26 09:55:56 2025 -0700 Merge tag 'vfs-6.16-rc1.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs mount updates from Christian Brauner: "This contains minor mount updates for this cycle: - mnt->mnt_devname can never be NULL so simplify the code handling that case - Add a comment about concurrent changes during statmount() and listmount() - Update the STATMOUNT_SUPPORTED macro - Convert mount flags to an enum" * tag 'vfs-6.16-rc1.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: statmount: update STATMOUNT_SUPPORTED macro fs: convert mount flags to enum ->mnt_devname is never NULL mount: add a comment about concurrent changes with statmount()/listmount() commit f5b60d6a575a7573a15e08aad129382aa39c228c Merge: fdb061195f53e5 73db1b5dab6fe1 Author: Paolo Abeni Date: Mon May 26 18:53:40 2025 +0200 Merge tag 'nf-next-25-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next Pablo Neira Ayuso says: ==================== Netfilter updates for net-next The following batch contains Netfilter updates for net-next, specifically 26 patches: 5 patches adding/updating selftests, 4 fixes, 3 PREEMPT_RT fixes, and 14 patches to enhance nf_tables): 1) Improve selftest coverage for pipapo 4 bit group format, from Florian Westphal. 2) Fix incorrect dependencies when compiling a kernel without legacy ip{6}tables support, also from Florian. 3) Two patches to fix nft_fib vrf issues, including selftest updates to improve coverage, also from Florian Westphal. 4) Fix incorrect nesting in nft_tunnel's GENEVE support, from Fernando F. Mancera. 5) Three patches to fix PREEMPT_RT issues with nf_dup infrastructure and nft_inner to match in inner headers, from Sebastian Andrzej Siewior. 6) Integrate conntrack information into nft trace infrastructure, from Florian Westphal. 7) A series of 13 patches to allow to specify wildcard netdevice in netdev basechain and flowtables, eg. table netdev filter { chain ingress { type filter hook ingress devices = { eth0, eth1, vlan* } priority 0; policy accept; } } This also allows for runtime hook registration on NETDEV_{UN}REGISTER event, from Phil Sutter. netfilter pull request 25-05-23 * tag 'nf-next-25-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: (26 commits) selftests: netfilter: Torture nftables netdev hooks netfilter: nf_tables: Add notifications for hook changes netfilter: nf_tables: Support wildcard netdev hook specs netfilter: nf_tables: Sort labels in nft_netdev_hook_alloc() netfilter: nf_tables: Handle NETDEV_CHANGENAME events netfilter: nf_tables: Wrap netdev notifiers netfilter: nf_tables: Respect NETDEV_REGISTER events netfilter: nf_tables: Prepare for handling NETDEV_REGISTER events netfilter: nf_tables: Have a list of nf_hook_ops in nft_hook netfilter: nf_tables: Pass nf_hook_ops to nft_unregister_flowtable_hook() netfilter: nf_tables: Introduce nft_register_flowtable_ops() netfilter: nf_tables: Introduce nft_hook_find_ops{,_rcu}() netfilter: nf_tables: Introduce functions freeing nft_hook objects netfilter: nf_tables: add packets conntrack state to debug trace info netfilter: conntrack: make nf_conntrack_id callable without a module dependency netfilter: nf_dup_netdev: Move the recursion counter struct netdev_xmit netfilter: nft_inner: Use nested-BH locking for nft_pcpu_tun_ctx netfilter: nf_dup{4, 6}: Move duplication check to task_struct netfilter: nft_tunnel: fix geneve_opt dump selftests: netfilter: nft_fib.sh: add type and oif tests with and without VRFs ... ==================== Link: https://patch.msgid.link/20250523132712.458507-1-pablo@netfilter.org Signed-off-by: Paolo Abeni commit 0a17adc6be08c55467df96a49bc0e74d09010a84 Merge: 5349b0051b12d6 0edd1d13de5eb3 f35e5b3ccfd351 Author: Rafael J. Wysocki Date: Mon May 26 18:37:38 2025 +0200 Merge branches 'acpi-processor' and 'acpi-cppc' Merge ACPI processor driver updates and ACPI CPPC library updates for 6.16-rc1: - Clean up the initialization of CPU data structures in the ACPI processor driver (Zhang Rui). - Remove an obsolete comment regarding the C-states handling in the ACPI processor driver (Giovanni Gherdovich). - Simplify PCC shared memory region handling (Sudeep Holla). - Rework and extend functions for reading CPPC register values and for updating CPPC registers (Lifeng Zheng). - Add three functions related to autonomous CPU performance state selection to the CPPC library (Lifeng Zheng). * acpi-processor: ACPI: processor: idle: Remove redundant pr->power.count assignment ACPI: processor: idle: Set pr->flags.power unconditionally ACPI: processor: idle: Remove obsolete comment * acpi-cppc: ACPI: CPPC: Add three functions related to autonomous selection ACPI: CPPC: Modify cppc_get_auto_sel_caps() to cppc_get_auto_sel() ACPI: CPPC: Refactor register value get and set ABIs ACPI: CPPC: Add cppc_set_reg_val() ACPI: CPPC: Extract cppc_get_reg_val_in_pcc() ACPI: CPPC: Rename cppc_get_perf() to cppc_get_reg_val() ACPI: CPPC: Optimize cppc_get_perf() ACPI: CPPC: Add IS_OPTIONAL_CPC_REG macro to judge if a cpc_reg is optional ACPI: CPPC: Simplify PCC shared memory region handling ACPI: PCC: Simplify PCC shared memory region handling commit 5349b0051b12d6f774d9ebd9846eba96d39c8af4 Merge: 57356d98c0a5ac 059717c2ba1f74 Author: Rafael J. Wysocki Date: Mon May 26 18:36:39 2025 +0200 Merge branch 'acpi-tables' Merge updates related to the handling of static (data-only) ACPI tables for 6.16-rc1: - Add __nonstring annotations for unterminated strings in the static ACPI tables parsing code (Kees Cook). - Add support for parsing the MRRM ACPI table and sysfs files to describe memory regions listed in it (Tony Luck, Anil Keshavamurthy). - Remove an (explicitly) unused header file include from the VIOT ACPI table parser file (Andy Shevchenko). - Improve logging around acpi_initialize_tables() (Bartosz Szczepanek). * acpi-tables: ACPI: MRRM: Fix default max memory region ACPI: tables: Improve logging around acpi_initialize_tables() ACPI: VIOT: Remove (explicitly) unused header ACPI: Add documentation for exposing MRRM data ACPI: MRRM: Add /sys files to describe memory ranges ACPI: MRRM: Minimal parse of ACPI MRRM table ACPI: tables: Add __nonstring annotations for unterminated strings commit 57356d98c0a5acf49cdafab7894248f29694b08d Merge: 94a370fc8def60 0e9fd691a70265 Author: Rafael J. Wysocki Date: Mon May 26 18:35:01 2025 +0200 Merge branch 'acpica' Merge ACPICA updates, including two upstream releases 20241212 and 20250404, for 6.16-rc1: - Fix two ACPICA SLAB cache leaks (Seunghun Han). - Add EINJv2 get error type action and define Error Injection Actions in hex values to avoid inconsistencies between the specification and the code (Zaid Alali). - Fix typo in comments for SRAT structures (Adam Lackorzynski). - Prevent possible loss of data in ACPICA because of u32 to u8 conversions (Saket Dumbre). - Fix reading FFixedHW operation regions in ACPICA (Daniil Tatianin). - Add support for printing AML arguments when the ACPICA debug level is ACPI_LV_TRACE_POINT (Mario Limonciello). - Drop a stale comment about the file content from actbl2.h (Sudeep Holla). - Apply pack(1) to union aml_resource (Tamir Duberstein). - Fix overflow check in the ACPICA version of vsnprintf() (gldrk). - Interpret SIDP structures in DMAR added revision 3.4 of the VT-d specification (Alexey Neyman). - Add typedef and other definitions related to MRRM to ACPICA (Tony Luck). - Add definitions for RIMT to ACPICA (Sunil V L). - Fix spelling mistake "Incremement" -> "Increment" in the ACPICA utilities code (Colin Ian King). - Add typedef and other definitions for ERDT to ACPICA (Tony Luck). - Introduce ACPI_NONSTRING and use it (Kees Cook, Ahmed Salem). - Rename structure and field names of the RAS2 table in actbl2.h (Shiju Jose). - Fix up whitespace in acpica/utcache.c (Zhe Qiao). - Avoid sequence overread in a call to strncmp() in ap_get_table_length() and replace strncpy() with memcpy() in ACPICA in some places (Ahmed Salem). - Update copyright year in all ACPICA files (Saket Dumbre). * acpica: (30 commits) ACPICA: Update copyright year ACPICA: Logfile: Changes for version 20250404 ACPICA: Replace strncpy() with memcpy() ACPICA: Apply ACPI_NONSTRING in more places ACPICA: Avoid sequence overread in call to strncmp() ACPICA: Adjust the position of code lines ACPICA: actbl2.h: ACPI 6.5: RAS2: Rename structure and field names of the RAS2 table ACPICA: Apply ACPI_NONSTRING ACPICA: Introduce ACPI_NONSTRING ACPICA: actbl2.h: ERDT: Add typedef and other definitions ACPICA: infrastructure: Add new DMT_BUF types and shorten a long name ACPICA: Utilities: Fix spelling mistake "Incremement" -> "Increment" ACPICA: MRRM: Some cleanups ACPICA: actbl2: Add definitions for RIMT ACPICA: actbl2.h: MRRM: Add typedef and other definitions ACPICA: infrastructure: Add new header and ACPI_DMT_BUF26 types ACPICA: Interpret SIDP structures in DMAR ACPICA: utilities: Fix overflow check in vsnprintf() ACPICA: Apply pack(1) to union aml_resource ACPICA: Drop stale comment about the header file content ... commit 8dd53535f1e129b7d75c512dc271bff76461ab6b Merge: 181d8e399f50c0 1afe9e7da8c0ab Author: Linus Torvalds Date: Mon May 26 09:33:44 2025 -0700 Merge tag 'vfs-6.16-rc1.super' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs freezing updates from Christian Brauner: "This contains various filesystem freezing related work for this cycle: - Allow the power subsystem to support filesystem freeze for suspend and hibernate. Now all the pieces are in place to actually allow the power subsystem to freeze/thaw filesystems during suspend/resume. Filesystems are only frozen and thawed if the power subsystem does actually own the freeze. If the filesystem is already frozen by the time we've frozen all userspace processes we don't care to freeze it again. That's userspace's job once the process resumes. We only actually freeze filesystems if we absolutely have to and we ignore other failures to freeze. We could bubble up errors and fail suspend/resume if the error isn't EBUSY (aka it's already frozen) but I don't think that this is worth it. Filesystem freezing during suspend/resume is best-effort. If the user has 500 ext4 filesystems mounted and 4 fail to freeze for whatever reason then we simply skip them. What we have now is already a big improvement and let's see how we fare with it before making our lives even harder (and uglier) than we have to. - Allow efivars to support freeze and thaw Allow efivarfs to partake to resync variable state during system hibernation and suspend. Add freeze/thaw support. This is a pretty straightforward implementation. We simply add regular freeze/thaw support for both userspace and the kernel. efivars is the first pseudofilesystem that adds support for filesystem freezing and thawing. The simplicity comes from the fact that we simply always resync variable state after efivarfs has been frozen. It doesn't matter whether that's because of suspend, userspace initiated freeze or hibernation. Efivars is simple enough that it doesn't matter that we walk all dentries. There are no directories and there aren't insane amounts of entries and both freeze/thaw are already heavy-handed operations. If userspace initiated a freeze/thaw cycle they would need CAP_SYS_ADMIN in the initial user namespace (as that's where efivarfs is mounted) so it can't be triggered by random userspace. IOW, we really really don't care" * tag 'vfs-6.16-rc1.super' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: f2fs: fix freezing filesystem during resize kernfs: add warning about implementing freeze/thaw efivarfs: support freeze/thaw power: freeze filesystems during suspend/resume libfs: export find_next_child() super: add filesystem freezing helpers for suspend and hibernate gfs2: pass through holder from the VFS for freeze/thaw super: use common iterator (Part 2) super: use a common iterator (Part 1) super: skip dying superblocks early super: simplify user_get_super() super: remove pointless s_root checks fs: allow all writers to be frozen locking/percpu-rwsem: add freezable alternative to down_read commit fdb061195f53e5b6d12595fc32a1a9c1130f0c23 Merge: 34d26315db39d2 e7a37c9e428a29 Author: Paolo Abeni Date: Mon May 26 18:30:47 2025 +0200 Merge tag 'ipsec-next-2025-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next Steffen Klassert says: ==================== 1) Remove some unnecessary strscpy_pad() size arguments. From Thorsten Blum. 2) Correct use of xso.real_dev on bonding offloads. Patchset from Cosmin Ratiu. 3) Add hardware offload configuration to XFRM_MSG_MIGRATE. From Chiachang Wang. 4) Refactor migration setup during cloning. This was done after the clone was created. Now it is done in the cloning function itself. From Chiachang Wang. 5) Validate assignment of maximal possible SEQ number. Prevent from setting to the maximum sequrnce number as this would cause for traffic drop. From Leon Romanovsky. 6) Prevent configuration of interface index when offload is used. Hardware can't handle this case.i From Leon Romanovsky. 7) Always use kfree_sensitive() for SA secret zeroization. From Zilin Guan. ipsec-next-2025-05-23 * tag 'ipsec-next-2025-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next: xfrm: use kfree_sensitive() for SA secret zeroization xfrm: prevent configuration of interface index when offload is used xfrm: validate assignment of maximal possible SEQ number xfrm: Refactor migration setup during the cloning process xfrm: Migrate offload configuration bonding: Fix multiple long standing offload races bonding: Mark active offloaded xfrm_states xfrm: Add explicit dev to .xdo_dev_state_{add,delete,free} xfrm: Remove unneeded device check from validate_xmit_xfrm xfrm: Use xdo.dev instead of xdo.real_dev net/mlx5: Avoid using xso.real_dev unnecessarily xfrm: Remove unnecessary strscpy_pad() size arguments ==================== Link: https://patch.msgid.link/20250523075611.3723340-1-steffen.klassert@secunet.com Signed-off-by: Paolo Abeni commit 34d26315db39d26666736478f8ea0ed9dae5418a Merge: 0a9b2c9fd1688c 3e20585abf2233 Author: Paolo Abeni Date: Mon May 26 18:11:23 2025 +0200 Merge tag 'linux-can-next-for-6.16-20250522' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next Marc Kleine-Budde says: ==================== pull-request: can-next 2025-05-22 this is a pull request of 22 patches for net-next/main. The series by Biju Das contains 19 patches and adds RZ/G3E CANFD support to the rcar_canfd driver. The patch by Vincent Mailhol adds a struct data_bittiming_params to group FD parameters as a preparation patch for CAN-XL support. Felix Maurer's patch imports tst-filter from can-tests into the kernel self tests and Vincent Mailhol adds support for physical CAN interfaces. linux-can-next-for-6.16-20250522 * tag 'linux-can-next-for-6.16-20250522' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next: (22 commits) selftests: can: test_raw_filter.sh: add support of physical interfaces selftests: can: Import tst-filter from can-tests can: dev: add struct data_bittiming_params to group FD parameters can: rcar_canfd: Add RZ/G3E support can: rcar_canfd: Enhance multi_channel_irqs handling can: rcar_canfd: Add external_clk variable to struct rcar_canfd_hw_info can: rcar_canfd: Add sh variable to struct rcar_canfd_hw_info can: rcar_canfd: Add struct rcanfd_regs variable to struct rcar_canfd_hw_info can: rcar_canfd: Add shared_can_regs variable to struct rcar_canfd_hw_info can: rcar_canfd: Add ch_interface_mode variable to struct rcar_canfd_hw_info can: rcar_canfd: Add {nom,data}_bittiming variables to struct rcar_canfd_hw_info can: rcar_canfd: Add max_cftml variable to struct rcar_canfd_hw_info can: rcar_canfd: Add max_aflpn variable to struct rcar_canfd_hw_info can: rcar_canfd: Add rnc_field_width variable to struct rcar_canfd_hw_info can: rcar_canfd: Update RCANFD_GAFLCFG macro can: rcar_canfd: Add rcar_canfd_setrnc() can: rcar_canfd: Drop the mask operation in RCANFD_GAFLCFG_SETRNC macro can: rcar_canfd: Update RCANFD_GERFL_ERR macro can: rcar_canfd: Drop RCANFD_GAFLCFG_GETRNC macro can: rcar_canfd: Use of_get_available_child_by_name() ... ==================== Link: https://patch.msgid.link/20250522084128.501049-1-mkl@pengutronix.de Signed-off-by: Paolo Abeni commit ba5cb47b56e5d89f0a5eb5163ffbfda1e3e7cef0 Author: Subbaraya Sundeep Date: Wed May 21 16:00:43 2025 +0530 octeontx2-af: Send Link events one by one Send link events one after another otherwise new message is overwriting the message which is being processed by PF. Fixes: a88e0f936ba9 ("octeontx2: Detect the mbox up or down message via register") Signed-off-by: Subbaraya Sundeep Reviewed-by: Michal Swiatkowski Reviewed-by: Simon Horman Link: https://patch.msgid.link/1747823443-404-1-git-send-email-sbhatta@marvell.com Signed-off-by: Paolo Abeni commit 4bf7b97eb390f0a0730572101e0ce3367d31a770 Author: Patrick Miller Date: Wed Oct 2 02:28:48 2024 +0000 rust: make section names plural Clean Rust documentation section headers to use plural names. Suggested-by: Miguel Ojeda Link: https://github.com/Rust-for-Linux/linux/issues/1110 Signed-off-by: Patrick Miller Link: https://lore.kernel.org/r/20241002022749.390836-1-paddymills@proton.me [ Removed the `init` one that doesn't apply anymore and reworded slightly. - Miguel ] Signed-off-by: Miguel Ojeda commit 181d8e399f50c0683b12d40432bb6e1ca5c58d37 Merge: a1ae8ce78bb260 76145cb37ff063 Author: Linus Torvalds Date: Mon May 26 09:02:39 2025 -0700 Merge tag 'vfs-6.16-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull misc vfs updates from Christian Brauner: "This contains the usual selections of misc updates for this cycle. Features: - Use folios for symlinks in the page cache FUSE already uses folios for its symlinks. Mirror that conversion in the generic code and the NFS code. That lets us get rid of a few folio->page->folio conversions in this path, and some of the few remaining users of read_cache_page() / read_mapping_page() - Try and make a few filesystem operations killable on the VFS inode->i_mutex level - Add sysctl vfs_cache_pressure_denom for bulk file operations Some workloads need to preserve more dentries than we currently allow through out sysctl interface A HDFS servers with 12 HDDs per server, on a HDFS datanode startup involves scanning all files and caching their metadata (including dentries and inodes) in memory. Each HDD contains approximately 2 million files, resulting in a total of ~20 million cached dentries after initialization To minimize dentry reclamation, they set vfs_cache_pressure to 1. Despite this configuration, memory pressure conditions can still trigger reclamation of up to 50% of cached dentries, reducing the cache from 20 million to approximately 10 million entries. During the subsequent cache rebuild period, any HDFS datanode restart operation incurs substantial latency penalties until full cache recovery completes To maintain service stability, more dentries need to be preserved during memory reclamation. The current minimum reclaim ratio (1/100 of total dentries) remains too aggressive for such workload. This patch introduces vfs_cache_pressure_denom for more granular cache pressure control The configuration [vfs_cache_pressure=1, vfs_cache_pressure_denom=10000] effectively maintains the full 20 million dentry cache under memory pressure, preventing datanode restart performance degradation - Avoid some jumps in inode_permission() using likely()/unlikely() - Avid a memory access which is most likely a cache miss when descending into devcgroup_inode_permission() - Add fastpath predicts for stat() and fdput() - Anonymous inodes currently don't come with a proper mode causing issues in the kernel when we want to add useful VFS debug assert. Fix that by giving them a proper mode and masking it off when we report it to userspace which relies on them not having any mode - Anonymous inodes currently allow to change inode attributes because the VFS falls back to simple_setattr() if i_op->setattr isn't implemented. This means the ownership and mode for every single user of anon_inode_inode can be changed. Block that as it's either useless or actively harmful. If specific ownership is needed the respective subsystem should allocate anonymous inodes from their own private superblock - Raise SB_I_NODEV and SB_I_NOEXEC on the anonymous inode superblock - Add proper tests for anonymous inode behavior - Make it easy to detect proper anonymous inodes and to ensure that we can detect them in codepaths such as readahead() Cleanups: - Port pidfs to the new anon_inode_{g,s}etattr() helpers - Try to remove the uselib() system call - Add unlikely branch hint return path for poll - Add unlikely branch hint on return path for core_sys_select - Don't allow signals to interrupt getdents copying for fuse - Provide a size hint to dir_context for during readdir() - Use writeback_iter directly in mpage_writepages - Update compression and mtime descriptions in initramfs documentation - Update main netfs API document - Remove useless plus one in super_cache_scan() - Remove unnecessary NULL-check guards during setns() - Add separate separate {get,put}_cgroup_ns no-op cases Fixes: - Fix typo in root= kernel parameter description - Use KERN_INFO for infof()|info_plog()|infofc() - Correct comments of fs_validate_description() - Mark an unlikely if condition with unlikely() in vfs_parse_monolithic_sep() - Delete macro fsparam_u32hex() - Remove unused and problematic validate_constant_table() - Fix potential unsigned integer underflow in fs_name() - Make file-nr output the total allocated file handles" * tag 'vfs-6.16-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (43 commits) fs: Pass a folio to page_put_link() nfs: Use a folio in nfs_get_link() fs: Convert __page_get_link() to use a folio fs/read_write: make default_llseek() killable fs/open: make do_truncate() killable fs/open: make chmod_common() and chown_common() killable include/linux/fs.h: add inode_lock_killable() readdir: supply dir_context.count as readdir buffer size hint vfs: Add sysctl vfs_cache_pressure_denom for bulk file operations fuse: don't allow signals to interrupt getdents copying Documentation: fix typo in root= kernel parameter description include/cgroup: separate {get,put}_cgroup_ns no-op case kernel/nsproxy: remove unnecessary guards fs: use writeback_iter directly in mpage_writepages fs: remove useless plus one in super_cache_scan() fs: add S_ANON_INODE fs: remove uselib() system call device_cgroup: avoid access to ->i_rdev in the common case in devcgroup_inode_permission() fs/fs_parse: Remove unused and problematic validate_constant_table() fs: touch up predicts in inode_permission() ... commit a1ae8ce78bb2600490d49a8f1ee88767b0e64381 Merge: dc762851444b32 759cfedc5ee7e5 Author: Linus Torvalds Date: Mon May 26 08:46:59 2025 -0700 Merge tag 'vfs-6.16-rc1.mount.api' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs mount api conversions from Christian Brauner: "This converts the bfs and omfs filesystems to the new mount api" * tag 'vfs-6.16-rc1.mount.api' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: omfs: convert to new mount API bfs: convert bfs to use the new mount api commit eb71feaacaaca227ae8f91c8578cf831553c5ab5 Author: Benno Lossin Date: Sun May 25 19:34:45 2025 +0200 rust: list: fix path of `assert_pinned!` Commit dbd5058ba60c ("rust: make pin-init its own crate") moved all items from pin-init into the pin-init crate, including the `assert_pinned!` macro. Thus fix the path of the sole user of the `assert_pinned!` macro. This occurrence was missed in the commit above, since it is in a macro rule that has no current users (although binder is a future user). Cc: stable@kernel.org Fixes: dbd5058ba60c ("rust: make pin-init its own crate") Signed-off-by: Benno Lossin Link: https://lore.kernel.org/r/20250525173450.853413-1-lossin@kernel.org [ Reworded slightly as discussed in the list. - Miguel ] Signed-off-by: Miguel Ojeda commit 0a9b2c9fd1688c7ecbff0702855577a3f8eef1df Author: Jeremy Kerr Date: Wed May 21 17:33:36 2025 +0800 net: mctp: use nlmsg_payload() for netlink message data extraction Jakub suggests: > I have a different request :) Matt, once this ends up in net-next > (end of this week) could you refactor it to use nlmsg_payload() ? > It doesn't exist in net but this is exactly why it was added. This refactors the additions to both mctp_dump_addrinfo(), and mctp_rtm_getneigh() - two cases where we're calling nlh_data() on an an incoming netlink message, without a prior nlmsg_parse(). For the neigh.c case, we cannot hit the failure where the nlh does not contain a full ndmsg at present, as the core handler (net/core/neighbour.c, neigh_get()) has already validated the size through neigh_valid_req_get(), and would have failed the get operation before the MCTP hander is called. However, relying on that is a bit fragile, so apply the nlmsg_payload refector here too. Reviewed-by: Simon Horman Signed-off-by: Jeremy Kerr Link: https://patch.msgid.link/20250521-mctp-nlmsg-payload-v2-1-e85df160c405@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 31eaaa5cb5e3a11290e037dbe00c90eb9f48b78a Merge: e272bbc9bf3716 c683e378c0907e Author: Paolo Abeni Date: Mon May 26 17:32:58 2025 +0200 Merge branch 'add-the-capability-to-consume-sram-for-hwfd-descriptor-queue-in-airoha_eth-driver' Lorenzo Bianconi says: ==================== Add the capability to consume SRAM for hwfd descriptor queue in airoha_eth driver In order to improve packet processing and packet forwarding performances, EN7581 SoC supports consuming SRAM instead of DRAM for hw forwarding descriptors queue. For downlink hw accelerated traffic request to consume SRAM memory for hw forwarding descriptors queue. Moreover, in some configurations QDMA blocks require a contiguous block of system memory for hwfd buffers queue. Introduce the capability to allocate hw buffers forwarding queue via the reserved-memory DTS property instead of running dmam_alloc_coherent(). v2: https://lore.kernel.org/r/20250509-airopha-desc-sram-v2-0-9dc3d8076dfb@kernel.org v1: https://lore.kernel.org/r/20250507-airopha-desc-sram-v1-0-d42037431bfa@kernel.org ==================== Link: https://patch.msgid.link/20250521-airopha-desc-sram-v3-0-a6e9b085b4f0@kernel.org Signed-off-by: Paolo Abeni commit c683e378c0907e66cee939145edf936c254ff1e3 Author: Lorenzo Bianconi Date: Wed May 21 09:16:39 2025 +0200 net: airoha: Add the capability to allocate hfwd descriptors in SRAM In order to improve packet processing and packet forwarding performances, EN7581 SoC supports consuming SRAM instead of DRAM for hw forwarding descriptors queue. For downlink hw accelerated traffic request to consume SRAM memory for hw forwarding descriptors queue. Signed-off-by: Lorenzo Bianconi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250521-airopha-desc-sram-v3-4-a6e9b085b4f0@kernel.org Signed-off-by: Paolo Abeni commit 3a1ce9e3d01bbf3912c3e3f81cb554d558eb715b Author: Lorenzo Bianconi Date: Wed May 21 09:16:38 2025 +0200 net: airoha: Add the capability to allocate hwfd buffers via reserved-memory In some configurations QDMA blocks require a contiguous block of system memory for hwfd buffers queue. Introduce the capability to allocate hw buffers forwarding queue via the reserved-memory DTS property instead of running dmam_alloc_coherent(). Signed-off-by: Lorenzo Bianconi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250521-airopha-desc-sram-v3-3-a6e9b085b4f0@kernel.org Signed-off-by: Paolo Abeni commit 09aa788f98da3e2f41ce158cc691d6d52e808bc9 Author: Lorenzo Bianconi Date: Wed May 21 09:16:37 2025 +0200 net: airoha: Do not store hfwd references in airoha_qdma struct Since hfwd descriptor and buffer queues are allocated via dmam_alloc_coherent() we do not need to store their references in airoha_qdma struct. This patch does not introduce any logical changes, just code clean-up. Signed-off-by: Lorenzo Bianconi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250521-airopha-desc-sram-v3-2-a6e9b085b4f0@kernel.org Signed-off-by: Paolo Abeni commit 2d13b45f8086a7142260cf19f4976b1e767fdcec Author: Lorenzo Bianconi Date: Wed May 21 09:16:36 2025 +0200 dt-bindings: net: airoha: Add EN7581 memory-region property Introduce memory-region and memory-region-names properties for the ethernet node available on EN7581 SoC in order to reserve system memory for hw forwarding buffers queue used by the QDMA modules. Signed-off-by: Lorenzo Bianconi Acked-by: Conor Dooley Link: https://patch.msgid.link/20250521-airopha-desc-sram-v3-1-a6e9b085b4f0@kernel.org Signed-off-by: Paolo Abeni commit e272bbc9bf3716be58e7a4b2296213c1218b2923 Merge: e8c35bfce4c131 cdae5bccab29a8 Author: Paolo Abeni Date: Mon May 26 17:25:45 2025 +0200 Merge branch 'add-functions-for-txgbe-aml-devices' Jiawen Wu says: ==================== Support phylink and link/gpio irqs for AML 25G/10G devices, and complete PTP and SRIOV. ==================== Link: https://patch.msgid.link/ Signed-off-by: Paolo Abeni commit cdae5bccab29a8e7810b682e886dfd8cd5a52ff3 Author: Jiawen Wu Date: Wed May 21 14:44:02 2025 +0800 net: txgbe: Implement SRIOV for AML devices Since .mac_link_up and .mac_link_down are changed for AML 25G/10G NICs, the SR-IOV related function should be invoked in these new functions, to bring VFs link up. Signed-off-by: Jiawen Wu Link: https://patch.msgid.link/BA8B302B7AAB6EA6+20250521064402.22348-10-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni commit 182af02690fbb3ba1015cba1e5e758d2ecab94f0 Author: Jiawen Wu Date: Wed May 21 14:44:01 2025 +0800 net: txgbe: Implement PTP for AML devices Support PTP clock and 1PPS output signal for AML devices. Signed-off-by: Jiawen Wu Link: https://patch.msgid.link/F2F6E5E8899D2C20+20250521064402.22348-9-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni commit d84a3ff9aae815c51c40b9b61e1bf26b7256eebf Author: Jiawen Wu Date: Wed May 21 14:44:00 2025 +0800 net: txgbe: Restrict the use of mismatched FW versions The new added mailbox commands require a new released firmware version. Otherwise, a lot of logs "Unknown FW command" would be printed. And the devices may not work properly. So add the test command in the probe function. Signed-off-by: Jiawen Wu Reviewed-by: Simon Horman Link: https://patch.msgid.link/18283F17BE0FA335+20250521064402.22348-8-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni commit c0f2e5113e2f073e88ea18e8912a9ee2558a0d6f Author: Jiawen Wu Date: Wed May 21 14:43:59 2025 +0800 net: txgbe: Correct the currect link settings For AML 25G/10G devices, some of the information returned from phylink_ethtool_ksettings_get() is not correct, since there is a fixed-link mode. So add additional corrections. Signed-off-by: Jiawen Wu Reviewed-by: Simon Horman Link: https://patch.msgid.link/C94BF867617C544D+20250521064402.22348-7-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni commit 343929799ace121cd9b795c526b2ad7aefe54458 Author: Jiawen Wu Date: Wed May 21 14:43:58 2025 +0800 net: txgbe: Support to handle GPIO IRQs for AML devices The driver needs to handle GPIO interrupts to identify SFP module and configure PHY by sending mailbox messages to firmware. Since the SFP module needs to wait for ready to get information when it is inserted, workqueue is added to handle delayed tasks. And each SW-FW interaction takes time to wait, so they are processed in the workqueue instead of IRQ handler function. Signed-off-by: Jiawen Wu Reviewed-by: Simon Horman Link: https://patch.msgid.link/399624AF221E8E28+20250521064402.22348-6-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni commit 6f8b4c01a8cd989a08a2eb6aab87e899ee450f93 Author: Jiawen Wu Date: Wed May 21 14:43:57 2025 +0800 net: txgbe: Implement PHYLINK for AML 25G/10G devices There is a new PHY attached to AML 25G/10G NIC, which is different from SP 10G/1G NIC. But the PHY configuration is handed over to firmware, and also I2C is controlled by firmware. So the different PHYLINK fixed-link mode is added for these devices. Signed-off-by: Jiawen Wu Reviewed-by: Simon Horman Link: https://patch.msgid.link/987B973A5929CD48+20250521064402.22348-5-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni commit 39709fe4bacda6748759522738e33464d6704dc0 Author: Jiawen Wu Date: Wed May 21 14:43:56 2025 +0800 net: txgbe: Distinguish between 40G and 25G devices For the following patches to support PHYLINK for AML 25G devices, separate MAC type wx_mac_aml40 to maintain the driver of 40G devices. Because 40G devices will complete support later, not now. And this patch makes the 25G devices use some PHYLINK interfaces, but it is not yet create PHYLINK and cannot be used on its own. It is just preparation for the next patches. Signed-off-by: Jiawen Wu Reviewed-by: Simon Horman Link: https://patch.msgid.link/592B1A6920867D0C+20250521064402.22348-4-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni commit 78cafb1bb7e9b3c27d36b0c8670494ab2b8dc1da Author: Jiawen Wu Date: Wed May 21 14:43:55 2025 +0800 net: wangxun: Use specific flag bit to simplify the code Most of the different code that requires MAC type in the common library is due to NGBE only supports a few queues and pools, unlike TXGBE, which supports 128 queues and 64 pools. This difference accounts for most of the hardware configuration differences in the driver code. So add a flag bit "WX_FLAG_MULTI_64_FUNC" for them to clean-up the driver code. Signed-off-by: Jiawen Wu Reviewed-by: Simon Horman Link: https://patch.msgid.link/C731132E124D75E5+20250521064402.22348-3-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni commit 893e4656d46248458a832736144f8477c416b284 Author: Jiawen Wu Date: Wed May 21 14:43:54 2025 +0800 net: txgbe: Remove specified SP type Since AML devices are going to reuse some definitions, remove the "SP" qualifier from these definitions. Signed-off-by: Jiawen Wu Reviewed-by: Simon Horman Link: https://patch.msgid.link/8EF712EC14B8FF70+20250521064402.22348-2-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni commit dc762851444b32057709cb40e7cdb3054e60b646 Merge: 6d5b940e1e14fc fb5a381d624bf6 Author: Linus Torvalds Date: Mon May 26 08:23:09 2025 -0700 Merge tag 'vfs-6.16-rc1.writepage' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull final writepage conversion from Christian Brauner: "This converts vboxfs from ->writepage() to ->writepages(). This was the last user of the ->writepage() method. So remove ->writepage() completely and all references to it" * tag 'vfs-6.16-rc1.writepage' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fs: Remove aops->writepage mm: Remove swap_writepage() and shmem_writepage() ttm: Call shmem_writeout() from ttm_backup_backup_page() i915: Use writeback_iter() shmem: Add shmem_writeout() writeback: Remove writeback_use_writepage() migrate: Remove call to ->writepage vboxsf: Convert to writepages 9p: Add a migrate_folio method commit e8c35bfce4c131c8a0777d25d9adfcbb0db8314b Author: Tristram Ha Date: Tue May 20 16:07:20 2025 -0700 net: dsa: microchip: Add SGMII port support to KSZ9477 switch The KSZ9477 switch driver uses the XPCS driver to operate its SGMII port. However there are some hardware bugs in the KSZ9477 SGMII module so workarounds are needed. There was a proposal to update the XPCS driver to accommodate KSZ9477, but the new code is not generic enough to be used by other vendors. It is better to do all these workarounds inside the KSZ9477 driver instead of modifying the XPCS driver. There are 3 hardware issues. The first is the MII_ADVERTISE register needs to be write once after reset for the correct code word to be sent. The XPCS driver disables auto-negotiation first before configuring the SGMII/1000BASE-X mode and then enables it back. The KSZ9477 driver then writes the MII_ADVERTISE register before enabling auto-negotiation. In 1000BASE-X mode the MII_ADVERTISE register will be set, so KSZ9477 driver does not need to write it. The second issue is the MII_BMCR register needs to set the exact speed and duplex mode when running in SGMII mode. During link polling the KSZ9477 will check the speed and duplex mode are different from previous ones and update the MII_BMCR register accordingly. The last issue is 1000BASE-X mode does not work with auto-negotiation on. The cause is the local port hardware does not know the link is up and so network traffic is not forwarded. The workaround is to write 2 additional bits when 1000BASE-X mode is configured. Note the SGMII interrupt in the port cannot be masked. As that interrupt is not handled in the KSZ9477 driver the SGMII interrupt bit will not be set even when the XPCS driver sets it. Signed-off-by: Tristram Ha Reviewed-by: Maxime Chevallier Tested-by: Maxime Chevallier Link: https://patch.msgid.link/20250520230720.23425-1-Tristram.Ha@microchip.com Signed-off-by: Paolo Abeni commit 6d5b940e1e14fcc20b5a3536647fe3c41b07d4f5 Merge: 0ff41df1cb268f 4e5c53e0380635 Author: Linus Torvalds Date: Mon May 26 08:02:43 2025 -0700 Merge tag 'vfs-6.16-rc1.async.dir' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs directory lookup updates from Christian Brauner: "This contains cleanups for the lookup_one*() family of helpers. We expose a set of functions with names containing "lookup_one_len" and others without the "_len". This difference has nothing to do with "len". It's rater a historical accident that can be confusing. The functions without "_len" take a "mnt_idmap" pointer. This is found in the "vfsmount" and that is an important question when choosing which to use: do you have a vfsmount, or are you "inside" the filesystem. A related question is "is permission checking relevant here?". nfsd and cachefiles *do* have a vfsmount but *don't* use the non-_len functions. They pass nop_mnt_idmap and refuse to work on filesystems which have any other idmap. This work changes nfsd and cachefile to use the lookup_one family of functions and to explictily pass &nop_mnt_idmap which is consistent with all other vfs interfaces used where &nop_mnt_idmap is explicitly passed. The remaining uses of the "_one" functions do not require permission checks so these are renamed to be "_noperm" and the permission checking is removed. This series also changes these lookup function to take a qstr instead of separate name and len. In many cases this simplifies the call" * tag 'vfs-6.16-rc1.async.dir' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: VFS: change lookup_one_common and lookup_noperm_common to take a qstr Use try_lookup_noperm() instead of d_hash_and_lookup() outside of VFS VFS: rename lookup_one_len family to lookup_noperm and remove permission check cachefiles: Use lookup_one() rather than lookup_one_len() nfsd: Use lookup_one() rather than lookup_one_len() VFS: improve interface for lookup_one functions commit 405b0d610745fb5e84fc2961d9b960abb9f3d107 Author: Nikita Zhandarovich Date: Tue May 20 14:32:39 2025 +0300 net: usb: aqc111: fix error handling of usbnet read calls Syzkaller, courtesy of syzbot, identified an error (see report [1]) in aqc111 driver, caused by incomplete sanitation of usb read calls' results. This problem is quite similar to the one fixed in commit 920a9fa27e78 ("net: asix: add proper error handling of usb read errors"). For instance, usbnet_read_cmd() may read fewer than 'size' bytes, even if the caller expected the full amount, and aqc111_read_cmd() will not check its result properly. As [1] shows, this may lead to MAC address in aqc111_bind() being only partly initialized, triggering KMSAN warnings. Fix the issue by verifying that the number of bytes read is as expected and not less. [1] Partial syzbot report: BUG: KMSAN: uninit-value in is_valid_ether_addr include/linux/etherdevice.h:208 [inline] BUG: KMSAN: uninit-value in usbnet_probe+0x2e57/0x4390 drivers/net/usb/usbnet.c:1830 is_valid_ether_addr include/linux/etherdevice.h:208 [inline] usbnet_probe+0x2e57/0x4390 drivers/net/usb/usbnet.c:1830 usb_probe_interface+0xd01/0x1310 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x4d1/0xd90 drivers/base/dd.c:658 __driver_probe_device+0x268/0x380 drivers/base/dd.c:800 ... Uninit was stored to memory at: dev_addr_mod+0xb0/0x550 net/core/dev_addr_lists.c:582 __dev_addr_set include/linux/netdevice.h:4874 [inline] eth_hw_addr_set include/linux/etherdevice.h:325 [inline] aqc111_bind+0x35f/0x1150 drivers/net/usb/aqc111.c:717 usbnet_probe+0xbe6/0x4390 drivers/net/usb/usbnet.c:1772 usb_probe_interface+0xd01/0x1310 drivers/usb/core/driver.c:396 ... Uninit was stored to memory at: ether_addr_copy include/linux/etherdevice.h:305 [inline] aqc111_read_perm_mac drivers/net/usb/aqc111.c:663 [inline] aqc111_bind+0x794/0x1150 drivers/net/usb/aqc111.c:713 usbnet_probe+0xbe6/0x4390 drivers/net/usb/usbnet.c:1772 usb_probe_interface+0xd01/0x1310 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] ... Local variable buf.i created at: aqc111_read_perm_mac drivers/net/usb/aqc111.c:656 [inline] aqc111_bind+0x221/0x1150 drivers/net/usb/aqc111.c:713 usbnet_probe+0xbe6/0x4390 drivers/net/usb/usbnet.c:1772 Reported-by: syzbot+3b6b9ff7b80430020c7b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3b6b9ff7b80430020c7b Tested-by: syzbot+3b6b9ff7b80430020c7b@syzkaller.appspotmail.com Fixes: df2d59a2ab6c ("net: usb: aqc111: Add support for getting and setting of MAC address") Signed-off-by: Nikita Zhandarovich Link: https://patch.msgid.link/20250520113240.2369438-1-n.zhandarovich@fintech.ru Signed-off-by: Paolo Abeni commit 65271f868cb1dca709ff69e45939bbef8d6d0b70 Author: Wentao Liang Date: Mon May 26 10:56:27 2025 +0800 regulator: max14577: Add error check for max14577_read_reg() The function max14577_reg_get_current_limit() calls the function max14577_read_reg(), but does not check its return value. A proper implementation can be found in max14577_get_online(). Add a error check for the max14577_read_reg() and return error code if the function fails. Fixes: b0902bbeb768 ("regulator: max14577: Add regulator driver for Maxim 14577") Cc: stable@vger.kernel.org # v3.14 Signed-off-by: Wentao Liang Link: https://patch.msgid.link/20250526025627.407-1-vulab@iscas.ac.cn Signed-off-by: Mark Brown commit 9c96808f10d84156b5e98e16176b725ec5a1386f Author: Christophe JAILLET Date: Sun May 25 14:47:35 2025 +0200 thermal/drivers/acerhdf: Constify struct thermal_zone_device_ops 'struct thermal_zone_device_ops' could be left unmodified in this driver. Constifying this structure moves some data to a read-only section, so increases overall security, especially when the structure holds some function pointers. While at it, also constify a struct thermal_zone_params. On a x86_64, with allmodconfig: Before: ====== text data bss dec hex filename 26422 12584 512 39518 9a5e drivers/platform/x86/acerhdf.o After: ===== text data bss dec hex filename 26646 12360 512 39518 9a5e drivers/platform/x86/acerhdf.o Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/e502fadf2c6b24fc4ec3a7880533f7ca68429720.1748177235.git.christophe.jaillet@wanadoo.fr Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 46a557694b464881b3c2c4a0ba389a6436419a37 Author: Yuezhang Mo Date: Thu Apr 10 17:26:14 2025 -0600 exfat: do not clear volume dirty flag during sync xfstests generic/482 tests the file system consistency after each FUA operation. It fails when run on exfat. exFAT clears the volume dirty flag with a FUA operation during sync. Since s_lock is not held when data is being written to a file, sync can be executed at the same time. When data is being written to a file, the FAT chain is updated first, and then the file size is updated. If sync is executed between updating them, the length of the FAT chain may be inconsistent with the file size. To avoid the situation where the file system is inconsistent but the volume dirty flag is cleared, this commit moves the clearing of the volume dirty flag from exfat_fs_sync() to exfat_put_super(), so that the volume dirty flag is not cleared until unmounting. After the move, there is no additional action during sync, so exfat_fs_sync() can be deleted. Reviewed-by: Sungjong Seo Signed-off-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit 1f3d9724e16d62c7d42c67d6613b8512f2887c22 Author: Namjae Jeon Date: Tue Apr 1 13:50:39 2025 +0900 exfat: fix double free in delayed_free The double free could happen in the following path. exfat_create_upcase_table() exfat_create_upcase_table() : return error exfat_free_upcase_table() : free ->vol_utbl exfat_load_default_upcase_table : return error exfat_kill_sb() delayed_free() exfat_free_upcase_table() <--------- double free This patch set ->vol_util as NULL after freeing it. Reported-by: Jianzhou Zhao Signed-off-by: Namjae Jeon commit 7d476f18abeba3241cd3a2b712b2666a23b6f6dd Author: Imre Deak Date: Tue May 20 17:22:19 2025 +0300 drm/i915/dp: Fix the enabling/disabling of audio SDP splitting Adjust the enabling/disabling steps of the DP audio SDP splitting according to a recent Bspec update. This moves the enabling to the audio codec enable sequence after the transcoder is enabled and disables SDP splitting explicitly during the audio disable sequence. Bspec requires waiting for a vblank event after the transcoder is enabled and before SDP splitting is enabled. There is no need for an explicit wait for this, since after the transcoder is enabled this vblank event is guaranteed to have happened via a flip done wait (see intel_atomic_commit_tail() -> drm_atomic_helper_wait_for_flip_done()). The bspec update is for LNL+ only, but the HW team clarified that this has been always the intended sequence on all platforms and bspec will be updated everywhere accordingly. The way SDP splitting was originally enabled matched the version of bspec at that time. Adding here the Fixes: line still, since this change fixes a FIFO underrun on PTL during output enabling when DSC is enabled. Bspec: 49283, 68943 Fixes: 8853750dbad8 ("drm/i915: Enable SDP split for DP2.0") Cc: Vinod Govindapillai Acked-by: Jani Nikula Reviewed-by: Vinod Govindapillai Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250520142219.1688401-1-imre.deak@intel.com (cherry picked from commit 56764c845aa5be14cd53702fc9f2da23e25857de) Signed-off-by: Joonas Lahtinen commit 21d8a6857bc11f3fa14b19768d840cf6d1f3fccd Author: Viresh Kumar Date: Mon May 26 11:05:03 2025 +0530 rust: opp: Make the doctest example depend on CONFIG_OF The doctest example uses a function only available for CONFIG_OF and so the build with doc tests fails when it isn't enabled. error[E0599]: no function or associated item named `from_of_cpumask` found for struct `rust_doctest_kernel_alloc_kbox_rs_4::kernel::opp::Table` in the current scope Fix this by making the doctest depend on CONFIG_OF. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202505260856.ZQWHW2xT-lkp@intel.com/ Signed-off-by: Viresh Kumar Link: https://patch.msgid.link/a80bfedcb4d94531dc27d3b48062db5042078e88.1748237646.git.viresh.kumar@linaro.org Signed-off-by: Rafael J. Wysocki commit ba09aae9400a1b353dbc3eeac91120baa9bac151 Merge: a5806cd506af5a 03eadcbd981b4c Author: Rafael J. Wysocki Date: Mon May 26 12:41:39 2025 +0200 Merge tag 'opp-updates-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Merge operating performance points (OPP) updates for 6.16 from Viresh Kumar: "- OPP: Add dev_pm_opp_set_level() (Praveen Talari). - Introduce scope-based cleanup headers and mutex locking guards in OPP core (Viresh Kumar). - switch to use kmemdup_array() (Zhang Enpei)." * tag 'opp-updates-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: OPP: switch to use kmemdup_array() OPP: Add dev_pm_opp_set_level() OPP: Use mutex locking guards OPP: Define and use scope-based cleanup helpers OPP: Use scope-based OF cleanup helpers OPP: Return opp_table from dev_pm_opp_get_opp_table_ref() OPP: Return opp from dev_pm_opp_get() OPP: Remove _get_opp_table_kref() commit f4ba2ea57da51d616b689c4b8826c517ff5a8523 Author: Jaroslav Kysela Date: Fri May 23 17:41:51 2025 +0200 firmware: cs_dsp: Fix OOB memory read access in KUnit test (ctl cache) KASAN reported out of bounds access - cs_dsp_ctl_cache_init_multiple_offsets(). The code uses mock_coeff_template.length_bytes (4 bytes) for register value allocations. But later, this length is set to 8 bytes which causes test code failures. As fix, just remove the lenght override, keeping the original value 4 for all operations. Cc: Simon Trimmer Cc: Charles Keepax Cc: Richard Fitzgerald Cc: patches@opensource.cirrus.com Cc: stable@vger.kernel.org Signed-off-by: Jaroslav Kysela Reviewed-by: Richard Fitzgerald Link: https://patch.msgid.link/20250523154151.1252585-1-perex@perex.cz Signed-off-by: Mark Brown commit d979b783d61f7f1f95664031b71a33afc74627b2 Author: Jaroslav Kysela Date: Fri May 23 17:58:14 2025 +0200 firmware: cs_dsp: Fix OOB memory read access in KUnit test (wmfw info) KASAN reported out of bounds access - cs_dsp_mock_wmfw_add_info(), because the source string length was rounded up to the allocation size. Cc: Simon Trimmer Cc: Charles Keepax Cc: Richard Fitzgerald Cc: patches@opensource.cirrus.com Cc: stable@vger.kernel.org Signed-off-by: Jaroslav Kysela Reviewed-by: Richard Fitzgerald Link: https://patch.msgid.link/20250523155814.1256762-1-perex@perex.cz Signed-off-by: Mark Brown commit 354ad60e123dad8e231e7443735020806f3c57d0 Author: Usama Arif Date: Fri May 23 17:52:40 2025 +0100 mm: slub: only warn once when allocating slab obj extensions fails In memory bound systems, a large number of warnings for failing this allocation repeatedly may mask any real issues in the system during memory pressure being reported in dmesg. Change this to warning only once. Signed-off-by: Usama Arif Reported-by: Vlad Poenaru Closes: https://lore.kernel.org/all/17fab2d6-5a74-4573-bcc3-b75951508f0a@gmail.com/ Reviewed-by: Shakeel Butt Reviewed-by: SeongJae Park Acked-by: Harry Yoo Signed-off-by: Vlastimil Babka commit f62bb41740462bf9fde4b110df5c7d3bc223fb3c Author: John Madieu Date: Mon May 19 00:08:12 2025 +0200 arm64: dts: renesas: rzg3e-smarc-som: Reduce I2C2 clock frequency Lower the I2C2 bus clock frequency on the RZ/G3E SMARC SoM from 1MHz to 400kHz to improve compatibility with a wider range of I2C peripherals. As the GreenPAK device is programmed to operate at 400kHz, the previous 1MHz setting was too aggressive, causing it to experience timing issues. Fixes: f7a98e256ee3 ("arm64: dts: renesas: rzg3e-smarc-som: Add I2C2 device pincontrol") Signed-off-by: John Madieu Reviewed-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250518220812.1480696-1-john.madieu.xa@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 3bfb22cecfe6b6f0d8ee56ef4b533cf68599c5d9 Author: Álvaro Fernández Rojas Date: Wed May 21 10:03:25 2025 +0200 mtd: rawnand: brcmnand: legacy exec_op implementation Commit 3c8260ce7663 ("mtd: rawnand: brcmnand: exec_op implementation") removed legacy interface functions, breaking < v5.0 controllers support. In order to fix older controllers we need to add an alternative exec_op implementation which doesn't rely on low level registers. Fixes: 3c8260ce7663 ("mtd: rawnand: brcmnand: exec_op implementation") Signed-off-by: Álvaro Fernández Rojas Reviewed-by: David Regan Reviewed-by: Florian Fainelli Reviewed-by: William Zhang Signed-off-by: Miquel Raynal commit 44ed1f5ff73e9e115b6f5411744d5a22ea1c855b Author: Wentao Liang Date: Mon May 26 11:43:44 2025 +0800 mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk The function sunxi_nfc_hw_ecc_write_chunk() calls the sunxi_nfc_hw_ecc_write_chunk(), but does not call the configuration function sunxi_nfc_randomizer_config(). Consequently, the randomization might not conduct correctly, which will affect the lifespan of NAND flash. A proper implementation can be found in sunxi_nfc_hw_ecc_write_page_dma(). Add the sunxi_nfc_randomizer_config() to config randomizer. Fixes: 4be4e03efc7f ("mtd: nand: sunxi: add randomizer support") Cc: stable@vger.kernel.org # v4.6 Signed-off-by: Wentao Liang Signed-off-by: Miquel Raynal commit e45b7196df60a4aef86c3998611c91fcc93d21f3 Author: Qiu Yutan Date: Wed May 21 10:14:08 2025 +0800 net: neigh: use kfree_skb_reason() in neigh_resolve_output() and neigh_connected_output() Replace kfree_skb() used in neigh_resolve_output() and neigh_connected_output() with kfree_skb_reason(). Following new skb drop reason is added: /* failed to fill the device hard header */ SKB_DROP_REASON_NEIGH_HH_FILLFAIL Signed-off-by: Qiu Yutan Signed-off-by: Jiang Kun Reviewed-by: Kuniyuki Iwashima Reviewed-by: Xu Xin Signed-off-by: David S. Miller commit 8ceeef23a3a7b077caa98be713c09a4cdfbd018f Author: Stanislav Fomichev Date: Tue May 20 13:30:44 2025 -0700 selftests: ncdevmem: add tx test with multiple IOVs Use prime 3 for length to make offset slowly drift away. Signed-off-by: Stanislav Fomichev Acked-by: Mina Almasry Signed-off-by: David S. Miller commit 61f24c6885d6d509c485b71bdde75b499f5d19b6 Author: Stanislav Fomichev Date: Tue May 20 13:30:43 2025 -0700 selftests: ncdevmem: make chunking optional Add new -z argument to specify max IOV size. By default, use single large IOV. Signed-off-by: Stanislav Fomichev Reviewed-by: Mina Almasry Signed-off-by: David S. Miller commit 384492c48e6a88c9a7f0376d8e8ac7f557988e92 Author: Stanislav Fomichev Date: Tue May 20 13:30:42 2025 -0700 net: devmem: support single IOV with sendmsg sendmsg() with a single iov becomes ITER_UBUF, sendmsg() with multiple iovs becomes ITER_IOVEC. iter_iov_len does not return correct value for UBUF, so teach to treat UBUF differently. Cc: Al Viro Cc: Pavel Begunkov Cc: Mina Almasry Fixes: bd61848900bf ("net: devmem: Implement TX path") Signed-off-by: Stanislav Fomichev Acked-by: Mina Almasry Reviewed-by: Pavel Begunkov Signed-off-by: David S. Miller commit 03bcbbb3995ba5df43af9aba45334e35f2dfe27b Author: Thomas Zimmermann Date: Tue May 20 09:14:00 2025 +0200 dummycon: Trigger redraw when switching consoles with deferred takeover Signal vt subsystem to redraw console when switching to dummycon with deferred takeover enabled. Makes the console switch to fbcon and displays the available output. With deferred takeover enabled, dummycon acts as the placeholder until the first output to the console happens. At that point, fbcon takes over. If the output happens while dummycon is not active, it cannot inform fbcon. This is the case if the vt subsystem runs in graphics mode. A typical graphical boot starts plymouth, a display manager and a compositor; all while leaving out dummycon. Switching to a text-mode console leaves the console with dummycon even if a getty terminal has been started. Returning true from dummycon's con_switch helper signals the vt subsystem to redraw the screen. If there's output available dummycon's con_putc{s} helpers trigger deferred takeover of fbcon, which sets a display mode and displays the output. If no output is available, dummycon remains active. v2: - make the comment slightly more verbose (Javier) Signed-off-by: Thomas Zimmermann Reported-by: Andrei Borzenkov Closes: https://bugzilla.suse.com/show_bug.cgi?id=1242191 Tested-by: Andrei Borzenkov Acked-by: Javier Martinez Canillas Fixes: 83d83bebf401 ("console/fbcon: Add support for deferred console takeover") Cc: Hans de Goede Cc: linux-fbdev@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Cc: # v4.19+ Link: https://lore.kernel.org/r/20250520071418.8462-1-tzimmermann@suse.de commit d91c0751d0a622bd29b6078a6d0e183c8342a574 Author: Eric Biggers Date: Tue May 13 21:54:07 2025 -0700 ksmbd: remove unnecessary softdep on crc32 ksmbd accesses crc32 using normal function calls (as opposed to e.g. the generic crypto infrastructure's name-based algorithm resolution), so there is no need to declare a module softdep. Signed-off-by: Eric Biggers Acked-by: Namjae Jeon Signed-off-by: Steve French commit eb21736021865112f8e1bec20fe55f995bc4e771 Author: Eric Biggers Date: Tue May 13 21:50:34 2025 -0700 ksmbd: use SHA-256 library API instead of crypto_shash API ksmbd_gen_sd_hash() does not support any other algorithm, so the crypto_shash abstraction provides no value. Just use the SHA-256 library API instead, which is much simpler and easier to use. Signed-off-by: Eric Biggers Acked-by: Namjae Jeon Signed-off-by: Steve French commit 2297554f01df6d3d4e98a3915c183ce3e491740a Author: Eric Biggers Date: Sun May 18 12:32:12 2025 -0700 x86/fpu: Fix irq_fpu_usable() to return false during CPU onlining irq_fpu_usable() incorrectly returned true before the FPU is initialized. The x86 CPU onlining code can call sha256() to checksum AMD microcode images, before the FPU is initialized. Since sha256() recently gained a kernel-mode FPU optimized code path, a crash occurred in kernel_fpu_begin_mask() during hotplug CPU onlining. (The crash did not occur during boot-time CPU onlining, since the optimized sha256() code is not enabled until subsys_initcalls run.) Fix this by making irq_fpu_usable() return false before fpu__init_cpu() has run. To do this without adding any additional overhead to irq_fpu_usable(), replace the existing per-CPU bool in_kernel_fpu with kernel_fpu_allowed which tracks both initialization and usage rather than just usage. The initial state is false; FPU initialization sets it to true; kernel-mode FPU sections toggle it to false and then back to true; and CPU offlining restores it to the initial state of false. Fixes: 11d7956d526f ("crypto: x86/sha256 - implement library instead of shash") Reported-by: Ayush Jain Closes: https://lore.kernel.org/r/20250516112217.GBaCcf6Yoc6LkIIryP@fat_crate.local Signed-off-by: Eric Biggers Tested-by: Ayush Jain Reviewed-by: Thomas Gleixner Signed-off-by: Herbert Xu commit c7622a4e44d9d008e0e5edcc46c71854c50cf4a8 Author: Alexandre Belloni Date: Mon May 26 00:21:52 2025 +0200 rtc: m41t80: reduce verbosity The driver currently uses dev_err for messages that have a very low probability of being read by the user as the error will probably never happen and the systems with the RTC probably don't have any user able to read the message. Moreover, the only user action after getting this message is the restart the action so drop the level to dev_dbg. Link: https://lore.kernel.org/r/20250525222153.1472917-1-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit 1a7ed2fffbe3096f1b15787b913547db887733c3 Author: A. Niyas Ahamed Mydeen Date: Wed Apr 2 17:35:46 2025 +0530 rtc: m41t80: kickstart ocillator upon failure The ocillator on the m41t62 (and other chips of this type) needs a kickstart upon a failure; the RTC read routine will notice the oscillator failure and fail reads. This is added in the RTC write routine; this allows the system to know that the time in the RTC is accurate. This is following the procedure described in section 3.11 of "https://www.st.com/resource/en/datasheet/m41t62.pdf" Signed-off-by: A. Niyas Ahamed Mydeen Reviewed-by: Corey Minyard Link: https://lore.kernel.org/r/20250402120546.336657-2-nmydeen@mvista.com Signed-off-by: Alexandre Belloni commit 818b6709e1cb0637cbdc67402c17759df39471b4 Author: Ciprian Marian Costea Date: Thu Apr 3 13:33:44 2025 +0300 rtc: s32g: add NXP S32G2/S32G3 SoC support Add a RTC driver for NXP S32G2/S32G3 SoCs. RTC tracks clock time during system suspend. It can be a wakeup source for the S32G2/S32G3 SoC based boards. The RTC module from S32G2/S32G3 is not battery-powered and it is not kept alive during system reset. Co-developed-by: Bogdan Hamciuc Signed-off-by: Bogdan Hamciuc Co-developed-by: Ghennadi Procopciuc Signed-off-by: Ghennadi Procopciuc Signed-off-by: Ciprian Marian Costea Reviewed-by: Frank Li Tested-by: Enric Balletbo i Serra Link: https://lore.kernel.org/r/20250403103346.3064895-3-ciprianmarian.costea@oss.nxp.com Signed-off-by: Alexandre Belloni commit 8568d8b4daecb8c1ac6a7a883ee2da7b70f11b20 Author: Ciprian Marian Costea Date: Thu Apr 3 13:33:43 2025 +0300 dt-bindings: rtc: add schema for NXP S32G2/S32G3 SoCs RTC tracks clock time during system suspend and it is used as a wakeup source on S32G2/S32G3 architecture. RTC from S32G2/S32G3 is not battery-powered and it is not kept alive during system reset. Co-developed-by: Bogdan-Gabriel Roman Signed-off-by: Bogdan-Gabriel Roman Co-developed-by: Ghennadi Procopciuc Signed-off-by: Ghennadi Procopciuc Signed-off-by: Ciprian Marian Costea Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250403103346.3064895-2-ciprianmarian.costea@oss.nxp.com Signed-off-by: Alexandre Belloni commit f4daa80d6be7d3c55ca72a8e560afc4e21f886aa Author: Gary Guo Date: Sat May 17 09:55:59 2025 +0100 rust: compile libcore with edition 2024 for 1.87+ Rust 1.87 (released on 2025-05-15) compiles core library with edition 2024 instead of 2021 [1]. Ensure that the edition matches libcore's expectation to avoid potential breakage. [ J3m3 reported in Zulip [2] that the `rust-analyzer` target was broken after this patch -- indeed, we need to avoid `core-cfgs` since those are passed to the `rust-analyzer` target. So, instead, I tweaked the patch to create a new `core-edition` variable and explicitly mention the `--edition` flag instead of reusing `core-cfg`s. In addition, pass a new argument using this new variable to `generate_rust_analyzer.py` so that we set the right edition there. By the way, for future reference: the `filter-out` change is needed for Rust < 1.87, since otherwise we would skip the `--edition=2021` we just added, ending up with no edition flag, and thus the compiler would default to the 2015 one. [2] https://rust-for-linux.zulipchat.com/#narrow/channel/291565/topic/x/near/520206547 - Miguel ] Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs). Link: https://github.com/rust-lang/rust/pull/138162 [1] Reported-by: est31 Closes: https://github.com/Rust-for-Linux/linux/issues/1163 Signed-off-by: Gary Guo Link: https://lore.kernel.org/r/20250517085600.2857460-1-gary@garyguo.net Signed-off-by: Miguel Ojeda commit df523db15a06c37cbabad8f477ae87d08c9081f2 Author: Miguel Ojeda Date: Mon Mar 24 22:03:52 2025 +0100 rust: dma: add missing Markdown code span Add missing Markdown code span. This was found using the Clippy `doc_markdown` lint, which we may want to enable. Fixes: ad2907b4e308 ("rust: add dma coherent allocator abstraction") Reviewed-by: Benno Lossin Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250324210359.1199574-6-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit f54c750333381bfeaa0e4a69b9563d4e4e21f1b3 Author: Miguel Ojeda Date: Mon Mar 24 22:03:56 2025 +0100 rust: task: add missing Markdown code spans and intra-doc links Add missing Markdown code spans and also convert them into intra-doc links. This was found using the Clippy `doc_markdown` lint, which we may want to enable. Fixes: e0020ba6cbcb ("rust: add PidNamespace") Reviewed-by: Benno Lossin Link: https://lore.kernel.org/r/20250324210359.1199574-10-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 1dbaf8b1bafb8557904eb54b98bb323a3061dd2c Author: Miguel Ojeda Date: Mon Mar 24 22:03:54 2025 +0100 rust: pci: fix docs related to missing Markdown code spans In particular: - Add missing Markdown code spans. - Improve title for `DeviceId`, adding a link to the struct in the C side, rather than referring to `bindings::`. - Convert `TODO` from documentation to a normal comment, and put code in block. This was found using the Clippy `doc_markdown` lint, which we may want to enable. Fixes: 1bd8b6b2c5d3 ("rust: pci: add basic PCI device / driver abstractions") Reviewed-by: Benno Lossin Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250324210359.1199574-8-ojeda@kernel.org [ Prefixed link text with `struct`. - Miguel ] Signed-off-by: Miguel Ojeda commit abd21a163d4188c180cabb6747b1d94e3c0586b9 Author: Miguel Ojeda Date: Mon Mar 24 22:03:51 2025 +0100 rust: alloc: add missing Markdown code span Add missing Markdown code span. This was found using the Clippy `doc_markdown` lint, which we may want to enable. Fixes: dd09538fb409 ("rust: alloc: implement `Cmalloc` in module allocator_test") Reviewed-by: Benno Lossin Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250324210359.1199574-5-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 673ec360cfb099a5f44dabee0f0e6c9b282efa7e Author: Miguel Ojeda Date: Mon Mar 24 22:03:50 2025 +0100 rust: alloc: add missing Markdown code spans Add missing Markdown code spans. This was found using the Clippy `doc_markdown` lint, which we may want to enable. Fixes: b6a006e21b82 ("rust: alloc: introduce allocation flags") Reviewed-by: Benno Lossin Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250324210359.1199574-4-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 9f047636831a61ce0840929555245dd17695206a Author: Miguel Ojeda Date: Mon Mar 24 22:03:55 2025 +0100 rust: platform: fix docs related to missing Markdown code spans Convert `TODO` from documentation to a normal comment, and put code in block. This was found using the Clippy `doc_markdown` lint, which we may want to enable. Fixes: 683a63befc73 ("rust: platform: add basic platform device / driver abstractions") Reviewed-by: Benno Lossin Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250324210359.1199574-9-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 69157b00b526c31522a00b9908bfd53fa21b47f2 Author: Arnd Bergmann Date: Thu May 22 16:38:49 2025 +0200 platform/x86/amd/hsmp: fix building with CONFIG_HWMON=m When CONFIG_HWMON is built as a loadable module, the HSMP drivers cannot be built-in: ERROR: modpost: "hsmp_create_sensor" [drivers/platform/x86/amd/hsmp/amd_hsmp.ko] undefined! ERROR: modpost: "hsmp_create_sensor" [drivers/platform/x86/amd/hsmp/hsmp_acpi.ko] undefined! Enforce that through the usual Kconfig dependnecy trick. Fixes: 92c025db52bb ("platform/x86/amd/hsmp: Report power via hwmon sensors") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250522144422.2824083-1-arnd@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 7ff5f091409f1c1bca6374bcce54d71e8328d17f Author: Luke Jones Date: Sat May 24 12:13:42 2025 +0200 platform/x86: asus-wmi: fix build without CONFIG_SUSPEND The patch "Refactor Ally suspend/resume" introduced an acpi_s2idle_dev_ops for use with ROG Ally which caused a build error if CONFIG_SUSPEND was not defined. Signed-off-by: Luke Jones Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202505090418.DaeaXe4i-lkp@intel.com/ Fixes: feea7bd6b02d ("platform/x86: asus-wmi: Refactor Ally suspend/resume") Link: https://lore.kernel.org/r/20250524101343.57883-2-luke@ljones.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d09a8a4ab57849d0401d7c0bc6583e367984d9f7 Author: Simon Horman Date: Tue May 20 15:33:33 2025 +0100 net: ethernet: mtk_eth_soc: Correct spelling Correct spelling of platforms, various, and initial. As flagged by codespell. Signed-off-by: Simon Horman Reviewed-by: Shannon Nelson Signed-off-by: David S. Miller commit b3456571cea18e64b9eaf55044db56d45326134d Author: Simon Horman Date: Tue May 20 15:25:41 2025 +0100 net: dlink: Correct endian treatment of t_SROM data As it's name suggests, parse_eeprom() parses EEPROM data. This is done by reading data, 16 bits at a time as follows: for (i = 0; i < 128; i++) ((__le16 *) sromdata)[i] = cpu_to_le16(read_eeprom(np, i)); sromdata is at the same memory location as psrom. And the type of psrom is a pointer to struct t_SROM. As can be seen in the loop above, data is stored in sromdata, and thus psrom, as 16-bit little-endian values. However, the integer fields of t_SROM are host byte order. In the case of the led_mode field this results in a but which has been addressed by commit e7e5ae71831c ("net: dlink: Correct endianness handling of led_mode"). In the case of the remaining fields, which are updated by this patch, I do not believe this does not result in any bugs. But it does seem best to correctly annotate the endianness of integers. Flagged by Sparse as: .../dl2k.c:344:35: warning: restricted __le32 degrades to integer Compile tested only. No run-time change intended. Signed-off-by: Simon Horman Signed-off-by: David S. Miller commit bb91f7547f79434e8818d3f235437e021d34c1cb Author: Hariprasad Kelam Date: Tue May 20 11:39:52 2025 +0530 octeontx2-af: NPC: Clear Unicast rule on nixlf detach The AF driver assigns reserved MCAM entries (for unicast, broadcast, etc.) based on the NIXLF number. When a NIXLF is detached, these entries are disabled. For example, PF NIXLF -------------------- PF0 0 SDP-VF0 1 If the user unbinds both PF0 and SDP-VF0 interfaces and then binds them in reverse order PF NIXLF --------------------- SDP-VF0 0 PF0 1 In this scenario, the PF0 unicast entry is getting corrupted because the MCAM entry contains stale data (SDP-VF0 ucast data) This patch resolves the issue by clearing the unicast MCAM entry during NIXLF detach Signed-off-by: Hariprasad Kelam Signed-off-by: David S. Miller commit ab535361efdf8129dc593f8f2d80b76767c07813 Author: Gregory CLEMENT Date: Fri May 23 09:58:15 2025 +0200 MIPS: SMP: Move the AP sync point before the calibration delay In the calibration delay process, some resources are shared, so it's better to move it after the parallel execution part. Thanks to the patch optimizing CPU delay calibration, this change has no impact on the boot time improvements gained from CPU parallel boot. Signed-off-by: Gregory CLEMENT Signed-off-by: Thomas Bogendoerfer commit 79ee1d20e37cd553cc961962fca8107e69a0c293 Author: Caleb James DeLisle Date: Wed May 21 21:33:33 2025 +0000 mips: econet: Fix incorrect Kconfig dependencies config ECONET selects SERIAL_OF_PLATFORM and that depends on SERIAL_8250 so we need to select SERIAL_8250 directly. Also do not enable DEBUG_ZBOOT unless DEBUG_KERNEL is set. Signed-off-by: Caleb James DeLisle Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202505211654.CBdIsoTq-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202505211451.WRjyf3a9-lkp@intel.com/ Signed-off-by: Thomas Bogendoerfer commit 260ce16e579d375ba8f1ac945308343522f98d50 Author: Ajit Khaparde Date: Fri May 23 13:29:52 2025 +0530 RDMA/bnxt_re: Support extended stats for Thor2 VF The driver currently checks if the user is querying VF RoCE statistics. It will not send the query_roce_stats_ext HWRM command if it is for a VF. But Thor2 VF can support extended statistics. Allow query of extended stats for Thor2 VFs. Signed-off-by: Ajit Khaparde Signed-off-by: Shravya KN Link: https://patch.msgid.link/20250523075952.1267827-1-kalesh-anakkur.purayil@broadcom.com Reviewed-by: Damodharam Ammepalli Reviewed-by: Kalesh AP Signed-off-by: Leon Romanovsky commit 6e7272afc9ab556be01de19b54bea3a1f9a9668f Author: Junxian Huang Date: Fri May 23 10:34:33 2025 +0800 RDMA/hns: Fix endian issue in trace events Avoid using __le32 directly in trace events to fix sparse complains: drivers/infiniband/hw/hns/./hns_roce_trace.h:48:1: sparse: sparse: cast to restricted __le32 drivers/infiniband/hw/hns/./hns_roce_trace.h:48:1: sparse: sparse: restricted __le32 degrades to integer drivers/infiniband/hw/hns/./hns_roce_trace.h:48:1: sparse: sparse: restricted __le32 degrades to integer drivers/infiniband/hw/hns/./hns_roce_trace.h:90:1: sparse: sparse: cast to restricted __le32 drivers/infiniband/hw/hns/./hns_roce_trace.h:90:1: sparse: sparse: restricted __le32 degrades to integer drivers/infiniband/hw/hns/./hns_roce_trace.h:90:1: sparse: sparse: restricted __le32 degrades to integer drivers/infiniband/hw/hns/./hns_roce_trace.h:173:1: sparse: sparse: cast to restricted __le32 drivers/infiniband/hw/hns/./hns_roce_trace.h:173:1: sparse: sparse: restricted __le32 degrades to integer drivers/infiniband/hw/hns/./hns_roce_trace.h:173:1: sparse: sparse: restricted __le32 degrades to integer Fixes: 6c98c8670806 ("RDMA/hns: Add trace for WQE dumping") Fixes: 1e63e2f96613 ("RDMA/hns: Add trace for AEQE dumping") Fixes: 6bd18dabf1c9 ("RDMA/hns: Add trace for CMDQ dumping") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202505170327.TNOpreil-lkp@intel.com/ Signed-off-by: Junxian Huang Link: https://patch.msgid.link/20250523023433.2171003-1-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky commit e91fb8b9d0edec86a1ef26490bc80af96210863d Author: Leon Romanovsky Date: Wed May 21 14:34:58 2025 +0300 RDMA/mlx5: Avoid flexible array warning The following warning is reported by sparse tool: drivers/infiniband/hw/mlx5/fs.c:1664:26: warning: array of flexible structures Avoid it by simply splitting array into two separate structs. Link: https://patch.msgid.link/7b891b96a9fc053d01284c184d25ae98d35db2d4.1747827041.git.leon@kernel.org Reviewed-by: Zhu Yanjun Signed-off-by: Leon Romanovsky commit 45611fe821af0e09cb9dc2dfd2418b2e1e1831f3 Author: Vlad Dumitrescu Date: Wed May 21 14:34:17 2025 +0300 IB/cm: Remove dead code and adjust naming Drop ib_send_cm_mra parameters which are always constant. Remove branch which is never taken. Adjust name to ib_prepare_cm_mra, which better reflects its functionality - no MRA is actually sent. Adjust name of related tracepoints. Push setting of the constant service timeout to cm.c and drop IB_CM_MRA_FLAG_DELAY. Signed-off-by: Vlad Dumitrescu Reviewed-by: Sean Hefty Link: https://patch.msgid.link/cdd2a237acf2b495c19ce02e4b1c42c41c6751c2.1747827207.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 259e9bd07c57b0fd8588f68e9adbe2c41170f4fe Author: Daisuke Matsuda Date: Sat May 24 14:43:28 2025 +0000 RDMA/core: Avoid hmm_dma_map_alloc() for virtual DMA devices Drivers such as rxe, which use virtual DMA, must not call into the DMA mapping core since they lack physical DMA capabilities. Otherwise, a NULL pointer dereference is observed as shown below. This patch ensures the RDMA core handles virtual and physical DMA paths appropriately. This fixes the following kernel oops: BUG: kernel NULL pointer dereference, address: 00000000000002fc #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 1028eb067 P4D 1028eb067 PUD 105da0067 PMD 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 3 UID: 1000 PID: 1854 Comm: python3 Tainted: G W 6.15.0-rc1+ #11 PREEMPT(voluntary) Tainted: [W]=WARN Hardware name: Trigkey Key N/Key N, BIOS KEYN101 09/02/2024 RIP: 0010:hmm_dma_map_alloc+0x25/0x100 Code: 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 49 89 d6 49 c1 e6 0c 41 55 41 54 53 49 39 ce 0f 82 c6 00 00 00 49 89 fc 87 fc 02 00 00 20 0f 84 af 00 00 00 49 89 f5 48 89 d3 49 89 cf RSP: 0018:ffffd3d3420eb830 EFLAGS: 00010246 RAX: 0000000000001000 RBX: ffff8b727c7f7400 RCX: 0000000000001000 RDX: 0000000000000001 RSI: ffff8b727c7f74b0 RDI: 0000000000000000 RBP: ffffd3d3420eb858 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 00007262a622a000 R14: 0000000000001000 R15: ffff8b727c7f74b0 FS: 00007262a62a1080(0000) GS:ffff8b762ac3e000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000002fc CR3: 000000010a1f0004 CR4: 0000000000f72ef0 PKRU: 55555554 Call Trace: ib_init_umem_odp+0xb6/0x110 [ib_uverbs] ib_umem_odp_get+0xf0/0x150 [ib_uverbs] rxe_odp_mr_init_user+0x71/0x170 [rdma_rxe] rxe_reg_user_mr+0x217/0x2e0 [rdma_rxe] ib_uverbs_reg_mr+0x19e/0x2e0 [ib_uverbs] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xd9/0x150 [ib_uverbs] ib_uverbs_cmd_verbs+0xd19/0xee0 [ib_uverbs] ? mmap_region+0x63/0xd0 ? __pfx_ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x10/0x10 [ib_uverbs] ib_uverbs_ioctl+0xba/0x130 [ib_uverbs] __x64_sys_ioctl+0xa4/0xe0 x64_sys_call+0x1178/0x2660 do_syscall_64+0x7e/0x170 ? syscall_exit_to_user_mode+0x4e/0x250 ? do_syscall_64+0x8a/0x170 ? do_syscall_64+0x8a/0x170 ? syscall_exit_to_user_mode+0x4e/0x250 ? do_syscall_64+0x8a/0x170 ? syscall_exit_to_user_mode+0x4e/0x250 ? do_syscall_64+0x8a/0x170 ? do_user_addr_fault+0x1d2/0x8d0 ? irqentry_exit_to_user_mode+0x43/0x250 ? irqentry_exit+0x43/0x50 ? exc_page_fault+0x93/0x1d0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7262a6124ded Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25 28 00 00 00 RSP: 002b:00007fffd08c3960 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fffd08c39f0 RCX: 00007262a6124ded RDX: 00007fffd08c3a10 RSI: 00000000c0181b01 RDI: 0000000000000007 RBP: 00007fffd08c39b0 R08: 0000000014107820 R09: 00007fffd08c3b44 R10: 000000000000000c R11: 0000000000000246 R12: 00007fffd08c3b44 R13: 000000000000000c R14: 00007fffd08c3b58 R15: 0000000014107960 Fixes: 1efe8c0670d6 ("RDMA/core: Convert UMEM ODP DMA mapping to caching IOVA and page linkage") Closes: https://lore.kernel.org/all/3e8f343f-7d66-4f7a-9f08-3910623e322f@gmail.com/ Signed-off-by: Daisuke Matsuda Link: https://patch.msgid.link/20250524144328.4361-1-dskmtsd@gmail.com Signed-off-by: Leon Romanovsky commit 9857af0fcff385c75433f2162c30c62eb912ef6d Author: Carlos Llamas Date: Sat May 24 22:07:58 2025 +0000 binder: fix yet another UAF in binder_devices Commit e77aff5528a18 ("binderfs: fix use-after-free in binder_devices") addressed a use-after-free where devices could be released without first being removed from the binder_devices list. However, there is a similar path in binder_free_proc() that was missed: ================================================================== BUG: KASAN: slab-use-after-free in binder_remove_device+0xd4/0x100 Write of size 8 at addr ffff0000c773b900 by task umount/467 CPU: 12 UID: 0 PID: 467 Comm: umount Not tainted 6.15.0-rc7-00138-g57483a362741 #9 PREEMPT Hardware name: linux,dummy-virt (DT) Call trace: binder_remove_device+0xd4/0x100 binderfs_evict_inode+0x230/0x2f0 evict+0x25c/0x5dc iput+0x304/0x480 dentry_unlink_inode+0x208/0x46c __dentry_kill+0x154/0x530 [...] Allocated by task 463: __kmalloc_cache_noprof+0x13c/0x324 binderfs_binder_device_create.isra.0+0x138/0xa60 binder_ctl_ioctl+0x1ac/0x230 [...] Freed by task 215: kfree+0x184/0x31c binder_proc_dec_tmpref+0x33c/0x4ac binder_deferred_func+0xc10/0x1108 process_one_work+0x520/0xba4 [...] ================================================================== Call binder_remove_device() within binder_free_proc() to ensure the device is removed from the binder_devices list before being kfreed. Cc: stable@vger.kernel.org Fixes: 12d909cac1e1 ("binderfs: add new binder devices to binder_devices") Reported-by: syzbot+4af454407ec393de51d6@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=4af454407ec393de51d6 Tested-by: syzbot+4af454407ec393de51d6@syzkaller.appspotmail.com Signed-off-by: Carlos Llamas Link: https://lore.kernel.org/r/20250524220758.915028-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman commit 40617439d572645207c1866dfb086de0be438a14 Author: Masahiro Yamada Date: Thu May 22 16:17:22 2025 +0900 docs/core-api/symbol-namespaces: drop table of contents and section numbering The manually updated table of contents and section numbering are hard to maintain. Make changes similar to the following commits: 5e8f0ba38a4d ("docs/kbuild/makefiles: throw out the local table of contents") 1a4c1c9df72e ("docs/kbuild/makefiles: drop section numbering, use references") Signed-off-by: Masahiro Yamada commit 9c036cfbb75bb58ecce589f547fdb8af153493a6 Author: Masahiro Yamada Date: Thu May 22 16:17:20 2025 +0900 modpost: check forbidden MODULE_IMPORT_NS("module:") at compile time Explicitly adding MODULE_IMPORT_NS("module:...") is not allowed. Currently, this is only checked at run time. That is, when such a module is loaded, an error message like the following is shown: foo: module tries to import module namespace: module:bar Obviously, checking this at compile time improves usability. In such a case, modpost will report the following error at compile time: ERROR: modpost: foo: explicitly importing namespace "module:bar" is not allowed. Signed-off-by: Masahiro Yamada commit 8f81d8529e19c84b014e4239d2012373274d138d Author: Masahiro Yamada Date: Wed May 14 14:46:33 2025 +0900 kbuild: move kbuild syntax processing to scripts/Makefile.build scripts/Makefile.lib is included by the following Makefiles: scripts/Makefile.build scripts/Makefile.modfinal scripts/Makefile.package scripts/Makefile.vmlinux scripts/Makefile.vmlinux_o However, the last four do not need to process Kbuild syntax such as obj-*, lib-*, subdir-*, etc. Move the relevant code to scripts/Makefile.build. Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier commit 2adde2eb1638336e17f887070e6dfc52205d464b Author: Henrik Lindström Date: Mon May 12 18:10:06 2025 +0200 Makefile: remove dependency on archscripts for header installation archscripts has nothing to do with headers_install. Signed-off-by: Henrik Lindström Reviewed-by: Nicolas Schier Signed-off-by: Masahiro Yamada commit cf9d692629fa3017989367ac86bf34109176cdad Author: Sami Tolvanen Date: Wed May 7 23:14:09 2025 +0000 Documentation/kbuild: Add new gendwarfksyms kABI rules Document the "byte_size" and "type_string" kABI stability rules. Signed-off-by: Sami Tolvanen Signed-off-by: Masahiro Yamada commit 881bf900bc880ee3ad88c0dd74253785088a25d7 Author: Sami Tolvanen Date: Wed May 7 23:14:08 2025 +0000 Documentation/kbuild: Drop section numbers Change the gendwarfksyms documentation to use proper chapter, section, and subsection adornments instead of fragile section numbers. Suggested-by: Masahiro Yamada Signed-off-by: Sami Tolvanen Signed-off-by: Masahiro Yamada commit c9083467f7b97e7c06b7a9038c4f18095329bd37 Author: Sami Tolvanen Date: Wed May 7 23:14:07 2025 +0000 gendwarfksyms: Add a kABI rule to override type strings In rare situations where distributions must make significant changes to otherwise opaque data structures that have inadvertently been included in the published ABI, keeping symbol versions stable using the existing kABI macros can become tedious. For example, Android decided to switch to a newer io_uring implementation in the 5.10 GKI kernel "to resolve a huge number of potential, and known, problems with the codebase," requiring "horrible hacks" with genksyms: "A number of the io_uring structures get used in other core kernel structures, only as "opaque" pointers, so there is not any real ABI breakage. But, due to the visibility of the structures going away, the CRC values of many scheduler variables and functions were changed." -- https://r.android.com/2425293 While these specific changes probably could have been hidden from gendwarfksyms using the existing kABI macros, this may not always be the case. Add a last resort kABI rule that allows distribution maintainers to fully override a type string for a symbol or a type. Also add a more informative error message in case we find a non-existent type references when calculating versions. Suggested-by: Giuliano Procida Signed-off-by: Sami Tolvanen Reviewed-by: Petr Pavlu Signed-off-by: Masahiro Yamada commit db59d74e5da144111fc133fb1bf72e6392bdb04e Author: Sami Tolvanen Date: Wed May 7 23:14:06 2025 +0000 gendwarfksyms: Add a kABI rule to override byte_size attributes A data structure can be partially opaque to modules if its allocation is handled by the core kernel, and modules only need to access some of its members. In this situation, it's possible to append new members to the structure without breaking the ABI, as long as the layout for the original members remains unchanged. For example, consider the following struct: struct s { unsigned long a; void *p; }; gendwarfksyms --stable --dump-dies produces the following type expansion: variable structure_type s { member base_type long unsigned int byte_size(8) encoding(7) a data_member_location(0) , member pointer_type { base_type void } byte_size(8) p data_member_location(8) } byte_size(16) To append new members, we can use the KABI_IGNORE() macro to hide them from gendwarfksyms --stable: struct s { /* old members with unchanged layout */ unsigned long a; void *p; /* new members not accessed by modules */ KABI_IGNORE(0, unsigned long n); }; However, we can't hide the fact that adding new members changes the struct size, as seen in the updated type string: variable structure_type s { member base_type long unsigned int byte_size(8) encoding(7) a data_member_location(0) , member pointer_type { base_type void } byte_size(8) p data_member_location(8) } byte_size(24) In order to support this use case, add a kABI rule that makes it possible to override the byte_size attribute for types: /* * struct s allocation is handled by the kernel, so * appending new members without changing the original * layout won't break the ABI. */ KABI_BYTE_SIZE(s, 16); This results in a type string that's unchanged from the original and therefore, won't change versions for symbols that reference the changed structure. Signed-off-by: Sami Tolvanen Reviewed-by: Petr Pavlu Signed-off-by: Masahiro Yamada commit ff2c5f5a9e01b9fc3b4959c2b3f40843cc0a5ecb Author: Sami Tolvanen Date: Wed May 7 23:14:05 2025 +0000 gendwarfksyms: Clean up kABI rule look-ups Reduce code duplication by moving kABI rule look-ups to separate functions. Signed-off-by: Sami Tolvanen Reviewed-by: Petr Pavlu Signed-off-by: Masahiro Yamada commit 707f853d7fa3ce323a6875487890c213e34d81a0 Author: Peter Zijlstra Date: Fri May 2 16:12:09 2025 +0200 module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper Helper macro to more easily limit the export of a symbol to a given list of modules. Eg: EXPORT_SYMBOL_GPL_FOR_MODULES(preempt_notifier_inc, "kvm"); will limit the use of said function to kvm.ko, any other module trying to use this symbol will refure to load (and get modpost build failures). Requested-by: Masahiro Yamada Requested-by: Christoph Hellwig Signed-off-by: Peter Zijlstra Reviewed-by: Petr Pavlu Signed-off-by: Masahiro Yamada commit 0267cbf297bf7ed9ef5181feceea9fe03c84318e Author: Peter Zijlstra Date: Fri May 2 16:12:08 2025 +0200 module: Account for the build time module name mangling Sean noted that scripts/Makefile.lib:name-fix-token rule will mangle the module name with s/-/_/g. Since this happens late in the build, only the kernel needs to bother with this, the modpost tool still sees the original name. Reported-by: Sean Christopherson Signed-off-by: Peter Zijlstra Tested-by: Sean Christopherson Reviewed-by: Petr Pavlu Signed-off-by: Masahiro Yamada commit 754f8733fc09dd92093cfbd34fa71a42d152b250 Author: Peter Zijlstra Date: Fri May 2 16:12:07 2025 +0200 module: Extend the module namespace parsing Instead of only accepting "module:${name}", extend it with a comma separated list of module names and add tail glob support. That is, something like: "module:foo-*,bar" is now possible. Signed-off-by: Peter Zijlstra Reviewed-by: Petr Pavlu Signed-off-by: Masahiro Yamada commit 520b1a147d918eb07132c847ad5598a17d3ff7ca Author: Peter Zijlstra Date: Fri May 2 16:12:06 2025 +0200 module: Add module specific symbol namespace support Designate the "module:${modname}" symbol namespace to mean: 'only export to the named module'. Notably, explicit imports of anything in the "module:" space is forbidden. Signed-off-by: Peter Zijlstra Reviewed-by: Petr Pavlu Signed-off-by: Masahiro Yamada commit 6b91ff002c67b2502009f99115c4b7fe5b7b8248 Author: Peter Zijlstra Date: Fri May 2 16:12:05 2025 +0200 modpost: Use for() loop Slight cleanup by using a for() loop instead of while(). This makes it clearer what is the iteration and what is the actual work done. Signed-off-by: Peter Zijlstra Signed-off-by: Masahiro Yamada commit 94ec70880fd376dd5cc60ba2bd7ddf830b3d4f28 Merge: cdb7d2d68cde61 78272d44970c07 Author: Ingo Molnar Date: Sun May 25 10:10:08 2025 +0200 Merge branch 'locking/futex' into locking/core, to pick up pending futex changes Signed-off-by: Ingo Molnar commit e7d952cc39fca34386ec9f15f68cb2eaac01b5ae Author: Ingo Molnar Date: Sat May 24 11:23:25 2025 +0200 perf/headers: Clean up a bit Do a bit of readability spring cleaning: - Fix misaligned structure member in perf_addr_filter: the new struct perf_addr_filter::action member was too long, but when it was added it was not aligned properly. Align all fields to the customary column 41 alignment of most of the rest of the header. - Adjust the vertical alignment of the definition of other structures and definitions as well, so that the 'most of' in the previous paragraph changes to 'all of'. ;-) - Prettify the assignments in perf_clear_branch_entry_bitfields() - Move comments from CPP definitions to outside the macro - Move perf_guest_info_callbacks and related defines from the front of the header closer to where it's used within the header. - And more #endif markers for larger CPP blocks and standardize #if/#else/#endif blocks to the following nomenclature: #ifdef CONFIG_FOO ... #else /* !CONFIG_FOO: */ ... #endif /* !CONFIG_FOO */ - Standardize on consistently using the 'extern' storage class where appropriate, we had cases where method prototypes sometimes omitted the storage class: extern void perf_pmu_migrate_context(struct pmu *pmu, int src_cpu, int dst_cpu); int perf_event_read_local(struct perf_event *event, u64 *value, u64 *enabled, u64 *running); extern u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running); Which is obviously a bit confusing and adds unnecessary noise. - s/__u64/u64 and similar cleanups: there's no point in using __u64 in non-UAPI headers, and doing so only adds unnecessary visual noise. - Harmonize all multi-parameter function prototypes along the following style: extern struct perf_event * perf_event_create_kernel_counter(struct perf_event_attr *attr, int cpu, struct task_struct *task, perf_overflow_handler_t callback, void *context); - etc. Cc: Peter Zijlstra Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Alexander Shishkin Cc: Mark Rutland Cc: Namhyung Kim Cc: Ian Rogers Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar commit b4a29efc51461edf1a02e9da656d4480cabd24b0 Author: Bo Liu Date: Thu May 22 05:49:31 2025 -0400 erofs: support DEFLATE decompression by using Intel QAT This patch introduces the use of the Intel QAT to offload EROFS data decompression, aiming to improve the decompression performance. A 285MiB dataset is used with the following command to create EROFS images with different cluster sizes: $ mkfs.erofs -zdeflate,level=9 -C{4096,16384,65536,131072,262144} Fio is used to test the following read patterns: $ fio -filename=testfile -bs=4k -rw=read -name=job1 $ fio -filename=testfile -bs=4k -rw=randread -name=job1 $ fio -filename=testfile -bs=4k -rw=randread --io_size=14m -name=job1 Here are some performance numbers for reference: Processors: Intel(R) Xeon(R) 6766E (144 cores) Memory: 512 GiB |-----------------------------------------------------------------------------| | | Cluster size | sequential read | randread | small randread(5%) | |-----------|--------------|-----------------|-----------|--------------------| | Intel QAT | 4096 | 538 MiB/s | 112 MiB/s | 20.76 MiB/s | | Intel QAT | 16384 | 699 MiB/s | 158 MiB/s | 21.02 MiB/s | | Intel QAT | 65536 | 917 MiB/s | 278 MiB/s | 20.90 MiB/s | | Intel QAT | 131072 | 1056 MiB/s | 351 MiB/s | 23.36 MiB/s | | Intel QAT | 262144 | 1145 MiB/s | 431 MiB/s | 26.66 MiB/s | | deflate | 4096 | 499 MiB/s | 108 MiB/s | 21.50 MiB/s | | deflate | 16384 | 422 MiB/s | 125 MiB/s | 18.94 MiB/s | | deflate | 65536 | 452 MiB/s | 159 MiB/s | 13.02 MiB/s | | deflate | 131072 | 452 MiB/s | 177 MiB/s | 11.44 MiB/s | | deflate | 262144 | 466 MiB/s | 194 MiB/s | 10.60 MiB/s | Signed-off-by: Bo Liu Reviewed-by: Gao Xiang Link: https://lore.kernel.org/r/20250522094931.28956-1-liubo03@inspur.com [ Gao Xiang: refine the commit message. ] Signed-off-by: Gao Xiang commit 97e69f12edb19a17589ca0b6f3988b2a28af87c8 Author: Kent Overstreet Date: Sat May 24 14:20:58 2025 -0400 bcachefs: Fix missing BTREE_UPDATE_internal_snapshot_node Repair code will do updates on older snapshot versions, so needs the correct annotation. Reported-by: syzbot+42581416dba62b364750@syzkaller.appspotmail.com Signed-off-by: Kent Overstreet commit 7098ba57c443868cab250a3a5db72c89ffbd9026 Author: Kent Overstreet Date: Sat May 24 01:56:10 2025 -0400 bcachefs: fix REFLINK_P_MAY_UPDATE_OPTIONS If we're doing a reflink copy of existing reflinked data, we may only set REFLINK_P_MAY_UPDATE_OPTIONS if it was set on the reflink pointer we're copying from. Signed-off-by: Kent Overstreet commit bf1c27c6d540c84f2de00e43b2efcbd214c8d63c Author: Ryan Wanner Date: Mon Apr 14 14:41:22 2025 -0700 dt-bindings: at91rm9260-rtt: add microchip,sama7d65-rtt Add SAMA7D65 RTT compatible to DT bindings documentation. Signed-off-by: Ryan Wanner Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/183474a65377f4030360166a5f2659af7323e82b.1744666011.git.Ryan.Wanner@microchip.com Signed-off-by: Alexandre Belloni commit 0a68f5be7883ecda536a62f4877a373cfec05089 Author: Ryan Wanner Date: Mon Apr 14 14:41:21 2025 -0700 dt-bindings: rtc: at91rm9200: add microchip,sama7d65-rtc Add SAMA7D65 RTC compatible to DT bindings documentation. Signed-off-by: Ryan Wanner Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/a274485331628be0bcf382b1ba489d4555fa49c8.1744666011.git.Ryan.Wanner@microchip.com Signed-off-by: Alexandre Belloni commit 5af9f1fa576874b24627d4c05e3a84672204c200 Author: Liu Dalin Date: Fri May 9 16:44:16 2025 +0800 rtc: loongson: Add missing alarm notifications for ACPI RTC events When an application sets and enables an alarm on Loongson RTC devices, the alarm notification fails to propagate to userspace because the ACPI event handler omits calling rtc_update_irq(). As a result, processes waiting via select() or poll() on RTC device files fail to receive alarm notifications. The ACPI interrupt is also triggered multiple times. In loongson_rtc_handler, we need to clear TOY_MATCH0_REG to resolve this issue. Fixes: 09471d8f5b39 ("rtc: loongson: clear TOY_MATCH0_REG in loongson_rtc_isr()") Fixes: 1b733a9ebc3d ("rtc: Add rtc driver for the Loongson family chips") Signed-off-by: Liu Dalin Reviewed-by: Binbin Zhou Link: https://lore.kernel.org/r/20250509084416.7979-1-liudalin@kylinsec.com.cn Signed-off-by: Alexandre Belloni commit d9f82683b123ce315cc36c4b20a5bc3d8644f947 Author: Jingbao Qiu Date: Wed May 7 21:56:20 2025 +0200 rtc: sophgo: add rtc support for Sophgo CV1800 SoC Implement the RTC driver for CV1800, which able to provide time alarm. Signed-off-by: Jingbao Qiu Signed-off-by: Alexander Sverdlin Link: https://lore.kernel.org/r/20250507195626.502240-1-alexander.sverdlin@gmail.com Signed-off-by: Alexandre Belloni commit 3639b35857e2cc5a75de6f2bb10a1cc3f949193f Author: Johan Hovold Date: Wed Apr 23 15:03:18 2025 +0200 rtc: stm32: drop unused module alias The driver only support OF probe so drop the unused platform module alias. Fixes: 4e64350f42e2 ("rtc: add STM32 RTC driver") Signed-off-by: Johan Hovold Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250423130318.31244-8-johan+linaro@kernel.org Signed-off-by: Alexandre Belloni commit 149834a414e1fc25411a2e0e913ba3127e5758c9 Author: Johan Hovold Date: Wed Apr 23 15:03:17 2025 +0200 rtc: s3c: drop unused module alias The driver only support OF probe so drop the unused platform module alias. Fixes: ae05c95074e0 ("rtc: s3c: add s3c_rtc_data structure to use variant data instead of s3c_cpu_type") Signed-off-by: Johan Hovold Fixes: 0d297df03890 ("ARM: s3c: simplify platform code") Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250423130318.31244-7-johan+linaro@kernel.org Signed-off-by: Alexandre Belloni commit d5e85c8bfaa630c5e854ac712b7f7d1f696c9954 Author: Johan Hovold Date: Wed Apr 23 15:03:16 2025 +0200 rtc: pm8xxx: drop unused module alias The driver only support OF probe so drop the unused platform module alias. Fixes: 5a418558cdae ("rtc: pm8xxx: add support for devicetree") Signed-off-by: Johan Hovold Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250423130318.31244-6-johan+linaro@kernel.org Signed-off-by: Alexandre Belloni commit c61f165617b19ad47be98791adb82ec7df9fa96b Author: Johan Hovold Date: Wed Apr 23 15:03:15 2025 +0200 rtc: jz4740: drop unused module alias The driver only support OF probe so drop the unused platform module alias. Fixes: 24e1f2c9383e ("rtc: ingenic: Only support probing from devicetree") Signed-off-by: Johan Hovold Acked-by: Paul Cercueil Link: https://lore.kernel.org/r/20250423130318.31244-5-johan+linaro@kernel.org Signed-off-by: Alexandre Belloni commit ac45f6e2473b36932d26fdf325d47c733f947ed8 Author: Johan Hovold Date: Wed Apr 23 15:03:14 2025 +0200 rtc: da9063: drop unused module alias The driver only support OF probe so drop the unused platform module alias. Fixes: 80ca3277bc7f ("rtc: da9063: Add DA9062 RTC capability to DA9063 RTC driver") Signed-off-by: Johan Hovold Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250423130318.31244-4-johan+linaro@kernel.org Signed-off-by: Alexandre Belloni commit 5f28ab049fb3179112dc04f1e8e9a475b8655602 Author: Johan Hovold Date: Wed Apr 23 15:03:13 2025 +0200 rtc: cpcap: drop unused module alias The driver only supports OF probe so drop the unused platform module alias. Fixes: dd3bf50b35e3 ("rtc: cpcap: new rtc driver") Signed-off-by: Johan Hovold Reviewed-by: Sebastian Reichel Link: https://lore.kernel.org/r/20250423130318.31244-3-johan+linaro@kernel.org Signed-off-by: Alexandre Belloni commit 9f05c3943eb621d3f5d6eaced5ac7c2d58f582a8 Author: Johan Hovold Date: Wed Apr 23 15:03:12 2025 +0200 rtc: at91rm9200: drop unused module alias The driver only support OF probe so drop the unused platform module alias. Fixes: 288d9cf1764a ("rtc: at91rm9200: use of_device_get_match_data()") Signed-off-by: Johan Hovold Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250423130318.31244-2-johan+linaro@kernel.org Signed-off-by: Alexandre Belloni commit ead4532832795f700fd8962cb1f2aad74f3dfca7 Author: Johan Hovold Date: Wed Apr 23 09:51:41 2025 +0200 rtc: pm8xxx: fix uefi offset lookup On many Qualcomm platforms the PMIC RTC control and time registers are read-only so that the RTC time can not be updated. Instead an offset needs be stored in some machine-specific non-volatile memory, which a driver can take into account. On platforms where the offset is stored in a Qualcomm specific UEFI variable the variables are also accessed in a non-standard way, which means that the OS cannot assume that the variable service is available by the time the driver probes. Use the new 'qcom,uefi-rtc-info' property to determine whether to probe defer until the UEFI offset becomes available so that the offset can be used also when the RTC driver is built in or when a dependency of the UEFI variable driver is built as a module (e.g. the driver for the SCM interconnects). Fixes: bba38b874886 ("rtc: pm8xxx: add support for uefi offset") Reported-by: Rob Clark Link: https://lore.kernel.org/lkml/CAF6AEGsfke=x0p1b2-uNX6DuQfRyEjVbJaxTbVLDT2YvSkGJbg@mail.gmail.com/ Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20250423075143.11157-3-johan+linaro@kernel.org Signed-off-by: Alexandre Belloni commit b23b91d56863d280af81c9ca11594484782ceea5 Author: Johan Hovold Date: Wed Apr 23 09:51:40 2025 +0200 dt-bindings: rtc: qcom-pm8xxx: add uefi-variable offset On many Qualcomm platforms the PMIC RTC control and time registers are read-only so that the RTC time can not be updated. Instead an offset needs be stored in some machine-specific non-volatile memory, which a driver can take into account. On platforms where the offset is stored in a Qualcomm specific UEFI variable the variables are also accessed in a non-standard way, which means that the OS cannot assume that the variable service is available by the time the RTC driver probes. Add a 'qcom,uefi-rtc-info' boolean flag to indicate that the RTC offset is stored in a Qualcomm specific UEFI variable so that the OS can determine whether to wait for it to become available. The UEFI variable is 882f8c2b-9646-435f-8de5-f208ff80c1bd-RTCInfo and holds a 12-byte structure where the first four bytes is a GPS time offset in little-endian byte order. Link: https://lore.kernel.org/all/aAecIkgmTTlThKEZ@hovoldconsulting.com/ Signed-off-by: Johan Hovold Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250423075143.11157-2-johan+linaro@kernel.org Signed-off-by: Alexandre Belloni commit 7498dca1d0d17c16a21f0e27fbb6414cf2645289 Author: Krzysztof Kozlowski Date: Thu Apr 17 09:46:40 2025 +0200 rtc: amlogic: Do not enable by default during compile testing Enabling the compile test should not cause automatic enabling of all drivers, but only allow to choose to compile them. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250417074640.81363-1-krzysztof.kozlowski@linaro.org Signed-off-by: Alexandre Belloni commit d8a0f6af1d36806d05883bdc5684aeae3689f927 Author: Alexandre Belloni Date: Tue Apr 8 16:42:03 2025 +0200 rtc: interface: silence KMSAN warning KMSAN complains that alarm->time can be used uninitialized. Pass 0 to trace_rtc_read_alarm in case it has not been set. Link: https://lore.kernel.org/r/20250408144203.3869821-1-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit 00286d7d643d3c98e48d9cc3a9f471b37154f462 Author: Wolfram Sang Date: Tue May 6 09:52:11 2025 +0200 i3c: controllers do not need to depend on I3C The Kconfig file for controller drivers is only sourced if the I3C symbol is enabled. No need to check for that in individual drivers. Signed-off-by: Wolfram Sang Link: https://lore.kernel.org/r/20250506075247.1545-2-wsa+renesas@sang-engineering.com Signed-off-by: Alexandre Belloni commit cd1a6a0c69e75bf64b44b00186136e563f392b50 Author: Carlos Song Date: Sun Apr 27 16:32:29 2025 +0800 i3c: master: svc: switch to bulk clk API for flexible clock support Use the clk_bulk API to handle clocks, so the code can support different numbers of clocks more easily. Make the code cleaner and more flexible. No change in functionality. Signed-off-by: Carlos Song Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250427083230.3325700-3-carlos.song@nxp.com Signed-off-by: Alexandre Belloni commit 489c773a68de187ad11482433119811949fbb88d Author: Carlos Song Date: Sun Apr 27 16:32:28 2025 +0800 dt-bindings: i3c: silvaco,i3c-master: add i.MX94 and i.MX95 I3C Add compatible string "nxp,imx94-i3c" and "nxp,imx95-i3c" for the i.MX94 chip and i.MX95 chip. Backward is compatible with "silvaco,i3c-master-v1". Also i.MX94 and i.MX95 I3C only need two clocks and Legacy I3C needs three clocks. So add restrictions for clock and clock-names properties for different Socs. Signed-off-by: Carlos Song Reviewed-by: Frank Li Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250427083230.3325700-2-carlos.song@nxp.com Signed-off-by: Alexandre Belloni commit 7917be170928189fefad490d1a1237fdfa6b856f Author: Radim Krčmář Date: Fri May 23 12:47:28 2025 +0200 RISC-V: KVM: lock the correct mp_state during reset Currently, the kvm_riscv_vcpu_sbi_system_reset() function locks vcpu->arch.mp_state_lock when updating tmp->arch.mp_state.mp_state which is incorrect hence fix it. Fixes: 2121cadec45a ("RISCV: KVM: Introduce mp_state_lock to avoid lock inversion") Signed-off-by: Radim Krčmář Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20250523104725.2894546-4-rkrcmar@ventanamicro.com Signed-off-by: Anup Patel commit 37c3714498fbc4abde82b8d9d1127c43e4271ac6 Author: Kever Yang Date: Tue May 6 10:57:10 2025 +0800 dt-bindings: watchdog: Add rk3562 compatible Add rockchip,rk3562-wdt for rk3562. Signed-off-by: Kever Yang Reviewed-by: Heiko Stuebner Acked-by: Rob Herring (Arm) Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20250506025715.33595-2-kever.yang@rock-chips.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 76d009ad9527573578f6b4f6432448e297a6a715 Author: Thomas Richard Date: Mon Apr 14 16:57:24 2025 +0200 dt-bindings: watchdog: fsl,scu-wdt: Document imx8qm Add an entry for 'fsl,imx8qm-sc-wdt' as imx8qm also contains the SCU watchdog block. Signed-off-by: Thomas Richard Acked-by: Rob Herring (Arm) Acked-by: Oliver Graute Reviewed-by: Frank Li Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20250414-imx8qm-watchdog-v2-1-449265a9da4e@bootlin.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit bd3f54ec559b554671e5a683e05794abe3a609df Author: Daniel Lezcano Date: Thu Apr 10 10:26:14 2025 +0200 watchdog: Add the Watchdog Timer for the NXP S32 platform The S32 platform has several Watchdog Timer available and tied with a CPU. The SWT0 is the only one which directly asserts the reset line, other SWT require an external setup to configure the reset behavior which is not part of this change. As a side note, in the NXP documentation, the s32g2 and s32g3 reference manuals refer the watchdog as the 'Software Timer Watchdog' where the name can be misleading as it is actually a hardware watchdog. The maximum watchdog timeout value depends on the clock feeding the SWT counter which is 32bits wide. On the s32g274-rb2, the clock has a rate of 51MHz which result on 83 seconds maximum timeout. The timeout can be specified via the device tree with the usual existing bindings 'timeout-sec' or via the module param timeout. The watchdog can be loaded with the 'nowayout' option, preventing the watchdog to be stopped. The watchdog can be started at boot time with the 'early-enable' option, thus letting the watchdog framework to service the watchdog counter. The watchdog support the magic character to stop when the userspace releases the device. Cc: Ghennadi Procopciuc Cc: Thomas Fossati Signed-off-by: Daniel Lezcano Tested-by: Alexandru-Catalin Ionita Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20250410082616.1855860-3-daniel.lezcano@linaro.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 45421ffbb4af3d29110c8c2ec92e06f3fec5096f Author: Daniel Lezcano Date: Thu Apr 10 10:26:13 2025 +0200 dt-bindings: watchdog: Add NXP Software Watchdog Timer Describe the Software Watchdog Timer available on the S32G platforms. Cc: Ghennadi Procopciuc Cc: Thomas Fossati Signed-off-by: Daniel Lezcano Reviewed-by: Rob Herring (Arm) Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20250410082616.1855860-2-daniel.lezcano@linaro.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 60625ff9085247f818eb0eb5f1512377ba511b33 Author: Krzysztof Kozlowski Date: Sun Apr 6 22:35:31 2025 +0200 watchdog: Correct kerneldoc warnings Correct kerneldoc syntax or drop kerneldoc entirely for function comments not being kerneldoc to fix warnings like: pretimeout_noop.c:19: warning: Function parameter or struct member 'wdd' not described in 'pretimeout_noop' Signed-off-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20250406203531.61322-2-krzysztof.kozlowski@linaro.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit b6f8a417e17f1929bb8e7e6ba9f4677f1f3ce364 Author: Krzysztof Kozlowski Date: Sun Apr 6 22:35:30 2025 +0200 watchdog: stm32: Fix wakeup source leaks on device unbind Device can be unbound or probe can fail, so driver must also release memory for the wakeup source. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20250406203531.61322-1-krzysztof.kozlowski@linaro.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 13b5fb3331436b6ec497763d733d3d749b161b01 Author: Krzysztof Kozlowski Date: Fri Apr 4 14:39:41 2025 +0200 watchdog: Do not enable by default during compile testing Enabling the compile test should not cause automatic enabling of all drivers. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20250404123941.362620-1-krzysztof.kozlowski@linaro.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit f8cdcc98c9833b8527121922b374148cafb8108d Author: Gustavo A. R. Silva Date: Thu Mar 27 11:12:11 2025 -0600 watchdog: cros-ec: Avoid -Wflex-array-member-not-at-end warning -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Use the `DEFINE_RAW_FLEX()` helper for on-stack definitions of a flexible structure where the size of the flexible-array member is known at compile-time, and refactor the rest of the code, accordingly. So, with these changes, fix the following warning: drivers/watchdog/cros_ec_wdt.c:29:40: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva Reviewed-by: Tzung-Bi Shih Reviewed-by: Kees Cook Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/Z-WG6_uhWsy_FCq3@kspp Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 325f510fcd9cda5a44bcb662b74ba4e3dabaca10 Author: Marcus Folkesson Date: Wed Mar 26 09:29:51 2025 +0100 watchdog: da9052_wdt: respect TWDMIN We have to wait at least the minimium time for the watchdog window (TWDMIN) before writings to the wdt register after the watchdog is activated. Otherwise the chip will assert TWD_ERROR and power down to reset mode. Signed-off-by: Marcus Folkesson Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20250326-da9052-fixes-v3-4-a38a560fef0e@gmail.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 8807f0afacc480ea9b8c143e765868907b5c4c47 Author: Marcus Folkesson Date: Wed Mar 26 09:29:50 2025 +0100 watchdog: da9052_wdt: do not disable wdt during probe If the watchog is started by the bootloader, we do not want the watchdog to be disabled. Signed-off-by: Marcus Folkesson Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20250326-da9052-fixes-v3-3-a38a560fef0e@gmail.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit ec90349a9433937e2fd83a57e16f40bce1fc1481 Author: Marcus Folkesson Date: Wed Mar 26 09:29:49 2025 +0100 watchdog: da9052_wdt: use timeout value from external inputs Introduce the `timeout` module parameter and pass it to watchdog_init_timeout(). If the parameter is not set or contains an invalid value, fallback on the `timeout-secs` devicetree property value. If none of the above is valid, go for the old default value. Signed-off-by: Marcus Folkesson Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20250326-da9052-fixes-v3-2-a38a560fef0e@gmail.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 776d14d201ae8b266208e0eae6510692bc58d9f2 Author: Marcus Folkesson Date: Wed Mar 26 09:29:48 2025 +0100 watchdog: da9052_wdt: add support for nowayout Add nowayout module parameter for not stopping the watchdog when userspace application quits. Signed-off-by: Marcus Folkesson Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20250326-da9052-fixes-v3-1-a38a560fef0e@gmail.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 628e124404b3db5e10e17228e680a2999018ab33 Author: Leo Yan Date: Mon Mar 31 18:27:59 2025 +0100 perf tests switch-tracking: Fix timestamp comparison The test might fail on the Arm64 platform with the error: # perf test -vvv "Track with sched_switch" Missing sched_switch events # The issue is caused by incorrect handling of timestamp comparisons. The comparison result, a signed 64-bit value, was being directly cast to an int, leading to incorrect sorting for sched events. The case does not fail everytime, usually I can trigger the failure after run 20 ~ 30 times: # while true; do perf test "Track with sched_switch"; done 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : FAILED! 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : FAILED! 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok I used cross compiler to build Perf tool on my host machine and tested on Debian / Juno board. Generally, I think this issue is not very specific to GCC versions. As both internal CI and my local env can reproduce the issue. My Host Build compiler: # aarch64-linux-gnu-gcc --version aarch64-linux-gnu-gcc (Ubuntu 13.3.0-6ubuntu2~24.04) 13.3.0 Juno Board: # lsb_release -a No LSB modules are available. Distributor ID: Debian Description: Debian GNU/Linux 12 (bookworm) Release: 12 Codename: bookworm Fix this by explicitly returning 0, 1, or -1 based on whether the result is zero, positive, or negative. Fixes: d44bc558297222d9 ("perf tests: Add a test for tracking with sched_switch") Reviewed-by: Ian Rogers Signed-off-by: Leo Yan Cc: Adrian Hunter Cc: James Clark Cc: Kan Liang Cc: Namhyung Kim Link: https://lore.kernel.org/r/20250331172759.115604-1-leo.yan@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 1b56e7d465cec2ac753f7aec281f7f949446ffcb Merge: 8b819afa494034 ae3392c0f12f17 Author: Greg Kroah-Hartman Date: Sat May 24 08:29:32 2025 +0200 Merge tag 'counter-updates-for-6.16b' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter into char-misc-next William writes: Second set of Counter updates for 6.16 Adds compatible for STM32MP25 SoC and enables respective encoder capability for stm32-timer-cnt. Implements watch_validate callback for microchip-tcb-capture. * tag 'counter-updates-for-6.16b' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter: counter: microchip-tcb-capture: Add watch validation support counter: stm32-timer-cnt: add support for stm32mp25 commit f8bb3ed3197966fb60bedcbdc126d2bd5bc0a77f Author: Dan Carpenter Date: Fri May 23 19:07:58 2025 +0300 drm/nouveau/tegra: Fix error pointer vs NULL return in nvkm_device_tegra_resource_addr() The nvkm_device_tegra_resource() function returns a mix of error pointers and NULL. The callers only expect it to return NULL on error. Change it to only return NULL. Fixes: 76b8f81a5b92 ("drm/nouveau: improve handling of 64-bit BARs") Signed-off-by: Dan Carpenter Reviewed-by: Timur Tabi Signed-off-by: Dave Airlie Link: https://lore.kernel.org/dri-devel/334404bdf60765cb5a8e855a74c688bc537531ee.camel@nvidia.com/T/#t commit 9caea9208fc3fbdbd4a41a2de8c6a0c969b030f9 Author: Kent Overstreet Date: Fri May 23 21:59:12 2025 -0400 bcachefs: Don't mount bs > ps without TRANSPARENT_HUGEPAGE Large folios aren't supported without TRANSPARENT_HUGEPAGE Signed-off-by: Kent Overstreet commit 3f2f028814abf68ce4d74bfd2627cb84d2afa389 Author: Kent Overstreet Date: Fri May 23 20:11:43 2025 -0400 bcachefs: Fix btree_iter_next_node() for new locking asserts We can't unlock a should_be_locked path unless we're in a transaction restart. Signed-off-by: Kent Overstreet commit 521f9584c2bd48198ac9d9b99a372b1306f3bb97 Author: Kent Overstreet Date: Fri May 23 14:03:06 2025 -0400 bcachefs: Ensure we don't use a blacklisted journal seq Different versions differ on the size of the blacklist range; it is theoretically possible that we could end up with blacklisted journal sequence numbers newer than the newest seq we find in the journal, and pick a new start seq that's blacklisted. Explicitly check for this in bch2_fs_journal_start(). Signed-off-by: Kent Overstreet commit 9b133c0d74b17db2dc0d2d70b6591b0ebb604463 Author: Kent Overstreet Date: Fri May 23 14:19:25 2025 -0400 bcachefs: Small check_fix_ptr fixes We don't want to change the bucket gen, on gen mismatch: it's possible to have multiple btree nodes with different gens in the same bucket that we want to keep, if we have to recover from btree node scan. It's also not necessary to set g->gen_valid; add a comment to that effect. Signed-off-by: Kent Overstreet commit cade003209cfe728de2ef880d5704cc322a7ce1f Author: Kent Overstreet Date: Fri May 23 18:31:53 2025 -0400 bcachefs: Fix opts.recovery_pass_last This was lost in the giant recovery pass rework - but it's used heavily by bcachefs subcommand utilities. Signed-off-by: Kent Overstreet commit f351d91edd507391518a4f5870185fa5bf38446b Author: Kent Overstreet Date: Fri May 23 18:30:10 2025 -0400 bcachefs: Fix allocate -> self healing path When we go to allocate and find taht a bucket in the freespace btree is actually allocated, we're supposed to return nonzero to tell the allocator to skip it. This fixes an emergency read only due to a bucket/ptr gen mismatch - we also don't return the correct bucket gen when this happens. Signed-off-by: Kent Overstreet commit 016c4b48b86d18b14f8a45beabefc5ccf7caf594 Author: Kent Overstreet Date: Fri May 23 13:13:44 2025 -0400 bcachefs: Fix endianness in casefold check/repair Fixes: 010c89468134 ("bcachefs: Check for casefolded dirents in non casefolded dirs") Signed-off-by: Kent Overstreet commit 9bba618694cc905b898661c18e3e40955573ef5e Merge: a5806cd506af5a 108a76779829a5 Author: Arnd Bergmann Date: Fri May 23 23:59:45 2025 +0200 Merge tag 'riscv-sophgo-dt-for-v6.16' of https://github.com/sophgo/linux into soc/late RISC-V Devicetrees for v6.16 Sophgo: Add Pinctrl & SPI support for SG2042 SoC, and refactor the dts of cv18xx to facilitate adding support for arm core later (SG200X has two cores, one is RISC-V and another is ARM64). Also add initial support for Sophgo SG2044/SRD3-10. SRD3-10 board bases on Sophgo SG2044 SoC and initial support includes uart only. This part of the changes involves some modifications to dts and bindings. Signed-off-by: Chen Wang * tag 'riscv-sophgo-dt-for-v6.16' of https://github.com/sophgo/linux: riscv: dts: sophgo: switch precise compatible for existed clock device for CV18XX riscv: dts: sophgo: Add initial device tree of Sophgo SRD3-10 dt-bindings: riscv: sophgo: Add SG2044 compatible string dt-bindings: interrupt-controller: Add Sophgo SG2044 PLIC dt-bindings: interrupt-controller: Add Sophgo SG2044 CLINT mswi riscv: dts: sopgho: use SOC_PERIPHERAL_IRQ to calculate interrupt number riscv: dts: sophgo: rename header file cv18xx.dtsi to cv180x.dtsi riscv: dts: sophgo: Move riscv cpu definition to a separate file riscv: dts: sophgo: Move all soc specific device into soc dtsi file riscv: sophgo: dts: Add spi controller for SG2042 riscv: dts: sophgo: sg2042: add pinctrl support Link: https://lore.kernel.org/r/MA0P287MB22622FA23ECF9B9216735FA0FE9CA@MA0P287MB2262.INDP287.PROD.OUTLOOK.COM Signed-off-by: Arnd Bergmann commit 002619c8736ca2125070ffef74d4617ba2406620 Merge: 73230fffcbbe05 879ede53958f7b Author: Dave Airlie Date: Sat May 24 07:45:40 2025 +1000 Merge tag 'drm-xe-next-fixes-2025-05-23' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next Driver Changes: - Fix a SLPC debugfs NULL pointer dereference (Aradhya) - Fix an arbitrary value sysfs read return (Aradhya) Signed-off-by: Dave Airlie From: Thomas Hellstrom Link: https://lore.kernel.org/r/aDAxCgfm7HJbrchD@fedora commit 73230fffcbbe0559f2334d284711667eac8d92fd Merge: c4f8ac095fc910 f4c7baa0699b69 Author: Dave Airlie Date: Sat May 24 07:43:11 2025 +1000 Merge tag 'drm-intel-next-fixes-2025-05-22' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next - Fix for Thunderbolt sink disconnect on MTL/ARL/LNL - Fix for DDI port clock select mask on PTL+ - Add error checks for alloc_ordered_workqueue() and alloc_workqueue() in display Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://lore.kernel.org/r/aC7LQUtxXKgOVTVt@jlahtine-mobl commit 4673dec88da803fa23f1af9e04761683a30dd6aa Author: Dan Carpenter Date: Fri May 23 19:09:03 2025 +0300 drm/panel: nt37801: Fix IS_ERR() vs NULL check in probe() The devm_drm_panel_alloc() function returns error pointers, it doesn't return NULL. Update the check to match. Fixes: 4fca6849864d ("drm/panel: Add Novatek NT37801 panel driver") Signed-off-by: Dan Carpenter Reviewed-by: Krzysztof Kozlowski Reviewed-by: Jessica Zhang Link: https://lore.kernel.org/r/aDCdn9r_ZAUTRpWn@stanley.mountain Signed-off-by: Dmitry Baryshkov commit 022546cdbf26ec6f42af7e2706702d5703df42f6 Author: Arnd Bergmann Date: Fri May 23 14:11:22 2025 +0200 drm/panel: nt37801: select CONFIG_DRM_DISPLAY_DSC_HELPER The newly added driver uses the DSC helper module, but does not select its Kconfig symbol, so configurations are possible that cause a link failure: ERROR: modpost: "drm_dsc_pps_payload_pack" [drivers/gpu/drm/panel/panel-novatek-nt37801.ko] undefined! Fixes: 4fca6849864d ("drm/panel: Add Novatek NT37801 panel driver") Signed-off-by: Arnd Bergmann Reviewed-by: Dmitry Baryshkov Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250523121127.2269693-1-arnd@kernel.org Signed-off-by: Dmitry Baryshkov commit 9f153b7fb5ae45c7d426851f896487927f40e501 Merge: 6eed708a569370 be9b359e056a78 Author: Dave Jiang Date: Fri May 23 13:26:24 2025 -0700 Merge branch 'for-6.16/cxl-features-ras' into cxl-for-next Add CXL RAS Features support. Features include "patrol scrub control", "error check scrub", "perform maintenance", and "memory sparing". This support connects the RAS Featurs to EDAC. commit be9b359e056a78bb6cc2e17cf457338f6aef57f9 Author: Shiju Jose Date: Wed May 21 13:47:46 2025 +0100 cxl/edac: Add CXL memory device soft PPR control feature Post Package Repair (PPR) maintenance operations may be supported by CXL devices that implement CXL.mem protocol. A PPR maintenance operation requests the CXL device to perform a repair operation on its media. For example, a CXL device with DRAM components that support PPR features may implement PPR Maintenance operations. DRAM components may support two types of PPR, hard PPR (hPPR), for a permanent row repair, and Soft PPR (sPPR), for a temporary row repair. Soft PPR is much faster than hPPR, but the repair is lost with a power cycle. During the execution of a PPR Maintenance operation, a CXL memory device: - May or may not retain data - May or may not be able to process CXL.mem requests correctly, including the ones that target the DPA involved in the repair. These CXL Memory Device capabilities are specified by Restriction Flags in the sPPR Feature and hPPR Feature. Soft PPR maintenance operation may be executed at runtime, if data is retained and CXL.mem requests are correctly processed. For CXL devices with DRAM components, hPPR maintenance operation may be executed only at boot because typically data may not be retained with hPPR maintenance operation. When a CXL device identifies error on a memory component, the device may inform the host about the need for a PPR maintenance operation by using an Event Record, where the Maintenance Needed flag is set. The Event Record specifies the DPA that should be repaired. A CXL device may not keep track of the requests that have already been sent and the information on which DPA should be repaired may be lost upon power cycle. The userspace tool requests for maintenance operation if the number of corrected error reported on a CXL.mem media exceeds error threshold. CXL spec 3.2 section 8.2.10.7.1.2 describes the device's sPPR (soft PPR) maintenance operation and section 8.2.10.7.1.3 describes the device's hPPR (hard PPR) maintenance operation feature. CXL spec 3.2 section 8.2.10.7.2.1 describes the sPPR feature discovery and configuration. CXL spec 3.2 section 8.2.10.7.2.2 describes the hPPR feature discovery and configuration. Add support for controlling CXL memory device soft PPR (sPPR) feature. Register with EDAC driver, which gets the memory repair attr descriptors from the EDAC memory repair driver and exposes sysfs repair control attributes for PRR to the userspace. For example CXL PPR control for the CXL mem0 device is exposed in /sys/bus/edac/devices/cxl_mem0/mem_repairX/ Add checks to ensure the memory to be repaired is offline and originates from a CXL DRAM or CXL gen_media error record reported in the current boot, before requesting a PPR operation on the device. Note: Tested with QEMU patch for CXL PPR feature. https://lore.kernel.org/linux-cxl/20250509172229.726-1-shiju.jose@huawei.com/T/#m70b2b010f43f7f4a6f9acee5ec9008498bf292c3 Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Signed-off-by: Shiju Jose Reviewed-by: Alison Schofield Acked-by: Dan Williams Link: https://patch.msgid.link/20250521124749.817-9-shiju.jose@huawei.com Signed-off-by: Dave Jiang commit 079e5c56a5c41d285068939ff7b0041ab10386fa Author: Mykyta Yatsenko Date: Fri May 23 19:17:05 2025 +0100 bpf: Fix error return value in bpf_copy_from_user_dynptr On error, copy_from_user returns number of bytes not copied to destination, but current implementation of copy_user_data_sleepable does not handle that correctly and returns it as error value, which may confuse user, expecting meaningful negative error value. Fixes: a498ee7576de ("bpf: Implement dynptr copy kfuncs") Reported-by: Dan Carpenter Signed-off-by: Mykyta Yatsenko Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250523181705.261585-1-mykyta.yatsenko5@gmail.com commit 588ca944c27729c7f950d1f44c6d6700a919969a Author: Shiju Jose Date: Wed May 21 13:47:45 2025 +0100 cxl/edac: Add CXL memory device memory sparing control feature Memory sparing is defined as a repair function that replaces a portion of memory with a portion of functional memory at that same DPA. The subclasses for this operation vary in terms of the scope of the sparing being performed. The cacheline sparing subclass refers to a sparing action that can replace a full cacheline. Row sparing is provided as an alternative to PPR sparing functions and its scope is that of a single DDR row. As per CXL r3.2 Table 8-125 foot note 1. Memory sparing is preferred over PPR when possible. Bank sparing allows an entire bank to be replaced. Rank sparing is defined as an operation in which an entire DDR rank is replaced. Memory sparing maintenance operations may be supported by CXL devices that implement CXL.mem protocol. A sparing maintenance operation requests the CXL device to perform a repair operation on its media. For example, a CXL device with DRAM components that support memory sparing features may implement sparing maintenance operations. The host may issue a query command by setting query resources flag in the input payload (CXL spec 3.2 Table 8-120) to determine availability of sparing resources for a given address. In response to a query request, the device shall report the resource availability by producing the memory sparing event record (CXL spec 3.2 Table 8-60) in which the Channel, Rank, Nibble Mask, Bank Group, Bank, Row, Column, Sub-Channel fields are a copy of the values specified in the request. During the execution of a sparing maintenance operation, a CXL memory device: - may not retain data - may not be able to process CXL.mem requests correctly. These CXL memory device capabilities are specified by restriction flags in the memory sparing feature readable attributes. When a CXL device identifies error on a memory component, the device may inform the host about the need for a memory sparing maintenance operation by using DRAM event record, where the 'maintenance needed' flag may set. The event record contains some of the DPA, Channel, Rank, Nibble Mask, Bank Group, Bank, Row, Column, Sub-Channel fields that should be repaired. The userspace tool requests for maintenance operation if the 'maintenance needed' flag set in the CXL DRAM error record. CXL spec 3.2 section 8.2.10.7.1.4 describes the device's memory sparing maintenance operation feature. CXL spec 3.2 section 8.2.10.7.2.3 describes the memory sparing feature discovery and configuration. Add support for controlling CXL memory device memory sparing feature. Register with EDAC driver, which gets the memory repair attr descriptors from the EDAC memory repair driver and exposes sysfs repair control attributes for memory sparing to the userspace. For example CXL memory sparing control for the CXL mem0 device is exposed in /sys/bus/edac/devices/cxl_mem0/mem_repairX/ Use case ======== 1. CXL device identifies a failure in a memory component, report to userspace in a CXL DRAM trace event with DPA and other attributes of memory to repair such as channel, rank, nibble mask, bank Group, bank, row, column, sub-channel. 2. Rasdaemon process the trace event and may issue query request in sysfs check resources available for memory sparing if either of the following conditions met. - 'maintenance needed' flag set in the event record. - 'threshold event' flag set for CVME threshold feature. - When the number of corrected error reported on a CXL.mem media to the userspace exceeds the threshold value for corrected error count defined by the userspace policy. 3. Rasdaemon process the memory sparing trace event and issue repair request for memory sparing. Kernel CXL driver shall report memory sparing event record to the userspace with the resource availability in order rasdaemon to process the event record and issue a repair request in sysfs for the memory sparing operation in the CXL device. Note: Based on the feedbacks from the community 'query' sysfs attribute is removed and reporting memory sparing error record to the userspace are not supported. Instead userspace issues sparing operation and kernel does the same to the CXL memory device, when 'maintenance needed' flag set in the DRAM event record. Add checks to ensure the memory to be repaired is offline and if online, then originates from a CXL DRAM error record reported in the current boot before requesting a memory sparing operation on the device. Note: Tested memory sparing feature control with QEMU patch "hw/cxl: Add emulation for memory sparing control feature" https://lore.kernel.org/linux-cxl/20250509172229.726-1-shiju.jose@huawei.com/T/#m5f38512a95670d75739f9dad3ee91b95c7f5c8d6 Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Signed-off-by: Shiju Jose Reviewed-by: Alison Schofield Acked-by: Dan Williams Link: https://patch.msgid.link/20250521124749.817-8-shiju.jose@huawei.com Signed-off-by: Dave Jiang commit 0b5ccb0de1e2cf83f18f012f0e6ba4365be9dd4b Author: Shiju Jose Date: Wed May 21 13:47:44 2025 +0100 cxl/edac: Support for finding memory operation attributes from the current boot Certain operations on memory, such as memory repair, are permitted only when the address and other attributes for the operation are from the current boot. This is determined by checking whether the memory attributes for the operation match those in the CXL gen_media or CXL DRAM memory event records reported during the current boot. The CXL event records must be backed up because they are cleared in the hardware after being processed by the kernel. Support is added for storing CXL gen_media or CXL DRAM memory event records in xarrays. Old records are deleted when they expire or when there is an overflow and which depends on platform correctly report Event Record Timestamp field of CXL spec Table 8-55 Common Event Record Format. Additionally, helper functions are implemented to find a matching record in the xarray storage based on the memory attributes and repair type. Add validity check, when matching attributes for sparing, using the validity flag in the DRAM event record, to ensure that all required attributes for a requested repair operation are valid and set. Reviewed-by: Dave Jiang Co-developed-by: Jonathan Cameron Signed-off-by: Jonathan Cameron Signed-off-by: Shiju Jose Reviewed-by: Alison Schofield Acked-by: Dan Williams Link: https://patch.msgid.link/20250521124749.817-7-shiju.jose@huawei.com Signed-off-by: Dave Jiang commit 077ee5f7ddcfd482ecac504b3f711aa5e4c049fe Author: Shiju Jose Date: Wed May 21 13:47:43 2025 +0100 cxl/edac: Add support for PERFORM_MAINTENANCE command Add support for PERFORM_MAINTENANCE command. CXL spec 3.2 section 8.2.10.7.1 describes the Perform Maintenance command. This command requests the device to execute the maintenance operation specified by the maintenance operation class and the maintenance operation subclass. Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Signed-off-by: Shiju Jose Reviewed-by: Alison Schofield Acked-by: Dan Williams Link: https://patch.msgid.link/20250521124749.817-6-shiju.jose@huawei.com Signed-off-by: Dave Jiang commit 85fb6a16ad14eab95e98bbba4f7d361f5cb83746 Author: Shiju Jose Date: Wed May 21 13:47:42 2025 +0100 cxl/edac: Add CXL memory device ECS control feature CXL spec 3.2 section 8.2.10.9.11.2 describes the DDR5 ECS (Error Check Scrub) control feature. The Error Check Scrub (ECS) is a feature defined in JEDEC DDR5 SDRAM Specification (JESD79-5) and allows the DRAM to internally read, correct single-bit errors, and write back corrected data bits to the DRAM array while providing transparency to error counts. The ECS control allows the requester to change the log entry type, the ECS threshold count (provided the request falls within the limits specified in DDR5 mode registers), switch between codeword mode and row count mode, and reset the ECS counter. Register with EDAC device driver, which retrieves the ECS attribute descriptors from the EDAC ECS and exposes the ECS control attributes to userspace via sysfs. For example, the ECS control for the memory media FRU0 in CXL mem0 device is located at /sys/bus/edac/devices/cxl_mem0/ecs_fru0/ Reviewed-by: Jonathan Cameron Reviewed-by: Fan Ni Reviewed-by: Dave Jiang Signed-off-by: Shiju Jose Reviewed-by: Alison Schofield Acked-by: Dan Williams Link: https://patch.msgid.link/20250521124749.817-5-shiju.jose@huawei.com Signed-off-by: Dave Jiang commit 0c6e6f1357cbdc158d555346a728aa4aeb0d7011 Author: Shiju Jose Date: Wed May 21 13:47:41 2025 +0100 cxl/edac: Add CXL memory device patrol scrub control feature CXL spec 3.2 section 8.2.10.9.11.1 describes the device patrol scrub control feature. The device patrol scrub proactively locates and makes corrections to errors in regular cycle. Allow specifying the number of hours within which the patrol scrub must be completed, subject to minimum and maximum limits reported by the device. Also allow disabling scrub allowing trade-off error rates against performance. Add support for patrol scrub control on CXL memory devices. Register with the EDAC device driver, which retrieves the scrub attribute descriptors from EDAC scrub and exposes the sysfs scrub control attributes to userspace. For example, scrub control for the CXL memory device "cxl_mem0" is exposed in /sys/bus/edac/devices/cxl_mem0/scrubX/. Additionally, add support for region-based CXL memory patrol scrub control. CXL memory regions may be interleaved across one or more CXL memory devices. For example, region-based scrub control for "cxl_region1" is exposed in /sys/bus/edac/devices/cxl_region1/scrubX/. [dj: A few formatting fixes from Jonathan] Reviewed-by: Dave Jiang Co-developed-by: Jonathan Cameron Signed-off-by: Jonathan Cameron Signed-off-by: Shiju Jose Reviewed-by: Alison Schofield Acked-by: Dan Williams Link: https://patch.msgid.link/20250521124749.817-4-shiju.jose@huawei.com Signed-off-by: Dave Jiang commit f76e0bbc8bc34c55fd5da569b9e1126cf42b09ec Author: Shiju Jose Date: Wed May 21 13:47:40 2025 +0100 cxl: Update prototype of function get_support_feature_info() Add following changes to function get_support_feature_info() 1. Make generic to share between cxl-fwctl and cxl-edac paths. 2. Rename get_support_feature_info() to cxl_feature_info() 3. Change parameter const struct fwctl_rpc_cxl *rpc_in to const uuid_t *uuid. Suggested-by: Dan Williams Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Signed-off-by: Shiju Jose Reviewed-by: Fan Ni Reviewed-by: Alison Schofield Acked-by: Dan Williams Link: https://patch.msgid.link/20250521124749.817-3-shiju.jose@huawei.com Signed-off-by: Dave Jiang commit ee4f03245554d86592a926080091d706395578f7 Author: Shiju Jose Date: Wed May 21 13:47:39 2025 +0100 EDAC: Update documentation for the CXL memory patrol scrub control feature Update the Documentation/edac/scrub.rst to include use cases and policies for CXL memory device-based, CXL region-based patrol scrub control and CXL Error Check Scrub (ECS). Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Signed-off-by: Shiju Jose Reviewed-by: Fan Ni Reviewed-by: Alison Schofield Acked-by: Dan Williams Link: https://patch.msgid.link/20250521124749.817-2-shiju.jose@huawei.com Signed-off-by: Dave Jiang commit 46bc169f6f07eca9a7d2346c703ea59bff385e22 Author: Johan Hovold Date: Wed Apr 2 15:26:34 2025 +0200 arm64: Kconfig: switch to HAVE_PWRCTRL The HAVE_PWRCTRL symbol has been renamed to reflect the pwrctrl framework name. Switch to the non-deprecated symbol. Signed-off-by: Johan Hovold Signed-off-by: Krzysztof Wilczyński Signed-off-by: Bjorn Helgaas Acked-by: Bartosz Golaszewski Link: https://patch.msgid.link/20250402132634.18065-5-johan+linaro@kernel.org commit d5fc1909349e1999427c86de31e98c4fa6e0b721 Author: Johan Hovold Date: Wed Apr 2 15:26:33 2025 +0200 wifi: ath12k: switch to PCI_PWRCTRL_PWRSEQ The PCI_PWRCTRL_PWRSEQ and HAVE_PWRCTRL symbols have been renamed to reflect the pwrctrl framework name. Switch to the non-deprecated symbols. Signed-off-by: Johan Hovold Signed-off-by: Krzysztof Wilczyński Signed-off-by: Bjorn Helgaas Acked-by: Jeff Johnson # drivers/net/wireless/ath/... Acked-by: Manivannan Sadhasivam Acked-by: Bartosz Golaszewski Link: https://patch.msgid.link/20250402132634.18065-4-johan+linaro@kernel.org commit 52ddd0265bca80be19438f184cc9ce0bf4cf5a4f Author: Johan Hovold Date: Wed Apr 2 15:26:32 2025 +0200 wifi: ath11k: switch to PCI_PWRCTRL_PWRSEQ The PCI_PWRCTRL_PWRSEQ and HAVE_PWRCTRL symbols have been renamed to reflect the pwrctrl framework name. Switch to the non-deprecated symbols. Signed-off-by: Johan Hovold Signed-off-by: Krzysztof Wilczyński Signed-off-by: Bjorn Helgaas Acked-by: Jeff Johnson # drivers/net/wireless/ath/... Acked-by: Manivannan Sadhasivam Acked-by: Bartosz Golaszewski Link: https://patch.msgid.link/20250402132634.18065-3-johan+linaro@kernel.org commit 13bbf6a5f065f235bba69f6c21272d992ed5d5d0 Author: Johan Hovold Date: Wed Apr 2 15:26:31 2025 +0200 PCI/pwrctrl: Rename pwrctrl Kconfig symbols and slot module Commits b88cbaaa6fa1 ("PCI/pwrctrl: Rename pwrctl files to pwrctrl") and 3f925cd62874 ("PCI/pwrctrl: Rename pwrctrl functions and structures") renamed the "pwrctl" framework to "pwrctrl" for consistency reasons. Rename also the Kconfig symbols so that they reflect the new name while adding entries for the deprecated ones. The old symbols can be removed once everything that depends on them has been updated. Note that no deprecated symbol is added for the new slot driver to avoid having to add a user visible option. Rename the new slot module to reflect the framework name and match the other pwrctrl modules. Signed-off-by: Johan Hovold Signed-off-by: Krzysztof Wilczyński Signed-off-by: Bjorn Helgaas Acked-by: Manivannan Sadhasivam Acked-by: Bartosz Golaszewski Link: https://patch.msgid.link/20250402132634.18065-2-johan+linaro@kernel.org commit 8b926f237743f020518162c62b93cb7107a2b5eb Author: Brian Norris Date: Wed Apr 9 11:53:13 2025 -0700 PCI/pwrctrl: Cancel outstanding rescan work when unregistering It's possible to trigger use-after-free here by: (a) forcing rescan_work_func() to take a long time and (b) utilizing a pwrctrl driver that may be unloaded for some reason Cancel outstanding work to ensure it is finished before we allow our data structures to be cleaned up. [bhelgaas: tidy commit log] Fixes: 8f62819aaace ("PCI/pwrctl: Rescan bus on a separate thread") Signed-off-by: Brian Norris Signed-off-by: Brian Norris Signed-off-by: Krzysztof Wilczyński Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam Acked-by: Bartosz Golaszewski Cc: Konrad Dybcio Link: https://patch.msgid.link/20250409115313.1.Ia319526ed4ef06bec3180378c9a008340cec9658@changeid commit 534e9cf3782f1bd6adf0bd7d17ff414ea12a6bf2 Merge: aca89f1be6bd31 43a38a0ff8c63e Author: Takashi Iwai Date: Fri May 23 20:45:16 2025 +0200 Merge tag 'asoc-v6.16-2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-next ASoC: Additional v6.16 updates A couple more updates on top of the last set I sent you, a new driver for the ES8375 and a fix for the Cirrus KUnit tests from Jaroslav. commit 059717c2ba1f745f35f4bbb8991e408c12031f1e Author: Anil S Keshavamurthy Date: Fri May 23 13:20:01 2025 -0400 ACPI: MRRM: Fix default max memory region Per the spec, the default max memory region must be 1 covering all system memory. When platform does not provide ACPI MRRM table or when CONFIG_ACPI is opted out, the acpi_mrrm_max_mem_region() function defaults to returning 1 region complying to RDT spec. Signed-off-by: Anil S Keshavamurthy Reviewed-by: Tony Luck Link: https://patch.msgid.link/20250523172001.1761634-1-anil.s.keshavamurthy@intel.com Signed-off-by: Rafael J. Wysocki commit bfccacdf93f6d80e51f070426d4942e7693f2716 Merge: 8259eb0e06d8f6 3c0421c93ce4ff Author: Andrii Nakryiko Date: Fri May 23 10:06:28 2025 -0700 Merge branch 'allow-mmap-of-sys-kernel-btf-vmlinux' Lorenz Bauer says: ==================== Allow mmap of /sys/kernel/btf/vmlinux I'd like to cut down the memory usage of parsing vmlinux BTF in ebpf-go. With some upcoming changes the library is sitting at 5MiB for a parse. Most of that memory is simply copying the BTF blob into user space. By allowing vmlinux BTF to be mmapped read-only into user space I can cut memory usage by about 75%. Signed-off-by: Lorenz Bauer --- Changes in v5: - Fix error return of btf_parse_raw_mmap (Andrii) - Link to v4: https://lore.kernel.org/r/20250510-vmlinux-mmap-v4-0-69e424b2a672@isovalent.com Changes in v4: - Go back to remap_pfn_range for aarch64 compat - Dropped btf_new_no_copy (Andrii) - Fixed nits in selftests (Andrii) - Clearer error handling in the mmap handler (Andrii) - Fixed build on s390 - Link to v3: https://lore.kernel.org/r/20250505-vmlinux-mmap-v3-0-5d53afa060e8@isovalent.com Changes in v3: - Remove slightly confusing calculation of trailing (Alexei) - Use vm_insert_page (Alexei) - Simplified libbpf code - Link to v2: https://lore.kernel.org/r/20250502-vmlinux-mmap-v2-0-95c271434519@isovalent.com Changes in v2: - Use btf__new in selftest - Avoid vm_iomap_memory in btf_vmlinux_mmap - Add VM_DONTDUMP - Add support to libbpf - Link to v1: https://lore.kernel.org/r/20250501-vmlinux-mmap-v1-0-aa2724572598@isovalent.com --- ==================== Link: https://patch.msgid.link/20250520-vmlinux-mmap-v5-0-e8c941acc414@isovalent.com Signed-off-by: Andrii Nakryiko commit 3c0421c93ce4ff0f5f2612666122c34fc941d569 Author: Lorenz Bauer Date: Tue May 20 14:01:19 2025 +0100 libbpf: Use mmap to parse vmlinux BTF from sysfs Teach libbpf to use mmap when parsing vmlinux BTF from /sys. We don't apply this to fall-back paths on the regular file system because there is no way to ensure that modifications underlying the MAP_PRIVATE mapping are not visible to the process. Signed-off-by: Lorenz Bauer Signed-off-by: Andrii Nakryiko Tested-by: Alan Maguire Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250520-vmlinux-mmap-v5-3-e8c941acc414@isovalent.com commit 828226b69ff54d57afd7b3cb56095ef8186ba290 Author: Lorenz Bauer Date: Tue May 20 14:01:18 2025 +0100 selftests: bpf: Add a test for mmapable vmlinux BTF Add a basic test for the ability to mmap /sys/kernel/btf/vmlinux. Ensure that the data is valid BTF and that it is padded with zero. Signed-off-by: Lorenz Bauer Signed-off-by: Andrii Nakryiko Tested-by: Alan Maguire Link: https://lore.kernel.org/bpf/20250520-vmlinux-mmap-v5-2-e8c941acc414@isovalent.com commit a539e2a6d51d1c12d89eec149ccc72ec561639bc Author: Lorenz Bauer Date: Tue May 20 14:01:17 2025 +0100 btf: Allow mmap of vmlinux btf User space needs access to kernel BTF for many modern features of BPF. Right now each process needs to read the BTF blob either in pieces or as a whole. Allow mmaping the sysfs file so that processes can directly access the memory allocated for it in the kernel. remap_pfn_range is used instead of vm_insert_page due to aarch64 compatibility issues. Signed-off-by: Lorenz Bauer Signed-off-by: Andrii Nakryiko Tested-by: Alan Maguire Reviewed-by: Shakeel Butt Link: https://lore.kernel.org/bpf/20250520-vmlinux-mmap-v5-1-e8c941acc414@isovalent.com commit 96959283a58d91ae20d025546f00e16f0a555208 Author: Michael Kelley Date: Mon May 19 21:01:43 2025 -0700 Drivers: hv: Always select CONFIG_SYSFB for Hyper-V guests The Hyper-V host provides guest VMs with a range of MMIO addresses that guest VMBus drivers can use. The VMBus driver in Linux manages that MMIO space, and allocates portions to drivers upon request. As part of managing that MMIO space in a Generation 2 VM, the VMBus driver must reserve the portion of the MMIO space that Hyper-V has designated for the synthetic frame buffer, and not allocate this space to VMBus drivers other than graphics framebuffer drivers. The synthetic frame buffer MMIO area is described by the screen_info data structure that is passed to the Linux kernel at boot time, so the VMBus driver must access screen_info for Generation 2 VMs. (In Generation 1 VMs, the framebuffer MMIO space is communicated to the guest via a PCI pseudo-device, and access to screen_info is not needed.) In commit a07b50d80ab6 ("hyperv: avoid dependency on screen_info") the VMBus driver's access to screen_info is restricted to when CONFIG_SYSFB is enabled. CONFIG_SYSFB is typically enabled in kernels built for Hyper-V by virtue of having at least one of CONFIG_FB_EFI, CONFIG_FB_VESA, or CONFIG_SYSFB_SIMPLEFB enabled, so the restriction doesn't usually affect anything. But it's valid to have none of these enabled, in which case CONFIG_SYSFB is not enabled, and the VMBus driver is unable to properly reserve the framebuffer MMIO space for graphics framebuffer drivers. The framebuffer MMIO space may be assigned to some other VMBus driver, with undefined results. As an example, if a VM is using a PCI pass-thru NVMe controller to host the OS disk, the PCI NVMe controller is probed before any graphics devices, and the NVMe controller is assigned a portion of the framebuffer MMIO space. Hyper-V reports an error to Linux during the probe, and the OS disk fails to get setup. Then Linux fails to boot in the VM. Fix this by having CONFIG_HYPERV always select SYSFB. Then the VMBus driver in a Gen 2 VM can always reserve the MMIO space for the graphics framebuffer driver, and prevent the undefined behavior. But don't select SYSFB when building for HYPERV_VTL_MODE as VTLs other than VTL 0 don't have a framebuffer and aren't subject to the issue. Adding SYSFB in such cases is harmless, but would increase the image size for no purpose. Fixes: a07b50d80ab6 ("hyperv: avoid dependency on screen_info") Signed-off-by: Michael Kelley Reviewed-by: Saurabh Sengar Link: https://lore.kernel.org/stable/20250520040143.6964-1-mhklinux%40outlook.com Link: https://lore.kernel.org/r/20250520040143.6964-1-mhklinux@outlook.com Signed-off-by: Wei Liu Message-ID: <20250520040143.6964-1-mhklinux@outlook.com> commit e89f91222ab3aef84af316567ebc815a10313f3a Author: Michael Kelley Date: Wed May 14 15:55:08 2025 -0700 Drivers: hv: vmbus: Add comments about races with "channels" sysfs dir The VMBus driver code has some inherent races in the creation of the "channels" sysfs subdirectory and its per-channel numbered subdirectories. These races have not generally been recognized or understood. Add some comments to call them out. No code changes. Signed-off-by: Michael Kelley Link: https://lore.kernel.org/r/20250514225508.52629-1-mhklinux@outlook.com Signed-off-by: Wei Liu Message-ID: <20250514225508.52629-1-mhklinux@outlook.com> commit f77276d1c9597ade06f3facbceb51bd1abf1bd5c Author: Michael Kelley Date: Mon May 19 21:44:35 2025 -0700 Documentation: hyperv: Update VMBus doc with new features and info Starting in the 6.15 kernel, VMBus interrupts are automatically assigned away from a CPU that is being taken offline. Add documentation describing this case. Also add details of Hyper-V behavior when the primary channel of a VMBus device is closed as the result of unbinding the device's driver. This behavior has not changed, but it was not previously documented. Signed-off-by: Michael Kelley Link: https://lore.kernel.org/r/20250520044435.7734-1-mhklinux@outlook.com Signed-off-by: Wei Liu Message-ID: <20250520044435.7734-1-mhklinux@outlook.com> commit dd1af0c4c56d7c60eaf7f30f9d816ed1befbd7d7 Author: Michael Kelley Date: Tue May 13 21:44:40 2025 -0700 PCI: hv: Remove unnecessary flex array in struct pci_packet struct pci_packet contains a "message" field that is a flex array of struct pci_message. struct pci_packet is usually followed by a second struct in a containing struct that is defined locally in individual functions in pci-hyperv.c. As such, the compiler flag -Wflex-array-member-not-at-end (introduced in gcc-14) generates multiple warnings such as: drivers/pci/controller/pci-hyperv.c:3809:35: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] The Linux kernel intends to introduce this compiler flag in standard builds, so the current code is problematic in generating these warnings. The "message" field is used only to locate the start of the second struct, and not as an array. Because the second struct can be addressed directly, the "message" field is not really necessary. Rather than try to fix its usage to meet the requirements of -Wflex-array-member-not-at-end, just eliminate the field and either directly reference the second struct, or use "pkt + 1" when "pkt" is dynamically allocated. Reported-by: Gustavo A. R. Silva Signed-off-by: Michael Kelley Link: https://lore.kernel.org/r/20250514044440.48924-1-mhklinux@outlook.com Signed-off-by: Wei Liu Message-ID: <20250514044440.48924-1-mhklinux@outlook.com> commit cd1769e1fef9ab8fbdfafb67b2c327418867afb6 Author: Long Li Date: Mon May 5 17:56:37 2025 -0700 Drivers: hv: Remove hv_alloc/free_* helpers There are no users for those functions, remove them. Signed-off-by: Long Li Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/1746492997-4599-6-git-send-email-longli@linuxonhyperv.com Signed-off-by: Wei Liu Message-ID: <1746492997-4599-6-git-send-email-longli@linuxonhyperv.com> commit a60822bc11b12e6c43cf25a610174ac44f744b27 Author: Long Li Date: Mon May 5 17:56:36 2025 -0700 Drivers: hv: Use kzalloc for panic page allocation To prepare for removal of hv_alloc_* and hv_free* functions, use kzalloc/kfree directly for panic reporting page. Signed-off-by: Long Li Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/1746492997-4599-5-git-send-email-longli@linuxonhyperv.com Signed-off-by: Wei Liu Message-ID: <1746492997-4599-5-git-send-email-longli@linuxonhyperv.com> commit 0315fef2aff9f251ddef8a4b53db9187429c3553 Author: Long Li Date: Mon May 5 17:56:35 2025 -0700 uio_hv_generic: Align ring size to system page Following the ring header, the ring data should align to system page boundary. Adjust the size if necessary. Cc: stable@vger.kernel.org Fixes: 95096f2fbd10 ("uio-hv-generic: new userspace i/o driver for VMBus") Signed-off-by: Long Li Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/1746492997-4599-4-git-send-email-longli@linuxonhyperv.com Signed-off-by: Wei Liu Message-ID: <1746492997-4599-4-git-send-email-longli@linuxonhyperv.com> commit c951ab8fd3589cf6991ed4111d2130816f2e3ac2 Author: Long Li Date: Mon May 5 17:56:34 2025 -0700 uio_hv_generic: Use correct size for interrupt and monitor pages Interrupt and monitor pages should be in Hyper-V page size (4k bytes). This can be different from the system page size. This size is read and used by the user-mode program to determine the mapped data region. An example of such user-mode program is the VMBus driver in DPDK. Cc: stable@vger.kernel.org Fixes: 95096f2fbd10 ("uio-hv-generic: new userspace i/o driver for VMBus") Signed-off-by: Long Li Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/1746492997-4599-3-git-send-email-longli@linuxonhyperv.com Signed-off-by: Wei Liu Message-ID: <1746492997-4599-3-git-send-email-longli@linuxonhyperv.com> commit 09eea7ad0b8e973dcf5ed49902838e5d68177f8e Author: Long Li Date: Mon May 5 17:56:33 2025 -0700 Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary There are use cases that interrupt and monitor pages are mapped to user-mode through UIO, so they need to be system page aligned. Some Hyper-V allocation APIs introduced earlier broke those requirements. Fix this by using page allocation functions directly for interrupt and monitor pages. Cc: stable@vger.kernel.org Fixes: ca48739e59df ("Drivers: hv: vmbus: Move Hyper-V page allocator to arch neutral code") Signed-off-by: Long Li Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/1746492997-4599-2-git-send-email-longli@linuxonhyperv.com Signed-off-by: Wei Liu Message-ID: <1746492997-4599-2-git-send-email-longli@linuxonhyperv.com> commit 43cb39ad260a168abf6da3a48f394afff92d436b Author: Roman Kisel Date: Wed May 7 11:22:26 2025 -0700 arch/x86: Provide the CPU number in the wakeup AP callback When starting APs, confidential guests and paravisor guests need to know the CPU number, and the pattern of using the linear search has emerged in several places. With N processors that leads to the O(N^2) time complexity. Provide the CPU number in the AP wake up callback so that one can get the CPU number in constant time. Suggested-by: Michael Kelley Signed-off-by: Roman Kisel Reviewed-by: Tom Lendacky Reviewed-by: Thomas Gleixner Reviewed-by: Michael Kelley Acked-by: Rafael J. Wysocki Link: https://lore.kernel.org/r/20250507182227.7421-3-romank@linux.microsoft.com Signed-off-by: Wei Liu Message-ID: <20250507182227.7421-3-romank@linux.microsoft.com> commit 86c48271e0d60c82665e9fd61277002391efcef7 Author: Roman Kisel Date: Wed May 7 11:22:25 2025 -0700 x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() To start an application processor in SNP-isolated guest, a hypercall is used that takes a virtual processor index. The hv_snp_boot_ap() function uses that START_VP hypercall but passes as VP index to it what it receives as a wakeup_secondary_cpu_64 callback: the APIC ID. As those two aren't generally interchangeable, that may lead to hung APs if the VP index and the APIC ID don't match up. Update the parameter names to avoid confusion as to what the parameter is. Use the APIC ID to the VP index conversion to provide the correct input to the hypercall. Cc: stable@vger.kernel.org Fixes: 44676bb9d566 ("x86/hyperv: Add smp support for SEV-SNP guest") Signed-off-by: Roman Kisel Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/20250507182227.7421-2-romank@linux.microsoft.com Signed-off-by: Wei Liu Message-ID: <20250507182227.7421-2-romank@linux.microsoft.com> commit d684f9b28809b783e8473727fdf14595b36d8fd3 Author: Roman Kisel Date: Mon Apr 28 14:07:42 2025 -0700 PCI: hv: Get vPCI MSI IRQ domain from DeviceTree The hyperv-pci driver uses ACPI for MSI IRQ domain configuration on arm64. It won't be able to do that in the VTL mode where only DeviceTree can be used. Update the hyperv-pci driver to get vPCI MSI IRQ domain in the DeviceTree case, too. Signed-off-by: Roman Kisel Acked-by: Bjorn Helgaas Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/20250428210742.435282-12-romank@linux.microsoft.com Signed-off-by: Wei Liu Message-ID: <20250428210742.435282-12-romank@linux.microsoft.com> commit ab7e531a8212394608838c31e9dfac69fafa6c8a Author: Roman Kisel Date: Mon Apr 28 14:07:41 2025 -0700 ACPI: irq: Introduce acpi_get_gsi_dispatcher() Using acpi_irq_create_hierarchy() in the cases where the code also handles OF leads to code duplication as the ACPI subsystem doesn't provide means to compute the IRQ domain parent whereas the OF does. Introduce acpi_get_gsi_dispatcher() so that the drivers relying on both ACPI and OF may use irq_domain_create_hierarchy() in the common code paths. No functional changes. Signed-off-by: Roman Kisel Reviewed-by: Michael Kelley Acked-by: Rafael J. Wysocki Link: https://lore.kernel.org/r/20250428210742.435282-11-romank@linux.microsoft.com Signed-off-by: Wei Liu Message-ID: <20250428210742.435282-11-romank@linux.microsoft.com> commit 18a34bb5221e2b79dbcba5bb50d92beb45b68e15 Author: Roman Kisel Date: Mon Apr 28 14:07:40 2025 -0700 Drivers: hv: vmbus: Introduce hv_get_vmbus_root_device() The ARM64 PCI code for hyperv needs to know the VMBus root device, and it is private. Provide a function that returns it. Rename it from "hv_dev" as "hv_dev" as a symbol is very overloaded. No functional changes. Signed-off-by: Roman Kisel Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/20250428210742.435282-10-romank@linux.microsoft.com Signed-off-by: Wei Liu Message-ID: <20250428210742.435282-10-romank@linux.microsoft.com> commit 1dc5df133b98eca75d079e4485ade6b601cadf59 Author: Roman Kisel Date: Mon Apr 28 14:07:39 2025 -0700 Drivers: hv: vmbus: Get the IRQ number from DeviceTree The VMBus driver uses ACPI for interrupt assignment on arm64 hence it won't function in the VTL mode where only DeviceTree can be used. Update the VMBus driver to discover interrupt configuration from DT. Signed-off-by: Roman Kisel Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/20250428210742.435282-9-romank@linux.microsoft.com Signed-off-by: Wei Liu Message-ID: <20250428210742.435282-9-romank@linux.microsoft.com> commit 23aa0c355921a39111f1646ef6592da20af9394c Author: Roman Kisel Date: Mon Apr 28 14:07:38 2025 -0700 dt-bindings: microsoft,vmbus: Add interrupt and DMA coherence properties To boot in the VTL mode, VMBus on arm64 needs interrupt description which the binding documentation lacks. The transactions on the bus are DMA coherent which is not mentioned as well. Add the interrupt property and the DMA coherence property to the VMBus binding. Update the example to match that. Fix typos. Signed-off-by: Roman Kisel Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250428210742.435282-8-romank@linux.microsoft.com Signed-off-by: Wei Liu Message-ID: <20250428210742.435282-8-romank@linux.microsoft.com> commit e956ee9491d90c4107ca6e7c4f2210d806c89f9b Author: Roman Kisel Date: Mon Apr 28 14:07:37 2025 -0700 arm64, x86: hyperv: Report the VTL the system boots in The hyperv guest code might run in various Virtual Trust Levels. Report the level when the kernel boots in the non-default (0) one. Signed-off-by: Roman Kisel Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/20250428210742.435282-7-romank@linux.microsoft.com Signed-off-by: Wei Liu Message-ID: <20250428210742.435282-7-romank@linux.microsoft.com> commit 1f5538a8e2fd3602cd507897c16ee647360a0423 Author: Roman Kisel Date: Mon Apr 28 14:07:36 2025 -0700 arm64: hyperv: Initialize the Virtual Trust Level field Various parts of the hyperv code need to know what VTL the kernel runs at, most notably VMBus needs that to establish communication with the host. Initialize the Virtual Trust Level field to enable booting in the Virtual Trust Level. Signed-off-by: Roman Kisel Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/20250428210742.435282-6-romank@linux.microsoft.com Signed-off-by: Wei Liu Message-ID: <20250428210742.435282-6-romank@linux.microsoft.com> commit e7e6902fbd19b25630cf6a258c44cb385f16b1c8 Author: Roman Kisel Date: Mon Apr 28 14:07:35 2025 -0700 Drivers: hv: Provide arch-neutral implementation of get_vtl() To run in the VTL mode, Hyper-V drivers have to know what VTL the system boots in, and the arm64/hyperv code does not have the means to compute that. Refactor the code to hoist the function that detects VTL, make it arch-neutral to be able to employ it to get the VTL on arm64. Signed-off-by: Roman Kisel Reviewed-by: Michael Kelley Reviewed-by: Tianyu Lan Link: https://lore.kernel.org/r/20250428210742.435282-5-romank@linux.microsoft.com Signed-off-by: Wei Liu Message-ID: <20250428210742.435282-5-romank@linux.microsoft.com> commit f41ceff1748612b9e1538becc13dc2f1617d9d14 Author: Roman Kisel Date: Mon Apr 28 14:07:34 2025 -0700 Drivers: hv: Enable VTL mode for arm64 Kconfig dependencies for arm64 guests on Hyper-V require that be ACPI enabled, and limit VTL mode to x86/x64. To enable VTL mode on arm64 as well, update the dependencies. Since VTL mode requires DeviceTree instead of ACPI, don’t require arm64 guests on Hyper-V to have ACPI unconditionally. Signed-off-by: Roman Kisel Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/20250428210742.435282-4-romank@linux.microsoft.com Signed-off-by: Wei Liu Message-ID: <20250428210742.435282-4-romank@linux.microsoft.com> commit 36ebd328a57ac6138470ecaea2f9ec0864e3db0f Author: Roman Kisel Date: Mon Apr 28 14:07:33 2025 -0700 arm64: hyperv: Use SMCCC to detect hypervisor presence The arm64 Hyper-V startup path relies on ACPI to detect running under a Hyper-V compatible hypervisor. That doesn't work on non-ACPI systems. Hoist the ACPI detection logic into a separate function. Then use the vendor-specific hypervisor service call (implemented recently in Hyper-V) via SMCCC in the non-ACPI case. Signed-off-by: Roman Kisel Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/20250428210742.435282-3-romank@linux.microsoft.com Signed-off-by: Wei Liu Message-ID: <20250428210742.435282-3-romank@linux.microsoft.com> commit 13423063c7cb7d1c34104a78cae85eb0281bae90 Author: Roman Kisel Date: Mon Apr 28 14:07:32 2025 -0700 arm64: kvm, smccc: Introduce and use API for getting hypervisor UUID The KVM/arm64 uses SMCCC to detect hypervisor presence. That code is private, and it follows the SMCCC specification. Other existing and emerging hypervisor guest implementations can and should use that standard approach as well. Factor out a common infrastructure that the guests can use, update KVM to employ the new API. The central notion of the SMCCC method is the UUID of the hypervisor, and the new API follows that. No functional changes. Validated with a KVM/arm64 guest. Signed-off-by: Roman Kisel Acked-by: Arnd Bergmann Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/20250428210742.435282-2-romank@linux.microsoft.com Signed-off-by: Wei Liu Message-ID: <20250428210742.435282-2-romank@linux.microsoft.com> commit a9c0b33ef2306327dd2db02c6274107065ff9307 Author: Shradha Gupta Date: Tue Apr 15 04:19:38 2025 -0700 tools: hv: Enable debug logs for hv_kvp_daemon Allow the KVP daemon to log the KVP updates triggered in the VM with a new debug flag(-d). When the daemon is started with this flag, it logs updates and debug information in syslog with loglevel LOG_DEBUG. This information comes in handy for debugging issues where the key-value pairs for certain pools show mismatch/incorrect values. The distro-vendors can further consume these changes and modify the respective service files to redirect the logs to specific files as needed. Signed-off-by: Shradha Gupta Reviewed-by: Naman Jain Reviewed-by: Dexuan Cui Link: https://lore.kernel.org/r/1744715978-8185-1-git-send-email-shradhagupta@linux.microsoft.com Signed-off-by: Wei Liu Message-ID: <1744715978-8185-1-git-send-email-shradhagupta@linux.microsoft.com> commit b4fe7398def6df344442b884d2288f80205cbd2d Author: Jon Pan-Doh Date: Thu May 22 18:21:26 2025 -0500 PCI/AER: Add sysfs attributes for log ratelimits Allow userspace to read/write log ratelimits per device (including enable/disable). Create aer/ sysfs directory to store them and any future AER configs. The new sysfs files are: /sys/bus/pci/devices/*/aer/correctable_ratelimit_burst /sys/bus/pci/devices/*/aer/correctable_ratelimit_interval_ms /sys/bus/pci/devices/*/aer/nonfatal_ratelimit_burst /sys/bus/pci/devices/*/aer/nonfatal_ratelimit_interval_ms The default values are ratelimit_burst=10, ratelimit_interval_ms=5000, so if we try to emit more than 10 messages in a 5 second period, some are suppressed. Update AER sysfs ABI filename to reflect the broader scope of AER sysfs attributes (e.g. stats and ratelimits). Documentation/ABI/testing/sysfs-bus-pci-devices-aer_stats -> sysfs-bus-pci-devices-aer Tested using aer-inject[1]. Configured correctable log ratelimit to 5. Sent 6 AER errors. Observed 5 errors logged while AER stats (cat /sys/bus/pci/devices//aer_dev_correctable) shows 6. Disabled ratelimiting and sent 6 more AER errors. Observed all 6 errors logged and accounted in AER stats (12 total errors). [1] https://git.kernel.org/pub/scm/linux/kernel/git/gong.chen/aer-inject.git [bhelgaas: note fatal errors are not ratelimited, "aer_report" -> "aer_info", replace ratelimit_log_enable toggle with *_ratelimit_interval_ms] Signed-off-by: Karolina Stolarek Signed-off-by: Jon Pan-Doh Signed-off-by: Bjorn Helgaas Reviewed-by: Kuppuswamy Sathyanarayanan Link: https://patch.msgid.link/20250522232339.1525671-21-helgaas@kernel.org commit 24816cc298ee9cc01003b10b888427faada4403d Author: Jon Pan-Doh Date: Thu May 22 18:21:25 2025 -0500 PCI/AER: Add ratelimits to PCI AER Documentation Add ratelimits section for rationale and defaults. [bhelgaas: note fatal errors are not ratelimited] Signed-off-by: Karolina Stolarek Signed-off-by: Jon Pan-Doh Signed-off-by: Bjorn Helgaas Tested-by: Krzysztof Wilczyński Reviewed-by: Kuppuswamy Sathyanarayanan Acked-by: Paul E. McKenney Link: https://patch.msgid.link/20250522232339.1525671-20-helgaas@kernel.org commit a57f2bfb4a5863f83087867c0e671f2418212d23 Author: Jon Pan-Doh Date: Thu May 22 18:21:24 2025 -0500 PCI/AER: Ratelimit correctable and non-fatal error logging Spammy devices can flood kernel logs with AER errors and slow/stall execution. Add per-device ratelimits for AER correctable and non-fatal uncorrectable errors that use the kernel defaults (10 per 5s). Logging of fatal errors is not ratelimited. There are two AER logging entry points: - aer_print_error() is used by DPC and native AER - pci_print_aer() is used by GHES and CXL The native AER aer_print_error() case includes a loop that may log details from multiple devices, which are ratelimited individually. If we log details for any device, we also log the Error Source ID from the Root Port or RCEC. If no such device details are found, we still log the Error Source from the ERR_* Message, ratelimited by the Root Port or RCEC that received it. The DPC aer_print_error() case is not ratelimited, since this only happens for fatal errors. The CXL pci_print_aer() case is ratelimited by the Error Source device. The GHES pci_print_aer() case is via aer_recover_work_func(), which searches for the Error Source device. If the device is not found, there's no per-device ratelimit, so we use a system-wide ratelimit that covers all error types (correctable, non-fatal, and fatal). Sargun at Meta reported internally that a flood of AER errors causes RCU CPU stall warnings and CSD-lock warnings. Tested using aer-inject[1]. Sent 11 AER errors. Observed 10 errors logged while AER stats (cat /sys/bus/pci/devices//aer_dev_correctable) show true count of 11. [1] https://git.kernel.org/pub/scm/linux/kernel/git/gong.chen/aer-inject.git [bhelgaas: commit log, factor out trace_aer_event() and aer_print_rp_info() changes to previous patches, enable Error Source logging if any downstream detail will be printed, don't ratelimit fatal errors, "aer_report" -> "aer_info", "cor_log_ratelimit" -> "correctable_ratelimit", "uncor_log_ratelimit" -> "nonfatal_ratelimit"] Reported-by: Sargun Dhillon Signed-off-by: Jon Pan-Doh Signed-off-by: Bjorn Helgaas Reviewed-by: Kuppuswamy Sathyanarayanan Link: https://patch.msgid.link/20250522232339.1525671-19-helgaas@kernel.org commit d72bae423004aa7b4d94c34a7fd0b48b64305a08 Author: Bjorn Helgaas Date: Thu May 22 18:21:23 2025 -0500 PCI/AER: Simplify add_error_device() Return -ENOSPC error early so the usual path through add_error_device() is the straightline code. Signed-off-by: Bjorn Helgaas Reviewed-by: Ilpo Järvinen Reviewed-by: Kuppuswamy Sathyanarayanan Link: https://patch.msgid.link/20250522232339.1525671-18-helgaas@kernel.org commit 94bc15c3484aa1dbbd01aee8f9eaa5dc347a01a8 Author: Bjorn Helgaas Date: Thu May 22 18:21:22 2025 -0500 PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index Previously aer_get_device_error_info() and aer_print_error() took a pointer to struct aer_err_info and a pointer to a pci_dev. Typically the pci_dev was one of the elements of the aer_err_info.dev[] array (DPC was an exception, where the dev[] array was unused). Convert aer_get_device_error_info() and aer_print_error() to take an index into the aer_err_info.dev[] array instead. A future patch will add per-device ratelimit information, so the index makes it convenient to find the ratelimit associated with the device. To accommodate DPC, set info->dev[0] to the DPC port before using these interfaces. Signed-off-by: Bjorn Helgaas Reviewed-by: Ilpo Järvinen Reviewed-by: Kuppuswamy Sathyanarayanan Link: https://patch.msgid.link/20250522232339.1525671-17-helgaas@kernel.org commit ecc1ca9185c377822c66cbf61ecfed914455d884 Author: Stuart Yoder Date: Wed Apr 30 10:47:23 2025 -0500 tpm_crb: ffa_tpm: fix/update comments describing the CRB over FFA ABI -Fix the comment describing the 'start' function, which was a cut/paste mistake for a different function. -The comment for DIRECT_REQ and DIRECT_RESP only mentioned AArch32 and listed 32-bit function IDs. Update to include 64-bit. Signed-off-by: Stuart Yoder Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 8d67b79bcc96f85cbd8c16a64e6e8899d5be522c Author: Yeoreum Yun Date: Tue Apr 15 19:50:13 2025 +0100 tpm_crb_ffa: use dev_xx() macro to print log Instead of pr_xxx() macro, use dev_xxx() to print log. This patch changes some error log level to warn log level when the tpm_crb_ffa secure partition doesn't support properly but system can run without it. (i.e) unsupport of direct message ABI or unsupported ABI version Signed-off-by: Yeoreum Yun Reviewed-by: Stefano Garzarella Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit a85b55ee64a5da58c6e2c69e2648023189210eae Author: Yeoreum Yun Date: Tue Apr 15 19:50:12 2025 +0100 tpm_ffa_crb: access tpm service over FF-A direct message request v2 For secure partition with multi service, tpm_ffa_crb can access tpm service with direct message request v2 interface according to chapter 3.3, TPM Service Command Response Buffer Interface Over FF-A specificationi v1.0 BET. This patch reflects this spec to access tpm service over FF-A direct message request v2 ABI. Acked-by: Sudeep Holla Signed-off-by: Yeoreum Yun Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 8dc9c078ab1870dff8613a5688de589c4175b679 Author: Colin Ian King Date: Wed Apr 30 09:34:35 2025 +0100 tpm: remove kmalloc failure error message The kmalloc failure message is just noise. Remove it and replace -EFAULT with -ENOMEM as standard for out of memory allocation error returns. Link: https://lore.kernel.org/linux-integrity/20250430083435.860146-1-colin.i.king@gmail.com/ Signed-off-by: Colin Ian King Reviewed-by: Jason Gunthorpe Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 09683a6184ad6fd635831402316651392b56cc3a Author: Karolina Stolarek Date: Thu May 22 18:21:21 2025 -0500 PCI/AER: Rename struct aer_stats to aer_info Update name to reflect the broader definition of structs/variables that are stored (e.g. ratelimits). This is a preparatory patch for adding rate limit support. [bhelgaas: "aer_report" -> "aer_info"] Signed-off-by: Karolina Stolarek Signed-off-by: Bjorn Helgaas Tested-by: Krzysztof Wilczyński Reviewed-by: Ilpo Järvinen Reviewed-by: Kuppuswamy Sathyanarayanan Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20250522232339.1525671-16-helgaas@kernel.org commit 36c5932074aaedebf905374dba2399a529215aa1 Author: Karolina Stolarek Date: Thu May 22 18:21:20 2025 -0500 PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING Some existing logs in pci_print_aer() log with error severity by default. Convert them to use KERN_WARNING for correctable errors and KERN_ERR for uncorrectable errors. [bhelgaas: commit log] Signed-off-by: Karolina Stolarek Signed-off-by: Bjorn Helgaas Tested-by: Krzysztof Wilczyński Reviewed-by: Kuppuswamy Sathyanarayanan Reviewed-by: Ilpo Järvinen Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20250522232339.1525671-15-helgaas@kernel.org commit 82013ff394ea58fced098a1fdc001b46cc3dd5ee Author: Bjorn Helgaas Date: Thu May 22 18:21:19 2025 -0500 PCI/ERR: Add printk level to pcie_print_tlp_log() aer_print_error() produces output at a printk level (KERN_ERR/KERN_WARNING/ etc) that depends on the kind of error, and it calls pcie_print_tlp_log(), which previously always produced output at KERN_ERR. Add a "level" parameter so aer_print_error() can control the level of the pcie_print_tlp_log() output to match. Signed-off-by: Bjorn Helgaas Reviewed-by: Ilpo Järvinen Reviewed-by: Kuppuswamy Sathyanarayanan Link: https://patch.msgid.link/20250522232339.1525671-14-helgaas@kernel.org commit c8f6791e33a7757025285db26f3b382cdcb7f7cd Author: Karolina Stolarek Date: Thu May 22 18:21:18 2025 -0500 PCI/AER: Check log level once and remember it When reporting an AER error, we check its type multiple times to determine the log level for each message. Do this check only in the top-level functions (aer_isr_one_error(), pci_print_aer()) and save the level in struct aer_err_info. [bhelgaas: save log level in struct aer_err_info instead of passing it as a parameter] Signed-off-by: Karolina Stolarek Signed-off-by: Bjorn Helgaas Tested-by: Krzysztof Wilczyński Reviewed-by: Ilpo Järvinen Reviewed-by: Kuppuswamy Sathyanarayanan Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20250522232339.1525671-13-helgaas@kernel.org commit 6bb4befbd65fa7f99688fb707e376637e5acfe36 Author: Bjorn Helgaas Date: Thu May 22 18:21:17 2025 -0500 PCI/AER: Trace error event before ratelimiting As with the AER statistics, we always want to emit trace events, even if the actual dmesg logging is rate limited. Call trace_aer_event() immediately after pci_dev_aer_stats_incr() so both happen before ratelimiting. Signed-off-by: Bjorn Helgaas Tested-by: Krzysztof Wilczyński Reviewed-by: Ilpo Järvinen Reviewed-by: Kuppuswamy Sathyanarayanan Link: https://patch.msgid.link/20250522232339.1525671-12-helgaas@kernel.org commit 88a7765e62b9e4c79c7ca2c7b749ae04f54a5668 Author: Bjorn Helgaas Date: Thu May 22 18:21:16 2025 -0500 PCI/AER: Update statistics before ratelimiting There are two AER logging entry points: - aer_print_error() is used by DPC (dpc_process_error()) and native AER handling (aer_process_err_devices()). - pci_print_aer() is used by GHES (aer_recover_work_func()) and CXL (cxl_handle_rdport_errors()) Both use __aer_print_error() to print the AER error bits. Previously __aer_print_error() also incremented the AER statistics via pci_dev_aer_stats_incr(). Call pci_dev_aer_stats_incr() early in the entry points instead of in __aer_print_error() so we update the statistics even if the actual printing of error bits is rate limited by a future change. Signed-off-by: Bjorn Helgaas Tested-by: Krzysztof Wilczyński Reviewed-by: Ilpo Järvinen Reviewed-by: Kuppuswamy Sathyanarayanan Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20250522232339.1525671-11-helgaas@kernel.org commit ad9839137cf9fb0f0c2d531bd04bc4382e6f2de9 Author: Bjorn Helgaas Date: Thu May 22 18:21:15 2025 -0500 PCI/AER: Simplify pci_print_aer() Simplify pci_print_aer() by initializing the struct aer_err_info "info" with a designated initializer list (it was previously initialized with memset()) and using pci_name(). Signed-off-by: Bjorn Helgaas Tested-by: Krzysztof Wilczyński Reviewed-by: Ilpo Järvinen Reviewed-by: Jonathan Cameron Reviewed-by: Kuppuswamy Sathyanarayanan Link: https://patch.msgid.link/20250522232339.1525671-10-helgaas@kernel.org commit 57964ba39057a76f3485437347bb4219be9c5b52 Author: Bjorn Helgaas Date: Thu May 22 18:21:14 2025 -0500 PCI/AER: Initialize aer_err_info before using it Previously the struct aer_err_info "e_info" was allocated on the stack without being initialized, so it contained junk except for the fields we explicitly set later. Initialize "e_info" at declaration with a designated initializer list, which initializes the other members to zero. Signed-off-by: Bjorn Helgaas Tested-by: Krzysztof Wilczyński Reviewed-by: Kuppuswamy Sathyanarayanan Reviewed-by: Ilpo Järvinen Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20250522232339.1525671-9-helgaas@kernel.org commit ca2426a570ab4bdf6185aea034ee09184420bd0d Author: Bjorn Helgaas Date: Thu May 22 18:21:13 2025 -0500 PCI/AER: Move aer_print_source() earlier in file Move aer_print_source() earlier in the file so a future change can use it from aer_print_error(), where it's easier to rate limit it. Signed-off-by: Bjorn Helgaas Tested-by: Krzysztof Wilczyński Reviewed-by: Kuppuswamy Sathyanarayanan Reviewed-by: Ilpo Järvinen Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20250522232339.1525671-8-helgaas@kernel.org commit 99c3fd0de8eb4e35459aaac5c1aa315a1a6843a6 Author: Jon Pan-Doh Date: Thu May 22 18:21:12 2025 -0500 PCI/AER: Rename aer_print_port_info() to aer_print_source() Rename aer_print_port_info() to aer_print_source() to be more descriptive. This logs the Error Source ID logged by a Root Port or Root Complex Event Collector when it receives an ERR_COR, ERR_NONFATAL, or ERR_FATAL Message. [bhelgaas: aer_print_rp_info() -> aer_print_source()] Signed-off-by: Jon Pan-Doh Signed-off-by: Bjorn Helgaas Tested-by: Krzysztof Wilczyński Reviewed-by: Ilpo Järvinen Reviewed-by: Kuppuswamy Sathyanarayanan Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20250522232339.1525671-7-helgaas@kernel.org commit f40bd2865501437bf5dfc7167be7b5c8f536b323 Author: Bjorn Helgaas Date: Thu May 22 18:21:11 2025 -0500 PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc Use PCI_BUS_NUM(), PCI_SLOT(), PCI_FUNC() to extract the bus number, device, and function number directly from the Error Source ID. There's no need to shift and mask it explicitly. Signed-off-by: Bjorn Helgaas Tested-by: Krzysztof Wilczyński Reviewed-by: Kuppuswamy Sathyanarayanan Reviewed-by: Ilpo Järvinen Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20250522232339.1525671-6-helgaas@kernel.org commit 6a1eda745967a1e84f6e4cae14c118c97319891e Author: Bjorn Helgaas Date: Thu May 22 18:21:10 2025 -0500 PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() Previously we decoded the AER Error Source ID in aer_isr_one_error_type(), then again in find_source_device() if we didn't find any devices with errors logged in their AER Capabilities. Consolidate this so we only decode and log the Error Source ID once in aer_isr_one_error_type(). Add a "found" parameter so we can add a note when we didn't find any downstream devices with errors logged in their AER Capability. This changes the dmesg logging when we found no devices with errors logged: - pci 0000:00:01.0: AER: Correctable error message received from 0000:02:00.0 - pci 0000:00:01.0: AER: found no error details for 0000:02:00.0 + pci 0000:00:01.0: AER: Correctable error message received from 0000:02:00.0 (no details found) Signed-off-by: Bjorn Helgaas Reviewed-by: Jonathan Cameron Reviewed-by: Kuppuswamy Sathyanarayanan Reviewed-by: Ilpo Järvinen Link: https://patch.msgid.link/20250522232339.1525671-5-helgaas@kernel.org commit 6fc4dae74afcf29ef82afbaaa9b082893871eda4 Author: Bjorn Helgaas Date: Thu May 22 18:21:09 2025 -0500 PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() aer_isr_one_error() duplicates the Error Source ID logging and AER error processing for Correctable Errors and Uncorrectable Errors. Factor out the duplicated code to aer_isr_one_error_type(). aer_isr_one_error() doesn't need the struct aer_rpc pointer, so pass it the Root Port or RCEC pci_dev pointer instead. Signed-off-by: Bjorn Helgaas Reviewed-by: Ilpo Järvinen Reviewed-by: Jonathan Cameron Reviewed-by: Kuppuswamy Sathyanarayanan Link: https://patch.msgid.link/20250522232339.1525671-4-helgaas@kernel.org commit a0b62cc310239c7f1323fb20bd3789f21bdd8615 Author: Bjorn Helgaas Date: Thu May 22 18:21:08 2025 -0500 PCI/DPC: Log Error Source ID only when valid DPC Error Source ID is only valid when the DPC Trigger Reason indicates that DPC was triggered due to reception of an ERR_NONFATAL or ERR_FATAL Message (PCIe r6.0, sec 7.9.14.5). When DPC was triggered by ERR_NONFATAL (PCI_EXP_DPC_STATUS_TRIGGER_RSN_NFE) or ERR_FATAL (PCI_EXP_DPC_STATUS_TRIGGER_RSN_FE) from a downstream device, log the Error Source ID (decoded into domain/bus/device/function). Don't print the source otherwise, since it's not valid. For DPC trigger due to reception of ERR_NONFATAL or ERR_FATAL, the dmesg logging changes: - pci 0000:00:01.0: DPC: containment event, status:0x000d source:0x0200 - pci 0000:00:01.0: DPC: ERR_FATAL detected + pci 0000:00:01.0: DPC: containment event, status:0x000d, ERR_FATAL received from 0000:02:00.0 and when DPC triggered for other reasons, where DPC Error Source ID is undefined, e.g., unmasked uncorrectable error: - pci 0000:00:01.0: DPC: containment event, status:0x0009 source:0x0200 - pci 0000:00:01.0: DPC: unmasked uncorrectable error detected + pci 0000:00:01.0: DPC: containment event, status:0x0009: unmasked uncorrectable error detected Previously the "containment event" message was at KERN_INFO and the "%s detected" message was at KERN_WARNING. Now the single message is at KERN_WARNING. Fixes: 26e515713342 ("PCI: Add Downstream Port Containment driver") Signed-off-by: Bjorn Helgaas Tested-by: Krzysztof Wilczyński Reviewed-by: Kuppuswamy Sathyanarayanan Reviewed-by: Jonathan Cameron Reviewed-by: Ilpo Järvinen Link: https://patch.msgid.link/20250522232339.1525671-3-helgaas@kernel.org commit a424b598e6a6c1e69a2bb801d6fd16e805ab2c38 Author: Bjorn Helgaas Date: Thu May 22 18:21:07 2025 -0500 PCI/DPC: Initialize aer_err_info before using it Previously the struct aer_err_info "info" was allocated on the stack without being initialized, so it contained junk except for the fields we explicitly set later. Initialize "info" at declaration so it starts as all zeros. Fixes: 8aefa9b0d910 ("PCI/DPC: Print AER status in DPC event handling") Signed-off-by: Bjorn Helgaas Tested-by: Krzysztof Wilczyński Reviewed-by: Kuppuswamy Sathyanarayanan Reviewed-by: Ilpo Järvinen Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20250522232339.1525671-2-helgaas@kernel.org commit 43a38a0ff8c63ee156d997cd13063c63cd55d812 Merge: fe6446215bfad1 de2b3119f9f7e2 Author: Mark Brown Date: Fri May 23 16:52:28 2025 +0100 ASoC: codecs: add support for ES8375 Merge series from Zhang Yi : The driver is for codec ES8375 of everest-semi. commit b00d6864a4c948529dc6ddd2df76bf175bf27c63 Merge: 72b17676d36830 76ebfa371f0ff8 Author: Mark Brown Date: Fri May 23 16:51:35 2025 +0100 spi: spi-qpic-snand: extend bitmasks usage Merge series from Gabor Juhos : The two patches in the series are extending the usage of FIELD_PREP() macro and predefined bitmasks usage in the driver. commit 72b17676d3683040a0add8988ec051a2a5adafd7 Author: Gabor Juhos Date: Thu May 15 22:13:29 2025 +0200 spi: spi-qpic-snand: return early on error from qcom_spi_io_op() When submitting of the descriptors fails, it is quite likely that the register read buffer contains no valid data. Even if the data is valid the function returns with an error code anyway. Change the code to return early if qcom_submit_descs() fails to avoid superfluously copying possibly invalid data. Also change the return statement at the end of the function to use zero value to indicate success obviusly. Signed-off-by: Gabor Juhos Link: https://patch.msgid.link/20250515-qpic-snand-early-error-v1-1-681c87611213@gmail.com Signed-off-by: Mark Brown commit 533c87e2ed742454957f14d7bef9f48d5a72e72d Author: Ming Lei Date: Fri May 23 00:35:21 2025 +0800 selftests: ublk: add test for UBLK_F_QUIESCE Add test generic_11 for covering new control command of UBLK_U_CMD_QUIESCE_DEV. Add 'quiesce -n dev_id' sub-command on ublk utility for transitioning device state to quiesce states, then verify the feature via generic_10 by doing quiesce and recovery. Cc: Yoav Cohen Link: https://lore.kernel.org/linux-block/DM4PR12MB632807AB7CDCE77D1E5AB7D0A9B92@DM4PR12MB6328.namprd12.prod.outlook.com/ Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250522163523.406289-4-ming.lei@redhat.com Signed-off-by: Jens Axboe commit b465ae7b2524170cb14fa25dbcb84923bfb1a0a9 Author: Ming Lei Date: Fri May 23 00:35:20 2025 +0800 ublk: add feature UBLK_F_QUIESCE Add feature UBLK_F_QUIESCE, which adds control command `UBLK_U_CMD_QUIESCE_DEV` for quiescing device, then device state can become `UBLK_S_DEV_QUIESCED` or `UBLK_S_DEV_FAIL_IO` finally from ublk_ch_release() with ublk server cooperation. This feature can help to support to upgrade ublk server application by shutting down ublk server gracefully, meantime keep ublk block device persistent during the upgrading period. The feature is only available for UBLK_F_USER_RECOVERY. Suggested-by: Yoav Cohen Link: https://lore.kernel.org/linux-block/DM4PR12MB632807AB7CDCE77D1E5AB7D0A9B92@DM4PR12MB6328.namprd12.prod.outlook.com/ Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250522163523.406289-3-ming.lei@redhat.com Signed-off-by: Jens Axboe commit f40b1f2670f084d2879e4a125a75ff7788ec67ba Author: Ming Lei Date: Fri May 23 00:35:19 2025 +0800 selftests: ublk: add test case for UBLK_U_CMD_UPDATE_SIZE Add test generic_10 for covering new control command of UBLK_U_CMD_UPDATE_SIZE. Add 'update_size -s|--size size_in_bytes' sub-command on ublk utility for supporting this feature, then verify the feature via generic_10. Cc: Omri Mann Cc: Jared Holzman Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250522163523.406289-2-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 17b7d785fc7fc94b94acc080e09de4b5023fbc1e Author: Yumeng Fang Date: Fri May 23 16:54:45 2025 +0800 i2c: Use str_read_write() helper Remove hard-coded strings by using the str_read_write() helper. Signed-off-by: Yumeng Fang Signed-off-by: Yunjian Long Signed-off-by: Wolfram Sang commit 927244f6efff6df5f8f2ab58c7d1eec9f90cc3f2 Author: Ritesh Harjani (IBM) Date: Thu May 22 19:21:10 2025 +0530 traceevent/block: Add REQ_ATOMIC flag to block trace events Filesystems like XFS can implement atomic write I/O using either REQ_ATOMIC flag set in the bio or via CoW operation. It will be useful if we have a flag in trace events to distinguish between the two. This patch adds char 'U' (Untorn writes) to rwbs field of the trace events if REQ_ATOMIC flag is set in the bio. ================= xfs_io-4238 [009] ..... 4148.126843: block_rq_issue: 259,0 WFSU 16384 () 768 + 32 none,0,0 [xfs_io] -0 [009] d.h1. 4148.129864: block_rq_complete: 259,0 WFSU () 768 + 32 none,0,0 [0] =============== xfs_io-4237 [010] ..... 4143.325616: block_rq_issue: 259,0 WS 16384 () 768 + 32 none,0,0 [xfs_io] -0 [010] d.H1. 4143.329138: block_rq_complete: 259,0 WS () 768 + 32 none,0,0 [0] Signed-off-by: Ritesh Harjani (IBM) Reviewed-by: Ojaswin Mujoo Link: https://lore.kernel.org/r/44317cb2ec4588f6a2c1501a96684e6a1196e8ba.1747921498.git.ritesh.list@gmail.com Signed-off-by: Jens Axboe commit 9c7dcf4c16ef521657450a82dc26775d6f556209 Merge: 17a3a30e8e3df7 2b2805404c926b Author: Wolfram Sang Date: Fri May 23 17:18:16 2025 +0200 Merge tag 'i2c-host-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-mergewindow i2c-host updates for v6.16 Cleanups and refactorings - Many drivers switched to dev_err_probe() - Generic cleanups applied to designware, iproc, ismt, mlxbf, npcm7xx, qcom-geni, pasemi, and thunderx - davinci: declare I2C mangling support among I2C features - designware: clean up DTS handling - designware: fix PM runtime on driver unregister - imx: improve error logging during probe - lpc2k: improve checks in probe error path - xgene-slimpro: improve PCC shared memory handling - pasemi: improve error handling in reset, smbus clear, timeouts - tegra: validate buffer length during transfers - wmt: convert binding to YAML format Improvements and extended support: - microchip-core: add SMBus support - mlxbf: add support for repeated start in block transfers - mlxbf: improve timer configuration - npcm: attempt clock toggle recovery before failing init - octeon: add support for block mode operations - pasemi: add support for unjam device feature - riic: add support for bus recovery New device support: - MediaTek Dimensity 1200 (MT6893) - Sophgo SG2044 - Renesas RZ/V2N (R9A09G056) - Rockchip RK3528 - AMD ISP (new driver) Misc changes: - core: add support for Write Disable-aware SPD commit 01daf71a4f57062055f68f8163ed1ad88fb47990 Author: George Moussalem Date: Thu May 22 09:48:51 2025 +0400 thermal: qcom: ipq5018: make ops_ipq5018 struct static Fix a sparse warning by making the ops_ipq5018 struct static. Fixes: 04b31cc53fe0 ("thermal/drivers/qcom/tsens: Add support for IPQ5018 tsens") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202505202356.S21Sc7bk-lkp@intel.com/ Signed-off-by: George Moussalem Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20250522-ipq5018-tsens-sparse-v1-1-97edaaaef27c@outlook.com Signed-off-by: Rafael J. Wysocki commit 879b141b7cfa09763f932f15f19e9bc0bcb020d5 Merge: a5806cd506af5a b3f6fcd8404f9f c6f0d53ebf358f 70892277ca2dba b3f3c493e96350 04cfc1ae14f3e9 bdcea7e396916c 33647d0be323f9 81244074b518ae 320302baed05c6 51c33f333bbf7b 5e2ff240b31a37 Author: Joerg Roedel Date: Fri May 23 17:14:32 2025 +0200 Merge branches 'fixes', 'apple/dart', 'arm/smmu/updates', 'arm/smmu/bindings', 'fsl/pamu', 'mediatek', 'renesas/ipmmu', 's390', 'intel/vt-d', 'amd/amd-vi' and 'core' into next commit 320302baed05c6456164652541f23d2a96522c06 Author: Lu Baolu Date: Tue May 20 15:58:49 2025 +0800 iommu/vt-d: Restore context entry setup order for aliased devices Commit 2031c469f816 ("iommu/vt-d: Add support for static identity domain") changed the context entry setup during domain attachment from a set-and-check policy to a clear-and-reset approach. This inadvertently introduced a regression affecting PCI aliased devices behind PCIe-to-PCI bridges. Specifically, keyboard and touchpad stopped working on several Apple Macbooks with below messages: kernel: platform pxa2xx-spi.3: Adding to iommu group 20 kernel: input: Apple SPI Keyboard as /devices/pci0000:00/0000:00:1e.3/pxa2xx-spi.3/spi_master/spi2/spi-APP000D:00/input/input0 kernel: DMAR: DRHD: handling fault status reg 3 kernel: DMAR: [DMA Read NO_PASID] Request device [00:1e.3] fault addr 0xffffa000 [fault reason 0x06] PTE Read access is not set kernel: DMAR: DRHD: handling fault status reg 3 kernel: DMAR: [DMA Read NO_PASID] Request device [00:1e.3] fault addr 0xffffa000 [fault reason 0x06] PTE Read access is not set kernel: applespi spi-APP000D:00: Error writing to device: 01 0e 00 00 kernel: DMAR: DRHD: handling fault status reg 3 kernel: DMAR: [DMA Read NO_PASID] Request device [00:1e.3] fault addr 0xffffa000 [fault reason 0x06] PTE Read access is not set kernel: DMAR: DRHD: handling fault status reg 3 kernel: applespi spi-APP000D:00: Error writing to device: 01 0e 00 00 Fix this by restoring the previous context setup order. Fixes: 2031c469f816 ("iommu/vt-d: Add support for static identity domain") Closes: https://lore.kernel.org/all/4dada48a-c5dd-4c30-9c85-5b03b0aa01f0@bfh.ch/ Cc: stable@vger.kernel.org Signed-off-by: Lu Baolu Reviewed-by: Kevin Tian Reviewed-by: Yi Liu Link: https://lore.kernel.org/r/20250514060523.2862195-1-baolu.lu@linux.intel.com Link: https://lore.kernel.org/r/20250520075849.755012-2-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel commit 18e899017500f1992d3816e326972c8954fbff2a Author: Colin Ian King Date: Thu May 22 09:31:57 2025 +0100 thermal/drivers/airoha: Fix spelling mistake "calibrarion" -> "calibration" There is a spelling mistake in a dev_info message. Fix it. Signed-off-by: Colin Ian King Link: https://patch.msgid.link/20250522083157.1957240-1-colin.i.king@gmail.com Signed-off-by: Rafael J. Wysocki commit 94a370fc8def6038dbc02199db9584b0b3690f1a Author: Armin Wolf Date: Sun May 18 20:51:11 2025 +0200 ACPI: bus: Bail out if acpi_kobj registration fails The ACPI sysfs code will fail to initialize if acpi_kobj is NULL, together with some ACPI drivers. Follow the other firmware subsystems and bail out if the kobject cannot be registered. Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20250518185111.3560-2-W_Armin@gmx.de Signed-off-by: Rafael J. Wysocki commit 528b541b71cf03e263272b051b70696f92258e9d Author: David Regan Date: Thu May 22 10:25:17 2025 -0700 mtd: nand: brcmnand: fix NAND timeout when accessing eMMC When booting a board to NAND and accessing NAND while eMMC transactions are occurring the NAND will sometimes timeout. This is due to both NAND and eMMC controller sharing the same data bus on BCMBCA chips. Fix is to extend NAND timeout to allow eMMC transactions time to complete. Signed-off-by: David Regan Reviewed-by: William Zhang Reviewed-by: Florian Fainelli Signed-off-by: Miquel Raynal commit dd133162c9cff5951a692fab9811fadf46a46457 Author: Alexandre Ghiti Date: Thu May 22 16:13:56 2025 +0200 ACPI: platform_profile: Avoid initializing on non-ACPI platforms The platform profile driver is loaded even on platforms that do not have ACPI enabled. The initialization of the sysfs entries was recently moved from platform_profile_register() to the module init call, and those entries need acpi_kobj to be initialized which is not the case when ACPI is disabled. This results in the following warning: WARNING: CPU: 5 PID: 1 at fs/sysfs/group.c:131 internal_create_group+0xa22/0xdd8 Modules linked in: CPU: 5 UID: 0 PID: 1 Comm: swapper/0 Tainted: G W 6.15.0-rc7-dirty #6 PREEMPT Tainted: [W]=WARN Hardware name: riscv-virtio,qemu (DT) epc : internal_create_group+0xa22/0xdd8 ra : internal_create_group+0xa22/0xdd8 Call Trace: internal_create_group+0xa22/0xdd8 sysfs_create_group+0x22/0x2e platform_profile_init+0x74/0xb2 do_one_initcall+0x198/0xa9e kernel_init_freeable+0x6d8/0x780 kernel_init+0x28/0x24c ret_from_fork+0xe/0x18 Fix this by checking if ACPI is enabled before trying to create sysfs entries. Fixes: 77be5cacb2c2 ("ACPI: platform_profile: Create class for ACPI platform profile") Signed-off-by: Alexandre Ghiti Reviewed-by: Arnd Bergmann Reviewed-by: Mark Pearson Link: https://patch.msgid.link/20250522141410.31315-1-alexghiti@rivosinc.com [ rjw: Subject and changelog edits ] Signed-off-by: Rafael J. Wysocki commit 3d5bef5d47c371e17041cd6c84e9c08e54ea9e63 Author: Miguel Ojeda Date: Sun Apr 13 02:56:50 2025 +0200 rust: add C FFI types to the prelude Rust kernel code is supposed to use the custom mapping of C FFI types, i.e. those from the `ffi` crate, rather than the ones coming from `core`. Thus, to minimize mistakes and to simplify the code everywhere, just provide them in the `kernel` prelude and ask in the Coding Guidelines to use them directly, i.e. as a single segment path. After this lands, we can start cleaning up the existing users. Ideally, we would use something like Clippy's `disallowed-types` to prevent the use of the `core` ones, but that one sees through aliases. Link: https://lore.kernel.org/rust-for-linux/CANiq72kc4gzfieD-FjuWfELRDXXD2vLgPv4wqk3nt4pjdPQ=qg@mail.gmail.com/ Reviewed-by: Danilo Krummrich Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250413005650.1745894-1-ojeda@kernel.org [ Reworded content of the documentation to focus on how to use the aliases first. - Miguel ] Signed-off-by: Miguel Ojeda commit fe6446215bfad11cf3b446f38b28dc7708973c25 Author: Jaroslav Kysela Date: Fri May 23 12:21:02 2025 +0200 firmware: cs_dsp: Fix OOB memory read access in KUnit test KASAN reported out of bounds access - cs_dsp_mock_bin_add_name_or_info(), because the source string length was rounded up to the allocation size. Cc: Simon Trimmer Cc: Charles Keepax Cc: Richard Fitzgerald Cc: patches@opensource.cirrus.com Cc: stable@vger.kernel.org Signed-off-by: Jaroslav Kysela Link: https://patch.msgid.link/20250523102102.1177151-1-perex@perex.cz Reviewed-by: Richard Fitzgerald Signed-off-by: Mark Brown commit 882826f58b2c48cafc7084a799207e76f2c74fe0 Author: Arnd Bergmann Date: Wed May 21 15:55:43 2025 +0200 ALSA: usb-audio: qcom: fix USB_XHCI dependency SND_USB_AUDIO_QMI depends on USB_XHCI_SIDEBAND, but that is a bool symbol and allows it to be built-in even when XHCI itself is in a loadable module. That configuration causes a link failure: arm-linux-gnueabi-ld: sound/usb/qcom/qc_audio_offload.o: in function `uaudio_event_ring_cleanup_free': qc_audio_offload.c:(.text+0x7dc): undefined reference to `xhci_sideband_remove_interrupter' arm-linux-gnueabi-ld: sound/usb/qcom/qc_audio_offload.o: in function `uaudio_endpoint_setup': qc_audio_offload.c:(.text+0xe88): undefined reference to `xhci_sideband_add_endpoint' Add the extra dependency on USB_XHCI itself. Fixes: 326bbc348298 ("ALSA: usb-audio: qcom: Introduce QC USB SND offloading support") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250521135551.2111109-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman commit e2d8ae899760ff71168d08047962caae07ab36a1 Author: Arnd Bergmann Date: Fri May 23 14:11:47 2025 +0200 ASoC: qdsp6: fix compile-testing without CONFIG_OF The driver builds cleanly only when CONFIG_OF is enabled, otherwise the compiler notices an unused symbol: sound/soc/qcom/qdsp6/q6usb.c:401:34: error: 'q6usb_dai_device_id' defined but not used [-Werror=unused-const-variable=] The driver does not support legacy board files, so the of_match_ptr() annotation has no use here and can be removed to avoid the warning. Fixes: e0dd9240f13a ("ASoC: qcom: qdsp6: Fetch USB offload mapped card and PCM device") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250523121152.2292574-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman commit 662a9ece32add94469138ae66999ee16cb37a531 Author: Arnd Bergmann Date: Fri May 23 14:09:43 2025 +0200 usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n When the USB5744 option is disabled, the onboard_usb driver warns about unused functions: drivers/usb/misc/onboard_usb_dev.c:358:12: error: 'onboard_dev_5744_i2c_write_byte' defined but not used [-Werror=unused-function] 358 | static int onboard_dev_5744_i2c_write_byte(struct i2c_client *client, u16 addr, u8 data) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/misc/onboard_usb_dev.c:313:12: error: 'onboard_dev_5744_i2c_read_byte' defined but not used [-Werror=unused-function] 313 | static int onboard_dev_5744_i2c_read_byte(struct i2c_client *client, u16 addr, u8 *data) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Extend the #ifdef block a little further to cover all of these functions. Ideally we'd use use if(IS_ENABLED()) instead, but that doesn't currently work because the i2c_transfer() and i2c_smbus_write_word_data() function declarations are hidden when CONFIG_I2C is disabled. Fixes: 1143d41922c0 ("usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250523120947.2170302-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman commit 6faaf6e0faf1cc9a1359cfe6ecb4d9711b4a9f29 Author: Pavel Begunkov Date: Fri May 23 10:04:46 2025 +0100 io_uring/cmd: warn on reg buf imports by ineligible cmds For IORING_URING_CMD_FIXED-less commands io_uring doesn't pull buf_index from the sqe, so imports might succeed if the index coincide, e.g. when it's 0, but otherwise it's error prone. Warn if someone tries to import without the flag. Signed-off-by: Pavel Begunkov Reviewed-by: Anuj Gupta Link: https://lore.kernel.org/r/a1c2c88e53c3fe96978f23d50c6bc66c2c79c337.1747991070.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 2b3c61b87519ff5d52fd9d6eb2632975f4e18b04 Author: Dmitry V. Levin Date: Mon May 12 01:49:53 2025 +0300 statmount: update STATMOUNT_SUPPORTED macro According to commit 8f6116b5b77b ("statmount: add a new supported_mask field"), STATMOUNT_SUPPORTED macro shall be updated whenever a new flag is added. Fixes: 7a54947e727b ("Merge patch series "fs: allow changing idmappings"") Signed-off-by: "Dmitry V. Levin" Link: https://lore.kernel.org/20250511224953.GA17849@strace.io Signed-off-by: Christian Brauner commit 101f2bbab541116ab861b9c3ac0ece07a7eaa756 Author: Stephen Brennan Date: Wed May 7 15:34:01 2025 -0700 fs: convert mount flags to enum In prior kernel versions (5.8-6.8), commit 9f6c61f96f2d9 ("proc/mounts: add cursor") introduced MNT_CURSOR, a flag used by readers from /proc/mounts to keep their place while reading the file. Later, commit 2eea9ce4310d8 ("mounts: keep list of mounts in an rbtree") removed this flag and its value has since been repurposed. For debuggers iterating over the list of mounts, cursors should be skipped as they are irrelevant. Detecting whether an element is a cursor can be difficult. Since the MNT_CURSOR flag is a preprocessor constant, it's not present in debuginfo, and since its value is repurposed, we cannot hard-code it. For this specific issue, cursors are possible to detect in other ways, but ideally, we would be able to read the mount flag definitions out of the debuginfo. For that reason, convert the mount flags to an enum. Link: https://github.com/osandov/drgn/pull/496 Signed-off-by: Stephen Brennan Link: https://lore.kernel.org/20250507223402.2795029-1-stephen.s.brennan@oracle.com Signed-off-by: Christian Brauner commit 7fc711739eb8c30955fd8a85be0db7d5a0aa10ae Author: Al Viro Date: Mon Apr 21 04:35:09 2025 +0100 ->mnt_devname is never NULL Not since 8f2918898eb5 "new helpers: vfs_create_mount(), fc_mount()" back in 2018. Get rid of the dead checks... Signed-off-by: Al Viro Link: https://lore.kernel.org/20250421033509.GV2023217@ZenIV Signed-off-by: Christian Brauner commit a68cb18624503a09a1b10e72c3bcc90f2eeb3ded Author: Christian Brauner Date: Wed Apr 16 10:19:05 2025 +0200 mount: add a comment about concurrent changes with statmount()/listmount() Add some comments in there highlighting a few non-obvious assumptions. Link: https://lore.kernel.org/20250416-zerknirschen-aluminium-14a55639076f@brauner Signed-off-by: Christian Brauner commit 0b2b066f8a854ff485319f697d16c5f565c32112 Author: Jens Axboe Date: Fri May 23 06:08:49 2025 -0600 io_uring/io-wq: only create a new worker if it can make progress Hashed work is serialized by io-wq, intended to be used for cases like serializing buffered writes to a regular file, where the file system will serialize the workers anyway with a mutex or similar. Since they would be forcibly serialized and blocked, it's more efficient for io-wq to handle these individually rather than issue them in parallel. If a worker is currently handling a hashed work item and gets blocked, don't create a new worker if the next work item is also hashed and mapped to the same bucket. That new worker would not be able to make any progress anyway. Reported-by: Fengnan Chang Reported-by: Diangang Li Link: https://lore.kernel.org/io-uring/20250522090909.73212-1-changfengnan@bytedance.com/ Signed-off-by: Jens Axboe commit 8343cae362e147a5d4505c2da0e161a4d9e9fbde Author: Jens Axboe Date: Fri May 23 06:05:37 2025 -0600 io_uring/io-wq: ignore non-busy worker going to sleep When an io-wq worker goes to sleep, it checks if there's work to do. If there is, it'll create a new worker. But if this worker is currently idle, it'll either get woken right back up immediately, or someone else has already created the necessary worker to handle this work. Only go through the worker creation logic if the current worker is currently handling a work item. That means it's being scheduled out as part of handling that work, not just going to sleep on its own. Signed-off-by: Jens Axboe commit e37dfc0530815ead6e8ddab2a4ccce3be31af954 Author: Jens Axboe Date: Fri May 23 06:04:29 2025 -0600 io_uring/io-wq: move hash helpers to the top Just in preparation for using them higher up in the function, move these generic helpers. Signed-off-by: Jens Axboe commit b41ac97fe0a6876edbc6fc90dfd05513ba7332ed Author: Kent Overstreet Date: Tue Apr 9 23:53:57 2024 -0400 bcachefs: Path must be locked if trans->locked && should_be_locked If path->should_be_locked is true, that means user code (of the btree API) has seen, in this transaction, something guarded by the node this path has locked, and we have to keep it locked until the end of the transaction. Assert that we're not violating this; should_be_locked should also be cleared only in _very_ special situations. Signed-off-by: Kent Overstreet commit 22e921a6f9b8ec4c9ccbef4accae1494c6695745 Author: Kent Overstreet Date: Thu May 22 15:52:15 2025 -0400 bcachefs: Simplify bch2_path_put() Simplify the "do we need to keep this locked?" checks. Signed-off-by: Kent Overstreet commit 80a160e49414972b712f30b9b287d88197fe3077 Author: Kent Overstreet Date: Thu May 22 15:33:14 2025 -0400 bcachefs: Plumb btree_trans for more locking asserts Signed-off-by: Kent Overstreet commit df92f3500b3f78b8e0ed3faa95c15a834ea9a821 Author: Kent Overstreet Date: Thu May 22 16:04:15 2025 -0400 bcachefs: Clear trans->locked before unlock We're adding new should_be_locked assertions: it's going to be illegal to unlock a should_be_locked path when trans->locked is true. Signed-off-by: Kent Overstreet commit eb34365adae033659384d1dedae99f73abd9815a Author: Kent Overstreet Date: Thu May 22 16:03:08 2025 -0400 bcachefs: Clear should_be_locked before unlock in key_cache_drop() We're adding new should_be_locked assertions, also add a comment explaining why clearing should_be_locked is safe here. Signed-off-by: Kent Overstreet commit be9fecdcdaf730dbf2ca70dbe5b6d42922df50d6 Author: Kent Overstreet Date: Thu May 22 18:12:54 2025 -0400 bcachefs: bch2_path_get() reuses paths if upgrade_fails & !should_be_locked Small additional optimization over the previous patch, bringing us closer to the original behaviour, except when we need to clone to avoid a transaction restart. Signed-off-by: Kent Overstreet commit aac49471b6c4a15cdb4bdade8c19527075af073d Author: Kent Overstreet Date: Thu May 22 18:00:45 2025 -0400 bcachefs: Give out new path if upgrade fails Avoid transaction restarts due to failure to upgrade - we can traverse a new iterator without a transaction restart. Signed-off-by: Kent Overstreet commit 66782b2acbc3291faba7e14d9b22b77a4f3f94e4 Author: Kent Overstreet Date: Thu May 22 16:54:31 2025 -0400 bcachefs: Fix btree_path_get_locks when not doing trans restart btree_path_get_locks, on failure, shouldn't unlock if we're not issuing a transaction restart: we might drop locks we're not supposed to (if path->should_be_locked is set). Signed-off-by: Kent Overstreet commit 5b7b342c402df2cfb1d9a8ea79613742d61d1293 Author: Kent Overstreet Date: Thu May 22 18:03:32 2025 -0400 bcachefs: btree_node_locked_type_nowrite() Small helper to improve locking assertions. Signed-off-by: Kent Overstreet commit 659489f37bd0471d5a77abdfe86eb105ad11297e Author: Kent Overstreet Date: Thu May 22 15:40:24 2025 -0400 bcachefs: Kill bch2_path_put_nokeep() bch2_path_put_nokeep() was intended for paths we wouldn't need to preserve for a transaction restart - it always frees them right away when the ref hits 0. But since paths are shared, freeing unconditionally is a bug, the path might have been used elsewhere and have should_be_locked set, i.e. we need to keep it locked until the end of the transaction. Signed-off-by: Kent Overstreet commit 73db1b5dab6fe17baf9fe2b0d7c8dfd1d4a5b3e5 Author: Phil Sutter Date: Wed May 21 22:44:34 2025 +0200 selftests: netfilter: Torture nftables netdev hooks Add a ruleset which binds to various interface names via netdev-family chains and flowtables and massage the notifiers by frequently renaming interfaces to match these names. While doing so: - Keep an 'nft monitor' running in background to receive the notifications - Loop over 'nft list ruleset' to exercise ruleset dump codepath - Have iperf running so the involved chains/flowtables see traffic If supported, also test interface wildcard support separately by creating a flowtable with 'wild*' interface spec and quickly add/remove matching dummy interfaces. Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso commit 465b9ee0ee7bc268d7f261356afd6c4262e48d82 Author: Phil Sutter Date: Wed May 21 22:44:33 2025 +0200 netfilter: nf_tables: Add notifications for hook changes Notify user space if netdev hooks are updated due to netdev add/remove events. Send minimal notification messages by introducing NFT_MSG_NEWDEV/DELDEV message types describing a single device only. Upon NETDEV_CHANGENAME, the callback has no information about the interface's old name. To provide a clear message to user space, include the hook's stored interface name in the notification. Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso commit 6d07a289504a246aa97cdac0fec61a15834801b7 Author: Phil Sutter Date: Wed May 21 22:44:32 2025 +0200 netfilter: nf_tables: Support wildcard netdev hook specs User space may pass non-nul-terminated NFTA_DEVICE_NAME attribute values to indicate a suffix wildcard. Expect for multiple devices to match the given prefix in nft_netdev_hook_alloc() and populate 'ops_list' with them all. When checking for duplicate hooks, compare the shortest prefix so a device may never match more than a single hook spec. Finally respect the stored prefix length when hooking into new devices from event handlers. Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso commit 6f670935b4703af1ef58b2cba7faf2bd154cce39 Author: Phil Sutter Date: Wed May 21 22:44:31 2025 +0200 netfilter: nf_tables: Sort labels in nft_netdev_hook_alloc() No point in having err_hook_alloc, just call return directly. Also rename err_hook_dev - it's not about the hook's device but freeing the hook itself. Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso commit 7b4856493d7801018c48bab6f8ab8482aba8be76 Author: Phil Sutter Date: Wed May 21 22:44:30 2025 +0200 netfilter: nf_tables: Handle NETDEV_CHANGENAME events For the sake of simplicity, treat them like consecutive NETDEV_REGISTER and NETDEV_UNREGISTER events. If the new name matches a hook spec and registration fails, escalate the error and keep things as they are. To avoid unregistering the newly registered hook again during the following fake NETDEV_UNREGISTER event, leave hooks alone if their interface spec matches the new name. Note how this patch also skips for NETDEV_REGISTER if the device is already registered. This is not yet possible as the new name would have to match the old one. This will change with wildcard interface specs, though. Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso commit 9669c1105b16fa9e02bc599464b3f96988c92ed0 Author: Phil Sutter Date: Wed May 21 22:44:29 2025 +0200 netfilter: nf_tables: Wrap netdev notifiers Handling NETDEV_CHANGENAME events has to traverse all chains/flowtables twice, prepare for this. No functional change intended. Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso commit a331b78a552551d0e404e58e6390b1c828d6af8f Author: Phil Sutter Date: Wed May 21 22:44:28 2025 +0200 netfilter: nf_tables: Respect NETDEV_REGISTER events Hook into new devices if their name matches the hook spec. Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso commit 104031ac89804cda09b0363156a0769aae0f875c Author: Phil Sutter Date: Wed May 21 22:44:27 2025 +0200 netfilter: nf_tables: Prepare for handling NETDEV_REGISTER events Put NETDEV_UNREGISTER handling code into a switch, no functional change intended as the function is only called for that event yet. Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso commit 73319a8ee18b9cf0b2dac87f8521595e0381ba0c Author: Phil Sutter Date: Wed May 21 22:44:26 2025 +0200 netfilter: nf_tables: Have a list of nf_hook_ops in nft_hook Supporting a 1:n relationship between nft_hook and nf_hook_ops is convenient since a chain's or flowtable's nft_hooks may remain in place despite matching interfaces disappearing. This stabilizes ruleset dumps in that regard and opens the possibility to claim newly added interfaces which match the spec. Also it prepares for wildcard interface specs since these will potentially match multiple interfaces. All spots dealing with hook registration are updated to handle a list of multiple nf_hook_ops, but nft_netdev_hook_alloc() only adds a single item for now to retain the old behaviour. The only expected functional change here is how vanishing interfaces are handled: Instead of dropping the respective nft_hook, only the matching nf_hook_ops are dropped. To safely remove individual ops from the list in netdev handlers, an rcu_head is added to struct nf_hook_ops so kfree_rcu() may be used. There is at least nft_flowtable_find_dev() which may be iterating through the list at the same time. Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso commit 91a089d0569d3ddfa70d0b630ec164e00dc3359b Author: Phil Sutter Date: Wed May 21 22:44:25 2025 +0200 netfilter: nf_tables: Pass nf_hook_ops to nft_unregister_flowtable_hook() The function accesses only the hook's ops field, pass it directly. This prepares for nft_hooks holding a list of nf_hook_ops in future. While at it, make use of the function in __nft_unregister_flowtable_net_hooks() as well. Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso commit 21aa0a03eb5360bc55b25f5599523896beac27df Author: Phil Sutter Date: Wed May 21 22:44:24 2025 +0200 netfilter: nf_tables: Introduce nft_register_flowtable_ops() Facilitate binding and registering of a flowtable hook via a single function call. Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso commit e225376d78fb2d85e99a2436a9e65765dc1ac234 Author: Phil Sutter Date: Wed May 21 22:44:23 2025 +0200 netfilter: nf_tables: Introduce nft_hook_find_ops{,_rcu}() Also a pretty dull wrapper around the hook->ops.dev comparison for now. Will search the embedded nf_hook_ops list in future. The ugly cast to eliminate the const qualifier will vanish then, too. Since this future list will be RCU-protected, also introduce an _rcu() variant here. Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso commit 75e20bcdce24b34e9bf71a7a731f9294fb2c633c Author: Phil Sutter Date: Wed May 21 22:44:22 2025 +0200 netfilter: nf_tables: Introduce functions freeing nft_hook objects Pointless wrappers around kfree() for now, prep work for an embedded list of nf_hook_ops. Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso commit 7e5c6aa67e6f6133c5a2c53852e1dd9af2c0c3fc Author: Florian Westphal Date: Thu May 22 15:49:34 2025 +0200 netfilter: nf_tables: add packets conntrack state to debug trace info Add the minimal relevant info needed for userspace ("nftables monitor trace") to provide the conntrack view of the packet: - state (new, related, established) - direction (original, reply) - status (e.g., if connection is subject to dnat) - id (allows to query ctnetlink for remaining conntrack state info) Example: trace id a62 inet filter PRE_RAW packet: iif "enp0s3" ether [..] [..] trace id a62 inet filter PRE_MANGLE conntrack: ct direction original ct state new ct id 32 trace id a62 inet filter PRE_MANGLE packet: [..] [..] trace id a62 inet filter IN conntrack: ct direction original ct state new ct status dnat-done ct id 32 [..] In this case one can see that while NAT is active, the new connection isn't subject to a translation. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 90869f43d06dfc836def2f53850a878f829e443e Author: Florian Westphal Date: Thu May 22 15:49:33 2025 +0200 netfilter: conntrack: make nf_conntrack_id callable without a module dependency While nf_conntrack_id() doesn't need any functionaliy from conntrack, it does reside in nf_conntrack_core.c -- callers add a module dependency on conntrack. Followup patch will need to compute the conntrack id from nf_tables_trace.c to include it in nf_trace messages emitted to userspace via netlink. I don't want to introduce a module dependency between nf_tables and conntrack for this. Since trace is slowpath, the added indirection is ok. One alternative is to move nf_conntrack_id to the netfilter/core.c, but I don't see a compelling reason so far. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit f37ad91270397a6d053e8623bdb3cf79859691d2 Author: Sebastian Andrzej Siewior Date: Mon May 12 12:28:46 2025 +0200 netfilter: nf_dup_netdev: Move the recursion counter struct netdev_xmit nf_dup_skb_recursion is a per-CPU variable and relies on disabled BH for its locking. Without per-CPU locking in local_bh_disable() on PREEMPT_RT this data structure requires explicit locking. Move nf_dup_skb_recursion to struct netdev_xmit, provide wrappers. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Pablo Neira Ayuso commit ba36fada9ab487634f61f92769c95bc148aa8f49 Author: Sebastian Andrzej Siewior Date: Mon May 12 12:28:45 2025 +0200 netfilter: nft_inner: Use nested-BH locking for nft_pcpu_tun_ctx nft_pcpu_tun_ctx is a per-CPU variable and relies on disabled BH for its locking. Without per-CPU locking in local_bh_disable() on PREEMPT_RT this data structure requires explicit locking. Make a struct with a nft_inner_tun_ctx member (original nft_pcpu_tun_ctx) and a local_lock_t and use local_lock_nested_bh() for locking. This change adds only lockdep coverage and does not alter the functional behaviour for !PREEMPT_RT. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Pablo Neira Ayuso commit a1f1acb9c5db9b385c9b3eb1f27f897c06df49ae Author: Sebastian Andrzej Siewior Date: Mon May 12 12:28:44 2025 +0200 netfilter: nf_dup{4, 6}: Move duplication check to task_struct nf_skb_duplicated is a per-CPU variable and relies on disabled BH for its locking. Without per-CPU locking in local_bh_disable() on PREEMPT_RT this data structure requires explicit locking. Due to the recursion involved, the simplest change is to make it a per-task variable. Move the per-CPU variable nf_skb_duplicated to task_struct and name it in_nf_duplicate. Add it to the existing bitfield so it doesn't use additional memory. Cc: Ingo Molnar Cc: Peter Zijlstra Cc: Juri Lelli Cc: Vincent Guittot Cc: Dietmar Eggemann Cc: Steven Rostedt Cc: Ben Segall Cc: Mel Gorman Cc: Valentin Schneider Acked-by: Peter Zijlstra (Intel) Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Pablo Neira Ayuso commit 22a9613de4c29d7d0770bfb8a5a9d73eb8df7dad Author: Fernando Fernandez Mancera Date: Wed May 21 11:41:08 2025 +0200 netfilter: nft_tunnel: fix geneve_opt dump When dumping a nft_tunnel with more than one geneve_opt configured the netlink attribute hierarchy should be as follow: NFTA_TUNNEL_KEY_OPTS | |--NFTA_TUNNEL_KEY_OPTS_GENEVE | | | |--NFTA_TUNNEL_KEY_GENEVE_CLASS | |--NFTA_TUNNEL_KEY_GENEVE_TYPE | |--NFTA_TUNNEL_KEY_GENEVE_DATA | |--NFTA_TUNNEL_KEY_OPTS_GENEVE | | | |--NFTA_TUNNEL_KEY_GENEVE_CLASS | |--NFTA_TUNNEL_KEY_GENEVE_TYPE | |--NFTA_TUNNEL_KEY_GENEVE_DATA | |--NFTA_TUNNEL_KEY_OPTS_GENEVE ... Otherwise, userspace tools won't be able to fetch the geneve options configured correctly. Fixes: 925d844696d9 ("netfilter: nft_tunnel: add support for geneve opts") Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Pablo Neira Ayuso commit 996d62ece03137b2462308acc15acadebe357c66 Author: Florian Westphal Date: Wed May 21 11:38:49 2025 +0200 selftests: netfilter: nft_fib.sh: add type and oif tests with and without VRFs Replace the existing VRF test with a more comprehensive one. It tests following combinations: - fib type (returns address type, e.g. unicast) - fib oif (route output interface index - both with and without 'iif' keyword (changes result, e.g. 'fib daddr type local' will be true when the destination address is configured on the local machine, but 'fib daddr . iif type local' will only be true when the destination address is configured on the incoming interface. Add all types of addresses to test with for both ipv4 and ipv6: - local address on the incoming interface - local address on another interface - local address on another interface thats part of a vrf - address on another host The ruleset stores obtained results from 'fib' in nftables sets and then queries the sets to check that it has the expected results. Perform one pass while packets are coming in on interface NOT part of a VRF and then again when it was added and make sure fib returns the expected routes and address types for the various addresses in the setup. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 9a119669fb1924cd9658c16da39a5a585e129e50 Author: Florian Westphal Date: Wed May 21 11:38:48 2025 +0200 netfilter: nf_tables: nft_fib: consistent l3mdev handling fib has two modes: 1. Obtain output device according to source or destination address 2. Obtain the type of the address, e.g. local, unicast, multicast. 'fib daddr type' should return 'local' if the address is configured in this netns or unicast otherwise. 'fib daddr . iif type' should return 'local' if the address is configured on the input interface or unicast otherwise, i.e. more restrictive. However, if the interface is part of a VRF, then 'fib daddr type' returns unicast even if the address is configured on the incoming interface. This is broken for both ipv4 and ipv6. In the ipv4 case, inet_dev_addr_type must only be used if the 'iif' or 'oif' (strict mode) was requested. Else inet_addr_type_dev_table() needs to be used and the correct dev argument must be passed as well so the correct fib (vrf) table is used. In the ipv6 case, the bug is similar, without strict mode, dev is NULL so .flowi6_l3mdev will be set to 0. Add a new 'nft_fib_l3mdev_master_ifindex_rcu()' helper and use that to init the .l3mdev structure member. For ipv6, use it from nft_fib6_flowi_init() which gets called from both the 'type' and the 'route' mode eval functions. This provides consistent behaviour for all modes for both ipv4 and ipv6: If strict matching is requested, the input respectively output device of the netfilter hooks is used. Otherwise, use skb->dev to obtain the l3mdev ifindex. Without this, most type checks in updated nft_fib.sh selftest fail: FAIL: did not find veth0 . 10.9.9.1 . local in fibtype4 FAIL: did not find veth0 . dead:1::1 . local in fibtype6 FAIL: did not find veth0 . dead:9::1 . local in fibtype6 FAIL: did not find tvrf . 10.0.1.1 . local in fibtype4 FAIL: did not find tvrf . 10.9.9.1 . local in fibtype4 FAIL: did not find tvrf . dead:1::1 . local in fibtype6 FAIL: did not find tvrf . dead:9::1 . local in fibtype6 FAIL: fib expression address types match (iif in vrf) (fib errounously returns 'unicast' for all of them, even though all of these addresses are local to the vrf). Fixes: f6d0cbcf09c5 ("netfilter: nf_tables: add fib expression") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 61fc01f8f7f8e299b9fed5a5e5e068ef0e40593d Author: Arnd Bergmann Date: Thu May 22 11:21:41 2025 +0100 crypto: qat - add missing header inclusion Without this header, the build of the new qat_6xxx driver fails when CONFIG_PCI_IOV is not set: In file included from drivers/crypto/intel/qat/qat_common/adf_gen6_shared.c:7: drivers/crypto/intel/qat/qat_common/adf_gen4_pfvf.h: In function 'adf_gen4_init_pf_pfvf_ops': drivers/crypto/intel/qat/qat_common/adf_gen4_pfvf.h:13:34: error: 'adf_pfvf_comms_disabled' undeclared (first use in this function) 13 | pfvf_ops->enable_comms = adf_pfvf_comms_disabled; | ^~~~~~~~~~~~~~~~~~~~~~~ Fixes: 17fd7514ae68 ("crypto: qat - add qat_6xxx driver") Signed-off-by: Arnd Bergmann Acked-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit 0a3cf32da469ff1df6e016f5f82b439a63d14461 Author: Herbert Xu Date: Mon May 19 18:29:38 2025 +0800 crypto: api - Redo lookup on EEXIST When two crypto algorithm lookups occur at the same time with different names for the same algorithm, e.g., ctr(aes-generic) and ctr(aes), they will both be instantiated. However, only one of them can be registered. The second instantiation will fail with EEXIST. Avoid failing the second lookup by making it retry, but only once because there are tricky names such as gcm_base(ctr(aes),ghash) that will always fail, despite triggering instantiation and EEXIST. Reported-by: Ingo Franzki Fixes: 2825982d9d66 ("[CRYPTO] api: Added event notification") Signed-off-by: Herbert Xu commit e60acc420368e3fcb8c158207d37a502c4eee9e2 Author: Jihed Chaibi Date: Wed May 21 23:48:51 2025 +0200 usb: typec: tipd: fix typo in TPS_STATUS_HIGH_VOLAGE_WARNING macro "VOLAGE" should become "VOLTAGE" Signed-off-by: Jihed Chaibi Reviewed-by: Brigham Campbell Link: https://lore.kernel.org/r/20250521214851.386796-1-jihed.chaibi.dev@gmail.com Signed-off-by: Greg Kroah-Hartman commit ae4432e01dd967a64f6670a152d91d5328032726 Author: Greg Kroah-Hartman Date: Wed May 21 15:35:24 2025 +0200 USB: typec: fix const issue in typec_match() typec_match() takes a const pointer, and then decides to cast it away into a non-const one, which is not a good thing to do overall. Fix this up by properly setting the pointers to be const to preserve that attribute. Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/2025052126-scholar-stainless-ad55@gregkh Fixes: d69d80484598 ("driver core: have match() callback in struct bus_type take a const *") Signed-off-by: Greg Kroah-Hartman commit 5f5cc794fac605afd3bef8065e33096aeacf6257 Author: Greg Kroah-Hartman Date: Wed May 21 15:41:40 2025 +0200 USB: gadget: udc: fix const issue in gadget_match_driver() gadget_match_driver() takes a const pointer, and then decides to cast it away into a non-const one, which is not a good thing to do overall. Fix this up by properly setting the pointers to be const to preserve that attribute. Fixes: d69d80484598 ("driver core: have match() callback in struct bus_type take a const *") Link: https://lore.kernel.org/r/2025052139-rash-unsaddle-7c5e@gregkh Signed-off-by: Greg Kroah-Hartman commit d1d89e8eee6f0e91cfad2a0375ad679fd5c1ae83 Author: Greg Kroah-Hartman Date: Wed May 21 15:41:46 2025 +0200 USB: gadget: fix up const issue with struct usb_function_instance In struct usb_function, the struct usb_function_instance pointer variable "fi" is listed as const, but it is written to in numerous places, making the const marking of it a total lie. Fix this up by just removing the const pointer attribute as this is modified in numerous places. Link: https://lore.kernel.org/r/2025052145-undress-puma-f7cf@gregkh Signed-off-by: Greg Kroah-Hartman commit 2596313a4d91afd94608e06cf877adedbdb656be Merge: 342e4955a1f1ce d3a889482bd5ab Author: Greg Kroah-Hartman Date: Fri May 23 12:23:01 2025 +0200 Merge tag 'usb-serial-6.16-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-next Johan writes: USB serial updates for 6.16-rc1 Here are the USB serial updates for 6.16-rc1, including: - fix of an incorrect const cast - removal of a bogus read urb sanity check - support for a couple of new pl2303 device types All have been in linux-next with no reported issues. * tag 'usb-serial-6.16-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB USB: serial: bus: fix const issue in usb_serial_device_match() USB: serial: ti_usb_3410_5052: drop bogus read urb check commit de2b3119f9f7e2b5b74838272618e5d4a6f1d076 Author: Zhang Yi Date: Fri May 23 10:55:02 2025 +0800 ASoC: codecs: add support for ES8375 The driver is for codec es8375 of everest Signed-off-by: Zhang Yi Link: https://patch.msgid.link/20250523025502.23214-3-zhangyi@everest-semi.com Signed-off-by: Mark Brown commit f70d0f893b945aa42576853212645f4d889332b4 Author: Zhang Yi Date: Fri May 23 10:55:01 2025 +0800 ASoC: dt-bindings: Add Everest ES8375 audio CODEC Add device tree binding documentation for Everest ES8375 Signed-off-by: Zhang Yi Link: https://patch.msgid.link/20250523025502.23214-2-zhangyi@everest-semi.com Signed-off-by: Mark Brown commit 1b85d923ba8c9e6afaf19e26708411adde94fba8 Merge: 7f3225fe8bc2b4 bf809a0aab2f3a Author: Marc Zyngier Date: Fri May 23 10:59:43 2025 +0100 Merge branch kvm-arm64/misc-6.16 into kvmarm-master/next * kvm-arm64/misc-6.16: : . : Misc changes and improvements for 6.16: : : - Add a new selftest for the SVE host state being corrupted by a guest : : - Keep HCR_EL2.xMO set at all times for systems running with the kernel at EL2, : ensuring that the window for interrupts is slightly bigger, and avoiding : a pretty bad erratum on the AmpereOne HW : : - Replace a couple of open-coded on/off strings with str_on_off() : : - Get rid of the pKVM memblock sorting, which now appears to be superflous : : - Drop superflous clearing of ICH_LR_EOI in the LR when nesting : : - Add workaround for AmpereOne's erratum AC04_CPU_23, which suffers from : a pretty bad case of TLB corruption unless accesses to HCR_EL2 are : heavily synchronised : : - Add a per-VM, per-ITS debugfs entry to dump the state of the ITS tables : in a human-friendly fashion : . KVM: arm64: Fix documentation for vgic_its_iter_next() KVM: arm64: vgic-its: Add debugfs interface to expose ITS tables arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 KVM: arm64: nv: Remove clearing of ICH_LR.EOI if ICH_LR.HW == 1 KVM: arm64: Drop sort_memblock_regions() KVM: arm64: selftests: Add test for SVE host corruption KVM: arm64: Force HCR_EL2.xMO to 1 at all times in VHE mode KVM: arm64: Replace ternary flags with str_on_off() helper Signed-off-by: Marc Zyngier commit 7f3225fe8bc2b4a406160d3efdb900bd01037aea Merge: 35e4d7fe699d67 538fbac74019c1 Author: Marc Zyngier Date: Fri May 23 10:58:57 2025 +0100 Merge branch kvm-arm64/nv-nv into kvmarm-master/next * kvm-arm64/nv-nv: : . : Flick the switch on the NV support by adding the missing piece : in the form of the VNCR page management. From the cover letter: : : "This is probably the most interesting bit of the whole NV adventure. : So far, everything else has been a walk in the park, but this one is : where the real fun takes place. : : With FEAT_NV2, most of the NV support revolves around tricking a guest : into accessing memory while it tries to access system registers. The : hypervisor's job is to handle the context switch of the actual : registers with the state in memory as needed." : . KVM: arm64: nv: Release faulted-in VNCR page from mmu_lock critical section KVM: arm64: nv: Handle TLBI S1E2 for VNCR invalidation with mmu_lock held KVM: arm64: nv: Hold mmu_lock when invalidating VNCR SW-TLB before translating KVM: arm64: Document NV caps and vcpu flags KVM: arm64: Allow userspace to request KVM_ARM_VCPU_EL2* KVM: arm64: nv: Remove dead code from ERET handling KVM: arm64: nv: Plumb TLBI S1E2 into system instruction dispatch KVM: arm64: nv: Add S1 TLB invalidation primitive for VNCR_EL2 KVM: arm64: nv: Program host's VNCR_EL2 to the fixmap address KVM: arm64: nv: Handle VNCR_EL2 invalidation from MMU notifiers KVM: arm64: nv: Handle mapping of VNCR_EL2 at EL2 KVM: arm64: nv: Handle VNCR_EL2-triggered faults KVM: arm64: nv: Add userspace and guest handling of VNCR_EL2 KVM: arm64: nv: Add pseudo-TLB backing VNCR_EL2 KVM: arm64: nv: Don't adjust PSTATE.M when L2 is nesting KVM: arm64: nv: Move TLBI range decoding to a helper KVM: arm64: nv: Snapshot S1 ASID tagging information during walk KVM: arm64: nv: Extract translation helper from the AT code KVM: arm64: nv: Allocate VNCR page when required arm64: sysreg: Add layout for VNCR_EL2 Signed-off-by: Marc Zyngier commit 35e4d7fe699d673500edc488b16b46882c773143 Merge: fef3acf5ae8011 3e4d5972205875 Author: Marc Zyngier Date: Fri May 23 10:58:34 2025 +0100 Merge branch kvm-arm64/at-fixes-6.16 into kvmarm-master/next * kvm-arm64/at-fixes-6.16: : . : Set of fixes for Address Translation (AT) instruction emulation, : which affect the (not yet upstream) NV support. : : From the cover letter: : : "Here's a small series of fixes for KVM's implementation of address : translation (aka the AT S1* instructions), addressing a number of : issues in increasing levels of severity: : : - We misreport PAR_EL1.PTW in a number of occasions, including state : that is not possible as per the architecture definition : : - We don't handle access faults at all, and that doesn't play very : well with the rest of the VNCR stuff : : - AT S1E{0,1} from EL2 with HCR_EL2.{E2H,TGE}={1,1} will absolutely : take the host down, no questions asked" : . KVM: arm64: Don't feed uninitialised data to HCR_EL2 KVM: arm64: Teach address translation about access faults KVM: arm64: Fix PAR_EL1.{PTW,S} reporting on AT S1E* Signed-off-by: Marc Zyngier commit fef3acf5ae801109119c07568677d8acfd16ccda Merge: 6eb0ed96293f7c 98dbe56a016a4e Author: Marc Zyngier Date: Fri May 23 10:58:15 2025 +0100 Merge branch kvm-arm64/fgt-masks into kvmarm-master/next * kvm-arm64/fgt-masks: (43 commits) : . : Large rework of the way KVM deals with trap bits in conjunction with : the CPU feature registers. It now draws a direct link between which : the feature set, the system registers that need to UNDEF to match : the configuration and bits that need to behave as RES0 or RES1 in : the trap registers that are visible to the guest. : : Best of all, these definitions are mostly automatically generated : from the JSON description published by ARM under a permissive : license. : . KVM: arm64: Handle TSB CSYNC traps KVM: arm64: Add FGT descriptors for FEAT_FGT2 KVM: arm64: Allow sysreg ranges for FGT descriptors KVM: arm64: Add context-switch for FEAT_FGT2 registers KVM: arm64: Add trap routing for FEAT_FGT2 registers KVM: arm64: Add sanitisation for FEAT_FGT2 registers KVM: arm64: Add FEAT_FGT2 registers to the VNCR page KVM: arm64: Use HCR_EL2 feature map to drive fixed-value bits KVM: arm64: Use HCRX_EL2 feature map to drive fixed-value bits KVM: arm64: Allow kvm_has_feat() to take variable arguments KVM: arm64: Use FGT feature maps to drive RES0 bits KVM: arm64: Validate FGT register descriptions against RES0 masks KVM: arm64: Switch to table-driven FGU configuration KVM: arm64: Handle PSB CSYNC traps KVM: arm64: Use KVM-specific HCRX_EL2 RES0 mask KVM: arm64: Remove hand-crafted masks for FGT registers KVM: arm64: Use computed FGT masks to setup FGT registers KVM: arm64: Propagate FGT masks to the nVHE hypervisor KVM: arm64: Unconditionally configure fine-grain traps KVM: arm64: Use computed masks as sanitisers for FGT registers ... Signed-off-by: Marc Zyngier commit 6eb0ed96293f7c2d5e0b170698169a04f7d95d1a Merge: cb86616c39f8be 69018866d2baa0 Author: Marc Zyngier Date: Fri May 23 10:57:44 2025 +0100 Merge branch kvm-arm64/mte-frac into kvmarm-master/next * kvm-arm64/mte-frac: : . : Prevent FEAT_MTE_ASYNC from being accidently exposed to a guest, : courtesy of Ben Horgan. From the cover letter: : : "The ID_AA64PFR1_EL1.MTE_frac field is currently hidden from KVM. : However, when ID_AA64PFR1_EL1.MTE==2, ID_AA64PFR1_EL1.MTE_frac==0 : indicates that MTE_ASYNC is supported. On a host with : ID_AA64PFR1_EL1.MTE==2 but without MTE_ASYNC support a guest with the : MTE capability enabled will incorrectly see MTE_ASYNC advertised as : supported. This series fixes that." : . KVM: selftests: Confirm exposing MTE_frac does not break migration KVM: arm64: Make MTE_frac masking conditional on MTE capability arm64/sysreg: Expose MTE_frac so that it is visible to KVM Signed-off-by: Marc Zyngier commit cb86616c39f8be7b9eaf0db4508b47d328b91e80 Merge: a90e0017541dbd 446692759b0732 Author: Marc Zyngier Date: Fri May 23 10:57:32 2025 +0100 Merge branch kvm-arm64/ubsan-el2 into kvmarm-master/next * kvm-arm64/ubsan-el2: : . : Add UBSAN support to the EL2 portion of KVM, reusing most of the : existing logic provided by CONFIG_IBSAN_TRAP. : : Patches courtesy of Mostafa Saleh. : . KVM: arm64: Handle UBSAN faults KVM: arm64: Introduce CONFIG_UBSAN_KVM_EL2 ubsan: Remove regs from report_ubsan_failure() arm64: Introduce esr_is_ubsan_brk() Signed-off-by: Marc Zyngier commit a90e0017541dbd2e6c1e40e501efefc938590390 Merge: 67bd641517b04d c353fde17d8f7e Author: Marc Zyngier Date: Fri May 23 10:56:25 2025 +0100 Merge branch kvm-arm64/pkvm-np-thp-6.16 into kvmarm-master/next * kvm-arm64/pkvm-np-thp-6.16: (21 commits) : . : Large mapping support for non-protected pKVM guests, courtesy of : Vincent Donnefort. From the cover letter: : : "This series adds support for stage-2 huge mappings (PMD_SIZE) to pKVM : np-guests, that is installing PMD-level mappings in the stage-2, : whenever the stage-1 is backed by either Hugetlbfs or THPs." : . KVM: arm64: np-guest CMOs with PMD_SIZE fixmap KVM: arm64: Stage-2 huge mappings for np-guests KVM: arm64: Add a range to pkvm_mappings KVM: arm64: Convert pkvm_mappings to interval tree KVM: arm64: Add a range to __pkvm_host_test_clear_young_guest() KVM: arm64: Add a range to __pkvm_host_wrprotect_guest() KVM: arm64: Add a range to __pkvm_host_unshare_guest() KVM: arm64: Add a range to __pkvm_host_share_guest() KVM: arm64: Introduce for_each_hyp_page KVM: arm64: Handle huge mappings for np-guest CMOs KVM: arm64: Extend pKVM selftest for np-guests KVM: arm64: Selftest for pKVM transitions KVM: arm64: Don't WARN from __pkvm_host_share_guest() KVM: arm64: Add .hyp.data section KVM: arm64: Unconditionally cross check hyp state KVM: arm64: Defer EL2 stage-1 mapping on share KVM: arm64: Move hyp state to hyp_vmemmap KVM: arm64: Introduce {get,set}_host_state() helpers KVM: arm64: Use 0b11 for encoding PKVM_NOPAGE KVM: arm64: Fix pKVM page-tracking comments ... Signed-off-by: Marc Zyngier commit 819aad967d4a71af18cd889097363c0a9d377c7a Merge: ea15e046263b19 431e2b874e417b Author: David S. Miller Date: Fri May 23 10:24:19 2025 +0100 Merge branch 'so_passrights' Kuniyuki Iwashima says: ==================== af_unix: Introduce SO_PASSRIGHTS. As long as recvmsg() or recvmmsg() is used with cmsg, it is not possible to avoid receiving file descriptors via SCM_RIGHTS. This series introduces a new socket option, SO_PASSRIGHTS, to allow disabling SCM_RIGHTS. The option is enabled by default. See patch 8 for background/context. This series is related to [0], but is split into a separate series, as most of the patches are specific to af_unix. The v2 of the BPF LSM extension part will be posted later, once this series is merged into net-next and has landed in bpf-next. [0]: https://lore.kernel.org/bpf/20250505215802.48449-1-kuniyu@amazon.com/ Changes: v5: * Patch 4 * Fix BPF selftest failure (setget_sockopt.c) v4: https://lore.kernel.org/netdev/20250515224946.6931-1-kuniyu@amazon.com/ * Patch 6 * Group sk->sk_scm_XXX bits by struct * Patch 9 * Remove errno handling v3: https://lore.kernel.org/netdev/20250514165226.40410-1-kuniyu@amazon.com/ * Patch 3 * Remove inline in scm.c * Patch 4 & 5 & 8 * Return -EOPNOTSUPP in getsockopt() * Patch 5 * Add CONFIG_SECURITY_NETWORK check for SO_PASSSEC * Patch 6 * Add kdoc for sk_scm_unused * Update sk_scm_XXX under lock_sock() in setsockopt() * Patch 7 * Update changelog (recent change -> aed6ecef55d7) v2: https://lore.kernel.org/netdev/20250510015652.9931-1-kuniyu@amazon.com/ * Added patch 4 & 5 to reuse sk_txrehash for scm_recv() flags v1: https://lore.kernel.org/netdev/20250508013021.79654-1-kuniyu@amazon.com/ ==================== Signed-off-by: David S. Miller commit 431e2b874e417b557f236199bdcc520e6e9ddb28 Author: Kuniyuki Iwashima Date: Mon May 19 13:58:00 2025 -0700 selftest: af_unix: Test SO_PASSRIGHTS. scm_rights.c has various patterns of tests to exercise GC. Let's add cases where SO_PASSRIGHTS is disabled. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Signed-off-by: David S. Miller commit 77cbe1a6d8730a07f99f9263c2d5f2304cf5e830 Author: Kuniyuki Iwashima Date: Mon May 19 13:57:59 2025 -0700 af_unix: Introduce SO_PASSRIGHTS. As long as recvmsg() or recvmmsg() is used with cmsg, it is not possible to avoid receiving file descriptors via SCM_RIGHTS. This behaviour has occasionally been flagged as problematic, as it can be (ab)used to trigger DoS during close(), for example, by passing a FUSE-controlled fd or a hung NFS fd. For instance, as noted on the uAPI Group page [0], an untrusted peer could send a file descriptor pointing to a hung NFS mount and then close it. Once the receiver calls recvmsg() with msg_control, the descriptor is automatically installed, and then the responsibility for the final close() now falls on the receiver, which may result in blocking the process for a long time. Regarding this, systemd calls cmsg_close_all() [1] after each recvmsg() to close() unwanted file descriptors sent via SCM_RIGHTS. However, this cannot work around the issue at all, because the final fput() may still occur on the receiver's side once sendmsg() with SCM_RIGHTS succeeds. Also, even filtering by LSM at recvmsg() does not work for the same reason. Thus, we need a better way to refuse SCM_RIGHTS at sendmsg(). Let's introduce SO_PASSRIGHTS to disable SCM_RIGHTS. Note that this option is enabled by default for backward compatibility. Link: https://uapi-group.org/kernel-features/#disabling-reception-of-scm_rights-for-af_unix-sockets #[0] Link: https://github.com/systemd/systemd/blob/v257.5/src/basic/fd-util.c#L612-L628 #[1] Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Signed-off-by: David S. Miller commit 3f84d577b79d2fce8221244f2509734940609ca6 Author: Kuniyuki Iwashima Date: Mon May 19 13:57:58 2025 -0700 af_unix: Inherit sk_flags at connect(). For SOCK_STREAM embryo sockets, the SO_PASS{CRED,PIDFD,SEC} options are inherited from the parent listen()ing socket. Currently, this inheritance happens at accept(), because these attributes were stored in sk->sk_socket->flags and the struct socket is not allocated until accept(). This leads to unintentional behaviour. When a peer sends data to an embryo socket in the accept() queue, unix_maybe_add_creds() embeds credentials into the skb, even if neither the peer nor the listener has enabled these options. If the option is enabled, the embryo socket receives the ancillary data after accept(). If not, the data is silently discarded. This conservative approach works for SO_PASS{CRED,PIDFD,SEC}, but would not for SO_PASSRIGHTS; once an SCM_RIGHTS with a hung file descriptor was sent, it'd be game over. To avoid this, we will need to preserve SOCK_PASSRIGHTS even on embryo sockets. Commit aed6ecef55d7 ("af_unix: Save listener for embryo socket.") made it possible to access the parent's flags in sendmsg() via unix_sk(other)->listener->sk->sk_socket->flags, but this introduces an unnecessary condition that is irrelevant for most sockets, accept()ed sockets and clients. Therefore, we moved SOCK_PASSXXX into struct sock. Let’s inherit sk->sk_scm_recv_flags at connect() to avoid receiving SCM_RIGHTS on embryo sockets created from a parent with SO_PASSRIGHTS=0. Note that the parent socket is locked in connect() so we don't need READ_ONCE() for sk_scm_recv_flags. Now, we can remove !other->sk_socket check in unix_maybe_add_creds() to avoid slow SOCK_PASS{CRED,PIDFD} handling for embryo sockets created from a parent with SO_PASS{CRED,PIDFD}=0. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Signed-off-by: David S. Miller commit 0e81cfd971dc4833c699dcd8924e54a5021bc4e8 Author: Kuniyuki Iwashima Date: Mon May 19 13:57:57 2025 -0700 af_unix: Move SOCK_PASS{CRED,PIDFD,SEC} to struct sock. As explained in the next patch, SO_PASSRIGHTS would have a problem if we assigned a corresponding bit to socket->flags, so it must be managed in struct sock. Mixing socket->flags and sk->sk_flags for similar options will look confusing, and sk->sk_flags does not have enough space on 32bit system. Also, as mentioned in commit 16e572626961 ("af_unix: dont send SCM_CREDENTIALS by default"), SOCK_PASSCRED and SOCK_PASSPID handling is known to be slow, and managing the flags in struct socket cannot avoid that for embryo sockets. Let's move SOCK_PASS{CRED,PIDFD,SEC} to struct sock. While at it, other SOCK_XXX flags in net.h are grouped as enum. Note that assign_bit() was atomic, so the writer side is moved down after lock_sock() in setsockopt(), but the bit is only read once in sendmsg() and recvmsg(), so lock_sock() is not needed there. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Signed-off-by: David S. Miller commit 7d8d93fdde50b86bbbf46a203c368ed320e729ab Author: Kuniyuki Iwashima Date: Mon May 19 13:57:56 2025 -0700 net: Restrict SO_PASS{CRED,PIDFD,SEC} to AF_{UNIX,NETLINK,BLUETOOTH}. SCM_CREDENTIALS and SCM_SECURITY can be recv()ed by calling scm_recv() or scm_recv_unix(), and SCM_PIDFD is only used by scm_recv_unix(). scm_recv() is called from AF_NETLINK and AF_BLUETOOTH. scm_recv_unix() is literally called from AF_UNIX. Let's restrict SO_PASSCRED and SO_PASSSEC to such sockets and SO_PASSPIDFD to AF_UNIX only. Later, SOCK_PASS{CRED,PIDFD,SEC} will be moved to struct sock and united with another field. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Signed-off-by: David S. Miller commit ae4f2f59e1f9c7c9cab1641a3c9645e587f0bc72 Author: Kuniyuki Iwashima Date: Mon May 19 13:57:55 2025 -0700 tcp: Restrict SO_TXREHASH to TCP socket. sk->sk_txrehash is only used for TCP. Let's restrict SO_TXREHASH to TCP to reflect this. Later, we will make sk_txrehash a part of the union for other protocol families. Note that we need to modify BPF selftest not to get/set SO_TEREHASH for non-TCP sockets. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Signed-off-by: David S. Miller commit 38b95d588f8fd07027ad8dbca3e1d2b5c13413ae Author: Kuniyuki Iwashima Date: Mon May 19 13:57:54 2025 -0700 scm: Move scm_recv() from scm.h to scm.c. scm_recv() has been placed in scm.h since the pre-git era for no particular reason (I think), which makes the file really fragile. For example, when you move SOCK_PASSCRED from include/linux/net.h to enum sock_flags in include/net/sock.h, you will see weird build failure due to terrible dependency. To avoid the build failure in the future, let's move scm_recv(_unix())? and its callees to scm.c. Note that only scm_recv() needs to be exported for Bluetooth. scm_send() should be moved to scm.c too, but I'll revisit later. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Signed-off-by: David S. Miller commit 3041bbbeb41b807d2e24d7d78d9cc1387d95898a Author: Kuniyuki Iwashima Date: Mon May 19 13:57:53 2025 -0700 af_unix: Don't pass struct socket to maybe_add_creds(). We will move SOCK_PASS{CRED,PIDFD,SEC} from struct socket.flags to struct sock for better handling with SOCK_PASSRIGHTS. Then, we don't need to access struct socket in maybe_add_creds(). Let's pass struct sock to maybe_add_creds() and its caller queue_oob(). While at it, we append the unix_ prefix and fix double spaces around the pid assignment. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Signed-off-by: David S. Miller commit 350d4546295949c8a29e345b340e57772813037a Author: Kuniyuki Iwashima Date: Mon May 19 13:57:52 2025 -0700 af_unix: Factorise test_bit() for SOCK_PASSCRED and SOCK_PASSPIDFD. Currently, the same checks for SOCK_PASSCRED and SOCK_PASSPIDFD are scattered across many places. Let's centralise the bit tests to make the following changes cleaner. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Signed-off-by: David S. Miller commit 35de409aa30269a3b106fe957a95f7a2b7e21a60 Author: Herbert Xu Date: Fri May 23 17:20:59 2025 +0800 Revert "crypto: testmgr - Add hash export format testing" This reverts commit 18c438b228558e05ede7dccf947a6547516fc0c7. The s390 hmac and sha3 algorithms are failing the test. Revert the change until they have been fixed. Reported-by: Ingo Franzki Link: https://lore.kernel.org/all/623a7fcb-b4cb-48e6-9833-57ad2b32a252@linux.ibm.com/ Signed-off-by: Herbert Xu commit 4e83ae6ec87dddac070ba349d3b839589b1bb957 Author: Christian Brauner Date: Fri May 23 10:47:06 2025 +0200 mips, net: ensure that SOCK_COREDUMP is defined For historical reasons mips has to override the socket enum values but the defines are all the same. So simply move the ARCH_HAS_SOCKET_TYPES scope. Fixes: a9194f88782a ("coredump: add coredump socket") Suggested-by: Arnd Bergmann Signed-off-by: Christian Brauner commit db26d62d79e4068934ad0dccdb92715df36352b9 Author: David Howells Date: Fri May 23 08:57:52 2025 +0100 netfs: Fix undifferentiation of DIO reads from unbuffered reads On cifs, "DIO reads" (specified by O_DIRECT) need to be differentiated from "unbuffered reads" (specified by cache=none in the mount parameters). The difference is flagged in the protocol and the server may behave differently: Windows Server will, for example, mandate that DIO reads are block aligned. Fix this by adding a NETFS_UNBUFFERED_READ to differentiate this from NETFS_DIO_READ, parallelling the write differentiation that already exists. cifs will then do the right thing. Fixes: 016dc8516aec ("netfs: Implement unbuffered/DIO read support") Signed-off-by: David Howells Link: https://lore.kernel.org/3444961.1747987072@warthog.procyon.org.uk Reviewed-by: "Paulo Alcantara (Red Hat)" Reviewed-by: Viacheslav Dubeyko cc: Steve French cc: netfs@lists.linux.dev cc: v9fs@lists.linux.dev cc: linux-afs@lists.infradead.org cc: linux-cifs@vger.kernel.org cc: ceph-devel@vger.kernel.org cc: linux-nfs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit 2b2805404c926b8dcd5c5c13d240722da714906e Author: Arnd Bergmann Date: Tue May 20 17:25:45 2025 +0200 i2c: mlxbf: avoid 64-bit division The 64-bit division in mlxbf_i2c_get_ticks() causes link failures when compile-testing on 32-bit machines: ERROR: modpost: "__udivdi3" [drivers/i2c/busses/i2c-mlxbf.ko] undefined! Change this to a div_u64(), which should replace the constant division with a a multiply/shift combination in the mlxbf_i2c_get_ticks(). The frequency calculation functions require a slow library call but should be used much rarer. Fixes: 053859002c20 ("i2c: mlxbf: Allow build with COMPILE_TEST") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250520152600.1975628-1-arnd@kernel.org Signed-off-by: Andi Shyti commit 3b7d8d151a7ebebc5257766110c102ab173b5844 Author: Enrico Zanda Date: Tue May 13 23:02:47 2025 +0200 i2c: viai2c-wmt: Replace dev_err() with dev_err_probe() in probe function This simplifies the code while improving log. Signed-off-by: Enrico Zanda Link: https://lore.kernel.org/r/20250513210246.528370-2-e.zanda1@gmail.com Signed-off-by: Andi Shyti commit bdf4442f4c7e8feb0733ee4de4d4ff7aa8b1c11d Author: Heikki Krogerus Date: Tue May 13 15:40:15 2025 +0300 i2c: designware: Don't warn about missing get_clk_rate_khz Converting the WARN_ON() to a dev_dbg() message in i2c_dw_clk_rate(). That removes the need to supply a dummy implementation for the callback (or alternatively a dummy clk device) when the fallback path is preferred where the existing values already in the clock registers are used - when a firmware has programmed the clock registers. The fallback path was introduced in commit 4fec76e0985c ("i2c: designware: Fix wrong setting for {ss,fs,hs}_{h,l}cnt registers"). Signed-off-by: Heikki Krogerus Acked-by: Jarkko Nikula Link: https://lore.kernel.org/r/20250513124015.2568924-1-heikki.krogerus@linux.intel.com Signed-off-by: Andi Shyti commit 2fe2b969d911a09abcd6a47401a3c66c38a310e6 Author: Tan En De Date: Sat Apr 12 10:33:03 2025 +0800 i2c: designware: Invoke runtime suspend on quick slave re-registration Replaced pm_runtime_put() with pm_runtime_put_sync_suspend() to ensure the runtime suspend is invoked immediately when unregistering a slave. This prevents a race condition where suspend was skipped when unregistering and registering slave in quick succession. For example, consider the rapid sequence of `delete_device -> new_device -> delete_device -> new_device`. In this sequence, it is observed that the dw_i2c_plat_runtime_suspend() might not be invoked after `delete_device` operation. This is because after `delete_device` operation, when the pm_runtime_put() is about to trigger suspend, the following `new_device` operation might race and cancel the suspend. If that happens, during the `new_device` operation, dw_i2c_plat_runtime_resume() is skipped (since there was no suspend), which means `i_dev->init()`, i.e. i2c_dw_init_slave(), is skipped. Since i2c_dw_init_slave() is skipped, i2c_dw_configure_fifo_slave() is skipped too, which leaves `DW_IC_INTR_MASK` unconfigured. If we inspect the interrupt mask register using devmem, it will show as zero. Example shell script to reproduce the issue: ``` #!/bin/sh SLAVE_LADDR=0x1010 SLAVE_BUS=13 NEW_DEVICE=/sys/bus/i2c/devices/i2c-$SLAVE_BUS/new_device DELETE_DEVICE=/sys/bus/i2c/devices/i2c-$SLAVE_BUS/delete_device # Create initial device echo slave-24c02 $SLAVE_LADDR > $NEW_DEVICE sleep 2 # Rapid sequence of # delete_device -> new_device -> delete_device -> new_device echo $SLAVE_LADDR > $DELETE_DEVICE echo slave-24c02 $SLAVE_LADDR > $NEW_DEVICE echo $SLAVE_LADDR > $DELETE_DEVICE echo slave-24c02 $SLAVE_LADDR > $NEW_DEVICE # Using devmem to inspect IC_INTR_MASK will show as zero ``` Signed-off-by: Tan En De Acked-by: Jarkko Nikula Link: https://lore.kernel.org/r/20250412023303.378600-1-ende.tan@starfivetech.com Signed-off-by: Andi Shyti commit e981364d89bff9d41583e2281d40e5c82d5e7c5d Author: Chris Babroski Date: Tue May 6 19:30:59 2025 +0000 i2c-mlxbf: Improve I2C bus timing configuration Update the I2C bus timing configuration on BlueField to match the configuration recommended and verified by the HW team. I2C block read failures were found on BlueField 3 during communication with a device that requires the use of repeated start conditions. Testing showed that these failures were caused by the I2C transaction getting aborted early due to a short bus "timeout" configuration value. This value determines how long the clock can be held low before the I2C transaction is aborted. Upon further inspection, it was also found that other I2C bus timing configuration values used by the kernel driver do not match the configuration that is recommended by the HW team and used in the BlueField BSP I2C drivers. Signed-off-by: Chris Babroski Reviewed-by: Asmaa Mnebhi Reviewed-by: Khalil Blaiech Link: https://lore.kernel.org/r/20250506193059.321345-2-cbabroski@nvidia.com Signed-off-by: Andi Shyti commit 6bdc662c05c5b0061dfb083e78ce67d86d60dc02 Author: Chris Babroski Date: Tue May 6 19:30:58 2025 +0000 i2c-mlxbf: Add repeated start condition support Add support for SMBus repeated start conditions to the Mellanox I2C driver. This support is specifically enabled for the I2C_FUNC_SMBUS_WRITE_I2C_BLOCK implementation which is required for communication with a specific I2C device on BlueField 3. Signed-off-by: Chris Babroski Reviewed-by: Asmaa Mnebhi Reviewed-by: Khalil Blaiech Link: https://lore.kernel.org/r/20250506193059.321345-1-cbabroski@nvidia.com Signed-off-by: Andi Shyti commit 24d9f60505208b6031f14e89963e668127919e3a Author: Enrico Zanda Date: Sun May 11 22:39:21 2025 +0200 i2c: xgene-slimpro: Replace dev_err() with dev_err_probe() in probe function This simplifies the code while improving log. Signed-off-by: Enrico Zanda Link: https://lore.kernel.org/r/20250511203920.325704-2-e.zanda1@gmail.com Signed-off-by: Andi Shyti commit 29b0b4ce6417b29bbcaabfa05fbe88e0a88b08f6 Author: Alexey Charkov Date: Tue May 6 14:38:15 2025 +0400 dt-bindings: i2c: i2c-wmt: Convert to YAML Rewrite the textual description for the WonderMedia I2C controller as YAML schema, and switch the filename to follow the compatible string. The controller only supports two bus speeds (100kHz and 400kHz) so restrict clock-frequency values accordingly. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Alexey Charkov Link: https://lore.kernel.org/r/20250506-vt8500-i2c-binding-v3-1-401c3e090a88@gmail.com Signed-off-by: Andi Shyti commit d6ceb4053826361d3561c49cff8d55f849ac1492 Author: prashanth kumar burujukindi Date: Wed Apr 30 12:23:39 2025 +0100 i2c: microchip-corei2c: add smbus support Add hardware support for the SMBUS commands smbus_quick, smbus_byte, smbus_byte_data, smbus_word_data and smbus_block_data, replacing the fallback to software emulation Signed-off-by: prashanth kumar burujukindi Signed-off-by: Conor Dooley Link: https://lore.kernel.org/r/20250430-preview-dormitory-85191523283d@spud Signed-off-by: Andi Shyti commit 053859002c20f6b8475343fdf04a0eaca34bb3f4 Author: Andi Shyti Date: Mon May 5 23:58:54 2025 +0200 i2c: mlxbf: Allow build with COMPILE_TEST Extend the Kconfig dependency to include COMPILE_TEST so the Mellanox BlueField I2C driver can be built on non-ARM64 platforms for compile testing purposes. Signed-off-by: Andi Shyti Cc: Khalil Blaiech Cc: Asmaa Mnebhi Link: https://lore.kernel.org/r/20250505215854.2896383-1-andi.shyti@kernel.org commit 66e64b457c238cc8f43870b3ff137b7d660fdb81 Author: Geert Uytterhoeven Date: Tue May 6 15:02:06 2025 +0200 i2c: I2C_DESIGNWARE_AMDISP should depend on DRM_AMD_ISP The AMD Image Signal Processor I2C functionality is only present on AMD platforms with ISP support, and its platform device is instantiated by the AMD ISP driver. Hence add a dependency on DRM_AMD_ISP, to prevent asking the user about this driver when configuring a kernel that does not support the AMD ISP. Fixes: d6263c468a76 ("i2c: amd-isp: Add ISP i2c-designware driver") Signed-off-by: Geert Uytterhoeven Reviewed-by: Pratap Nirujogi Link: https://lore.kernel.org/r/3888f892b8c4d8c8acd17e56581e726ace7f7092.1746536495.git.geert+renesas@glider.be Signed-off-by: Andi Shyti commit 34c5f34df95f71fc500ff0e942210ebc97d2ef65 Author: Dr. David Alan Gilbert Date: Fri May 9 18:35:20 2025 +0100 mfd: sm501: Remove unused sm501_find_clock sm501_find_clock() was added in 2007 as part of commit b6d6454fdb66 ("[PATCH] mfd: SM501 core driver") but hasn't been used. Remove it. Signed-off-by: "Dr. David Alan Gilbert" Link: https://lore.kernel.org/r/20250509173521.49596-1-linux@treblig.org Signed-off-by: Lee Jones commit 950a3c38f73d8167409b2d229ce5139b2be4eff7 Author: Christophe JAILLET Date: Sun May 11 22:42:30 2025 +0200 mfd: 88pm886: Constify struct regmap_irq_chip and some other structures 'struct regmap_irq_chip' is not modified in this driver. Constifying this structure moves some data to a read-only section, so increase overall security, especially when the structure holds some function pointers. While at it, also constify some other structures. On a x86_64, with allmodconfig, as an example: Before: ====== text data bss dec hex filename 5032 3304 64 8400 20d0 drivers/mfd/88pm886.o After: ===== text data bss dec hex filename 5800 2536 64 8400 20d0 drivers/mfd/88pm886.o Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/1681629840761e30494cb8920668710df60a81b8.1746996137.git.christophe.jaillet@wanadoo.fr Signed-off-by: Lee Jones commit bdc76c19db1b969d3d7d5da9cccfb39c6bbe6a5c Author: Nícolas F. R. A. Prado Date: Fri May 2 12:43:21 2025 -0400 dt-bindings: mfd: syscon: Add mediatek,mt8365-infracfg-nao The register space described by DT node of compatible mediatek,mt8365-infracfg-nao exposes a variety of unrelated registers, including registers for controlling bus protection on the MT8365 SoC, which is used by the power domain controller through a syscon. Add this compatible to the syscon binding. Signed-off-by: Nícolas F. R. A. Prado Acked-by: Conor Dooley Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250502-mt8365-infracfg-nao-compatible-v1-1-e40394573f98@collabora.com Signed-off-by: Lee Jones commit 37ef4aa4039c42f4b15dc7e40d3e437b7f031522 Author: Krzysztof Kozlowski Date: Sun Apr 6 21:50:16 2025 +0200 mfd: sprd-sc27xx: Fix wakeup source leaks on device unbind Device can be unbound, so driver must also release memory for the wakeup source. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Baolin Wang Link: https://lore.kernel.org/r/20250406-mfd-device-wakekup-leak-v1-8-318e14bdba0a@linaro.org Signed-off-by: Lee Jones commit 82ae581e56c36dbaee4e8da12d52018eeca01d4a Author: Krzysztof Kozlowski Date: Sun Apr 6 21:50:15 2025 +0200 mfd: rt5033: Fix wakeup source leaks on device unbind Device can be unbound, so driver must also release memory for the wakeup source. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250406-mfd-device-wakekup-leak-v1-7-318e14bdba0a@linaro.org Signed-off-by: Lee Jones commit fd37695dae093533d444237c86c3181a7339abb4 Author: Krzysztof Kozlowski Date: Sun Apr 6 21:50:14 2025 +0200 mfd: max8925: Fix wakeup source leaks on device unbind Device can be unbound, so driver must also release memory for the wakeup source. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250406-mfd-device-wakekup-leak-v1-6-318e14bdba0a@linaro.org Signed-off-by: Lee Jones commit a59a56cc4fb1f7d101f7ce1f5396ceaa2e304b71 Author: Krzysztof Kozlowski Date: Sun Apr 6 21:50:13 2025 +0200 mfd: max77705: Fix wakeup source leaks on device unbind Device can be unbound, so driver must also release memory for the wakeup source. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250406-mfd-device-wakekup-leak-v1-5-318e14bdba0a@linaro.org Signed-off-by: Lee Jones commit 6c7115cdf6440e1e2f15e21efe92e2b757940627 Author: Krzysztof Kozlowski Date: Sun Apr 6 21:50:12 2025 +0200 mfd: max77541: Fix wakeup source leaks on device unbind Device can be unbound, so driver must also release memory for the wakeup source. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250406-mfd-device-wakekup-leak-v1-4-318e14bdba0a@linaro.org Signed-off-by: Lee Jones commit d905d06e64b0eb3da43af6186c132f5282197998 Author: Krzysztof Kozlowski Date: Sun Apr 6 21:50:11 2025 +0200 mfd: max14577: Fix wakeup source leaks on device unbind Device can be unbound, so driver must also release memory for the wakeup source. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250406-mfd-device-wakekup-leak-v1-3-318e14bdba0a@linaro.org Signed-off-by: Lee Jones commit 2c8294c9aaa0f799c440d10e3582ef410be881bd Author: Krzysztof Kozlowski Date: Sun Apr 6 21:50:10 2025 +0200 mfd: as3722: Fix wakeup source leaks on device unbind Device can be unbound, so driver must also release memory for the wakeup source. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250406-mfd-device-wakekup-leak-v1-2-318e14bdba0a@linaro.org Signed-off-by: Lee Jones commit 6d0b2398b2638208d68ba06601f776cd5d983b75 Author: Krzysztof Kozlowski Date: Sun Apr 6 21:50:09 2025 +0200 mfd: 88pm886: Fix wakeup source leaks on device unbind Device can be unbound, so driver must also release memory for the wakeup source. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Karel Balej Link: https://lore.kernel.org/r/20250406-mfd-device-wakekup-leak-v1-1-318e14bdba0a@linaro.org Signed-off-by: Lee Jones commit 54a425bd3f5b1bb9152bd10b0a125c392012b08a Author: Krzysztof Kozlowski Date: Thu May 1 16:51:27 2025 +0200 dt-bindings: mfd: Correct indentation and style in DTS example DTS example in the bindings should be indented with 2- or 4-spaces and aligned with opening '- |', so correct any differences like 3-spaces or mixtures 2- and 4-spaces in one binding. While re-indenting, drop unused labels. No functional changes here, but saves some comments during reviews of new patches built on existing code. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250501145125.59952-4-krzysztof.kozlowski@linaro.org Signed-off-by: Lee Jones commit f9a9ad91da2d0fea42b30cde63f993f85f9702d1 Author: Krzysztof Kozlowski Date: Thu May 1 16:51:26 2025 +0200 dt-bindings: mfd: Drop unrelated nodes from DTS example Binding example should not contain other nodes, e.g. consumers of resource providers, because this is completely redundant and adds unnecessary bloat. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250501145125.59952-3-krzysztof.kozlowski@linaro.org Signed-off-by: Lee Jones commit 70becbeb7f064a47a1d02ea9b1443be17f4de7af Author: Dmitry Baryshkov Date: Fri Apr 25 20:47:03 2025 +0300 dt-bindings: mfd: syscon: Add qcom,apq8064-sps-sic Add compat for Smart Peripheral System (SPS) Interrupt Controller (SIC) present on Qualcomm APQ8064 SoC. Signed-off-by: Dmitry Baryshkov Acked-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250425-fix-nexus-4-v3-3-da4e39e86d41@oss.qualcomm.com Signed-off-by: Lee Jones commit 6d31da9b65006912757cdc48a0e6e91665344865 Author: Dmitry Baryshkov Date: Fri Apr 25 20:47:02 2025 +0300 dt-bindings: mfd: syscon: Add qcom,apq8064-mmss-sfpb Add compat string for Qualcomm MultiMedia SubSystem System FPB. Signed-off-by: Dmitry Baryshkov Acked-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250425-fix-nexus-4-v3-2-da4e39e86d41@oss.qualcomm.com Signed-off-by: Lee Jones commit 59d60c16ed41475f3b5f7b605e75fbf8e3628720 Author: Alexey Gladkov Date: Sat Apr 26 18:16:32 2025 +0200 mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE The name used in the macro does not exist. drivers/mfd/stmpe-spi.c:132:26: error: use of undeclared identifier 'stmpe_id' 132 | MODULE_DEVICE_TABLE(spi, stmpe_id); Fixes: e789995d5c61 ("mfd: Add support for STMPE SPI interface") Signed-off-by: Alexey Gladkov Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/79d5a847303e45a46098f2d827d3d8a249a32be3.1745591072.git.legion@kernel.org Signed-off-by: Lee Jones commit 401c16f0b47e4f2c1dd7ba95844ac7f2494d9b06 Author: Frank Wunderlich Date: Tue Apr 22 15:24:28 2025 +0200 dt-bindings: mfd: syscon: Add mt7988-topmisc Add compatible for Mediatek mt7988 topmisc syscon. This hardware block contains 2 functional blocks - a powercontroller which is not needed (switched by atf) - a multiplexer for high-speed Combo-Phy This compatible is only for the multiplexer part. Signed-off-by: Frank Wunderlich Acked-by: Krzysztof Kozlowski Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250422132438.15735-6-linux@fw-web.de Signed-off-by: Lee Jones commit f41cc37f4bc0e8cd424697bf6e26586cadcf4b9b Author: Christophe JAILLET Date: Mon Apr 21 17:00:35 2025 +0200 mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() If devm_of_platform_populate() fails, some clean-up needs to be done, as already done in the remove function. Add a new devm_add_action_or_reset() to fix the leak in the probe and remove the need of a remove function. Fixes: c695abab2429 ("mfd: Add Samsung Exynos Low Power Audio Subsystem driver") Signed-off-by: Christophe JAILLET Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/69471e839efc0249a504492a8de3497fcdb6a009.1745247209.git.christophe.jaillet@wanadoo.fr Signed-off-by: Lee Jones commit b70b84556eeca5262d290e8619fe0af5b7664a52 Author: Christophe JAILLET Date: Mon Apr 21 17:00:34 2025 +0200 mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() exynos_lpass_disable() is called twice in the remove function. Remove one of these calls. Fixes: 90f447170c6f ("mfd: exynos-lpass: Add runtime PM support") Signed-off-by: Christophe JAILLET Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/74d69e8de10308c9855db6d54155a3de4b11abfd.1745247209.git.christophe.jaillet@wanadoo.fr Signed-off-by: Lee Jones commit 484f0f59f09edd1f6fa63703c12eb30d72a519ac Author: Christophe JAILLET Date: Mon Apr 21 17:00:33 2025 +0200 mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe() If an error occurs after a successful regmap_init_mmio(), regmap_exit() should be called as already done in the .remove() function. Switch to devm_regmap_init_mmio() to avoid the leak and simplify the .remove() function. Fixes: c414df12bdf7 ("mfd: exynos-lpass: Add missing remove() function") Signed-off-by: Christophe JAILLET Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/38414eecb1096840946756ae86887aea2a489c1b.1745247209.git.christophe.jaillet@wanadoo.fr Signed-off-by: Lee Jones commit 9bc2d48514a584af85292da181cc9a4fd6c39f31 Author: AngeloGioacchino Del Regno Date: Wed Apr 16 14:02:25 2025 +0200 dt-bindings: mfd: mediatek,mt8195-scpsys: Add support for MT6893 Add a compatible string for the scpsys block found in the MediaTek Dimensity 1200 (MT6893) SoC. Signed-off-by: AngeloGioacchino Del Regno Acked-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250416120225.147826-1-angelogioacchino.delregno@collabora.com Signed-off-by: Lee Jones commit 9282dc393d6b0436233a336d4904e6003f4e4435 Author: André Draszik Date: Wed Apr 9 21:37:53 2025 +0100 MAINTAINERS: add myself as reviewer for Samsung S2M MFD I'm working on a Samsung device which includes this MFD and would like to be Cc'ed to further contributions and help on reviewing them. Add me as reviewer. Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250409-s2mpg10-v4-32-d66d5f39b6bf@linaro.org Signed-off-by: Lee Jones commit 217c445c40c0a83854504d7167d7db707717bcb2 Author: André Draszik Date: Wed Apr 9 21:37:44 2025 +0100 mfd: sec: Add myself as module author Add myself as module author, so people know whom to complain to about after the recent updates. Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250409-s2mpg10-v4-23-d66d5f39b6bf@linaro.org Signed-off-by: Lee Jones commit 10008dcc623441acb3bdb67069ee8d62c2aa79f1 Author: André Draszik Date: Wed Apr 9 21:37:43 2025 +0100 mfd: sec-irq: Convert to using REGMAP_IRQ_REG() macros Use REGMAP_IRQ_REG macro helpers instead of open coding. This makes the code a bit shorter and more obvious. Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250409-s2mpg10-v4-22-d66d5f39b6bf@linaro.org Signed-off-by: Lee Jones commit 55684cbb537c02a027a0948220450f5b37db1e70 Author: André Draszik Date: Wed Apr 9 21:37:42 2025 +0100 mfd: sec-common: Convert to using MFD_CELL macros Use MFD_CELL macro helpers instead of open coding. This makes the code a bit shorter and more obvious. Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250409-s2mpg10-v4-21-d66d5f39b6bf@linaro.org Signed-off-by: Lee Jones commit 2b897a1c2b667fce1fd9dcf318dbab5992c3e506 Author: André Draszik Date: Wed Apr 9 21:37:41 2025 +0100 mfd: sec-common: Use sizeof(*var), not sizeof(struct type_of_var) Using sizeof(*var) is generally preferred over using the size of its open-coded type when allocating memory. This helps avoiding bugs when the variable type changes but the memory allocation isn't updated, and it simplifies renaming of the struct if ever necessary. No functional change. Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250409-s2mpg10-v4-20-d66d5f39b6bf@linaro.org Signed-off-by: Lee Jones commit 856c6514d5ab491a5ad4be6e797d0d5283ad51aa Author: André Draszik Date: Wed Apr 9 21:37:40 2025 +0100 mfd: sec: Don't compare against NULL / 0 for errors, use ! Follow general style and use if (!arg) instead of comparing against NULL. While at it, drop a useless init in sec-irq.c. Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250409-s2mpg10-v4-19-d66d5f39b6bf@linaro.org Signed-off-by: Lee Jones commit adf91d9e1983dec3d5fabc273e8ff89918b852c1 Author: André Draszik Date: Wed Apr 9 21:37:39 2025 +0100 mfd: sec: Change device_type to int Now that sec-i2c doesn't match device type by pointer casting anymore, we can switch the device type from unsigned long to int easily. This saves a few bytes in struct sec_pmic_dev due to member alignment. Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250409-s2mpg10-v4-18-d66d5f39b6bf@linaro.org Signed-off-by: Lee Jones commit aaaeae7e2ad1574fad3c68e249f02fa87a600516 Author: André Draszik Date: Wed Apr 9 21:37:38 2025 +0100 mfd: sec-i2c: Rework platform data and regmap instantiating Instead of a large open-coded switch statement, just add both regmap config and device type to the OF match data. This allows us to have all related information in one place, and avoids a long switch() statement. Reviewed-by: Krzysztof Kozlowski Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250409-s2mpg10-v4-17-d66d5f39b6bf@linaro.org Signed-off-by: Lee Jones commit 0c33784aeaeb8867682e520bf28042b6ffce200a Author: André Draszik Date: Wed Apr 9 21:37:37 2025 +0100 mfd: sec-common: Don't ignore errors from sec_irq_init() sec_irq_init() can fail, we shouldn't continue and ignore the error in that case, but actually error out. Reviewed-by: Krzysztof Kozlowski Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250409-s2mpg10-v4-16-d66d5f39b6bf@linaro.org Signed-off-by: Lee Jones commit fcc7f3b675b26c81ba07dc35eb849e6ea9afce7f Author: André Draszik Date: Wed Apr 9 21:37:36 2025 +0100 mfd: sec-irq: s2dos05 doesn't support interrupts The commit bf231e5febcf ("mfd: sec-core: Add support for the Samsung s2dos05") adding s2dos05 support didn't add anything related to IRQ support, so I assume this works without IRQs. Rather than printing a warning message in sec_irq_init() due to the missing IRQ number, or returning an error due to a missing irq chip regmap, just return early explicitly. This will become particularly important once errors from sec_irq_init() aren't ignored anymore in an upcoming patch and helps the reader of this code while reasoning about what the intention might be here. Reviewed-by: Krzysztof Kozlowski Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250409-s2mpg10-v4-15-d66d5f39b6bf@linaro.org Signed-off-by: Lee Jones commit 1cea1b6b2c89ef67ebd09e43d85d7308f86a538c Author: André Draszik Date: Wed Apr 9 21:37:35 2025 +0100 mfd: sec-i2c: s2dos05/s2mpu05: Use explicit regmap config and drop default When support for PMICs without compatibles was removed in commit f736d2c0caa8 ("mfd: sec: Remove PMICs without compatibles"), sec_regmap_config effectively became an orphan, because S5M8763X was the only user left of it before removal, using the default: case of the switch statement. When s2dos05 and s2mpu05 support was added in commit bf231e5febcf ("mfd: sec-core: Add support for the Samsung s2dos05") and commit ed33479b7beb ("mfd: sec: Add support for S2MPU05 PMIC"), they ended up using that orphaned regmap_config in a non-obvious way due to the default: case of the device type switch matching statement taking effect again. To make things more obvious, and to help the reader of this code while reasoning about what the intention might be here, and to ensure future additions to support new devices in this driver don't forget to add a regmap config, add an explicit regmap config for these two devices, and completely remove the generic regmap config as it becomes an orphan again that shouldn't be used by any device. Note that this commit doesn't fix the issue that s2dos05_regmap_config ands2mpu05_regmap_config really are incomplete, but I have no documentation on them. Reviewed-by: Krzysztof Kozlowski Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250409-s2mpg10-v4-14-d66d5f39b6bf@linaro.org Signed-off-by: Lee Jones commit 176a30687bb5bd5c401ee1142381841988386e6e Author: André Draszik Date: Wed Apr 9 21:37:34 2025 +0100 mfd: sec: Use dev_err_probe() where appropriate dev_err_probe() exists to simplify code and harmonise error messages, there's no reason not to use it here. While at it, harmonise some error messages. Reviewed-by: Krzysztof Kozlowski Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250409-s2mpg10-v4-13-d66d5f39b6bf@linaro.org Signed-off-by: Lee Jones commit ada2b490c72bf6521aab135ba6e866639f9b0220 Author: André Draszik Date: Wed Apr 9 21:37:33 2025 +0100 mfd: sec-i2c: Sort struct of_device_id entries and the device type switch Sort struct of_device_id entries and the device type switch in _probe() alphabetically, which makes it easier to find the right place where to insert new entries in the future. Reviewed-by: Krzysztof Kozlowski Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250409-s2mpg10-v4-12-d66d5f39b6bf@linaro.org Signed-off-by: Lee Jones commit d58b81c436f00259019ad11f2a9af19d84496de3 Author: André Draszik Date: Wed Apr 9 21:37:32 2025 +0100 mfd: sec-common: Fix multiple trivial whitespace issues Rectify a couple of alignment problems reported by Checkpatch. Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250409-s2mpg10-v4-11-d66d5f39b6bf@linaro.org Signed-off-by: Lee Jones commit b355f0cb92bd5e48d850e32960ac18fb1394cf8e Author: André Draszik Date: Wed Apr 9 21:37:31 2025 +0100 mfd: sec: Merge separate core and irq modules There is no reason to have these two kernel modules separate. Having them merged into one kernel module also slightly reduces memory consumption and module load times a little. mapped size (lsmod): before: after: sec_core 20480 sec_core 24576 sec_irq 16384 ---------------- total 36864 Section sizes (size -A): before: after: sec_core 6780 sec_core 13239 sec_irq 8046 ---------------- Total 14826 Reviewed-by: Krzysztof Kozlowski Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250409-s2mpg10-v4-10-d66d5f39b6bf@linaro.org Signed-off-by: Lee Jones commit 5338709089b75f57a9b3b7b17a0424ecab5f2fd8 Author: André Draszik Date: Wed Apr 9 21:37:30 2025 +0100 mfd: sec: Add support for S2MPG10 PMIC Add support for Samsung's S2MPG10 PMIC, which is a Power Management IC for mobile applications with buck converters, various LDOs, power meters, RTC, clock outputs, and additional GPIOs interfaces. Contrary to existing Samsung S2M series PMICs supported, communication is not via I2C, but via the Samsung ACPM firmware. This commit adds the core driver. Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250409-s2mpg10-v4-9-d66d5f39b6bf@linaro.org Signed-off-by: Lee Jones commit 680ef57915db0f715e99a683c15f0f9f7c700e64 Author: André Draszik Date: Wed Apr 9 21:37:29 2025 +0100 mfd: sec: Split into core and transport (i2c) drivers As a preparation for adding support for Samsung's S2MPG10, which is connected via SPEEDY / ACPM rather than I2C, split out (move) all I2C-specific driver code into its own kernel module, sec-i2c, and make the existing sec-core module be just the transport-agnostic core driver kernel module. At the same time, update all defconfigs that reference the old kconfig symbol name. While at it, also update file header comments and module description(s) to drop references to 'mfd', and update comments to be C-style, not C++. Reviewed-by: Krzysztof Kozlowski Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250409-s2mpg10-v4-8-d66d5f39b6bf@linaro.org Signed-off-by: Lee Jones commit 8b88b5e4d58151d8a37250afc978f253cd8cc4fb Author: André Draszik Date: Wed Apr 9 21:37:28 2025 +0100 mfd: sec: Move private internal API to internal header sec_irq_init() is an internal API for the core driver, and doesn't belong into the public header. Due to an upcoming split of the driver into a core and i2c driver, we'll also be adding more internal APIs, which again shouldn't be in the public header. Move it into a new internal include. Reviewed-by: Krzysztof Kozlowski Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250409-s2mpg10-v4-7-d66d5f39b6bf@linaro.org Signed-off-by: Lee Jones commit 5bef1b7f10a81b61863f11aaa146a773cbc64e61 Author: André Draszik Date: Wed Apr 9 21:37:27 2025 +0100 mfd: sec: Update includes to add missing and remove superfluous ones This driver misses to include some of the respective headers of some of the APIs used. It also includes headers that aren't needed (e.g. due to previous driver rework where includes weren't updated). It is good practice to directly include all headers used, which avoids implicit dependencies and spurious build breakage if someone rearranged headers, as this could cause the implicit includes to be dropped. Include the relevant headers explicitly and drop superfluous ones. Reviewed-by: Krzysztof Kozlowski Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250409-s2mpg10-v4-6-d66d5f39b6bf@linaro.org Signed-off-by: Lee Jones commit 271dc4fbede4274d0729eec10a33bd772df2837a Author: André Draszik Date: Wed Apr 9 21:37:26 2025 +0100 mfd: sec: Sort includes alphabetically Sorting headers alphabetically helps locating duplicates, and makes it easier to figure out where to insert new headers. Reviewed-by: Krzysztof Kozlowski Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250409-s2mpg10-v4-5-d66d5f39b6bf@linaro.org Signed-off-by: Lee Jones commit b3379422b460ea8c0556df300d547d63e5569cda Author: André Draszik Date: Wed Apr 9 21:37:25 2025 +0100 mfd: sec-core: Drop non-existing forward declarations sec_irq_resume() was removed in commit 6445b84abf91 ("mfd: Add s2mps11 irq driver") and sec_irq_exit() in commit 3dc6f4aaafbe ("mfd: sec: Use devm_mfd_add_devices and devm_regmap_add_irq_chip") while the prototypes were left. They should be removed. Do so. Reviewed-by: Krzysztof Kozlowski Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250409-s2mpg10-v4-4-d66d5f39b6bf@linaro.org Signed-off-by: Lee Jones commit 72d856ee1927442cefe97a159fde347e59555f88 Author: André Draszik Date: Wed Apr 9 21:37:22 2025 +0100 dt-bindings: mfd: samsung,s2mps11: add s2mpg10 The Samsung S2MPG10 PMIC is similar to the existing PMICs supported by this binding. It is a Power Management IC for mobile applications with buck converters, various LDOs, power meters, RTC, clock outputs, and additional GPIOs interfaces. Unlike other Samsung PMICs, communication is not via I2C, but via the Samsung ACPM firmware, it therefore doesn't need a 'reg' property but needs to be a child of the ACPM firmware node instead. S2MPG10 can also act as a system power controller allowing implementation of a true cold-reset of the system. Support for the other components like regulators and power meters will be added in subsequent future patches. Reviewed-by: Krzysztof Kozlowski Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250409-s2mpg10-v4-1-d66d5f39b6bf@linaro.org Signed-off-by: Lee Jones commit 20e805cec0641697079a5d41f732573d7eb9be01 Author: Ryan Wanner Date: Mon Apr 14 14:41:25 2025 -0700 dt-bindings: mfd: syscon: Add microchip,sama7d65-secumod Add SAMA7D65 SECUMOD compatible string to DT bindings documentation. Signed-off-by: Ryan Wanner Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/2fdd14313d9cf008dbc4a63a91ba0cb5cf372ad6.1744666011.git.Ryan.Wanner@microchip.com Signed-off-by: Lee Jones commit f7c636be96a151ce86f9291bed31145b61e50261 Author: Ryan Wanner Date: Mon Apr 14 14:41:24 2025 -0700 dt-bindings: mfd: syscon: atmel,sama5d2-secumod: Convert to yaml Convert Microchip AT91 secumod to YAML format. Signed-off-by: Ryan Wanner Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/a999a719a652ec834f1176d69a3e9b207cbd63e6.1744666011.git.Ryan.Wanner@microchip.com Signed-off-by: Lee Jones commit 9c998b9d3128d6def5f0517342714c0721042462 Author: Ryan Wanner Date: Mon Apr 14 14:41:23 2025 -0700 dt-bindings: mfd: atmel: Add microchip,sama7d65-gpbr Add SAMA7D65 GPBR compatible to DT bindings documentation. Signed-off-by: Ryan Wanner Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/ddbcb306699b8c09f3210d714c0701afa1a7cb96.1744666011.git.Ryan.Wanner@microchip.com Signed-off-by: Lee Jones commit cf5c739af8ff024a211ece4381ea71874428607b Author: Bartosz Golaszewski Date: Mon Apr 7 09:24:15 2025 +0200 mfd: ucb1x00: Use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20250407-gpiochip-set-rv-mfd-v1-3-43f4d86d01d1@linaro.org Signed-off-by: Lee Jones commit 651974212cacef4ad24c4f97d52b6761f2219e96 Author: Bartosz Golaszewski Date: Mon Apr 7 09:24:14 2025 +0200 mfd: tps65010: Use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20250407-gpiochip-set-rv-mfd-v1-2-43f4d86d01d1@linaro.org Signed-off-by: Lee Jones commit 3745b5ca35298885035fd5e3a133be7292cbe2fc Author: Bartosz Golaszewski Date: Mon Apr 7 09:24:13 2025 +0200 mfd: sm501: Use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20250407-gpiochip-set-rv-mfd-v1-1-43f4d86d01d1@linaro.org Signed-off-by: Lee Jones commit ba1a455393c430c97235cb593d40a3ea7ad8acca Author: Artur Weber Date: Sun Mar 16 19:18:52 2025 +0100 mfd: bcm590xx: Drop unused "id" member of bcm590xx struct The "id" member of the bcm590xx struct is unused and will be confusing once we add an actual PMU ID storage value. Drop it; a replacement will be introduced in a future commit. Signed-off-by: Artur Weber Reviewed-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250316-bcm59054-v7-4-4281126be1b8@gmail.com Signed-off-by: Lee Jones commit 879ede53958f7bab79a88888f77e0ca91f0f77da Author: Aradhya Bhatia Date: Fri May 16 12:43:55 2025 +0000 drm/xe: Default auto_link_downgrade status to false xe_pcode_read() can return back successfully without updating the variable 'val'. This can cause an arbitrary value to show up in the sysfs file. Allow the auto_link_downgrade_status to default to 0 to avoid any arbitrary value from coming up. Fixes: 0e414bf7ad01 ("drm/xe: Expose PCIe link downgrade attributes") Reviewed-by: Tejas Upadhyay Signed-off-by: Aradhya Bhatia Link: https://lore.kernel.org/r/20250516124355.4872-1-aradhya.bhatia@intel.com Signed-off-by: Matt Roper (cherry picked from commit a7f87deac2295d11865048bcb9c2de369b52ed93) Signed-off-by: Thomas Hellström commit e22d7acf9f47b01c9a538f3dac5c8e8d46fbca96 Author: Aradhya Bhatia Date: Fri May 16 14:19:02 2025 +0000 drm/xe/guc: Make creation of SLPC debugfs files conditional Platforms that do not support SLPC are exempted from the GuC PC support. The GuC PC does not get initialized, and neither do its BOs get created. This causes a problem because the GuC PC debugfs file is still being created. Whenever the file is attempted to read, it causes a NULL pointer dereference on the supposed BO of the GuC PC. So, make the creation of SLPC debugfs files conditional to when SLPC features are supported. Fixes: aaab5404b16f ("drm/xe: Introduce GuC PC debugfs") Suggested-by: Matt Roper Reviewed-by: Tejas Upadhyay Reviewed-by: Stuart Summers Signed-off-by: Aradhya Bhatia Link: https://lore.kernel.org/r/20250516141902.5614-1-aradhya.bhatia@intel.com Signed-off-by: Matt Roper (cherry picked from commit 17486cf3df5320752cc67ee8bcb2379d1b9de76c) Signed-off-by: Thomas Hellström commit 7f9bbc1140ff8796230bc2634055763e271fd692 Author: Stefano Stabellini Date: Mon May 12 14:54:52 2025 -0700 xen/arm: call uaccess_ttbr0_enable for dm_op hypercall dm_op hypercalls might come from userspace and pass memory addresses as parameters. The memory addresses typically correspond to buffers allocated in userspace to hold extra hypercall parameters. On ARM, when CONFIG_ARM64_SW_TTBR0_PAN is enabled, they might not be accessible by Xen, as a result ioreq hypercalls might fail. See the existing comment in arch/arm64/xen/hypercall.S regarding privcmd_call for reference. For privcmd_call, Linux calls uaccess_ttbr0_enable before issuing the hypercall thanks to commit 9cf09d68b89a. We need to do the same for dm_op. This resolves the problem. Cc: stable@kernel.org Fixes: 9cf09d68b89a ("arm64: xen: Enable user access before a privcmd hvc call") Signed-off-by: Stefano Stabellini Reviewed-by: Juergen Gross Message-ID: Signed-off-by: Juergen Gross commit 74287971dbb3fe322bb316afd9e7fb5807e23bee Author: Roger Pau Monne Date: Wed May 14 10:04:26 2025 +0200 xen/x86: fix initial memory balloon target When adding extra memory regions as ballooned pages also adjust the balloon target, otherwise when the balloon driver is started it will populate memory to match the target value and consume all the extra memory regions added. This made the usage of the Xen `dom0_mem=,max:` command line parameter for dom0 not work as expected, as the target won't be adjusted and when the balloon is started it will populate memory straight to the 'max:' value. It would equally affect domUs that have memory != maxmem. Kernels built with CONFIG_XEN_UNPOPULATED_ALLOC are not affected, because the extra memory regions are consumed by the unpopulated allocation driver, and then balloon_add_regions() becomes a no-op. Reported-by: John Fixes: 87af633689ce ('x86/xen: fix balloon target initialization for PVH dom0') Signed-off-by: Roger Pau Monné Reviewed-by: Juergen Gross Tested-by: Marek Marczykowski-Górecki Message-ID: <20250514080427.28129-1-roger.pau@citrix.com> Signed-off-by: Juergen Gross commit d24c6b78ac550072df359c17e6aadddf079257d0 Author: Roger Pau Monne Date: Wed May 14 11:20:36 2025 +0200 xen: enable XEN_UNPOPULATED_ALLOC as part of xen.config PVH dom0 is useless without XEN_UNPOPULATED_ALLOC, as otherwise it will very likely balloon out all dom0 memory to map foreign and grant pages. Enable it by default as part of xen.config. This also requires enabling MEMORY_HOTREMOVE and ZONE_DEVICE. Signed-off-by: Roger Pau Monné Reviewed-by: Juergen Gross Message-ID: <20250514092037.28970-1-roger.pau@citrix.com> Signed-off-by: Juergen Gross commit 406251a408f51a5ff1b7d41a1d590b35aff5b0fa Author: John Ernberg Date: Mon May 12 07:14:50 2025 +0000 xen: swiotlb: Wire up map_resource callback When running Xen on iMX8QXP, an Arm SoC without IOMMU, DMA performed via its eDMA v3 DMA engine fail with a mapping error. The eDMA performs DMA between RAM and MMIO space, and it's the MMIO side that cannot be mapped. MMIO->RAM DMA access cannot be bounce buffered if it would straddle a page boundary and on Xen the MMIO space is 1:1 mapped for Arm, and x86 PV Dom0. Cases where MMIO space is not 1:1 mapped, such as x86 PVH Dom0, requires an IOMMU present to deal with the mapping. Considering the above the map_resource callback can just be wired to the existing dma_direct_map_resource() function. There is nothing to do for unmap so the unmap callback is not needed. Signed-off-by: John Ernberg Reviewed-by: Stefano Stabellini Message-ID: <20250512071440.3726697-1-john.ernberg@actia.se> Signed-off-by: Juergen Gross commit 0ffca606e902151fbe09d4356c493fe79ca93956 Author: Ian Rogers Date: Thu May 15 11:14:17 2025 -0700 perf pmu intel: Adjust cpumaks for sub-NUMA clusters on graniterapids On graniterapids the cache home agent (CHA) and memory controller (IMC) PMUs all have their cpumask set to per-socket information. In order for per NUMA node aggregation to work correctly the PMUs cpumask needs to be set to CPUs for the relevant sub-NUMA grouping. For example, on a 2 socket graniterapids machine with sub NUMA clustering of 3, for uncore_cha and uncore_imc PMUs the cpumask is "0,120" leading to aggregation only on NUMA nodes 0 and 3: ``` $ perf stat --per-node -e 'UNC_CHA_CLOCKTICKS,UNC_M_CLOCKTICKS' -a sleep 1 Performance counter stats for 'system wide': N0 1 277,835,681,344 UNC_CHA_CLOCKTICKS N0 1 19,242,894,228 UNC_M_CLOCKTICKS N3 1 277,803,448,124 UNC_CHA_CLOCKTICKS N3 1 19,240,741,498 UNC_M_CLOCKTICKS 1.002113847 seconds time elapsed ``` By updating the PMUs cpumasks to "0,120", "40,160" and "80,200" then the correctly 6 NUMA node aggregations are achieved: ``` $ perf stat --per-node -e 'UNC_CHA_CLOCKTICKS,UNC_M_CLOCKTICKS' -a sleep 1 Performance counter stats for 'system wide': N0 1 92,748,667,796 UNC_CHA_CLOCKTICKS N0 0 6,424,021,142 UNC_M_CLOCKTICKS N1 0 92,753,504,424 UNC_CHA_CLOCKTICKS N1 1 6,424,308,338 UNC_M_CLOCKTICKS N2 0 92,751,170,084 UNC_CHA_CLOCKTICKS N2 0 6,424,227,402 UNC_M_CLOCKTICKS N3 1 92,745,944,144 UNC_CHA_CLOCKTICKS N3 0 6,423,752,086 UNC_M_CLOCKTICKS N4 0 92,725,793,788 UNC_CHA_CLOCKTICKS N4 1 6,422,393,266 UNC_M_CLOCKTICKS N5 0 92,717,504,388 UNC_CHA_CLOCKTICKS N5 0 6,421,842,618 UNC_M_CLOCKTICKS 1.003406645 seconds time elapsed ``` In general, having the perf tool adjust cpumasks isn't desirable as ideally the PMU driver would be advertising the correct cpumask. Signed-off-by: Ian Rogers Tested-by: Kan Liang Tested-by: Weilin Wang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Link: https://lore.kernel.org/r/20250515181417.491401-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 9e893dab828577adb166cc2badfb4711f1cd6e4c Author: Arnaldo Carvalho de Melo Date: Thu May 22 19:01:47 2025 -0300 perf tests trace_summary.sh: Run in exclusive mode And it is being successfull only when running alone, probably because there are some tests that add the vfs_getname probe that gets used by 'perf trace' and alter how it does syscall arg pathname resolution. This should be removed or made a fallback to the preferred BPF mode of getting syscall parameters, but till then, run this in exclusive mode. For reference, here are some of the tests that run close to this one: 127: perf record offcpu profiling tests : Ok 128: perf all PMU test : Ok 129: perf stat --bpf-counters test : Ok 130: Check Arm CoreSight trace data recording and synthesized samples: Skip 131: Check Arm CoreSight disassembly script completes without errors : Skip 132: Check Arm SPE trace data recording and synthesized samples : Skip 133: Test data symbol : Ok 134: Miscellaneous Intel PT testing : Skip 135: test Intel TPEBS counting mode : Skip 136: perf script task-analyzer tests : Ok 137: Check open filename arg using perf trace + vfs_getname : Ok 138: perf trace summary : Ok Cc: Adrian Hunter Cc: Howard Chu Cc: Ian Rogers Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Link: https://lore.kernel.org/r/aC-hHTgArwlF_zu9@x1 Signed-off-by: Arnaldo Carvalho de Melo commit dd8633bd09bcd346fc3c38ce516e73083eb841a6 Author: Namhyung Kim Date: Thu May 22 07:25:51 2025 -0700 perf test: Add cgroup summary test case for 'perf trace' $ sudo ./perf test -vv 112 112: perf trace summary: --- start --- test child forked, pid 1018940 testing: perf trace -s -- true testing: perf trace -S -- true testing: perf trace -s --summary-mode=thread -- true testing: perf trace -S --summary-mode=total -- true testing: perf trace -as --summary-mode=thread --no-bpf-summary -- true testing: perf trace -as --summary-mode=total --no-bpf-summary -- true testing: perf trace -as --summary-mode=thread --bpf-summary -- true testing: perf trace -as --summary-mode=total --bpf-summary -- true testing: perf trace -aS --summary-mode=total --bpf-summary -- true testing: perf trace -as --summary-mode=cgroup --bpf-summary -- true testing: perf trace -aS --summary-mode=cgroup --bpf-summary -- true ---- end(0) ---- 112: perf trace summary : Ok Reviewed-by: Howard Chu Signed-off-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250522142551.1062417-1-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 59df607bf8b482588fae63fb3e1d666ed866f491 Author: Gautam Menghani Date: Mon May 19 12:51:44 2025 -0700 perf python: Add counting.py as example for counting perf events Add counting.py - a python version of counting.c to demonstrate measuring and reading of counts for given perf events. Committer testing: Build perf and make the generated python binding somewhere you can point to to avoid using the one in the distro python3-perf (fedora, may be different in other distros): $ make -k O=/tmp/build/$(basename $PWD)/ -C tools/perf install-bin Copy /tmp/build/perf-tools-next/python/perf.cpython-313-x86_64-linux-gnu.so to somewhere outside this toolbox container and then use it with root: # export PYTHONPATH=/root/python/ # ls -la /root/python/ total 10640 drwxr-xr-x. 1 root root 72 May 21 11:40 . dr-xr-x---. 1 root root 574 May 21 11:40 .. -rwxr-xr-x. 1 acme acme 10894360 May 21 11:40 perf.cpython-313-x86_64-linux-gnu.so # tools/perf/python/counting.py | head -5 For evsel(software/cpu-clock/) val: 2930946 enable: 2932479 run: 2932479 For evsel(software/cpu-clock/) val: 2924975 enable: 2926267 run: 2926267 For evsel(software/cpu-clock/) val: 2921017 enable: 2922430 run: 2922430 For evsel(software/cpu-clock/) val: 2914966 enable: 2916549 run: 2916549 For evsel(software/cpu-clock/) val: 2910027 enable: 2911589 run: 2911589 # Signed-off-by: Gautam Menghani Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Howard Chu Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Madhavan Srinivasan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra [ make the API take a CPU and thread then compute from these the appropriate indices. ] Signed-off-by: Ian Rogers Link: https://lore.kernel.org/linux-perf-users/CAP-5=fWb-=hCYmpg7U5N9C94EucQGTOS7YwR2-fo4ptOexzxyg@mail.gmail.com/ Link: https://lore.kernel.org/r/20250519195148.1708988-8-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit aa6848374023ea14664e6812e0f64e1a28044936 Author: Gautam Menghani Date: Mon May 19 12:51:43 2025 -0700 perf python: Add evlist close support Add support for the evlist close function. Signed-off-by: Gautam Menghani Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Howard Chu Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Madhavan Srinivasan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250519195148.1708988-7-irogers@google.com Signed-off-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo commit 739621f65702d532527aec124b0818d3a1521b5e Author: Gautam Menghani Date: Mon May 19 12:51:42 2025 -0700 perf python: Add evsel read method Add the evsel read method to enable python to read counter data for the given evsel. Signed-off-by: Gautam Menghani Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Howard Chu Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Madhavan Srinivasan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/linux-perf-users/20250512055748.479786-1-gautam@linux.ibm.com/ Link: https://lore.kernel.org/r/20250519195148.1708988-6-irogers@google.com [ make the API take a CPU and thread then compute from these the appropriate indices. ] Signed-off-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo commit 3b4991dcb49e1d99129ead644858cf7f77b8fb6b Author: Gautam Menghani Date: Mon May 19 12:51:41 2025 -0700 perf python: Add support for 'struct perf_counts_values' to return counter data Add support for the perf_counts_values struct to enable the python bindings to read and return the counter data. Committer notes: Use T_ULONG instead of Py_T_ULONG, as all the other PyMemberDef arrays, fixing the build with older python3 versions. Use { .name = NULL, } to finish the new PyMemberDef pyrf_counts_values_members array, again as the other arrays to please some clang versions, ditto for PyGetSetDef. Signed-off-by: Gautam Menghani Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Howard Chu Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Madhavan Srinivasan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250519195148.1708988-5-irogers@google.com Signed-off-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo commit 17a2a72df3b632a14c25b4e3117deb57860b548c Author: Gao Xiang Date: Thu May 22 16:49:53 2025 +0800 erofs: clean up erofs_{init,exit}_sysfs() Get rid of useless `goto`s. No logic changes. Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20250522084953.412096-1-hsiangkao@linux.alibaba.com commit 09febae220d2ea51da324215be7d6871de6aa5f5 Merge: 0af2f6be1b4281 276036283716b9 Author: Stephen Boyd Date: Thu May 22 16:16:59 2025 -0700 Merge tag 'v6.16-rockchip-clk1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into clk-rockchip Pull Rockchip clk driver updates from Heiko Stuebner: - Ability to handle different "General Register Files" syscons, not just a single system-one, plus ability to model individual gates found there. - For whatever reason Rockchip also moved the mmc-phase-clocks from the clock-unit for the GRF on some newer socs like the rk3528 (before moving them fully to the mmc controller itself on the rk3576), so add a new clock-variant for the phases, reusing the new GRF handling. - The old rk3036 got real handling of the usb480m mux and some PLL rates were added. * tag 'v6.16-rockchip-clk1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: clk: rockchip: rk3528: add slab.h header include clk: rockchip: rk3576: add missing slab.h include clk: rockchip: rename gate-grf clk file clk: rockchip: rename branch_muxgrf to branch_grf_mux clk: rockchip: Pass NULL as reg pointer when registering GRF MMC clocks clk: rockchip: rk3036: mark ddrphy as critical clk: rockchip: rk3036: fix implementation of usb480m clock mux dt-bindings: clock: rk3036: add SCLK_USB480M clock-id clk: rockchip: rk3528: Add SD/SDIO tuning clocks in GRF region clk: rockchip: Support MMC clocks in GRF region dt-bindings: clock: Add GRF clock definition for RK3528 clk: rockchip: add GATE_GRFs for SAI MCLKOUT to rk3576 clk: rockchip: introduce GRF gates clk: rockchip: introduce auxiliary GRFs dt-bindings: clock: rk3576: add IOC gated clocks clk: rockchip: rk3568: Add PLL rate for 33.3MHz clk: rockchip: Drop empty init callback for rk3588 PLL type clk: rockchip: rk3588: Add PLL rate for 1500 MHz commit 8259eb0e06d8f64c700f5fbdb28a5c18e10de291 Author: Jiayuan Chen Date: Fri May 16 22:17:12 2025 +0800 bpf, sockmap: Avoid using sk_socket after free when sending The sk->sk_socket is not locked or referenced in backlog thread, and during the call to skb_send_sock(), there is a race condition with the release of sk_socket. All types of sockets(tcp/udp/unix/vsock) will be affected. Race conditions: ''' CPU0 CPU1 backlog::skb_send_sock sendmsg_unlocked sock_sendmsg sock_sendmsg_nosec close(fd): ... ops->release() -> sock_map_close() sk_socket->ops = NULL free(socket) sock->ops->sendmsg ^ panic here ''' The ref of psock become 0 after sock_map_close() executed. ''' void sock_map_close() { ... if (likely(psock)) { ... // !! here we remove psock and the ref of psock become 0 sock_map_remove_links(sk, psock) psock = sk_psock_get(sk); if (unlikely(!psock)) goto no_psock; <=== Control jumps here via goto ... cancel_delayed_work_sync(&psock->work); <=== not executed sk_psock_put(sk, psock); ... } ''' Based on the fact that we already wait for the workqueue to finish in sock_map_close() if psock is held, we simply increase the psock reference count to avoid race conditions. With this patch, if the backlog thread is running, sock_map_close() will wait for the backlog thread to complete and cancel all pending work. If no backlog running, any pending work that hasn't started by then will fail when invoked by sk_psock_get(), as the psock reference count have been zeroed, and sk_psock_drop() will cancel all jobs via cancel_delayed_work_sync(). In summary, we require synchronization to coordinate the backlog thread and close() thread. The panic I catched: ''' Workqueue: events sk_psock_backlog RIP: 0010:sock_sendmsg+0x21d/0x440 RAX: 0000000000000000 RBX: ffffc9000521fad8 RCX: 0000000000000001 ... Call Trace: ? die_addr+0x40/0xa0 ? exc_general_protection+0x14c/0x230 ? asm_exc_general_protection+0x26/0x30 ? sock_sendmsg+0x21d/0x440 ? sock_sendmsg+0x3e0/0x440 ? __pfx_sock_sendmsg+0x10/0x10 __skb_send_sock+0x543/0xb70 sk_psock_backlog+0x247/0xb80 ... ''' Fixes: 4b4647add7d3 ("sock_map: avoid race between sock_map_close and sk_psock_put") Reported-by: Michal Luczaj Signed-off-by: Jiayuan Chen Signed-off-by: Martin KaFai Lau Reviewed-by: John Fastabend Link: https://lore.kernel.org/r/20250516141713.291150-1-jiayuan.chen@linux.dev commit 0409ac483a81a28bd10bdaa247733e6f35a7eef8 Merge: 0af2f6be1b4281 be0e9a37278727 Author: Stephen Boyd Date: Thu May 22 16:14:17 2025 -0700 Merge tag 'sunxi-clk-for-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into clk-allwinner Pull Allwinner clk driver updates from Chen-Yu Tsai: - Add support for DE (display engine) 3.3 clocks on H616 - Add missing LVDS reset control on H616 - Do not enable by default during compile testing * tag 'sunxi-clk-for-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: clk: sunxi-ng: ccu: add Display Engine 3.3 (DE33) support dt-bindings: allwinner: add H616 DE33 clock binding clk: sunxi-ng: h616: Add LVDS reset for LCD TCON dt-bindings: clock: sun50i-h616-ccu: Add LVDS reset clk: sunxi: Do not enable by default during compile testing clk: sunxi-ng: Do not enable by default during compile testing commit b217785073f073f17fef54735cbbc8a03193b9b1 Merge: 0af2f6be1b4281 0afce85ed26c73 Author: Stephen Boyd Date: Thu May 22 15:46:48 2025 -0700 Merge tag 'clk-meson-v6.16-1' of https://github.com/BayLibre/clk-meson into clk-amlogic Pull Amlogic clk driver updates from Jerome Brunet: - Fix Amlogic G12 SPICC clock sources - Compile test Amlogic clocks only if ARCH_MESON is set * tag 'clk-meson-v6.16-1' of https://github.com/BayLibre/clk-meson: clk: meson: Do not enable by default during compile testing clk: meson-g12a: add missing fclk_div2 to spicc commit 3a4c538e13d65ed891f8c52efe9d2af7a73450b3 Merge: 0af2f6be1b4281 81214185e7e1fc Author: Stephen Boyd Date: Thu May 22 15:32:50 2025 -0700 Merge tag 'samsung-clk-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into clk-samsung Pull Samsung SoC clock driver updates from Krzysztof Kozlowski: - Add Samsung ExynosAutov920 CPU cluster CL0, CL1 and CL2 clock controllers - Fix Samsung ExynosAutov920 HSI1 USBDRD clock parents - Minor cleanup for Samsung Exynos4 clk drivers * tag 'samsung-clk-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: clk: samsung: correct clock summary for hsi1 block clk: samsung: exynosautov920: Fix incorrect CLKS_NR_CPUCL0 definition clk: samsung: exynosautov920: add cpucl1/2 clock support dt-bindings: clock: exynosautov920: add cpucl1/2 clock definitions clk: samsung: exynosautov920: add cpucl0 clock support dt-bindings: clock: exynosautov920: add cpucl0 clock definitions clk: samsung: Use samsung CCF common function commit 1ffbdb7aa89af52c9c1cbfe9aaaafbb4117a9ed3 Merge: bef96521310e8d 28548f3f7994dd Author: Stephen Boyd Date: Thu May 22 15:26:04 2025 -0700 Merge tag 'renesas-clk-for-v6.16-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into clk-renesas Pull Renesas clk driver updates from Geert Uytterhoeven: - Add Expanded Serial Peripheral Interface (xSPI) clocks and resets on Renesas RZ/G3E * tag 'renesas-clk-for-v6.16-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers: clk: renesas: r9a09g047: Add XSPI clock/reset clk: renesas: r9a09g047: Add support for xspi mux and divider dt-bindings: clock: renesas,r9a09g047-cpg: Add XSPI and GBETH PTP core clocks clk: renesas: Use str_on_off() helper commit 29c98b13921eb15548954f18bf5d96b6e62d69de Merge: 0af2f6be1b4281 50d4b157fa96bf Author: Stephen Boyd Date: Thu May 22 15:21:43 2025 -0700 Merge tag 'thead-clk-for-v6.16' of https://github.com/pdp7/linux into clk-thead Pull T-HEAD clk driver updates from Drew Fustini: - Clk driver for Video Output (VO) subsystem in the T-HEAD TH1520 SoC * tag 'thead-clk-for-v6.16' of https://github.com/pdp7/linux: clk: thead: Add clock support for VO subsystem in T-HEAD TH1520 SoC dt-bindings: clock: thead: Add TH1520 VO clock controller commit f7819f7988f9c7292315c522d65301ced5cfa7db Author: Igor Korotin Date: Wed Apr 2 17:00:47 2025 +0100 docs: rust: quick-start: update Ubuntu instructions Split installation instructions for Ubuntu into 2 different sections: - For Ubuntu 25.04: this release provides easy-to-install Rust packages. - For Ubuntu 24.10 and below: these releases provide rust-1.80 and bindgen-0.65, which do not set their tools as defaults. The instructions for these versions have been updated to configure Rust tools properly. Signed-off-by: Igor Korotin Link: https://lore.kernel.org/r/20250402160047.1827500-1-igor.korotin@yahoo.com [ Dropped 24.10 -- it is soon out of support and their `bindgen` issue (reported as issue #2086639) was never patched anyway. Removed trailing spaces. Split into subheaders. Added `rustfmt` link. Removed spurious backquotes. Reworded contents slightly. - Miguel ] Signed-off-by: Miguel Ojeda commit de7cd3e4d6387df6a5ae8c4c32ff0479ebe0efb5 Author: Igor Korotin Date: Mon May 19 17:45:53 2025 +0100 rust: use absolute paths in macros referencing core and kernel Macros and auto-generated code should use absolute paths, `::core::...` and `::kernel::...`, for core and kernel references. This prevents issues where user-defined modules named `core` or `kernel` could be picked up instead of the `core` or `kernel` crates. Thus clean some references up. Suggested-by: Benno Lossin Closes: https://github.com/Rust-for-Linux/linux/issues/1150 Signed-off-by: Igor Korotin Reviewed-by: Benno Lossin Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250519164615.3310844-1-igor.korotin.linux@gmail.com [ Applied `rustfmt`. Reworded slightly. - Miguel ] Signed-off-by: Miguel Ojeda commit 977c4308ee4270cf46e2c66b37de8e04670daa0c Author: Rudraksha Gupta Date: Thu May 22 05:02:31 2025 -0700 rust: arm: fix unknown (to Clang) argument '-mno-fdpic' Currently rust on arm fails to compile due to '-mno-fdpic'. This flag disables a GCC feature that we don't want for kernel builds, so let's skip it as it doesn't apply to Clang. UPD include/generated/asm-offsets.h CALL scripts/checksyscalls.sh RUSTC L rust/core.o BINDGEN rust/bindings/bindings_generated.rs BINDGEN rust/bindings/bindings_helpers_generated.rs CC rust/helpers/helpers.o Unable to generate bindings: clang diagnosed error: error: unknown argument: '-mno-fdpic' make[2]: *** [rust/Makefile:369: rust/bindings/bindings_helpers_generated.rs] Error 1 make[2]: *** Deleting file 'rust/bindings/bindings_helpers_generated.rs' make[2]: *** Waiting for unfinished jobs.... Unable to generate bindings: clang diagnosed error: error: unknown argument: '-mno-fdpic' make[2]: *** [rust/Makefile:349: rust/bindings/bindings_generated.rs] Error 1 make[2]: *** Deleting file 'rust/bindings/bindings_generated.rs' make[1]: *** [/home/pmos/build/src/linux-next-next-20250521/Makefile:1285: prepare] Error 2 make: *** [Makefile:248: __sub-make] Error 2 [ Naresh provided the draft diff [1]. Ben explained [2]: FDPIC is only relevant with no-MMU targets, and then only for userspace. When configured for the arm-*-uclinuxfdpiceabi target, GCC enables FDPIC by default to facilitate compiling userspace programs. FDPIC is never used for the kernel, and we pass -mno-fdpic when building the kernel to override the default and make sure FDPIC is disabled. and [3]: -mno-fdpic disables a GCC feature that we don't want for kernel builds. clang does not support this feature, so it always behaves as though -mno-fdpic is passed. Therefore, it should be fine to mix the two, at least as far as FDPIC is concerned. [1] https://lore.kernel.org/rust-for-linux/CA+G9fYt4otQK4pHv8pJBW9e28yHSGCDncKquwuJiJ_1ou0pq0w@mail.gmail.com/ [2] https://lore.kernel.org/rust-for-linux/aAKrq2InExQk7f_k@dell-precision-5540/ [3] https://lore.kernel.org/rust-for-linux/aAo_F_UP1Gd4jHlZ@dell-precision-5540/ - Miguel ] Reported-by: Linux Kernel Functional Testing Closes: https://lore.kernel.org/all/CA+G9fYvOanQBYXKSg7C6EU30k8sTRC0JRPJXYu7wWK51w38QUQ@mail.gmail.com/ Suggested-by: Miguel Ojeda Acked-by: Naresh Kamboju Signed-off-by: Rudraksha Gupta Link: https://lore.kernel.org/r/20250522-rust-mno-fdpic-arm-fix-v2-1-a6f691d9c198@gmail.com [ Reworded title. - Miguel ] Signed-off-by: Miguel Ojeda commit 6888a036cfc3d617d0843ecc9bd8504e91fb9de6 Merge: 5ead949920c773 c04eeeb2af8ea2 Author: Martin KaFai Lau Date: Thu May 22 14:26:59 2025 -0700 Merge branch 'selftests-bpf-test-sockmap-sockhash-redirection' Michal Luczaj says: ==================== selftests/bpf: Test sockmap/sockhash redirection The idea behind this series is to comprehensively test the BPF redirection: BPF_MAP_TYPE_SOCKMAP, BPF_MAP_TYPE_SOCKHASH x sk_msg-to-egress, sk_msg-to-ingress, sk_skb-to-egress, sk_skb-to-ingress x AF_INET, SOCK_STREAM, AF_INET6, SOCK_STREAM, AF_INET, SOCK_DGRAM, AF_INET6, SOCK_DGRAM, AF_UNIX, SOCK_STREAM, AF_UNIX, SOCK_DGRAM, AF_VSOCK, SOCK_STREAM, AF_VSOCK, SOCK_SEQPACKET New module is introduced, sockmap_redir: all supported and unsupported redirect combinations are tested for success and failure respectively. Code is pretty much stolen/adapted from Jakub Sitnicki's sockmap_redir_matrix.c [1]. Usage: $ cd tools/testing/selftests/bpf $ make $ sudo ./test_progs -t sockmap_redir ... Summary: 1/576 PASSED, 0 SKIPPED, 0 FAILED [1]: https://github.com/jsitnicki/sockmap-redir-matrix/blob/main/sockmap_redir_matrix.c Changes in v3: - Drop unrelated changes; sockmap_listen, test_sockmap_listen, doc - Collect tags [Jakub, John] - Introduce BPF verdict programs especially for sockmap_redir [Jiayuan] - Link to v2: https://lore.kernel.org/r/20250411-selftests-sockmap-redir-v2-0-5f9b018d6704@rbox.co Changes in v2: - Verify that the unsupported redirect combos do fail [Jakub] - Dedup tests in sockmap_listen - Cosmetic changes and code reordering - Link to v1: https://lore.kernel.org/bpf/42939687-20f9-4a45-b7c2-342a0e11a014@rbox.co/ ==================== Link: https://patch.msgid.link/20250515-selftests-sockmap-redir-v3-0-a1ea723f7e7e@rbox.co Signed-off-by: Martin KaFai Lau commit 200577f69f29a58c90c67c83a0df6d12850e1d09 Author: Shakeel Butt Date: Wed May 14 11:41:58 2025 -0700 memcg: objcg stock trylock without irq disabling There is no need to disable irqs to use objcg per-cpu stock, so let's just not do that but consume_obj_stock() and refill_obj_stock() will need to use trylock instead to avoid deadlock against irq. One consequence of this change is that the charge request from irq context may take slowpath more often but it should be rare. Link: https://lkml.kernel.org/r/20250514184158.3471331-8-shakeel.butt@linux.dev Signed-off-by: Shakeel Butt Acked-by: Vlastimil Babka Cc: Alexei Starovoitov Cc: Johannes Weiner Cc: Michal Hocko Cc: Muchun Song Cc: Roman Gushchin Cc: Sebastian Andrzej Siewior Signed-off-by: Andrew Morton commit 0ccf1806d44f7c567c73d6ef076a8f6c8c16c74b Author: Shakeel Butt Date: Wed May 14 11:41:57 2025 -0700 memcg: no stock lock for cpu hot-unplug Previously on the cpu hot-unplug, the kernel would call drain_obj_stock() with objcg local lock. However local lock was not needed as the stock which was accessed belongs to a dead cpu but we kept it there to disable irqs as drain_obj_stock() may call mod_objcg_mlstate() which required irqs disabled. However there is no need to disable irqs now for mod_objcg_mlstate(), so we can remove the local lock altogether from cpu hot-unplug path. Link: https://lkml.kernel.org/r/20250514184158.3471331-7-shakeel.butt@linux.dev Signed-off-by: Shakeel Butt Acked-by: Vlastimil Babka Cc: Alexei Starovoitov Cc: Johannes Weiner Cc: Michal Hocko Cc: Muchun Song Cc: Roman Gushchin Cc: Sebastian Andrzej Siewior Signed-off-by: Andrew Morton commit eee8a1778cab9efd5ba0eee1c081b4a4b396375b Author: Shakeel Butt Date: Wed May 14 11:41:56 2025 -0700 memcg: make __mod_memcg_lruvec_state re-entrant safe against irqs Let's make __mod_memcg_lruvec_state re-entrant safe and name it mod_memcg_lruvec_state(). The only thing needed is to convert the usage of __this_cpu_add() to this_cpu_add(). There are two callers of mod_memcg_lruvec_state() and one of them i.e. __mod_objcg_mlstate() will be re-entrant safe as well, so, rename it mod_objcg_mlstate(). The last caller __mod_lruvec_state() still calls __mod_node_page_state() which is not re-entrant safe yet, so keep it as is. Link: https://lkml.kernel.org/r/20250514184158.3471331-6-shakeel.butt@linux.dev Signed-off-by: Shakeel Butt Acked-by: Vlastimil Babka Cc: Alexei Starovoitov Cc: Johannes Weiner Cc: Michal Hocko Cc: Muchun Song Cc: Roman Gushchin Cc: Sebastian Andrzej Siewior Signed-off-by: Andrew Morton commit e52401e7247bb36cabba389ae32fb75a12a6e94b Author: Shakeel Butt Date: Wed May 14 11:41:55 2025 -0700 memcg: make count_memcg_events re-entrant safe against irqs Let's make count_memcg_events re-entrant safe against irqs. The only thing needed is to convert the usage of __this_cpu_add() to this_cpu_add(). In addition, with re-entrant safety, there is no need to disable irqs. Also add warnings for in_nmi() as it is not safe against nmi context. Link: https://lkml.kernel.org/r/20250514184158.3471331-5-shakeel.butt@linux.dev Signed-off-by: Shakeel Butt Acked-by: Vlastimil Babka Cc: Alexei Starovoitov Cc: Johannes Weiner Cc: Michal Hocko Cc: Muchun Song Cc: Roman Gushchin Cc: Sebastian Andrzej Siewior Signed-off-by: Andrew Morton commit 8814e3b8692b31e0150a894dd70c14ca0b7b746a Author: Shakeel Butt Date: Wed May 14 11:41:54 2025 -0700 memcg: make mod_memcg_state re-entrant safe against irqs Let's make mod_memcg_state re-entrant safe against irqs. The only thing needed is to convert the usage of __this_cpu_add() to this_cpu_add(). In addition, with re-entrant safety, there is no need to disable irqs. mod_memcg_state() is not safe against nmi, so let's add warning if someone tries to call it in nmi context. Link: https://lkml.kernel.org/r/20250514184158.3471331-4-shakeel.butt@linux.dev Signed-off-by: Shakeel Butt Acked-by: Vlastimil Babka Cc: Alexei Starovoitov Cc: Johannes Weiner Cc: Michal Hocko Cc: Muchun Song Cc: Roman Gushchin Cc: Sebastian Andrzej Siewior Signed-off-by: Andrew Morton commit c7163535cdaf7305aac14745483abb54684a43d5 Author: Shakeel Butt Date: Wed May 14 11:41:53 2025 -0700 memcg: move preempt disable to callers of memcg_rstat_updated Let's move the explicit preempt disable code to the callers of memcg_rstat_updated and also remove the memcg_stats_lock and related functions which ensures the callers of stats update functions have disabled preemption because now the stats update functions are explicitly disabling preemption. Link: https://lkml.kernel.org/r/20250514184158.3471331-3-shakeel.butt@linux.dev Signed-off-by: Shakeel Butt Acked-by: Vlastimil Babka Cc: Alexei Starovoitov Cc: Johannes Weiner Cc: Michal Hocko Cc: Muchun Song Cc: Roman Gushchin Cc: Sebastian Andrzej Siewior Signed-off-by: Andrew Morton commit 8a4b42b955286c122c4402b458acbc1d92953fbd Author: Shakeel Butt Date: Wed May 14 11:41:52 2025 -0700 memcg: memcg_rstat_updated re-entrant safe against irqs Patch series "memcg: make memcg stats irq safe", v2. This series converts memcg stats to be irq safe i.e. memcg stats can be updated in any context (task, softirq or hardirq) without disabling the irqs. This is still not nmi-safe on all architectures but after this series converting memcg charging and stats nmi-safe will be easier. This patch (of 7): memcg_rstat_updated() is used to track the memcg stats updates for optimizing the flushes. At the moment, it is not re-entrant safe and the callers disabled irqs before calling. However to achieve the goal of updating memcg stats without irqs, memcg_rstat_updated() needs to be re-entrant safe against irqs. This patch makes memcg_rstat_updated() re-entrant safe using this_cpu_* ops. On archs with CONFIG_ARCH_HAS_NMI_SAFE_THIS_CPU_OPS, this patch is also making memcg_rstat_updated() nmi safe. [lorenzo.stoakes@oracle.com: fix build] Link: https://lkml.kernel.org/r/22f69e6e-7908-4e92-96ca-5c70d535c439@lucifer.local Link: https://lkml.kernel.org/r/20250514184158.3471331-1-shakeel.butt@linux.dev Link: https://lkml.kernel.org/r/20250514184158.3471331-2-shakeel.butt@linux.dev Signed-off-by: Shakeel Butt Signed-off-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Tested-by: Alexei Starovoitov Cc: Johannes Weiner Cc: Michal Hocko Cc: Muchun Song Cc: Roman Gushchin Cc: Sebastian Andrzej Siewior Signed-off-by: Andrew Morton commit cc79061b8fc119807111b615aa791562374b15b2 Author: Baolin Wang Date: Tue May 13 14:56:35 2025 +0800 mm: khugepaged: decouple SHMEM and file folios' collapse Originally, the file pages collapse was intended for tmpfs/shmem to merge into THP in the background. However, now not only tmpfs/shmem can support large folios, but some other file systems (such as XFS, erofs ...) also support large folios. Therefore, it is time to decouple the support of file folios collapse from SHMEM. Link: https://lkml.kernel.org/r/ce5c2314e0368cf34bda26f9bacf01c982d4da17.1747119309.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Acked-by: David Hildenbrand Acked-by: Zi Yan Cc: Dev Jain Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: Michal Hocko Cc: Mike Rapoport Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 19e0713bbe4a682b651dfd3773d2a06a9d61c47b Author: Ryan Chung Date: Tue May 13 16:44:11 2025 +0900 selftests/eventfd: correct test name and improve messages - Rename test from eventfd_chek_flag_cloexec_and_nonblock to eventfd_check_flag_cloexec_and_nonblock. - Make the RDWR‐flag comment declarative: “The kernel automatically adds the O_RDWR flag.” - Update semaphore‐flag failure message to: “eventfd semaphore flag check failed: …” Link: https://lkml.kernel.org/r/20250513074411.6965-1-seokwoo.chung130@gmail.com Signed-off-by: Ryan Chung Reviewed-by: Wen Yang Cc: Shuah Khan Signed-off-by: Andrew Morton commit 780138b123816d717dbc0771d4c87e9a8a01963d Author: Casey Chen Date: Tue May 13 12:26:02 2025 -0600 alloc_tag: check mem_profiling_support in alloc_tag_init If mem_profiling_support is false, for example by sysctl.vm.mem_profiling=never, alloc_tag_init should skip module tags allocation, codetag type registration and procfs init. Link: https://lkml.kernel.org/r/20250513182602.121843-1-cachen@purestorage.com Signed-off-by: Casey Chen Reviewed-by: Yuanyuan Zhong Acked-by: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 6a4b3551ba1079e8831fb2821765a49b7fd33dbd Author: SeongJae Park Date: Mon May 12 17:27:15 2025 -0700 Docs/damon: update titles and brief introductions to explain DAMOS DAMON was initially developed only for data access monitoring, and then extended for not only access monitoring but also access-aware system operations (DAMOS). But the documents have old titles and brief introductions for only the monitoring part. Update the titles and the brief introductions to explain DAMOS part together. Link: https://lkml.kernel.org/r/20250513002715.40126-7-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Jonathan Corbet Cc: Shuah Khan Signed-off-by: Andrew Morton commit 03f83209e8e72df7eb6ed0afc60adca492844082 Author: SeongJae Park Date: Mon May 12 17:27:14 2025 -0700 selftests/damon/_damon_sysfs: read tried regions directories in order Kdamond.update_schemes_tried_regions() reads and stores tried regions information out of address order. It makes debugging a test failure difficult. Change the behavior to do the reading and writing in the address order. Link: https://lkml.kernel.org/r/20250513002715.40126-6-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Jonathan Corbet Cc: Shuah Khan Signed-off-by: Andrew Morton commit 094fb14913c7c92b2fa8b398fe6a4b8f143aec25 Author: SeongJae Park Date: Mon May 12 17:27:13 2025 -0700 mm/damon/tests/core-kunit: add a test for damos_set_filters_default_reject() DAMOS filters' default reject behavior is not very simple. Actually there was a mistake[1] during the development. Add a kunit test for validating the behavior. Link: https://lkml.kernel.org/r/20250513002715.40126-5-sj@kernel.org Link: https://lore.kernel.org/20250227002913.19359-1-sj@kernel.org [1] Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Jonathan Corbet Cc: Shuah Khan Signed-off-by: Andrew Morton commit a82cf30010665a3602cc6051d760e19e9174ae3d Author: SeongJae Park Date: Mon May 12 17:27:12 2025 -0700 mm/damon/paddr: remove unused variable, folio_list, in damon_pa_stat() Commit c0cb9d91bf297 ("mm/damon/paddr: report filter-passed bytes back for DAMOS_STAT action") added unused variable in damon_pa_stat(), due to a copy-and-paste error. Remove it. Link: https://lkml.kernel.org/r/20250513002715.40126-4-sj@kernel.org Fixes: c0cb9d91bf29 ("mm/damon/paddr: report filter-passed bytes back for DAMOS_STAT action") Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Jonathan Corbet Cc: Shuah Khan Signed-off-by: Andrew Morton commit 0bac6b1a1111977c769e1933e0b0fc24e3647d97 Author: SeongJae Park Date: Mon May 12 17:27:11 2025 -0700 mm/damon/sysfs-schemes: fix wrong comment on damons_sysfs_quota_goal_metric_strs A comment on damos_sysfs_quota_goal_metric_strs is simply wrong, due to a copy-and-paste error. Fix it. Link: https://lkml.kernel.org/r/20250513002715.40126-3-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Jonathan Corbet Cc: Shuah Khan Signed-off-by: Andrew Morton commit 591c4c78be06360fe31b31401564bdb2d2b79995 Author: SeongJae Park Date: Mon May 12 17:27:10 2025 -0700 mm/damon/core: warn and fix nr_accesses[_bp] corruption Patch series "mm/damon: minor fixups and improvements for code, tests, and documents". Yet another batch of miscellaneous DAMON changes. Fix and improve minor problems in code, tests and documents. This patch (of 6): For a bug such as double aggregation reset[1], ->nr_accesses and/or ->nr_accesses_bp of damon_region could be corrupted. Such corruption can make monitoring results pretty inaccurate, so the root causing bug should be investigated. Meanwhile, the corruption itself can easily be fixed but silently fixing it will hide the bug. Fix the corruption as soon as found, but WARN_ONCE() so that we can be aware of the existence of the bug while keeping the system running in a more sane way. Link: https://lkml.kernel.org/r/20250513002715.40126-1-sj@kernel.org Link: https://lkml.kernel.org/r/20250513002715.40126-2-sj@kernel.org Link: https://lore.kernel.org/20250302214145.356806-1-sj@kernel.org [1] Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Jonathan Corbet Cc: Shuah Khan Signed-off-by: Andrew Morton commit 2aad4edf6e1018b28b7000faec56b7b6e585c8e1 Author: Alexei Starovoitov Date: Fri May 16 17:34:46 2025 -0700 mm: rename try_alloc_pages() to alloc_pages_nolock() The "try_" prefix is confusing, since it made people believe that try_alloc_pages() is analogous to spin_trylock() and NULL return means EAGAIN. This is not the case. If it returns NULL there is no reason to call it again. It will most likely return NULL again. Hence rename it to alloc_pages_nolock() to make it symmetrical to free_pages_nolock() and document that NULL means ENOMEM. Link: https://lkml.kernel.org/r/20250517003446.60260-1-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov Acked-by: Vlastimil Babka Acked-by: Johannes Weiner Reviewed-by: Shakeel Butt Acked-by: Harry Yoo Cc: Andrii Nakryiko Cc: Kumar Kartikeya Dwivedi Cc: Michal Hocko Cc: Peter Zijlstra Cc: Sebastian Andrzej Siewior Cc: Steven Rostedt Signed-off-by: Andrew Morton commit 5fc4b770fc35c05874dd2dd5bf1f03d354025b62 Author: Mark Brown Date: Sun May 18 15:04:42 2025 +0100 selftests/mm: deduplicate second mmap() of 5*PAGE_SIZE at base The map_fixed_noreplace test does two blocks of test starting from a mapping of 5 pages at the base address, logging a test result for each initial mapping. These are logged with the same test name, causing test automation software to see two reports for the same test in a single run. Tweak the log message for the second one to deduplicate. Link: https://lkml.kernel.org/r/20250518-selftests-mm-map-fixed-noreplace-dup-v1-1-1a11a62c5e9f@kernel.org Signed-off-by: Mark Brown Cc: Shuah Khan Signed-off-by: Andrew Morton commit 6669d1aaa0c45a50a4cc5f1756ab03578eaebd18 Author: Lorenzo Stoakes Date: Wed May 14 09:40:24 2025 +0100 mm: remove WARN_ON_ONCE() in file_has_valid_mmap_hooks() Having encountered a trinity report in linux-next (Linked in the 'Closes' tag) it appears that there are legitimate situations where a file-backed mapping can be acquired but no file->f_op->mmap or file->f_op->mmap_prepare is set, at which point do_mmap() should simply error out with -ENODEV. Since previously we did not warn in this scenario and it appears we rely upon this, restore this situation, while retaining a WARN_ON_ONCE() for the case where both are set, which is absolutely incorrect and must be addressed and thus always requires a warning. If further work is required to chase down precisely what is causing this, then we can later restore this, but it makes no sense to hold up this series to do so, as this is existing and apparently expected behaviour. Link: https://lkml.kernel.org/r/20250514084024.29148-1-lorenzo.stoakes@oracle.com Fixes: c84bf6dd2b83 ("mm: introduce new .mmap_prepare() file callback") Signed-off-by: Lorenzo Stoakes Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202505141434.96ce5e5d-lkp@intel.com Reviewed-by: Vlastimil Babka Reviewed-by: Pedro Falcato Acked-by: David Hildenbrand Cc: Al Viro Cc: Christian Brauner Cc: Jan Kara Cc: Jann Horn Cc: Liam Howlett Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit cc0535acd1b439cfc854dfd27618b6f790497661 Author: Lorenzo Stoakes Date: Tue May 13 15:57:06 2025 +0100 MAINTAINERS: add kernel/fork.c to relevant sections Currently kernel/fork.c both contains absolutely key logic relating to a number of kernel subsystems and also has absolutely no assignment in MAINTAINERS. Correct this by placing this file in relevant sections - mm core, exec and the scheduler so people know who to contact when making changes here. scripts/get_maintainers.pl can perfectly well handle a file being in multiple sections, so this functions correctly. Intent is that we keep putting changes to kernel/fork.c through Andrew's tree. Link: https://lkml.kernel.org/r/20250513145706.122101-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: Peter Zijlstra (Intel) Acked-by: Michal Hocko Acked-by: Vlastimil Babka Reviewed-by: Kees Cook Acked-by: David Hildenbrand Acked-by: Liam R. Howlett Cc: Ben Segall Cc: Dietmar Eggemann Cc: Ingo Molnar Cc: Juri Lelli Cc: Mel Gorman Cc: Mike Rapoport Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Valentin Schneider Cc: Vincent Guittot Signed-off-by: Andrew Morton commit 698c0089cdf0b27d37f0b24824b682c23de5f72d Author: Baolin Wang Date: Mon May 12 10:57:12 2025 +0800 mm: convert do_set_pmd() to take a folio In do_set_pmd(), we always use the folio->page to build PMD mappings for the entire folio. Since all callers of do_set_pmd() already hold a stable folio, converting do_set_pmd() to take a folio is safe and more straightforward. In addition, to ensure the extensibility of do_set_pmd() for supporting larger folios beyond PMD size, we keep the 'page' parameter to specify which page within the folio should be mapped. No functional changes expected. Link: https://lkml.kernel.org/r/9b488f4ecb4d3fd8634e3d448dd0ed6964482480.1747017104.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Reviewed-by: Zi Yan Acked-by: David Hildenbrand Cc: Dev Jain Cc: Johannes Weiner Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 5053383829ab2b17dc4766a832004c848f4af9df Author: Baolin Wang Date: Mon May 12 10:57:11 2025 +0800 mm: khugepaged: convert set_huge_pmd() to take a folio We've already gotten the stable locked folio in collapse_pte_mapped_thp(), so just use folio for set_huge_pmd() to set the PMD entry, which is more straightforward. Moreover, we will check the folio size in do_set_pmd(), so we can remove the unnecessary VM_BUG_ON() in set_huge_pmd(). While we are at it, we can also remove the PageTransHuge(), as it currently has no callers. Link: https://lkml.kernel.org/r/110c3e1ec5fe7854a0e2c95ffcbc985817180ed7.1747017104.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Acked-by: David Hildenbrand Cc: Dev Jain Cc: Johannes Weiner Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Signed-off-by: Andrew Morton commit a624c424d5d3778863ac67f87a374c22b1520c27 Author: David Hildenbrand Date: Mon May 12 14:34:24 2025 +0200 mm/io-mapping: track_pfn() -> "pfnmap tracking" track_pfn() does not exist, let's simply refer to it as "pfnmap tracking". Link: https://lkml.kernel.org/r/20250512123424.637989-12-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Acked-by: Ingo Molnar [x86 bits] Reviewed-by: Liam R. Howlett Cc: Andy Lutomirski Cc: Borislav Betkov Cc: Dave Airlie Cc: "H. Peter Anvin" Cc: Jani Nikula Cc: Jann Horn Cc: Jonas Lahtinen Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Peter Xu Cc: Peter Zijlstra Cc: Rodrigo Vivi Cc: Steven Rostedt Cc: Thomas Gleinxer Cc: Tvrtko Ursulin Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 11c82e71817779fc002d47c5beb6ad9df444289a Author: David Hildenbrand Date: Mon May 12 14:34:23 2025 +0200 drm/i915: track_pfn() -> "pfnmap tracking" track_pfn() does not exist, let's simply refer to it as "pfnmap tracking". Link: https://lkml.kernel.org/r/20250512123424.637989-11-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Acked-by: Ingo Molnar [x86 bits] Reviewed-by: Liam R. Howlett Cc: Andy Lutomirski Cc: Borislav Betkov Cc: Dave Airlie Cc: "H. Peter Anvin" Cc: Jani Nikula Cc: Jann Horn Cc: Jonas Lahtinen Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Peter Xu Cc: Peter Zijlstra Cc: Rodrigo Vivi Cc: Steven Rostedt Cc: Thomas Gleinxer Cc: Tvrtko Ursulin Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 99e27b047c4ce17feed4bb5c5cb2f1521470afcd Author: David Hildenbrand Date: Mon May 12 14:34:22 2025 +0200 x86/mm/pat: inline memtype_match() into memtype_erase() Let's just have it in a single function. The resulting function is certainly small enough and readable. Link: https://lkml.kernel.org/r/20250512123424.637989-10-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Cc: Andy Lutomirski Cc: Borislav Betkov Cc: Dave Airlie Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jani Nikula Cc: Jann Horn Cc: Jonas Lahtinen Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Peter Xu Cc: Peter Zijlstra Cc: Rodrigo Vivi Cc: Steven Rostedt Cc: Thomas Gleinxer Cc: Tvrtko Ursulin Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 81baf8450165ac57cca52f73b541a1056a2ca676 Author: David Hildenbrand Date: Mon May 12 14:34:21 2025 +0200 x86/mm/pat: remove MEMTYPE_*_MATCH The "memramp() shrinking" scenario no longer applies, so let's remove that now-unnecessary handling. Link: https://lkml.kernel.org/r/20250512123424.637989-9-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Acked-by: Ingo Molnar [x86 bits] Reviewed-by: Liam R. Howlett Cc: Andy Lutomirski Cc: Borislav Betkov Cc: Dave Airlie Cc: "H. Peter Anvin" Cc: Jani Nikula Cc: Jann Horn Cc: Jonas Lahtinen Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Peter Xu Cc: Peter Zijlstra Cc: Rodrigo Vivi Cc: Steven Rostedt Cc: Thomas Gleinxer Cc: Tvrtko Ursulin Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit b3662fb91b98fc9503589ea98634fd48eee19426 Author: David Hildenbrand Date: Mon May 12 14:34:20 2025 +0200 x86/mm/pat: remove strict_prot parameter from reserve_pfn_range() Always set to 0, so let's remove it. Link: https://lkml.kernel.org/r/20250512123424.637989-8-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Acked-by: Ingo Molnar [x86 bits] Reviewed-by: Liam R. Howlett Cc: Andy Lutomirski Cc: Borislav Betkov Cc: Dave Airlie Cc: "H. Peter Anvin" Cc: Jani Nikula Cc: Jann Horn Cc: Jonas Lahtinen Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Peter Xu Cc: Peter Zijlstra Cc: Rodrigo Vivi Cc: Steven Rostedt Cc: Thomas Gleinxer Cc: Tvrtko Ursulin Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit cba4dbeb7bfcf8b69d491288c3bf877ead883214 Author: David Hildenbrand Date: Mon May 12 14:34:19 2025 +0200 mm: remove VM_PAT It's unused, so let's remove it. Link: https://lkml.kernel.org/r/20250512123424.637989-7-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Acked-by: Ingo Molnar [x86 bits] Reviewed-by: Liam R. Howlett Cc: Andy Lutomirski Cc: Borislav Betkov Cc: Dave Airlie Cc: "H. Peter Anvin" Cc: Jani Nikula Cc: Jann Horn Cc: Jonas Lahtinen Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Peter Xu Cc: Peter Zijlstra Cc: Rodrigo Vivi Cc: Steven Rostedt Cc: Thomas Gleinxer Cc: Tvrtko Ursulin Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 7bd7d74ec01954fde9eb65b065eb55bcda4f86e2 Author: David Hildenbrand Date: Mon May 12 14:34:18 2025 +0200 x86/mm/pat: remove old pfnmap tracking interface We can now get rid of the old interface along with get_pat_info() and follow_phys(). Link: https://lkml.kernel.org/r/20250512123424.637989-6-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Acked-by: Ingo Molnar [x86 bits] Reviewed-by: Liam R. Howlett Cc: Andy Lutomirski Cc: Borislav Betkov Cc: Dave Airlie Cc: "H. Peter Anvin" Cc: Jani Nikula Cc: Jann Horn Cc: Jonas Lahtinen Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Peter Xu Cc: Peter Zijlstra Cc: Rodrigo Vivi Cc: Steven Rostedt Cc: Thomas Gleinxer Cc: Tvrtko Ursulin Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit f8e97613fed25758ddf52159b87e1c66e619a23a Author: David Hildenbrand Date: Mon May 12 14:34:17 2025 +0200 mm: convert VM_PFNMAP tracking to pfnmap_track() + pfnmap_untrack() Let's use our new interface. In remap_pfn_range(), we'll now decide whether we have to track (full VMA covered) or only lookup the cachemode (partial VMA covered). Remember what we have to untrack by linking it from the VMA. When duplicating VMAs (e.g., splitting, mremap, fork), we'll handle it similar to anon VMA names, and use a kref to share the tracking. Once the last VMA un-refs our tracking data, we'll do the untracking, which simplifies things a lot and should sort our various issues we saw recently, for example, when partially unmapping/zapping a tracked VMA. This change implies that we'll keep tracking the original PFN range even after splitting + partially unmapping it: not too bad, because it was not working reliably before. The only thing that kind-of worked before was shrinking such a mapping using mremap(): we managed to adjust the reservation in a hacky way, now we won't adjust the reservation but leave it around until all involved VMAs are gone. If that ever turns out to be an issue, we could hook into VM splitting code and split the tracking; however, that adds complexity that might not be required, so we'll keep it simple for now. Link: https://lkml.kernel.org/r/20250512123424.637989-5-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Ingo Molnar [x86 bits] Reviewed-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Cc: Andy Lutomirski Cc: Borislav Betkov Cc: Dave Airlie Cc: "H. Peter Anvin" Cc: Jani Nikula Cc: Jann Horn Cc: Jonas Lahtinen Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Peter Xu Cc: Peter Zijlstra Cc: Rodrigo Vivi Cc: Steven Rostedt Cc: Thomas Gleinxer Cc: Tvrtko Ursulin Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit db44863a4d9df3604c4ff76507bb2056b6392e58 Author: David Hildenbrand Date: Mon May 12 14:34:16 2025 +0200 mm: introduce pfnmap_track() and pfnmap_untrack() and use them for memremap Let's provide variants of track_pfn_remap() and untrack_pfn() that won't mess with VMAs, and replace the usage in mm/memremap.c. Add some documentation. Link: https://lkml.kernel.org/r/20250512123424.637989-4-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Acked-by: Ingo Molnar [x86 bits] Reviewed-by: Liam R. Howlett Cc: Andy Lutomirski Cc: Borislav Betkov Cc: Dave Airlie Cc: "H. Peter Anvin" Cc: Jani Nikula Cc: Jann Horn Cc: Jonas Lahtinen Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Peter Xu Cc: Peter Zijlstra Cc: Rodrigo Vivi Cc: Steven Rostedt Cc: Thomas Gleinxer Cc: Tvrtko Ursulin Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit e1e1a3ae7f9f0cb06e80af0f24927be63149d081 Author: David Hildenbrand Date: Mon May 12 14:34:15 2025 +0200 mm: convert track_pfn_insert() to pfnmap_setup_cachemode*() ... by factoring it out from track_pfn_remap() into pfnmap_setup_cachemode() and provide pfnmap_setup_cachemode_pfn() as a replacement for track_pfn_insert(). For PMDs/PUDs, we keep checking a single pfn only. Add some documentation, and also document why it is valid to not check the whole pfn range. We'll reuse pfnmap_setup_cachemode() from core MM next. Link: https://lkml.kernel.org/r/20250512123424.637989-3-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Ingo Molnar [x86 bits] Reviewed-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Cc: Andy Lutomirski Cc: Borislav Betkov Cc: Dave Airlie Cc: "H. Peter Anvin" Cc: Jani Nikula Cc: Jann Horn Cc: Jonas Lahtinen Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Peter Xu Cc: Peter Zijlstra Cc: Rodrigo Vivi Cc: Steven Rostedt Cc: Thomas Gleinxer Cc: Tvrtko Ursulin Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit ed1a7814036c60ced6198548558342ef75af3ad8 Author: David Hildenbrand Date: Mon May 12 14:34:14 2025 +0200 x86/mm/pat: factor out setting cachemode into pgprot_set_cachemode() VM_PAT annoyed me too much and wasted too much of my time, let's clean PAT handling up and remove VM_PAT. This should sort out various issues with VM_PAT we discovered recently, and will hopefully make the whole code more stable and easier to maintain. In essence: we stop letting PAT mode mess with VMAs and instead lift what to track/untrack to the MM core. We remember per VMA which pfn range we tracked in a new struct we attach to a VMA (we have space without exceeding 192 bytes), use a kref to share it among VMAs during split/mremap/fork, and automatically untrack once the kref drops to 0. This implies that we'll keep tracking a full pfn range even after partially unmapping it, until fully unmapping it; but as that case was mostly broken before, this at least makes it work in a way that is least intrusive to VMA handling. Shrinking with mremap() used to work in a hacky way, now we'll similarly keep the original pfn range tacked even after this form of partial unmap. Does anybody care about that? Unlikely. If we run into issues, we could likely handled that (adjust the tracking) when our kref drops to 1 while freeing a VMA. But it adds more complexity, so avoid that for now. Briefly tested with the new pfnmap selftests [1]. This patch (of 11): Let's factor it out to make the code easier to grasp. Drop one comment where it is now rather obvious what is happening. Use it also in pgprot_writecombine()/pgprot_writethrough() where clearing the old cachemode might not be required, but given that we are already doing a function call, no need to care about this micro-optimization. Link: https://lkml.kernel.org/r/20250512123424.637989-1-david@redhat.com Link: https://lkml.kernel.org/r/20250512123424.637989-2-david@redhat.com Link: https://lkml.kernel.org/r/20250509153033.952746-1-david@redhat.com [1] Signed-off-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Acked-by: Ingo Molnar [x86 bits] Reviewed-by: Liam R. Howlett Cc: Andy Lutomirski Cc: Borislav Betkov Cc: Dave Airlie Cc: David Hildenbrand Cc: "H. Peter Anvin" Cc: Jani Nikula Cc: Jann Horn Cc: Jonas Lahtinen Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Peter Xu Cc: Peter Zijlstra Cc: Rodrigo Vivi Cc: Steven Rostedt Cc: Thomas Gleinxer Cc: Tvrtko Ursulin Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 4df65651f7075481e44c03bb39855a38783d87ac Author: Baolin Wang Date: Fri May 9 08:45:21 2025 +0800 mm: mincore: use pte_batch_hint() to batch process large folios When I tested the mincore() syscall, I observed that it takes longer with 64K mTHP enabled on my Arm64 server. The reason is the mincore_pte_range() still checks each PTE individually, even when the PTEs are contiguous, which is not efficient. Thus we can use pte_batch_hint() to get the batch number of the present contiguous PTEs, which can improve the performance. I tested the mincore() syscall with 1G anonymous memory populated with 64K mTHP, and observed an obvious performance improvement: w/o patch w/ patch changes 6022us 549us +91% Moreover, I also tested mincore() with disabling mTHP/THP, and did not see any obvious regression for base pages. Link: https://lkml.kernel.org/r/99cb00ee626ceb6e788102ca36821815cd832237.1746697240.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Reviewed-by: Barry Song Reviewed-by: Dev Jain Acked-by: David Hildenbrand Cc: Dev Jain Cc: Ryan Roberts Cc: Zi Yan Signed-off-by: Andrew Morton commit 83b6d498d027002e79c2ce40b5729137500c3170 Author: Zhongkun He Date: Fri May 9 16:35:28 2025 +0800 mm: cma: set early_pfn and bitmap as a union in cma_memrange Since early_pfn and bitmap are never used at the same time, they can be defined as a union to reduce the size of the data structure. This change can save 8 * u64 entries per CMA. Link: https://lkml.kernel.org/r/20250509083528.1360952-1-hezhongkun.hzk@bytedance.com Signed-off-by: Zhongkun He Signed-off-by: Andrew Morton commit 2616b370323a953c437ed2bf40a277e9deaa3709 Author: David Hildenbrand Date: Fri May 9 17:30:32 2025 +0200 selftests/mm: add simple VM_PFNMAP tests based on mmap'ing /dev/mem Let's test some basic functionality using /dev/mem. These tests will implicitly cover some PAT (Page Attribute Handling) handling on x86. These tests will only run when /dev/mem access to the first two pages in physical address space is possible and allowed; otherwise, the tests are skipped. On current x86-64 with PAT inside a VM, all tests pass: TAP version 13 1..6 # Starting 6 tests from 1 test cases. # RUN pfnmap.madvise_disallowed ... # OK pfnmap.madvise_disallowed ok 1 pfnmap.madvise_disallowed # RUN pfnmap.munmap_split ... # OK pfnmap.munmap_split ok 2 pfnmap.munmap_split # RUN pfnmap.mremap_fixed ... # OK pfnmap.mremap_fixed ok 3 pfnmap.mremap_fixed # RUN pfnmap.mremap_shrink ... # OK pfnmap.mremap_shrink ok 4 pfnmap.mremap_shrink # RUN pfnmap.mremap_expand ... # OK pfnmap.mremap_expand ok 5 pfnmap.mremap_expand # RUN pfnmap.fork ... # OK pfnmap.fork ok 6 pfnmap.fork # PASSED: 6 / 6 tests passed. # Totals: pass:6 fail:0 xfail:0 xpass:0 skip:0 error:0 However, we are able to trigger: [ 27.888251] x86/PAT: pfnmap:1790 freeing invalid memtype [mem 0x00000000-0x00000fff] There are probably more things worth testing in the future, such as MAP_PRIVATE handling. But this set of tests is sufficient to cover most of the things we will rework regarding PAT handling. Link: https://lkml.kernel.org/r/20250509153033.952746-1-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Cc: Shuah Khan Cc: Ingo Molnar Cc: Peter Xu Cc: Dev Jain Signed-off-by: Andrew Morton commit 3f12680913fda8de06c21e836dd5f246fe1684e5 Author: Yuquan Wang Date: Thu May 8 10:27:19 2025 +0800 mm: numa_memblks: introduce numa_add_reserved_memblk acpi_parse_cfmws() currently adds empty CFMWS ranges to numa_meminfo with the expectation that numa_cleanup_meminfo moves them to numa_reserved_meminfo. There is no need for that indirection when it is known in advance that these unpopulated ranges are meant for numa_reserved_meminfo in support of future hotplug / CXL provisioning. Introduce and use numa_add_reserved_memblk() to add the empty CFMWS ranges directly. Link: https://lkml.kernel.org/r/20250508022719.3941335-1-wangyuquan1236@phytium.com.cn Signed-off-by: Yuquan Wang Reviewed-by: Alison Schofield Cc: Bruno Faccini Cc: Chen Baozi Cc: Dan Williams Cc: David Hildenbrand Cc: Haibo Xu Cc: Huacai Chen Cc: Joanthan Cameron Cc: Len Brown Cc: Mike Rapoport Cc: Robert Richter Signed-off-by: Andrew Morton commit 5c5f0468d172ddec2e333d738d2a1f85402cf0bc Author: Jeongjun Park Date: Fri May 9 01:56:20 2025 +0900 mm/vmalloc: fix data race in show_numa_info() The following data-race was found in show_numa_info(): ================================================================== BUG: KCSAN: data-race in vmalloc_info_show / vmalloc_info_show read to 0xffff88800971fe30 of 4 bytes by task 8289 on cpu 0: show_numa_info mm/vmalloc.c:4936 [inline] vmalloc_info_show+0x5a8/0x7e0 mm/vmalloc.c:5016 seq_read_iter+0x373/0xb40 fs/seq_file.c:230 proc_reg_read_iter+0x11e/0x170 fs/proc/inode.c:299 .... write to 0xffff88800971fe30 of 4 bytes by task 8287 on cpu 1: show_numa_info mm/vmalloc.c:4934 [inline] vmalloc_info_show+0x38f/0x7e0 mm/vmalloc.c:5016 seq_read_iter+0x373/0xb40 fs/seq_file.c:230 proc_reg_read_iter+0x11e/0x170 fs/proc/inode.c:299 .... value changed: 0x0000008f -> 0x00000000 ================================================================== According to this report,there is a read/write data-race because m->private is accessible to multiple CPUs. To fix this, instead of allocating the heap in proc_vmalloc_init() and passing the heap address to m->private, vmalloc_info_show() should allocate the heap. Link: https://lkml.kernel.org/r/20250508165620.15321-1-aha310510@gmail.com Fixes: 8e1d743f2c26 ("mm: vmalloc: support multiple nodes in vmallocinfo") Signed-off-by: Jeongjun Park Suggested-by: Eric Dumazet Suggested-by: Andrew Morton Reviewed-by: "Uladzislau Rezki (Sony)" Signed-off-by: Andrew Morton commit a08f0ac32bf48e7bb70b75fc42d8e2d376825496 Merge: 0af2f6be1b4281 41b08610dd262d Author: Stephen Boyd Date: Thu May 22 14:55:12 2025 -0700 Merge tag 'riscv-sophgo-clk-for-v6.16' of https://github.com/sophgo/linux into clk-sophgo Pull RISC-V Sophgo clk driver updates from Chen Wang: - Replace compatible for Sophgo CV1800 series SoC - Add clock support for Sophgo SG2044 * tag 'riscv-sophgo-clk-for-v6.16' of https://github.com/sophgo/linux: clk: sophgo: Add clock controller support for SG2044 SoC clk: sophgo: Add PLL clock controller support for SG2044 SoC dt-bindings: clock: sophgo: add clock controller for SG2044 dt-bindings: soc: sophgo: Add SG2044 top syscon device clk: sophgo: Add support for newly added precise compatible dt-bindings: clock: sophgo: Use precise compatible for CV1800 series SoC commit d2c6acff6386f43ed307822454b970c831c48f1b Author: Jonas Karlman Date: Sun May 18 22:06:52 2025 +0000 dt-bindings: mmc: sdhci-of-dwcmhsc: Allow use of a power-domain The commit 7e856617a1f3 ("dt-bindings: mmc: Add support for rk3576 eMMC") limited use of power-domains to Rockchip RK3576. Remove the power-domains: false to allow use of power-domains with more controllers, e.g. with SDHCI on Rockchip RK3528. Signed-off-by: Jonas Karlman Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250518220707.669515-6-jonas@kwiboo.se Signed-off-by: Ulf Hansson commit c04eeeb2af8ea2c3f764d2d093bb9b435024a019 Author: Michal Luczaj Date: Thu May 15 00:15:31 2025 +0200 selftests/bpf: sockmap_listen cleanup: Drop af_inet SOCK_DGRAM redir tests Remove tests covered by sockmap_redir. Signed-off-by: Michal Luczaj Signed-off-by: Martin KaFai Lau Acked-by: John Fastabend Link: https://lore.kernel.org/r/20250515-selftests-sockmap-redir-v3-8-a1ea723f7e7e@rbox.co commit f3de1cf621f7e8f7653a24b9e0f21ac7aefbbf27 Author: Michal Luczaj Date: Thu May 15 00:15:30 2025 +0200 selftests/bpf: sockmap_listen cleanup: Drop af_unix redir tests Remove tests covered by sockmap_redir. Signed-off-by: Michal Luczaj Signed-off-by: Martin KaFai Lau Acked-by: John Fastabend Link: https://lore.kernel.org/r/20250515-selftests-sockmap-redir-v3-7-a1ea723f7e7e@rbox.co commit 9266e49d608cb5b8857863ef1d787fe9ccca0ee8 Author: Michal Luczaj Date: Thu May 15 00:15:29 2025 +0200 selftests/bpf: sockmap_listen cleanup: Drop af_vsock redir tests Remove tests covered by sockmap_redir. Signed-off-by: Michal Luczaj Signed-off-by: Martin KaFai Lau Acked-by: John Fastabend Link: https://lore.kernel.org/r/20250515-selftests-sockmap-redir-v3-6-a1ea723f7e7e@rbox.co commit f0709263a07ef076ac4e55f0d68e04d521b2184c Author: Michal Luczaj Date: Thu May 15 00:15:28 2025 +0200 selftests/bpf: Add selftest for sockmap/hashmap redirection Test redirection logic. All supported and unsupported redirect combinations are tested for success and failure respectively. BPF_MAP_TYPE_SOCKMAP BPF_MAP_TYPE_SOCKHASH x sk_msg-to-egress sk_msg-to-ingress sk_skb-to-egress sk_skb-to-ingress x AF_INET, SOCK_STREAM AF_INET6, SOCK_STREAM AF_INET, SOCK_DGRAM AF_INET6, SOCK_DGRAM AF_UNIX, SOCK_STREAM AF_UNIX, SOCK_DGRAM AF_VSOCK, SOCK_STREAM AF_VSOCK, SOCK_SEQPACKET Suggested-by: Jakub Sitnicki Signed-off-by: Michal Luczaj Signed-off-by: Martin KaFai Lau Acked-by: John Fastabend Link: https://lore.kernel.org/r/20250515-selftests-sockmap-redir-v3-5-a1ea723f7e7e@rbox.co commit f266905bb3d828e678e80d235fbd3e46d8c04a50 Author: Michal Luczaj Date: Thu May 15 00:15:27 2025 +0200 selftests/bpf: Introduce verdict programs for sockmap_redir Instead of piggybacking on test_sockmap_listen, introduce test_sockmap_redir especially for sockmap redirection tests. Suggested-by: Jiayuan Chen Signed-off-by: Michal Luczaj Signed-off-by: Martin KaFai Lau Acked-by: John Fastabend Link: https://lore.kernel.org/r/20250515-selftests-sockmap-redir-v3-4-a1ea723f7e7e@rbox.co commit b57482b0fe8e370e2895b9925a733c21cfec183a Author: Michal Luczaj Date: Thu May 15 00:15:26 2025 +0200 selftests/bpf: Add u32()/u64() to sockmap_helpers Add integer wrappers for convenient sockmap usage. While there, fix misaligned trailing slashes. Suggested-by: Jakub Sitnicki Signed-off-by: Michal Luczaj Signed-off-by: Martin KaFai Lau Reviewed-by: Jakub Sitnicki Acked-by: John Fastabend Link: https://lore.kernel.org/r/20250515-selftests-sockmap-redir-v3-3-a1ea723f7e7e@rbox.co commit d87857946ded5acfe273404c4126f75d8e7619c8 Author: Michal Luczaj Date: Thu May 15 00:15:25 2025 +0200 selftests/bpf: Add socket_kind_to_str() to socket_helpers Add function that returns string representation of socket's domain/type. Suggested-by: Jakub Sitnicki Signed-off-by: Michal Luczaj Signed-off-by: Martin KaFai Lau Reviewed-by: Jakub Sitnicki Acked-by: John Fastabend Link: https://lore.kernel.org/r/20250515-selftests-sockmap-redir-v3-2-a1ea723f7e7e@rbox.co commit fb1131d5e181604a6ef06a691709213decfe42bd Author: Michal Luczaj Date: Thu May 15 00:15:24 2025 +0200 selftests/bpf: Support af_unix SOCK_DGRAM socket pair creation Handle af_unix in init_addr_loopback(). For pair creation, bind() the peer socket to make SOCK_DGRAM connect() happy. Signed-off-by: Michal Luczaj Signed-off-by: Martin KaFai Lau Reviewed-by: Jakub Sitnicki Acked-by: John Fastabend Link: https://lore.kernel.org/r/20250515-selftests-sockmap-redir-v3-1-a1ea723f7e7e@rbox.co commit ea15e046263b19e91ffd827645ae5dfa44ebd044 Merge: 43a1ce8f42cb45 ed73728fd14e14 Author: Jakub Kicinski Date: Thu May 22 14:05:18 2025 -0700 Merge tag 'wireless-next-2025-05-22' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== Lots of new things, notably: * ath12k: monitor mode for WCN7850, better 6 GHz regulatory * brcmfmac: SAE for some Cypress devices * iwlwifi: rework device configuration * mac80211: scan improvements with MLO * mt76: EHT improvements, new device IDs * rtw88: throughput improvements * rtw89: MLO, STA/P2P concurrency improvements, SAR * tag 'wireless-next-2025-05-22' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (389 commits) wifi: mt76: mt7925: add rfkill_poll for hardware rfkill wifi: mt76: support power delta calculation for 5 TX paths wifi: mt76: fix available_antennas setting wifi: mt76: mt7996: fix RX buffer size of MCU event wifi: mt76: mt7996: change max beacon size wifi: mt76: mt7996: fix invalid NSS setting when TX path differs from NSS wifi: mt76: mt7996: drop fragments with multicast or broadcast RA wifi: mt76: mt7996: set EHT max ampdu length capability wifi: mt76: mt7996: fix beamformee SS field wifi: mt76: remove capability of partial bandwidth UL MU-MIMO wifi: mt76: mt7925: add test mode support wifi: mt76: mt7925: extend MCU support for testmode wifi: mt76: mt7925: ensure all MCU commands wait for response wifi: mt76: mt7925: refine the sniffer commnad wifi: mt76: mt7925: prevent multiple scan commands wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() wifi: mt76: mt7925: add RNR scan support for 6GHz wifi: mt76: add mt76_connac_mcu_build_rnr_scan_param routine wifi: mt76: scan: Fix 'mlink' dereferenced before IS_ERR_OR_NULL check ... ==================== Link: https://patch.msgid.link/20250522165501.189958-50-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit aca89f1be6bd3196dedc368e257351c1e561082e Author: Takashi Iwai Date: Thu May 22 22:52:51 2025 +0200 ALSA: hda: acpi: Make driver's match data const static The driver's match data, nvidia_hda_data, is referred only locally, and should be static. Also, as it's a read-only data, it can be gracefully const, too. Fixes: 4b214c9bbe26 ("ALSA: hda - Add new driver for HDA controllers listed via ACPI") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202505230426.k8ruTgnr-lkp@intel.com/ Link: https://patch.msgid.link/20250522205252.4056-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit ebaa3bf415e7faaf41f5a440aa00574539f0c2ab Author: Takashi Iwai Date: Thu May 22 22:46:23 2025 +0200 ALSA: hda: acpi: Use SYSTEM_SLEEP_PM_OPS() The dev_pm_ops definition must be SYSTEM_SLEEP_PM_OPS() instead of SET_SYSTEM_SLEEP_PM_OPS(); otherwise it leads compile warnings without CONFIG_PM_SLEEP. The latest patch version I took was back to an old macro (likely mistakenly), and I overlooked it at applying. Fix it now. Fixes: 4b214c9bbe26 ("ALSA: hda - Add new driver for HDA controllers listed via ACPI") Reported-by: Randy Dunlap Closes: https://lore.kernel.org/20250522203020.1478369-1-rdunlap@infradead.org Link: https://patch.msgid.link/20250522204624.1757-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 43a1ce8f42cb45d028a8e5f1c2748fb3eff48fb3 Merge: 33e1b1b3991ba8 3aa1dc3c9060e3 Author: Jakub Kicinski Date: Thu May 22 13:46:13 2025 -0700 Merge tag 'for-net-next-2025-05-22' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next Luiz Augusto von Dentz says: ==================== bluetooth-next pull request for net-next: core: - Add support for SIOCETHTOOL ETHTOOL_GET_TS_INFO - Separate CIS_LINK and BIS_LINK link types - Introduce HCI Driver protocol drivers: - btintel_pcie: Do not generate coredump for diagnostic events - btusb: Add HCI Drv commands for configuring altsetting - btusb: Add RTL8851BE device 0x0bda:0xb850 - btusb: Add new VID/PID 13d3/3584 for MT7922 - btusb: Add new VID/PID 13d3/3630 and 13d3/3613 for MT7925 - btnxpuart: Implement host-wakeup feature * tag 'for-net-next-2025-05-22' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next: (23 commits) Bluetooth: btintel: Check dsbr size from EFI variable Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922 Bluetooth: btusb: use skb_pull to avoid unsafe access in QCA dump handling Bluetooth: L2CAP: Fix not checking l2cap_chan security level Bluetooth: separate CIS_LINK and BIS_LINK link types Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925 Bluetooth: add support for SIOCETHTOOL ETHTOOL_GET_TS_INFO Bluetooth: btintel_pcie: Dump debug registers on error Bluetooth: ISO: Fix getpeername not returning sockaddr_iso_bc fields Bluetooth: ISO: Fix not using SID from adv report Revert "Bluetooth: btusb: add sysfs attribute to control USB alt setting" Revert "Bluetooth: btusb: Configure altsetting for HCI_USER_CHANNEL" Bluetooth: btusb: Add HCI Drv commands for configuring altsetting Bluetooth: Introduce HCI Driver protocol Bluetooth: btnxpuart: Implement host-wakeup feature dt-bindings: net: bluetooth: nxp: Add support for host-wakeup Bluetooth: btusb: Add RTL8851BE device 0x0bda:0xb850 Bluetooth: hci_uart: Remove unnecessary NULL check before release_firmware() Bluetooth: btmtksdio: Fix wakeup source leaks on device unbind ... ==================== Link: https://patch.msgid.link/20250522171048.3307873-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit 273cc949655c70001778eb0b9e7db993df845912 Author: Tejun Heo Date: Wed May 21 12:23:06 2025 -1000 sched_ext: Call ops.update_idle() after updating builtin idle bits BPF schedulers that use both builtin CPU idle mechanism and ops.update_idle() may want to use the latter to create interlocking between ops.enqueue() and CPU idle transitions so that either ops.enqueue() sees the idle bit or ops.update_idle() sees the task queued somewhere. This can prevent race conditions where CPUs go idle while tasks are waiting in DSQs. For such interlocking to work, ops.update_idle() must be called after builtin CPU masks are updated. Relocate the invocation. Currently, there are no ordering requirements on transitions from idle and this relocation isn't expected to make meaningful differences in that direction. This also makes the ops.update_idle() behavior semantically consistent: any action performed in this callback should be able to override the builtin idle state, not the other way around. Signed-off-by: Tejun Heo Reviewed-and-tested-by: Andrea Righi Acked-by: Changwoo Min commit 82648b8b2ae0a0ff371e2a98133844658cfaae9a Author: Tejun Heo Date: Wed May 14 00:46:12 2025 -0400 sched_ext: Convert cgroup BPF support to use cgroup_lifetime_notifier Replace explicit cgroup_bpf_inherit/offline() calls from cgroup creation/destruction paths with notification callback registered on cgroup_lifetime_notifier. Signed-off-by: Tejun Heo commit 9e8c67a9e526f497d606d721cf6b92dd68d90806 Author: Tejun Heo Date: Wed May 14 00:44:44 2025 -0400 sched_ext: Introduce cgroup_lifetime_notifier Other subsystems may make use of the cgroup hierarchy with the cgroup_bpf support being one such example. For such a feature, it's useful to be able to hook into cgroup creation and destruction paths to perform feature-specific initializations and cleanups. Add cgroup_lifetime_notifier which generates CGROUP_LIFETIME_ONLINE and CGROUP_LIFETIME_OFFLINE events whenever cgroups are created and destroyed, respectively. The next patch will convert cgroup_bpf to use the new notifier and other uses are planned. Signed-off-by: Tejun Heo commit cd22cbad1b800e55f5bd38c58be16f9d0b171d9a Author: Tejun Heo Date: Wed May 14 00:43:41 2025 -0400 cgroup: Minor reorganization of cgroup_create() cgroup_bpf init and exit handling will be moved to a notifier chain. In prepartion, reorganize cgroup_create() a bit so that the new cgroup is fully initialized before any outside changes are made. - cgrp->ancestors[] initialization and the hierarchical nr_descendants and nr_frozen_descendants updates were in the same loop. Separate them out and do the former earlier and do the latter later. - Relocate cgroup_bpf_inherit() call so that it's after all cgroup initializations are complete. No visible behavior changes expected. Signed-off-by: Tejun Heo commit 2a6c0136ae9ac44f2b097e469d4cee95cd11e4f8 Author: Kent Overstreet Date: Tue May 6 21:54:35 2025 -0400 bcachefs: bch2_journal_write_checksum() We need to delay checksumming the journal write; we don't know the blocksize until after we allocate the write. Signed-off-by: Kent Overstreet commit d385ca5603a3af3c5cc85d16e42e6063a257ea55 Author: Kent Overstreet Date: Thu May 22 12:50:22 2025 -0400 bcachefs: Reduce stack usage in data_update_index_update() Separate tracepoint message generation and other slowpath code into non-inline functions, and use bch2_trans_log_str() instead of using a printbuf for our journal message. Signed-off-by: Kent Overstreet commit 7d886a82bf9cb2b3b0e591a915c89c4696598149 Author: Kent Overstreet Date: Thu May 22 12:49:56 2025 -0400 bcachefs: bch2_trans_log_str() The data update path doesn't need a printbuf for its log message - this will help reduce stack usage. Signed-off-by: Kent Overstreet commit 4a9eb20efa9f07b54382bb2713439fc09336d45a Author: Kent Overstreet Date: Thu May 22 12:34:40 2025 -0400 bcachefs: Kill bkey_buf usage in data_update_index_update() Reduce stack usage - bkey_buf has a 96 byte buffer on the stack, but the btree_trans bump allocator works just fine here. Signed-off-by: Kent Overstreet commit d16e7994c8b2ed38beb8bae6f4b1292987b627af Author: Shashank Balaji Date: Thu May 22 11:08:14 2025 +0900 cgroup, docs: cpu controller's interaction with various scheduling policies The cpu controller interface files account for or affect processes differently based on their scheduling policy, and the underlying scheduler used (fair-class vs. BPF scheduler). Document these differences Signed-off-by: Shashank Balaji Signed-off-by: Tejun Heo commit aa3a7b6261d8530da3d06c61d21b1acda54abf52 Author: Shashank Balaji Date: Thu May 22 11:08:13 2025 +0900 sched_ext, docs: convert mentions of "CFS" to "fair-class scheduler" Mentions of CFS are stale since the fair-class scheduler is implemented using EEVDF. So, convert such mentions to "fair-class scheduler" to stay algorithm-name agnostic. Signed-off-by: Shashank Balaji Signed-off-by: Tejun Heo commit 79bfa4b38ad6fd6da6e568b5be2e1fff32565a93 Author: Shashank Balaji Date: Thu May 22 11:08:12 2025 +0900 cgroup, docs: convert space indentation to tab indentation The paragraphs on cpu.uclamp.{min,max} are space indented. Convert them to tab indentation to make them uniform with the other paragraphs. Signed-off-by: Shashank Balaji Signed-off-by: Tejun Heo commit 2b6d96503255a3ed676cd70f8368870c6d6a25c6 Author: Fedor Pchelkin Date: Tue Mar 25 19:32:13 2025 +0300 jffs2: check jffs2_prealloc_raw_node_refs() result in few other places Fuzzing hit another invalid pointer dereference due to the lack of checking whether jffs2_prealloc_raw_node_refs() completed successfully. Subsequent logic implies that the node refs have been allocated. Handle that. The code is ready for propagating the error upwards. KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 1 PID: 5835 Comm: syz-executor145 Not tainted 5.10.234-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:jffs2_link_node_ref+0xac/0x690 fs/jffs2/nodelist.c:600 Call Trace: jffs2_mark_erased_block fs/jffs2/erase.c:460 [inline] jffs2_erase_pending_blocks+0x688/0x1860 fs/jffs2/erase.c:118 jffs2_garbage_collect_pass+0x638/0x1a00 fs/jffs2/gc.c:253 jffs2_reserve_space+0x3f4/0xad0 fs/jffs2/nodemgmt.c:167 jffs2_write_inode_range+0x246/0xb50 fs/jffs2/write.c:362 jffs2_write_end+0x712/0x1110 fs/jffs2/file.c:302 generic_perform_write+0x2c2/0x500 mm/filemap.c:3347 __generic_file_write_iter+0x252/0x610 mm/filemap.c:3465 generic_file_write_iter+0xdb/0x230 mm/filemap.c:3497 call_write_iter include/linux/fs.h:2039 [inline] do_iter_readv_writev+0x46d/0x750 fs/read_write.c:740 do_iter_write+0x18c/0x710 fs/read_write.c:866 vfs_writev+0x1db/0x6a0 fs/read_write.c:939 do_pwritev fs/read_write.c:1036 [inline] __do_sys_pwritev fs/read_write.c:1083 [inline] __se_sys_pwritev fs/read_write.c:1078 [inline] __x64_sys_pwritev+0x235/0x310 fs/read_write.c:1078 do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x67/0xd1 Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 2f785402f39b ("[JFFS2] Reduce visibility of raw_node_ref to upper layers of JFFS2 code.") Fixes: f560928baa60 ("[JFFS2] Allocate node_ref for wasted space when skipping to page boundary") Cc: stable@vger.kernel.org Signed-off-by: Fedor Pchelkin Reviewed-by: Zhihao Cheng Signed-off-by: Richard Weinberger commit ec9e6f22bce433b260ea226de127ec68042849b0 Author: Artem Sadovnikov Date: Fri Mar 7 16:34:09 2025 +0000 jffs2: check that raw node were preallocated before writing summary Syzkaller detected a kernel bug in jffs2_link_node_ref, caused by fault injection in jffs2_prealloc_raw_node_refs. jffs2_sum_write_sumnode doesn't check return value of jffs2_prealloc_raw_node_refs and simply lets any error propagate into jffs2_sum_write_data, which eventually calls jffs2_link_node_ref in order to link the summary to an expectedly allocated node. kernel BUG at fs/jffs2/nodelist.c:592! invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 1 PID: 31277 Comm: syz-executor.7 Not tainted 6.1.128-syzkaller-00139-ge10f83ca10a1 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:jffs2_link_node_ref+0x570/0x690 fs/jffs2/nodelist.c:592 Call Trace: jffs2_sum_write_data fs/jffs2/summary.c:841 [inline] jffs2_sum_write_sumnode+0xd1a/0x1da0 fs/jffs2/summary.c:874 jffs2_do_reserve_space+0xa18/0xd60 fs/jffs2/nodemgmt.c:388 jffs2_reserve_space+0x55f/0xaa0 fs/jffs2/nodemgmt.c:197 jffs2_write_inode_range+0x246/0xb50 fs/jffs2/write.c:362 jffs2_write_end+0x726/0x15d0 fs/jffs2/file.c:301 generic_perform_write+0x314/0x5d0 mm/filemap.c:3856 __generic_file_write_iter+0x2ae/0x4d0 mm/filemap.c:3973 generic_file_write_iter+0xe3/0x350 mm/filemap.c:4005 call_write_iter include/linux/fs.h:2265 [inline] do_iter_readv_writev+0x20f/0x3c0 fs/read_write.c:735 do_iter_write+0x186/0x710 fs/read_write.c:861 vfs_iter_write+0x70/0xa0 fs/read_write.c:902 iter_file_splice_write+0x73b/0xc90 fs/splice.c:685 do_splice_from fs/splice.c:763 [inline] direct_splice_actor+0x10c/0x170 fs/splice.c:950 splice_direct_to_actor+0x337/0xa10 fs/splice.c:896 do_splice_direct+0x1a9/0x280 fs/splice.c:1002 do_sendfile+0xb13/0x12c0 fs/read_write.c:1255 __do_sys_sendfile64 fs/read_write.c:1323 [inline] __se_sys_sendfile64 fs/read_write.c:1309 [inline] __x64_sys_sendfile64+0x1cf/0x210 fs/read_write.c:1309 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Fix this issue by checking return value of jffs2_prealloc_raw_node_refs before calling jffs2_sum_write_data. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Cc: stable@vger.kernel.org Fixes: 2f785402f39b ("[JFFS2] Reduce visibility of raw_node_ref to upper layers of JFFS2 code.") Signed-off-by: Artem Sadovnikov Reviewed-by: Zhihao Cheng Signed-off-by: Richard Weinberger commit 73e9bb465f4ab8cdfc99a1a2252ae80d7587bfc0 Author: Thorsten Blum Date: Tue Apr 22 19:47:57 2025 +0200 ubifs: Fix grammar in error message s/much/many/ Reviewed-by: Zhihao Cheng Signed-off-by: Thorsten Blum Signed-off-by: Richard Weinberger commit b80a61173d08e10b502578cbcb7a55febeff983b Author: Thorsten Blum Date: Thu May 22 20:01:09 2025 +0200 ALSA: atmel: Replace deprecated strcpy() with strscpy() strcpy() is deprecated; use strscpy() instead. Use strscpy() to copy the long name because there's no string to format with sprintf(). No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20250522180111.12144-2-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai commit d18bbb7b8a7b21238dd05f7ddb7d90e2a50171bf Merge: 547c5775a742d9 62f134ab190c5f Author: Takashi Iwai Date: Thu May 22 20:34:24 2025 +0200 Merge branch 'for-linus' into for-next Sync with the pending 6.15 fixes. Signed-off-by: Takashi Iwai commit 547c5775a742d9c83891b629b75d1d4c8e88d8c0 Merge: 4fe238513407d8 7ce3bf76c3adfb Author: Takashi Iwai Date: Thu May 22 20:30:34 2025 +0200 Merge tag 'asoc-v6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-next ASoC: Updates for v6.16 The changes in this release are quite large, mainly in drivers rather than the core. This is partly due to cleanups that touch a lot of drivers and partly due to several relatively large new drivers. - Support for automatically enumerating DAIs from standards conforming SoundWire SDCA devices, further work is required for these to be useful in an actual card. - Conversion of quite a few drivers to newer GPIO APIs. - More helpers and cleanups from Mormimoto-san. - Support for a wider range of AVS platforms. - Support for AMD ACP 7.x platforms, Cirrus Logic CS35L63 and CS48L32, Everest Semiconductor ES8389, Longsoon-1 AC'97 controllers, nVidia Tegra264, Richtek ALC203 and RT9123 and Rockchip SAI controllers. commit 62f134ab190c5fd5c9f68fe638ad8e13bb8a4cb4 Author: Greg Kroah-Hartman Date: Thu May 22 12:08:05 2025 +0200 ALSA: core: fix up bus match const issues. In commit d69d80484598 ("driver core: have match() callback in struct bus_type take a const *"), the match bus callback was changed to have the driver be a const pointer. Unfortunately that const attribute was thrown away when container_of() is called, which is not correct and was not caught by the compiler due to how container_of() is implemented. Fix this up by correctly preserving the const attribute of the driver passed to the bus match function which requires the hdac_driver match function to also take a const pointer for the driver structure. Cc: Jaroslav Kysela Cc: Takashi Iwai Fixes: d69d80484598 ("driver core: have match() callback in struct bus_type take a const *") Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/2025052204-hyphen-thermal-3e72@gregkh Signed-off-by: Takashi Iwai commit 462e244faba02d92c9e349f9877abc4a6564f4e7 Merge: f709b78aecab51 688abe2860fd9c Author: Takashi Iwai Date: Thu May 22 20:29:00 2025 +0200 Merge tag 'asoc-fix-v6.15-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.15 A couple more small fixes for v6.15, both of which could also easily wait until the merge window. commit 3aa1dc3c9060e335e82e9c182bf3d1db29220b1b Author: Kees Cook Date: Tue May 20 09:31:35 2025 -0700 Bluetooth: btintel: Check dsbr size from EFI variable Since the size of struct btintel_dsbr is already known, we can just start there instead of querying the EFI variable size. If the final result doesn't match what we expect also fail. This fixes a stack buffer overflow when the EFI variable is larger than struct btintel_dsbr. Reported-by: zepta Closes: https://lore.kernel.org/all/CAPBS6KoaWV9=dtjTESZiU6KK__OZX0KpDk-=JEH8jCHFLUYv3Q@mail.gmail.com Fixes: eb9e749c0182 ("Bluetooth: btintel: Allow configuring drive strength of BRI") Signed-off-by: Kees Cook Signed-off-by: Luiz Augusto von Dentz commit 3bb88524b7d030160bb3c9b35f928b2778092111 Author: Dmitry Antipov Date: Tue May 20 11:42:30 2025 +0300 Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() In 'mgmt_mesh_foreach()', iterate over mesh commands rather than generic mgmt ones. Compile tested only. Fixes: b338d91703fa ("Bluetooth: Implement support for Mesh") Signed-off-by: Dmitry Antipov Signed-off-by: Luiz Augusto von Dentz commit 71d9d3522aec301e4a1c4eae4b5e0656fc4a7262 Author: Liwei Sun Date: Tue May 13 14:13:54 2025 +0800 Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922 A new variant of MT7922 wireless device has been identified. The device introduces itself as MEDIATEK MT7922, so treat it as MediaTek device. With this patch, btusb driver works as expected: [ 3.151162] Bluetooth: Core ver 2.22 [ 3.151185] Bluetooth: HCI device and connection manager initialized [ 3.151189] Bluetooth: HCI socket layer initialized [ 3.151191] Bluetooth: L2CAP socket layer initialized [ 3.151194] Bluetooth: SCO socket layer initialized [ 3.295718] Bluetooth: hci0: HW/SW Version: 0x008a008a, Build Time: 20241106163512 [ 4.676634] Bluetooth: BNEP (Ethernet Emulation) ver 1.3 [ 4.676637] Bluetooth: BNEP filters: protocol multicast [ 4.676640] Bluetooth: BNEP socket layer initialized [ 5.560453] Bluetooth: hci0: Device setup in 2320660 usecs [ 5.560457] Bluetooth: hci0: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported. [ 5.619197] Bluetooth: hci0: AOSP extensions version v1.00 [ 5.619204] Bluetooth: hci0: AOSP quality report is supported [ 5.619301] Bluetooth: MGMT ver 1.23 [ 6.741247] Bluetooth: RFCOMM TTY layer initialized [ 6.741258] Bluetooth: RFCOMM socket layer initialized [ 6.741261] Bluetooth: RFCOMM ver 1.11 lspci output: 04:00.0 Network controller: MEDIATEK Corp. MT7922 802.11ax PCI Express Wireless Network Adapter USB information: T: Bus=01 Lev=01 Prnt=01 Port=04 Cnt=02 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=13d3 ProdID=3584 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms I: If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us I:* If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us Signed-off-by: Liwei Sun Signed-off-by: Luiz Augusto von Dentz commit c27046c98bd26d4270c076e7d851d68aaaf964a3 Author: En-Wei Wu Date: Thu May 8 22:15:20 2025 +0800 Bluetooth: btusb: use skb_pull to avoid unsafe access in QCA dump handling Use skb_pull() and skb_pull_data() to safely parse QCA dump packets. This avoids direct pointer math on skb->data, which could lead to invalid access if the packet is shorter than expected. Fixes: 20981ce2d5a5 ("Bluetooth: btusb: Add WCN6855 devcoredump support") Signed-off-by: En-Wei Wu Signed-off-by: Luiz Augusto von Dentz commit 631c8682c3b8ce2678b2d849b3f28e5568853591 Author: Luiz Augusto von Dentz Date: Wed May 7 15:00:30 2025 -0400 Bluetooth: L2CAP: Fix not checking l2cap_chan security level l2cap_check_enc_key_size shall check the security level of the l2cap_chan rather than the hci_conn since for incoming connection request that may be different as hci_conn may already been encrypted using a different security level. Fixes: 522e9ed157e3 ("Bluetooth: l2cap: Check encryption key size on incoming connection") Signed-off-by: Luiz Augusto von Dentz commit 33e1b1b3991ba8c0d02b2324a582e084272205d6 Merge: 3ccf3f441f93f1 5cdb2c77c4c3d3 Author: Jakub Kicinski Date: Thu May 22 09:42:41 2025 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-6.15-rc8). Conflicts: 80f2ab46c2ee ("irdma: free iwdev->rf after removing MSI-X") 4bcc063939a5 ("ice, irdma: fix an off by one in error handling code") c24a65b6a27c ("iidc/ice/irdma: Update IDC to support multiple consumers") https://lore.kernel.org/20250513130630.280ee6c5@canb.auug.org.au No extra adjacent changes. Signed-off-by: Jakub Kicinski commit 4518e5a60c7fbf0cdff393c2681db39d77b4f87e Author: Li RongQing Date: Wed May 21 11:46:47 2025 +0800 vfio/type1: Fix error unwind in migration dirty bitmap allocation When setting up dirty page tracking at the vfio IOMMU backend for device migration, if an error is encountered allocating a tracking bitmap, the unwind loop fails to free previously allocated tracking bitmaps. This occurs because the wrong loop index is used to generate the tracking object. This results in unintended memory usage for the life of the current DMA mappings where bitmaps were successfully allocated. Use the correct loop index to derive the tracking object for freeing during unwind. Fixes: d6a4c185660c ("vfio iommu: Implementation of ioctl for dirty pages tracking") Signed-off-by: Li RongQing Link: https://lore.kernel.org/r/20250521034647.2877-1-lirongqing@baidu.com Signed-off-by: Alex Williamson commit 5ead949920c773d4c3a42988391c2e6d0f32650f Author: Mykyta Yatsenko Date: Thu May 22 02:38:13 2025 +0100 selftests/bpf: Add SKIP_LLVM makefile variable Introduce SKIP_LLVM makefile variable that allows to avoid using llvm dependencies when building BPF selftests. This is different from existing feature-llvm, as the latter is a result of automatic detection and should not be set by user explicitly. Avoiding llvm dependencies could be useful for environments that do not have them, given that as of now llvm dependencies are required only by jit_disasm_helpers.c. Signed-off-by: Mykyta Yatsenko Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250522013813.125428-1-mykyta.yatsenko5@gmail.com commit 8b819afa494034ba413fecd5745cdf91e2b2b335 Merge: bdc319f1c9bf9d 5fed7fe33c2cd7 Author: Greg Kroah-Hartman Date: Thu May 22 18:25:27 2025 +0200 Merge tag 'icc-6.16-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/djakov/icc into char-misc-next Georgi writes: interconnect changes for 6.16 This pull request contains the interconnect changes for the 6.16-rc1 merge window. The core and driver changes are listed below. Core changes: - Add support for dynamic id allocation, that allows creating multiple instances of the same provider Driver changes: - Add driver for the EPSS L3 instances on SA8775P SoC - Add QoS support for SM8650 SoC - Add some missing nodes for SM8650 - Misc dt-binding style and indentation fixes Signed-off-by: Georgi Djakov * tag 'icc-6.16-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/djakov/icc: interconnect: qcom: sm8650: remove regmap config for mc_virt & clk_virt interconnect: qcom: sm8650: add the MASTER_APSS_NOC dt-bindings: interconnect: sm8650: document the MASTER_APSS_NOC interconnect: qcom: sm8650: enable QoS configuration dt-bindings: interconnect: Correct indentation and style in DTS example interconnect: qcom: sa8775p: Add dynamic icc node id support interconnect: qcom: icc-rpmh: Add dynamic icc node id support interconnect: qcom: Add multidev EPSS L3 support interconnect: core: Add dynamic id allocation support dt-bindings: interconnect: Add EPSS L3 compatible for SA8775P commit 3ccf3f441f93f18edbd482d2ef606e5153c5542c Merge: db807e5ef8eea6 8f7b00307bf146 Author: Jakub Kicinski Date: Thu May 22 09:15:07 2025 -0700 Merge branch 'net-mlx5-convert-mlx5-to-netdev-instance-locking' Tariq Toukan says: ==================== net/mlx5: Convert mlx5 to netdev instance locking Cosmin Ratiu says: mlx5 manages multiple netdevices, from basic Ethernet to Infiniband netdevs. This patch series converts the driver to use netdev instance locking for everything in preparation for TCP devmem Zero Copy. Because mlx5 is tightly coupled with the ipoib driver, a series of changes first happen in ipoib to allow it to work with mlx5 netdevs that use instance locking: IB/IPoIB: Enqueue separate work_structs for each flushed interface IB/IPoIB: Replace vlan_rwsem with the netdev instance lock IB/IPoIB: Allow using netdevs that require the instance lock A small patch then avoids dropping RTNL during firmware update: net/mlx5e: Don't drop RTNL during firmware flash The main patch then converts all mlx5 netdevs to use instance locking: net/mlx5e: Convert mlx5 netdevs to instance locking ==================== Link: https://patch.msgid.link/1747829342-1018757-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 8f7b00307bf14676b7e7f0210110a36aa0ff3e93 Author: Cosmin Ratiu Date: Wed May 21 15:09:02 2025 +0300 net/mlx5e: Convert mlx5 netdevs to instance locking This patch convert mlx5 to use the new netdev instance lock in addition to the pre-existing state_lock (and the RTNL). mlx5e_priv.state_lock was already used throughout mlx5 to protect against concurrent state modifications on the same netdev, usually in addition to the RTNL. The new netdev instance lock will eventually replace it, but for now, it is acquired in addition to the existing locks in the order RTNL -> instance lock -> state_lock. All three netdev types handled by mlx5 are converted to the new style of locking, because they share a lot of code related to initializing channels and dealing with NAPI, so it's better to convert all three rather than introduce different assumptions deep in the call stack depending on the type of device. Because of the nature of the call graphs in mlx5, it wasn't possible to incrementally convert parts of the driver to use the new lock, since either all call paths into NAPI have to possess the new lock if the *_locked variants are used, or none of them can have the lock. One area which required extra care is the interaction between closing channels and devlink health reporter tasks. Previously, the recovery tasks were unconditionally acquiring the RTNL, which could lead to deadlocks in these scenarios: T1: mlx5e_close (== .ndo_stop(), has RTNL) -> mlx5e_close_locked -> mlx5e_close_channels -> mlx5e_ptp_close -> mlx5e_ptp_close_queues -> mlx5e_ptp_close_txqsqs -> mlx5e_ptp_close_txqsq -> cancel_work_sync(&ptpsq->report_unhealthy_work) waits for T2: mlx5e_ptpsq_unhealthy_work -> mlx5e_reporter_tx_ptpsq_unhealthy -> mlx5e_health_report -> devlink_health_report -> devlink_health_reporter_recover -> mlx5e_tx_reporter_ptpsq_unhealthy_recover which does: rtnl_lock(); => Deadlock. Another similar instance of this is: T1: mlx5e_close (== .ndo_stop(), has RTNL) -> mlx5e_close_locked -> mlx5e_close_channels -> mlx5e_ptp_close -> mlx5e_ptp_close_queues -> mlx5e_ptp_close_txqsqs -> mlx5e_ptp_close_txqsq -> cancel_work_sync(&sq->recover_work) waits for T2: mlx5e_tx_err_cqe_work -> mlx5e_reporter_tx_err_cqe -> mlx5e_health_report -> devlink_health_report -> devlink_health_reporter_recover -> mlx5e_tx_reporter_err_cqe_recover which does: rtnl_lock(); => Another deadlock. Fix that by using the same pattern previously done in mlx5e_tx_timeout_work, where the RTNL was repeatedly tried to be acquired until either: a) it is successfully acquired or b) there's no need for the work to be done any more (channel is being closed). Now, for all three recovery tasks, the instance lock is repeatedly tried to be acquired until successful or the channel/SQ is closed. As a side-effect, drop the !test_bit(MLX5E_STATE_OPENED, &priv->state) check from mlx5e_tx_timeout_work, it's weaker than !test_bit(MLX5E_STATE_CHANNELS_ACTIVE, &priv->state) and unnecessary. Future patches will introduce new call paths (from netdev queue management ops) which can close channels (and call cancel_work_sync on the recovery tasks) without the RTNL lock and only with the netdev instance lock. Signed-off-by: Cosmin Ratiu Reviewed-by: Carolina Jubran Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1747829342-1018757-6-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit d7d4f9f7365a53dc5ae21fd117770e5781caae41 Author: Cosmin Ratiu Date: Wed May 21 15:09:01 2025 +0300 net/mlx5e: Don't drop RTNL during firmware flash There's no explanation in the original commit of why that was done, but presumably flashing takes a long time and holding RTNL for so long blocks other interactions with the netdev layer. However, the stack is moving towards netdev instance locking and dropping and reacquiring RTNL in the context of flashing introduces locking ordering issues: RTNL must be acquired before the netdev instance lock and released after it. This patch therefore takes the simpler approach by no longer dropping and reacquiring the RTNL, as soon RTNL for ethtool will be removed, leaving only the instance lock to protect against races. Signed-off-by: Cosmin Ratiu Reviewed-by: Carolina Jubran Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1747829342-1018757-5-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit fd07ba1680ba3c82d6a19a5c8c02af0a42045674 Author: Cosmin Ratiu Date: Wed May 21 15:09:00 2025 +0300 IB/IPoIB: Allow using netdevs that require the instance lock After the last patch removing vlan_rwsem, it is an incremental step to allow ipoib to work with netdevs that require the instance lock. In several places, netdev_lock() is changed to netdev_lock_ops_to_full() which takes care of not acquiring the lock again when the netdev is already locked. In ipoib_ib_tx_timeout_work() and __ipoib_ib_dev_flush() for HEAVY flushes, the netdev lock is acquired/released. This is needed because these functions end up calling .ndo_stop()/.ndo_open() on subinterfaces, and the device may expect the netdev instance lock to be held. ipoib_set_mode() now explicitly acquires ops lock while manipulating the features, mtu and tx queues. Finally, ipoib_napi_enable()/ipoib_napi_disable() now use the *_locked variants of the napi_enable()/napi_disable() calls and optionally acquire the netdev lock themselves depending on the dev they operate on. Signed-off-by: Cosmin Ratiu Reviewed-by: Carolina Jubran Reviewed-by: Leon Romanovsky Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1747829342-1018757-4-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 463e5176969795a1d80205842e210c539c16fc81 Author: Cosmin Ratiu Date: Wed May 21 15:08:59 2025 +0300 IB/IPoIB: Replace vlan_rwsem with the netdev instance lock vlan_rwsem was added more than a decade ago to work around a deadlock involving the original mutex being acquired twice, once from the wq. Subsequent changes then tweaked it to partially protect access to ipoib_dev_priv->child_intfs together with the RTNL. Flushing the wq synchronously was also since then refactored to happen separately. This semaphore unfortunately prevents updating ipoib to work with devices that require the netdev lock, because of lock ordering issues between RTNL, vlan_rwsem and the netdev instance locks of parent and child devices. To uncomplicate things, this commit replaces vlan_rwsem with the netdev instance lock of the parent device. Both parent child_intfs list and the children's list membership in it require holding the parent netdev instance lock. All call paths were carefully reviewed and no-longer-needed ASSERT_RTNL calls were dropped. Some non-trivial changes: - ipoib_match_gid_pkey_addr() now only acquires the instance lock and iterates through child_intfs for the first level of recursion (the parent), as it's not possible to have multiple levels of nested subinterfaces. - ipoib_open() and ipoib_stop() schedule tasks on the global workqueue to open/stop child interfaces to avoid potentially acquiring nested netdev instance locks. To avoid the device going away between the task scheduling and execution, netdev_hold/netdev_put are used. Signed-off-by: Cosmin Ratiu Reviewed-by: Carolina Jubran Reviewed-by: Leon Romanovsky Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1747829342-1018757-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 5f85120e7462c9fc51cb9c52bc6e81b13d4c93e1 Author: Cosmin Ratiu Date: Wed May 21 15:08:58 2025 +0300 IB/IPoIB: Enqueue separate work_structs for each flushed interface Previously, flushing a netdevice involved first flushing all child devices from the flush task itself. That requires holding the lock that protects the list for the entire duration of the flush. This poses a problem when converting from vlan_rwsem to the netdev instance lock (next patch), because holding the parent lock while trying to acquire a child lock makes lockdep unhappy, rightfully. Fix this by splitting a big flush task into individual flush tasks (all are already created in their respective ipoib_dev_priv structs) and defining a helper function to enqueue all of them while holding the list lock. In ipoib_set_mac, the function is not used and the task is enqueued directly, because in the subsequent patches locking is changed and this function may be called with the netdev instance lock held. This is effectively a noop, the wq is single-threaded and ordered and will execute the same flush operations in the same order as before. Furthermore, there should be no new races because ipoib_parent_unregister_pre() calls flush_workqueue() after stopping new work generation to wait for pending work to complete. flush_workqueue() waits for all currently enqueued work to finish before returning. Signed-off-by: Cosmin Ratiu Reviewed-by: Carolina Jubran Reviewed-by: Leon Romanovsky Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1747829342-1018757-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 28be240c763a44932bfe573f09e145d182e52609 Author: Caleb Sander Mateos Date: Thu May 22 09:04:50 2025 -0600 trace/io_uring: fix io_uring_local_work_run ctx documentation The comment for the tracepoint io_uring_local_work_run refers to a field "tctx" and a type "io_uring_ctx", neither of which exist. "tctx" looks to mean "ctx" and "io_uring_ctx" should be "io_ring_ctx". Signed-off-by: Caleb Sander Mateos Link: https://lore.kernel.org/r/20250522150451.2385652-1-csander@purestorage.com Signed-off-by: Jens Axboe commit 0b261d7c1cd32dc93cbc92425fb55e67b24c6638 Author: Leon Romanovsky Date: Thu May 22 14:36:18 2025 +0300 RDMA/rxe: Break endless pagefault loop for RO pages RO pages has "perm" equal to 0, that caused to the situation where such pages were marked as needed to have fault and caused to infinite loop. Fixes: eedd5b1276e7 ("RDMA/umem: Store ODP access mask information in PFN") Reported-by: Daisuke Matsuda Closes: https://lore.kernel.org/all/3016329a-4edd-4550-862f-b298a1b79a39@gmail.com/ Link: https://patch.msgid.link/096fab178d48ed86942ee22eafe9be98e29092aa.1747913377.git.leonro@nvidia.com Tested-by: Daisuke Matsuda Signed-off-by: Leon Romanovsky commit bdc319f1c9bf9d8c41467ab7e2ecb1a73f86a6fd Merge: 0ca7cb70894eea 408c97c4a5e0b6 Author: Greg Kroah-Hartman Date: Thu May 22 18:04:43 2025 +0200 Merge tag 'coresight-next-v6.16' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/coresight/linux into char-misc-next Suzuki writes: coresight: updates for Linux v6.16 CoreSight self-hosted trace driver subsystem updates for Linux v6.16 includes: - Clear CLAIM tags on device probe if self-hosted tags are set. - Support for perf AUX pause/resume for CoreSight ETM PMU driver, with trace collection at pause. - Miscellaneous fixes for the subsystem Signed-off-by: Suzuki K Poulose * tag 'coresight-next-v6.16' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/coresight/linux: (27 commits) coresight: prevent deactivate active config while enabling the config coresight: holding cscfg_csdev_lock while removing cscfg from csdev coresight/etm4: fix missing disable active config coresight: etm4x: Fix timestamp bit field handling coresight: tmc: fix failure to disable/enable ETF after reading Documentation: coresight: Document AUX pause and resume coresight: perf: Update buffer on AUX pause coresight: tmc: Re-enable sink after buffer update coresight: perf: Support AUX trace pause and resume coresight: etm4x: Hook pause and resume callbacks coresight: Introduce pause and resume APIs for source coresight: etm4x: Extract the trace unit controlling coresight: cti: Replace inclusion by struct fwnode_handle forward declaration coresight: Disable MMIO logging for coresight stm driver coresight: replicator: Fix panic for clearing claim tag coresight: Add a KUnit test for coresight_find_default_sink() coresight: Remove extern from function declarations coresight: Remove inlines from static function definitions coresight: Clear self hosted claim tag on probe coresight: etm3x: Convert raw base pointer to struct coresight access ... commit e485502c37b097b0bd773baa7e2741bf7bd2909a Author: Mario Limonciello Date: Thu May 22 09:13:28 2025 -0500 Revert "drm/amd: Keep display off while going into S4" commit 68bfdc8dc0a1a ("drm/amd: Keep display off while going into S4") attempted to keep displays off during the S4 sequence by not resuming display IP. This however leads to hangs because DRM clients such as the console can try to access registers and cause a hang. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4155 Fixes: 68bfdc8dc0a1a ("drm/amd: Keep display off while going into S4") Reviewed-by: Alex Deucher Link: https://lore.kernel.org/r/20250522141328.115095-1-mario.limonciello@amd.com Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 914e0dc5082a335ea5e7d905e99e1a1cde001369 Author: Ming Lei Date: Thu May 22 23:20:40 2025 +0800 ublk: run auto buf unregisgering in same io_ring_ctx with registering UBLK_F_AUTO_BUF_REG requires that the buffer registered automatically is unregistered in same `io_ring_ctx`, so check it explicitly. Document this requirement for UBLK_F_AUTO_BUF_REG. Drop WARN_ON_ONCE() which is triggered from userspace code path. Fixes: 99c1e4eb6a3f ("ublk: register buffer to local io_uring with provided buf index via UBLK_F_AUTO_BUF_REG") Reported-by: Caleb Sander Mateos Reviewed-by: Caleb Sander Mateos Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250522152043.399824-3-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 3a91f28fab43f093c72312148288d125ae160c2d Author: Ming Lei Date: Thu May 22 23:20:39 2025 +0800 io_uring: add helper io_uring_cmd_ctx_handle() Add helper io_uring_cmd_ctx_handle() for driver to track per-context resource, such as registered kernel io buffer. Suggested-by: Caleb Sander Mateos Signed-off-by: Ming Lei Reviewed-by: Caleb Sander Mateos Link: https://lore.kernel.org/r/20250522152043.399824-2-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 42f520f70d6ca066808026d0b6163040ee1d9b9d Author: Lijo Lazar Date: Tue May 13 18:57:21 2025 +0530 drm/amd/pm: Fetch partition metrics on SMUv13.0.12 Add support to fetch compute partition related metrics in SMUv13.0.12 SOCs. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit fa75a9680b381647999f6a6329a993a99a6fd1fa Author: Aurabindo Pillai Date: Wed May 21 10:22:46 2025 -0400 Revert "drm/amd/display: [FW Promotion] Release 0.1.11.0" This reverts commit 81fc9ca25f02c53c055b842a40f2a915bd0bd5e0 since it introduces incompatbility with older firmware Signed-off-by: Aurabindo Pillai Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit a359288ccb4dd8edb086e7de8fdf6e36f544c922 Author: Philip Yang Date: Wed May 14 11:13:52 2025 -0400 drm/amdgpu: seq64 memory unmap uses uninterruptible lock To unmap and free seq64 memory when drm node close to free vm, if there is signal accepted, then taking vm lock failed and leaking seq64 va mapping, and then dmesg has error log "still active bo inside vm". Change to use uninterruptible lock fix the mapping leaking and no dmesg error log. Signed-off-by: Philip Yang Reviewed-by: Christian König Signed-off-by: Alex Deucher commit b758667f55a09bc86ac0cb230c4e0e5ca931a3a5 Author: Mangesh Gadre Date: Tue May 13 13:20:20 2025 +0800 drm/amdgpu: update ras support check update ras support check for vcn 5.0.1 Signed-off-by: Mangesh Gadre Reviewed-by: Stanley.Yang Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 25e9fb6e3ad885a83437f4aab1039bbbaab13d92 Author: Mangesh Gadre Date: Fri May 16 08:06:00 2025 +0800 drm/amdgpu: Enable RAS for jpeg 5.0.1 Enable jpeg ras posion processing and aca error logging Signed-off-by: Mangesh Gadre Reviewed-by: Stanley.Yang Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 8d74ce4e5524b39e991bfa025f1382e54c5f710a Author: Mangesh Gadre Date: Wed May 14 13:17:02 2025 +0800 drm/amdgpu: Add jpeg poison status reg added registers to enable jpeg ras Signed-off-by: Mangesh Gadre Reviewed-by: Stanley.Yang Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 5035caf18d88cde5a1fd661dbb45b1229816c07e Author: Mangesh Gadre Date: Fri May 16 07:52:14 2025 +0800 drm/amdgpu: Enable RAS for vcn 5.0.1 Enable vcn ras posion processing and aca error logging Signed-off-by: Mangesh Gadre Reviewed-by: Stanley.Yang Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 076873e5b360ccd91687e23c6ca0042a0356b9eb Author: Wayne Lin Date: Tue May 20 09:34:42 2025 +0800 drm/amd/display: Add a new dcdebugmask to allow skip detection LT Under specific embedded scenarios, we might still use DP interface rather than eDP interface. Under such case, detection link training is unnecessary. Add a new dcdebugmask value that can be used to skip the detection LT Reviewed-by: Tom Chung Link: https://lore.kernel.org/amd-gfx/20250521063934.2111323-1-Wayne.Lin@amd.com/ Signed-off-by: Wayne Lin Signed-off-by: Alex Deucher commit 02fd27e6cf853e55cebcefb4aa7a9828a6848510 Author: Melissa Wen Date: Fri Apr 25 17:52:30 2025 -0300 drm/amd/display: no 3D and blnd LUT as DPP color caps for DCN401 Match what is declared as DPP color caps with hw caps. DCN401 has MPC shaper + 3D LUTs that are movable before and after blending (get from plane or stream), but no DPP blend LUTs. Signed-off-by: Melissa Wen Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit f9f403218e1ca947a1a017be01da6ae7fb637eba Author: Melissa Wen Date: Tue May 13 18:38:17 2025 -0300 drm/amd/display: only collect data if debug gamut_remap is available Color gamut_remap state log may be not available for some hw versions, so prevent null pointer dereference by checking if there is a function to collect data for this hw version. Signed-off-by: Melissa Wen Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit dd64956685fa48358c4152d952070c8c073e5f89 Author: Tvrtko Ursulin Date: Mon May 19 17:37:12 2025 +0100 drm/amdgpu: Remove duplicated "context still alive" check When amdgpu_ctx_mgr_fini() calls amdgpu_ctx_mgr_entity_fini() it contains the exact same "context still alive" check as it will do next. Remove the duplicated copy. Reviewed-by: Christian König Signed-off-by: Tvrtko Ursulin Cc: Alex Deucher Cc: Christian König Signed-off-by: Alex Deucher commit 16f2c942b6e44a0c3970134c8c460c7fd465ac9d Author: Tvrtko Ursulin Date: Mon May 19 17:37:11 2025 +0100 drm/amdgpu: Make amdgpu_ctx_mgr_entity_fini static Function amdgpu_ctx_mgr_entity_fini() only has a single local caller so lets make it local. Reviewed-by: Christian König Signed-off-by: Tvrtko Ursulin Cc: Alex Deucher Cc: Christian König Signed-off-by: Alex Deucher commit e90bd6d898165c281b5582361857e7bc8e0f917d Author: Alex Deucher Date: Wed May 7 16:51:38 2025 -0400 drm/amdgpu: Update runtime pm checks Don't enable BACO when in passthrough. PCI resets don't work correctly when in BACO. Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit f55fcf15a9c585d0a3f294307f1499d3759459c6 Author: Mangesh Gadre Date: Wed May 14 12:31:36 2025 +0800 drm/amdgpu: Add vcn poison status reg added register to enable vcn ras Signed-off-by: Mangesh Gadre Reviewed-by: Stanley.Yang Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 74956242a0dfe4ef7fef0f9a4e8f7ea7415be97b Author: Lijo Lazar Date: Fri May 16 20:16:57 2025 +0530 drm/amd/pm: Use external link order for xgmi data xgmi_port_num interface reports external link number for port number. To be consistent, use the external link number for reporting other XGMI link data also. v2: For invalid link number return -EINVAL (Kevin) Signed-off-by: Lijo Lazar Acked-by: Yang Wang Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 8f9f3854a14efe34824d278a6127aed54b1294fc Author: Jihed Chaibi Date: Sat May 17 05:09:35 2025 +0200 drm/radeon: fixing typo in macro name "ENABLE" is currently misspelled in SYS_INFO_GPUCAPS__ENABEL_DFS_BYPASS Signed-off-by: Jihed Chaibi Signed-off-by: Alex Deucher commit ae6f4ab96be19395b8977f65670ae60d01096a83 Author: Jihed Chaibi Date: Sat May 17 05:06:09 2025 +0200 drm/amdgpu: fixing typo in macro name "ENABLE" is currently misspelled in SYS_INFO_GPUCAPS__ENABEL_DFS_BYPASS PS: checkpatch.pl is complaining about the presence of a space at the start of drivers/gpu/drm/amd/include/atomfirmware.h line: 1716 This is propably because this file uses (two) spaces and not tabs. Signed-off-by: Jihed Chaibi Signed-off-by: Alex Deucher commit 05daa7c739f43aec4358f5a4c291e1b2d0fc7885 Author: Daniil Ryabov Date: Sat May 17 02:35:16 2025 +0300 drm/amd/display: fix typo in comments Fix double 'u' in 'frequuency' Signed-off-by: Daniil Ryabov Signed-off-by: Alex Deucher commit 57d4100cc94fe5a8dcabd72a66ed1d5c6f14291a Author: Leonardo Gomes Date: Sat May 17 11:20:55 2025 -0300 drm/amd/display: Adjust set_value function with prefix to help in ftrace Adjust set_value function in hw_hpd.c file to have prefix to help in ftrace, the name change from 'set_value' to 'dal_hw_hpd_set_value' Signed-off-by: Leonardo da Silva Gomes Co-developed-by: Derick Frias Signed-off-by: Derick Frias Signed-off-by: Alex Deucher commit f0e9c6f67a02eea72aab9f598b884395876b971b Author: Leonardo Gomes Date: Sat May 17 11:20:54 2025 -0300 drm/amd/display: Adjust get_value function with prefix to help in ftrace Adjust get_value function in hw_hpd.c file to have prefix to help in ftrace, the name change from 'get_value' to 'dal_hw_hpd_get_value' Signed-off-by: Leonardo da Silva Gomes Co-developed-by: Derick Frias Signed-off-by: Derick Frias Signed-off-by: Alex Deucher commit 4cd694fdbf453a6fe875ad6236b04d7b9a5e49db Author: Lijo Lazar Date: Mon May 5 16:55:34 2025 +0530 drm/amd/pm: Fetch partition metrics on SMUv13.0.6 Add support to fetch compute partition related metrics in SMUv13.0.6 SOCs. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit cbbab29246c8b22c3d6285756dd14992cbaa2d5e Author: Lijo Lazar Date: Mon May 5 15:18:06 2025 +0530 drm/amdgpu: Add sysfs nodes for partition Add sysfs nodes to provide compute paritition specific data. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 54a01f775194a8b5acc6bd735aa0d092469dcff7 Author: Lijo Lazar Date: Mon May 5 16:53:29 2025 +0530 drm/amd/pm: Add support to query partition metrics Add interfaces to query compute partition related metrics data. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 1b2231de416312f96e29b9761bd06de1d637492e Author: Stanley.Yang Date: Tue May 13 20:10:05 2025 +0800 drm/amdgpu: Register aqua vanjaram jpeg poison irq Register aqua vanjaram jpeg poison irq, add jpeg poison handle. Signed-off-by: Stanley.Yang Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 4c4a89149608c5b006570b933e893a06c45edfe1 Author: Stanley.Yang Date: Tue May 13 19:46:08 2025 +0800 drm/amdgpu: Register aqua vanjaram vcn poison irq Register aqua vanjaram vcn poison irq, add vcn poison handle. Signed-off-by: Stanley.Yang Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 1327d8f4061c08c29ea8ce7bb89e209d3c1e8b29 Author: Lijo Lazar Date: Tue Apr 29 08:37:38 2025 +0530 drm/amd/pm: Use macro to initialize metrics table Helps to keep a build time check about usage of right datatype and avoids maintenance as new versions get added. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Reviewed-by: Yang Wang Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 2ed4fd99690ba1efab204f03be80fabd6c0ec3cf Author: Asad Kamal Date: Wed Apr 30 00:40:50 2025 +0800 drm/amd/pm: Fill pldm version for SMU v13.0.6 SOCs Fetch pldm version from static metrics table for SMU v13.0.6 SOCs Signed-off-by: Asad Kamal Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 7f30f8ef6547d67c1932697d6b5b971665b43e5b Author: Asad Kamal Date: Wed Apr 30 00:25:01 2025 +0800 drm/amd/pm: Update pmfw headers for smu_v_13_0_6 Update pmfw headers for smu_v_13_0_6 to include pldm version as part of statics metrics table Signed-off-by: Asad Kamal Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 0132ba7ff0f613915d332a30fcf14cf66e317f98 Author: Jesse.Zhang Date: Thu May 15 15:02:13 2025 +0800 drm/amdgpu: Fix eviction fence worker race during fd close The current cleanup order during file descriptor close can lead to a race condition where the eviction fence worker attempts to access a destroyed mutex from the user queue manager: [ 517.294055] DEBUG_LOCKS_WARN_ON(lock->magic != lock) [ 517.294060] WARNING: CPU: 8 PID: 2030 at kernel/locking/mutex.c:564 [ 517.294094] Workqueue: events amdgpu_eviction_fence_suspend_worker [amdgpu] The issue occurs because: 1. We destroy the user queue manager (including its mutex) first 2. Then try to destroy eviction fences which may have pending work 3. The eviction fence worker may try to access the already-destroyed mutex Fix this by reordering the cleanup to: 1. First mark the fd as closing and destroy eviction fences, which flushes any pending work 2. Then safely destroy the user queue manager after we're certain no more fence work will be executed The copy in amdgpu_driver_postclose_kms() needs to be removed (Christian) Reviewed-by: Christian König Reviewed-by: Prike Liang Reviewed-by: Arvind Yadav Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit b2c11e27080d8556664c20c30ca3527ffa99bec4 Author: Prike Liang Date: Wed Apr 30 10:34:14 2025 +0800 drm/amdgpu: lock the eviction fence for wq signals it Lock and refer to the eviction fence before the eviction fence schedules work queue tries to signal it. Suggested-by: Christian König Signed-off-by: Prike Liang Acked-by: Alex Deucher Reviewed-by: Arvind Yadav Reviewed-by: Christian König Signed-off-by: Alex Deucher commit eed6a6b2264078806163424b7cb70a3b47cb8e97 Author: Andrey Vatoropin Date: Wed Apr 2 14:12:25 2025 +0000 drm/amdkfd: Change svm_range_get_info return type Static analysis shows that pointer "svms" cannot be NULL because it points to the object "struct svm_range_list". Remove the extra NULL check. It is meaningless and harms the readability of the code. In the function svm_range_get_info() there is no possibility of failure. Therefore, the caller of the function svm_range_get_info() does not need a return value. Change the function svm_range_get_info() return type from "int" to "void". Since the function svm_range_get_info() has a return type of "void". The caller of the function svm_range_get_info() does not need a return value. Delete extra code. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Andrey Vatoropin Signed-off-by: Felix Kuehling Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit ea3b0b7f541b9511abe2b89547c95458804f38e2 Author: David Thompson Date: Tue Mar 18 17:47:47 2025 -0400 EDAC/bluefield: Don't use bluefield_edac_readl() result on error The bluefield_edac_readl() routine returns an uninitialized result on error paths. In those cases the calling routine should not use the uninitialized result. The driver should simply log the error, and then return early. Fixes: e41967575474 ("EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2") Signed-off-by: David Thompson Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Shravan Kumar Ramani Link: https://lore.kernel.org/20250318214747.12271-1-davthompson@nvidia.com commit d90f0bce579c66ac1066edf36203bd5596fd978b Merge: 4e2e6841ff761c 7f332f9fe9d854 Author: Alexei Starovoitov Date: Thu May 22 08:40:57 2025 -0700 Merge branch 's390-bpf-use-kernel-s-expoline-thunks' Ilya Leoshkevich says: ==================== This series simplifies the s390 JIT by replacing the generation of expolines (Spectre mitigation) with using the ones from the kernel text. This is possible thanks to the V!=R s390 kernel rework. Patch 1 is a small prerequisite for arch/s390 that I would like to get in via the BPF tree. It has Heiko's Acked-by. Patches 2 and 3 are the implementation. ==================== Link: https://patch.msgid.link/20250519223646.66382-1-iii@linux.ibm.com Signed-off-by: Alexei Starovoitov commit 7f332f9fe9d854c1680fea223b6cb04530859a1a Author: Ilya Leoshkevich Date: Mon May 19 23:30:06 2025 +0100 s390/bpf: Use kernel's expoline thunks Simplify the JIT code by replacing the custom expolines with the ones defined in the kernel text. Signed-off-by: Ilya Leoshkevich Link: https://lore.kernel.org/r/20250519223646.66382-4-iii@linux.ibm.com Signed-off-by: Alexei Starovoitov commit 9053ba042fc7c0e718566932288cc88b3bb2dbe1 Author: Ilya Leoshkevich Date: Mon May 19 23:30:05 2025 +0100 s390/bpf: Add macros for calling external functions After the V!=R rework (commit c98d2ecae08f ("s390/mm: Uncouple physical vs virtual address spaces")), kernel and BPF programs are allocated within a 4G region, making it possible to use relative addressing to directly use kernel functions from BPF code. Add two new macros for calling kernel functions from BPF code: EMIT6_PCREL_RILB_PTR() and EMIT6_PCREL_RILC_PTR(). Factor out parts of the existing macros that are helpful for implementing the new ones. Signed-off-by: Ilya Leoshkevich Link: https://lore.kernel.org/r/20250519223646.66382-3-iii@linux.ibm.com Signed-off-by: Alexei Starovoitov commit f7562001c8b854390899b53d06ba4202c89339e6 Author: Ilya Leoshkevich Date: Mon May 19 23:30:04 2025 +0100 s390: always declare expoline thunks It would be convenient to use the following pattern in the BPF JIT: if (nospec_uses_trampoline()) emit_call(__s390_indirect_jump_r1); Unfortunately with CONFIG_EXPOLINE=n the compiler complains about the missing prototype of __s390_indirect_jump_r1(). One could wrap the whole "if" statement in an #ifdef, but this clutters the code. Instead, declare expoline thunk prototypes even when compiling without expolines. When using the above code structure and compiling without expolines, references to them are optimized away, and there are no linker errors. Acked-by: Heiko Carstens Signed-off-by: Ilya Leoshkevich Link: https://lore.kernel.org/r/20250519223646.66382-2-iii@linux.ibm.com Signed-off-by: Alexei Starovoitov commit db807e5ef8eea6948bb4993466623046f52d3056 Author: Taehee Yoo Date: Tue May 20 07:11:55 2025 +0000 eth: bnxt: fix deadlock when xdp is attached or detached When xdp is attached or detached, dev->ndo_bpf() is called by do_setlink(), and it acquires netdev_lock() if needed. Unlike other drivers, the bnxt driver is protected by netdev_lock while xdp is attached/detached because it sets dev->request_ops_lock to true. So, the bnxt_xdp(), that is callback of ->ndo_bpf should not acquire netdev_lock(). But the xdp_features_{set | clear}_redirect_target() was changed to acquire netdev_lock() internally. It causes a deadlock. To fix this problem, bnxt driver should use xdp_features_{set | clear}_redirect_target_locked() instead. Splat looks like: ============================================ WARNING: possible recursive locking detected 6.15.0-rc6+ #1 Not tainted -------------------------------------------- bpftool/1745 is trying to acquire lock: ffff888131b85038 (&dev->lock){+.+.}-{4:4}, at: xdp_features_set_redirect_target+0x1f/0x80 but task is already holding lock: ffff888131b85038 (&dev->lock){+.+.}-{4:4}, at: do_setlink.constprop.0+0x24e/0x35d0 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&dev->lock); lock(&dev->lock); *** DEADLOCK *** May be due to missing lock nesting notation 3 locks held by bpftool/1745: #0: ffffffffa56131c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_setlink+0x1fe/0x570 #1: ffffffffaafa75a0 (&net->rtnl_mutex){+.+.}-{4:4}, at: rtnl_setlink+0x236/0x570 #2: ffff888131b85038 (&dev->lock){+.+.}-{4:4}, at: do_setlink.constprop.0+0x24e/0x35d0 stack backtrace: CPU: 1 UID: 0 PID: 1745 Comm: bpftool Not tainted 6.15.0-rc6+ #1 PREEMPT(undef) Hardware name: ASUS System Product Name/PRIME Z690-P D4, BIOS 0603 11/01/2021 Call Trace: dump_stack_lvl+0x7a/0xd0 print_deadlock_bug+0x294/0x3d0 __lock_acquire+0x153b/0x28f0 lock_acquire+0x184/0x340 ? xdp_features_set_redirect_target+0x1f/0x80 __mutex_lock+0x1ac/0x18a0 ? xdp_features_set_redirect_target+0x1f/0x80 ? xdp_features_set_redirect_target+0x1f/0x80 ? __pfx_bnxt_rx_page_skb+0x10/0x10 [bnxt_en ? __pfx___mutex_lock+0x10/0x10 ? __pfx_netdev_update_features+0x10/0x10 ? bnxt_set_rx_skb_mode+0x284/0x540 [bnxt_en ? __pfx_bnxt_set_rx_skb_mode+0x10/0x10 [bnxt_en ? xdp_features_set_redirect_target+0x1f/0x80 xdp_features_set_redirect_target+0x1f/0x80 bnxt_xdp+0x34e/0x730 [bnxt_en 11cbcce8fa11cff1dddd7ef358d6219e4ca9add3] dev_xdp_install+0x3f4/0x830 ? __pfx_bnxt_xdp+0x10/0x10 [bnxt_en 11cbcce8fa11cff1dddd7ef358d6219e4ca9add3] ? __pfx_dev_xdp_install+0x10/0x10 dev_xdp_attach+0x560/0xf70 dev_change_xdp_fd+0x22d/0x280 do_setlink.constprop.0+0x2989/0x35d0 ? __pfx_do_setlink.constprop.0+0x10/0x10 ? lock_acquire+0x184/0x340 ? find_held_lock+0x32/0x90 ? rtnl_setlink+0x236/0x570 ? rcu_is_watching+0x11/0xb0 ? trace_contention_end+0xdc/0x120 ? __mutex_lock+0x946/0x18a0 ? __pfx___mutex_lock+0x10/0x10 ? __lock_acquire+0xa95/0x28f0 ? rcu_is_watching+0x11/0xb0 ? rcu_is_watching+0x11/0xb0 ? cap_capable+0x172/0x350 rtnl_setlink+0x2cd/0x570 Fixes: 03df156dd3a6 ("xdp: double protect netdev->xdp_flags with netdev->lock") Signed-off-by: Taehee Yoo Reviewed-by: Simon Horman Reviewed-by: Michael Chan Link: https://patch.msgid.link/20250520071155.2462843-1-ap420073@gmail.com Signed-off-by: Jakub Kicinski commit 8b53f46eb430fe5b42d485873b85331d2de2c469 Author: Florian Westphal Date: Wed May 21 11:38:47 2025 +0200 netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy With a VRF, ipv4 and ipv6 FIB expression behave differently. fib daddr . iif oif Will return the input interface name for ipv4, but the real device for ipv6. Example: If VRF device name is tvrf and real (incoming) device is veth0. First round is ok, both ipv4 and ipv6 will yield 'veth0'. But in the second round (incoming device will be set to "tvrf"), ipv4 will yield "tvrf" whereas ipv6 returns "veth0" for the second round too. This makes ipv6 behave like ipv4. A followup patch will add a test case for this, without this change it will fail with: get element inet t fibif6iif { tvrf . dead:1::99 . tvrf } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ FAIL: did not find tvrf . dead:1::99 . tvrf in fibif6iif Alternatively we could either not do anything at all or change ipv4 to also return the lower/real device, however, nft (userspace) doc says "iif: if fib lookup provides a route then check its output interface is identical to the packets input interface." which is what the nft fib ipv4 behaviour is. Fixes: f6d0cbcf09c5 ("netfilter: nf_tables: add fib expression") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 98287045c9797fd3dd30422d92077e511809b4b9 Author: Florian Westphal Date: Wed May 21 11:38:46 2025 +0200 selftests: netfilter: move fib vrf test to nft_fib.sh It was located in conntrack_vrf.sh because that already had the VRF bits. Lets not add to this and move it to nft_fib.sh where this belongs. No functional changes for the subtest intended. The subtest is limited, it only covered 'fib oif' (route output interface query) when the incoming interface is part of a VRF. Next we can extend it to cover 'fib type' for VRFs and also check fib results when there is an unrelated VRF in same netns. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 839340f7c7bb9a83b95bdf1abbef6dff990e35f5 Author: Florian Westphal Date: Wed May 21 11:38:45 2025 +0200 selftests: netfilter: nft_fib.sh: add 'type' mode tests fib can either lookup the interface id/name of the output interface that would be used for the given address, or it can check for the type of the address according to the fib, e.g. local, unicast, multicast and so on. This can be used to e.g. make a locally configured address only reachable through its interface. Example: given eth0:10.1.1.1 and eth1:10.1.2.1 then 'fib daddr type' for 10.1.1.1 arriving on eth1 will be 'local', but 'fib daddr . iif type' is expected to return 'unicast', whereas 'fib daddr' and 'fib daddr . iif' are expected to indicate 'local' if such a packet arrives on eth0. So far nft_fib.sh only covered oif/oifname, not type. Repeat tests both with default and a policy (ip rule) based setup. Also try to run all remaining tests even if a subtest has failed. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit c38eb2973c18d34a8081d173a6ad298461f4a37c Author: Florian Westphal Date: Fri May 16 16:12:13 2025 +0200 netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds Its now possible to build a kernel that has no support for the classic xtables get/setsockopt interfaces and builtin tables. In this case, we have CONFIG_IP6_NF_MANGLE=n and CONFIG_IP_NF_ARPTABLES=n. For optstript, the ipv6 code is so small that we can enable it if netfilter ipv6 support exists. For mark, check if either classic arptables or NFT_ARP_COMPAT is set. Fixes: a9525c7f6219 ("netfilter: xtables: allow xtables-nft only builds") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit d31c1cafc4a7b790f752f2816e275d14fcb9aeef Author: Florian Westphal Date: Tue May 6 15:07:11 2025 +0200 selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation Pipapo supports a more compact '4 bit group' format that is chosen when the memory needed for the default exceeds a threshold (2mb). Add coverage for those code paths, the existing tests use small sets that are handled by the default representation. This comes with a test script run-time increase, but I think its ok: normal: 2m35s -> 3m9s debug: 3m24s -> 5m29s (with KSFT_MACHINE_SLOW=yes). Cc: Stefano Brivio Signed-off-by: Florian Westphal Reviewed-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso commit 471db2c2d4f80ee94225a1ef246e4f5011733e50 Author: Lin.Cao Date: Thu May 15 10:07:13 2025 +0800 drm/scheduler: signal scheduled fence when kill job When an entity from application B is killed, drm_sched_entity_kill() removes all jobs belonging to that entity through drm_sched_entity_kill_jobs_work(). If application A's job depends on a scheduled fence from application B's job, and that fence is not properly signaled during the killing process, application A's dependency cannot be cleared. This leads to application A hanging indefinitely while waiting for a dependency that will never be resolved. Fix this issue by ensuring that scheduled fences are properly signaled when an entity is killed, allowing dependent applications to continue execution. Signed-off-by: Lin.Cao Reviewed-by: Philipp Stanner Signed-off-by: Christian König Link: https://lore.kernel.org/r/20250515020713.1110476-1-lincao12@amd.com commit a95fadf4a2998949f41e31a03326d2a46a360f0d Author: Lukas Bulwahn Date: Tue Mar 25 10:21:59 2025 +0100 MAINTAINERS: Adjust the file entry in SIEMENS IPC LED DRIVERS Commit 835a0c10d33b ("leds: Rename simple directory to simatic") renames the driver's directory to drivers/leds/simatic, but misses to adjust the SIEMENS IPC LED DRIVERS section in MAINTAINERS. Hence, ./scripts/get_maintainer.pl --self-test=patterns complains about a broken reference. Adjust the file entry to this renaming. Signed-off-by: Lukas Bulwahn Link: https://lore.kernel.org/r/20250325092159.213463-1-lukas.bulwahn@redhat.com Signed-off-by: Lee Jones commit 70a9d374293b42055626d59c2eeeff4d624806bf Author: Wolfram Sang Date: Tue Mar 18 10:12:12 2025 +0100 mfd: tps65010: Use per-client debugfs directory The I2C core now provides a debugfs entry for each client. Let this driver use it instead of the root directory. Further improvements by this change: automatic support of multiple instances. Signed-off-by: Wolfram Sang Link: https://lore.kernel.org/r/20250318091234.22170-1-wsa+renesas@sang-engineering.com Signed-off-by: Lee Jones commit 1d2aeee6dd629084cc524ec2d00100e70aa3c824 Author: Wolfram Sang Date: Tue Mar 18 10:13:41 2025 +0100 mfd: aat2870: Use per-client debugfs directory The I2C core now provides a debugfs entry for each client. Let this driver use it instead of the custom directory in debugfs root. Further improvements by this change: automatic clean up on removal, support of multiple instances. Signed-off-by: Wolfram Sang Link: https://lore.kernel.org/r/20250318091426.22258-2-wsa+renesas@sang-engineering.com Signed-off-by: Lee Jones commit 18e6c1d2a7e2b35311c5b82abd7d4ee8ef541369 Merge: e36d96a2a1aae8 3f51b232c1da8e 8824dc7f947ac5 5d61bb1675ff76 ef7f3631a44b8e Author: Lee Jones Date: Thu May 22 15:49:34 2025 +0100 Merge branches 'ib-firmware-mfd-6.16', 'ib-mfd-clocksource-pwm-6.16', 'ib-mfd-gpio-nvmem-6.16', 'ib-mfd-regulator-6.16' and 'ib-mfd-regulator-6.16-1' into ibs-for-mfd-merged commit 4e2e6841ff761cc15a54e8bebcf35d7325ec78a2 Author: Di Shen Date: Tue May 20 13:49:43 2025 +0800 bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic" This reverts commit 4a8f635a6054. Althought get_pid_task() internally already calls rcu_read_lock() and rcu_read_unlock(), the find_vpid() was not. The documentation for find_vpid() clearly states: "Must be called with the tasklist_lock or rcu_read_lock() held." Add proper rcu_read_lock/unlock() to protect the find_vpid(). Fixes: 4a8f635a6054 ("bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic") Reported-by: Xuewen Yan Signed-off-by: Di Shen Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20250520054943.5002-1-xuewen.yan@unisoc.com Signed-off-by: Alexei Starovoitov commit bfc6270ab3ff9478a4cad4d49482854d632dbce3 Author: Alison Schofield Date: Wed May 21 16:36:23 2025 -0700 cxl/features: Remove the inline specifier from to_cxlfs() to_cxlfs() was declared 'inline' in the header but only defined in drivers/cxl/core/features.c. This has worked because features.c was the only file using the function and the definition happened to be available in the same compilation unit. However, in preparation for a second .c file using the header and needing to call the function, the inline specifier became an issue. Sparse flagged the declaration as invalid since 'inline' requires a visible definition at the point of use. Defining the function in the header was considered but rejected, as it depends on internal symbols not visible at that level. Remove the inline specifier to correct the linkage violation. Signed-off-by: Alison Schofield Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Shiju Jose Link: https://patch.msgid.link/20250521233625.1745849-1-alison.schofield@intel.com Signed-off-by: Dave Jiang commit 774a1fa880bc949d88b5ddec9494a13be733dfa8 Author: Niklas Schnelle Date: Thu May 22 14:13:15 2025 +0200 s390/pci: Serialize device addition and removal Prior changes ensured that when zpci_release_device() is called and it removed the zdev from the zpci_list this instance can not be found via the zpci_list anymore even while allowing re-add of reserved devices. This only accounts for the overall lifetime and zpci_list addition and removal, it does not yet prevent concurrent add of a new instance for the same underlying device. Such concurrent add would subsequently cause issues such as attempted re-use of the same IOMMU sysfs directory and is generally undesired. Introduce a new zpci_add_remove_lock mutex to serialize adding a new device with removal. Together this ensures that if a struct zpci_dev is not found in the zpci_list it was either already removed and torn down, or its removal and tear down is in progress with the zpci_add_remove_lock held. Cc: stable@vger.kernel.org Fixes: a46044a92add ("s390/pci: fix zpci_zdev_put() on reserve") Reviewed-by: Gerd Bayer Tested-by: Gerd Bayer Signed-off-by: Niklas Schnelle Signed-off-by: Heiko Carstens commit 4b1815a52d7eb03b3e0e6742c6728bc16a4b2d1d Author: Niklas Schnelle Date: Thu May 22 14:13:14 2025 +0200 s390/pci: Allow re-add of a reserved but not yet removed device The architecture assumes that PCI functions can be removed synchronously as PCI events are processed. This however clashes with the reference counting of struct pci_dev which allows device drivers to hold on to a struct pci_dev reference even as the underlying device is removed. To bridge this gap commit 2a671f77ee49 ("s390/pci: fix use after free of zpci_dev") keeps the struct zpci_dev in ZPCI_FN_STATE_RESERVED state until common code releases the struct pci_dev. Only when all references are dropped, the struct zpci_dev can be removed and freed. Later commit a46044a92add ("s390/pci: fix zpci_zdev_put() on reserve") moved the deletion of the struct zpci_dev from the zpci_list in zpci_release_device() to the point where the device is reserved. This was done to prevent handling events for a device that is already being removed, e.g. when the platform generates both PCI event codes 0x304 and 0x308. In retrospect, deletion from the zpci_list in the release function without holding the zpci_list_lock was also racy. A side effect of this handling is that if the underlying device re-appears while the struct zpci_dev is in the ZPCI_FN_STATE_RESERVED state, the new and old instances of the struct zpci_dev and/or struct pci_dev may clash. For example when trying to create the IOMMU sysfs files for the new instance. In this case, re-adding the new instance is aborted. The old instance is removed, and the device will remain absent until the platform issues another event. Fix this by allowing the struct zpci_dev to be brought back up right until it is finally removed. To this end also keep the struct zpci_dev in the zpci_list until it is finally released when all references have been dropped. Deletion from the zpci_list from within the release function is made safe by using kref_put_lock() with the zpci_list_lock. This ensures that the releasing code holds the last reference. Cc: stable@vger.kernel.org Fixes: a46044a92add ("s390/pci: fix zpci_zdev_put() on reserve") Reviewed-by: Gerd Bayer Tested-by: Gerd Bayer Signed-off-by: Niklas Schnelle Signed-off-by: Heiko Carstens commit 47c397844869ad0e6738afb5879c7492f4691122 Author: Niklas Schnelle Date: Thu May 22 14:13:13 2025 +0200 s390/pci: Prevent self deletion in disable_slot() As disable_slot() takes a struct zpci_dev from the Configured to the Standby state. In Standby there is still a hotplug slot so this is not usually a case of sysfs self deletion. This is important because self deletion gets very hairy in terms of locking (see for example recover_store() in arch/s390/pci/pci_sysfs.c). Because the pci_dev_put() is not within the critical section of the zdev->state_lock however, disable_slot() can turn into a case of self deletion if zPCI device event handling slips between the mutex_unlock() and the pci_dev_put(). If the latter is the last put and zpci_release_device() is called this then tries to remove the hotplug slot via zpci_exit_slot() which will try to remove the hotplug slot directory the disable_slot() is part of i.e. self deletion. Prevent this by widening the zdev->state_lock critical section to include the pci_dev_put() which is then guaranteed to happen with the struct zpci_dev still in Standby state ensuring it will not lead to a zpci_release_device() call as at least the zPCI event handling code still holds a reference. Cc: stable@vger.kernel.org Fixes: a46044a92add ("s390/pci: fix zpci_zdev_put() on reserve") Reviewed-by: Gerd Bayer Tested-by: Gerd Bayer Signed-off-by: Niklas Schnelle Signed-off-by: Heiko Carstens commit d76f9633296785343d45f85199f4138cb724b6d2 Author: Niklas Schnelle Date: Thu May 22 14:13:12 2025 +0200 s390/pci: Remove redundant bus removal and disable from zpci_release_device() Remove zpci_bus_remove_device() and zpci_disable_device() calls from zpci_release_device(). These calls were done when the device transitioned into the ZPCI_FN_STATE_STANDBY state which is guaranteed to happen before it enters the ZPCI_FN_STATE_RESERVED state. When zpci_release_device() is called the device is known to be in the ZPCI_FN_STATE_RESERVED state which is also checked by a WARN_ON(). Cc: stable@vger.kernel.org Fixes: a46044a92add ("s390/pci: fix zpci_zdev_put() on reserve") Reviewed-by: Gerd Bayer Reviewed-by: Julian Ruess Tested-by: Gerd Bayer Signed-off-by: Niklas Schnelle Signed-off-by: Heiko Carstens commit 050a3e71ce24c6f18d70679d68056f76375ff51c Author: Mikulas Patocka Date: Mon May 19 23:56:11 2025 -0400 dm mpath: replace spin_lock_irqsave with spin_lock_irq Replace spin_lock_irqsave/spin_unlock_irqrestore with spin_lock_irq/spin_unlock_irq at places where it is known that interrupts are enabled. Signed-off-by: Mikulas Patocka Signed-off-by: Benjamin Marzinski commit 0ca7cb70894eeaf3f401f43d364977076fea0293 Merge: 16d693749866f2 0c86e33819785f Author: Greg Kroah-Hartman Date: Thu May 22 15:54:52 2025 +0200 Merge tag 'iio-for-6.16a-take2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next Jonathan writes: IIO: New device support, features and cleanup for 6.16 - take 2 Note - last minute rebase was to drop a typo patch that I'd accidentally picked up (in the microblaze arch Kconfig) Take 2 is due to that rebase messing up some fixes tags that were referring to patches after that point. There is a known merge conflict due to changes in neighbouring lines. Stephen's resolution in linux-next is: https://lore.kernel.org/linux-next/20250506155728.65605bae@canb.auug.org.au/ Added 3 named IIO reviewers to MAINTAINERS. This is a reflection of those who have been doing much of this work for some time. Lars-Peter is removed from the entry having moved on to other topics. Thanks Nuno, David and Andy for stepping up and Lars-Peter for all your hard work in the past! Includes the usual mix of new device support, features and general cleanup. This time we also have some tree wide changes. - Rip out the iio_device_claim_direct_scoped() as it proved hard to work with. This series includes quite a few related cleanups such as use of guard or factoring code out to allow direct returns. - Switch from iio_device_claim/release_direct_mode() to new iio_device_claim/release_direct() which is structured so that sparse can warn on failed releases. There were a few false positives but those were mostly in code that benefited from being cleaned up as part of this process. - Introduce iio_push_to_buffers_with_ts() to replace the _timestamp() version over time. This version takes the size of the supplied buffer which the core checks is at least as big as expected by calculation from channel descriptions of those channels enabled. Use this in an initial set of drivers. - Add macros for IIO_DECLARE_BUFFER_WITH_TS() and IIO_DECLARE_DMA_BUFFER_WITH_TS() to avoid lots of fiddly code to ensure correctly aligned buffers for timestamps being added onto the end of channel data. New device support ------------------ adi,ad3530r - New driver for AD3530, AD3530R, AD3531 and AD3531R DACs with programmable gain controls. R variants have internal references. adi,ad7476 - Add support (dt compatible only) for the Rohm BU79100G ADC which is fully compatible with the ti,ads7866. adi,ad7606 - Support ad7606c-16 and ad7606c-18 devices. Includes switch to dynamic channel information allocation. adi,ad7380 - Add support for the AD7389-4 dfrobot,sen0322 - New driver for this oxygen sensor. mediatek,mt2701-auxadc - Add binding for MT6893 which is fully compatible with already supported MT8173. meson-saradc - Support the GXLX SoCs. Mostly this is a workaround for some unrelated clock control bits found in the ADC register map. nuvoton,nct7201 - New driver for NCT7201 and NCT7202 I2C ADCs. rohm,bd79124 - New driver for this 12-bit, 8-channel SAR ADC. - Switch to new set_rv etc gpio callbacks that were added in 6.15. rohm,bd79703 - Add support for BD79700, BD79701 and BD79702 DACs that have subsets of functionality of the already supported bd79703. Included making this driver suitable for support device variants. st,stm32-lptimer - Add support for stm32pm25 to this trigger. Features -------- Beyond IIO - Property iterator for named children. core - Enable writes for 64 bit integers used for standard IIO ABI elements. Previously these could be read only. - Helper library that should avoid code duplication for simpler ADC bindings that have a child node per channel. - Enforce that IIO_DMA_MINALIGN is always at least 8 (almost always true and simplifies code on all significant architectures) core/backend - Add support to control source of data - useful when the HDL includes things like generated ramps for testing purposes. Enable this for adi-axi-dac adi,ad3552-hs - Add debugfs related callbacks to allow debug access to register contents. adi,ad4000 - Support SPI offload with appropriate FPGA firmware along with improving documentation. adi,ad7293 - Add support for external reference voltage. adi,ad7606 - Support SPI offload. adi,ad7768-1 - Support reset GPIO. adi,admv8818 - Support filter frequencies beyond 2^32. adi,adxl345 - Add single and double tap events. hid-sensor-prox - Support 16-bit report sizes as seen on some Intel platforms. invensense,icm42600 - Enable use of named interrupts to avoid problems with some wiring choices. Get the interrupt by name, but fallback to previous assumption on the first being INT1 if no names are supplied. microchip,mcp3911 - Add reset gpio support. rohm,bh7150 - Add reset gpio support. st,stm32 - Add support to control oversampling. ti,adc128s052 - Add support for ROHM BD79104 which is early compatible with the TI parts already supported by this driver. Includes some general driver cleanup and a separate dt binding. - Simplify reference voltage handling by assuming it is fixed after enabling the supply. winsen,mhz19b - New driver for this C02 sensor. Cleanup and minor fixes ----------------------- dt-bindings - Correct indentation and style for DTS examples. - Use unevalutateProperties for SPI devices instead of additionalProperties to allow generic SPI properties from spi-peripheral-props.yaml ABI Docs - Add missing docs for sampling_frequency when it applies only to events. Treewide - Various minor tweaks, comment fixes and similar. - Sort TI ADCs in Kconfig that had gotten out of order. - Switch various drives that provide GPIO chip functionality to the new callbacks with return values. - Standardize on { } formatting for all array sentinels. - Make use of aligned_s64 in a few places to replace either wrong types or manually defined equivalents. - Drop places where spi bits_per_word is set to 8 because that is the default anyway. adi,ad_sigma_delta library - Avoid a potential use of uninitialized data if reg_size has a value that is not supported (no drivers hit this but it is reasonable hardening) adi,ad4030 - Add error checking for scan types and no longer store it in state. - Rework code to reduce duplication. - Move setting the mode from buffer preenable() to update_scan_mode(), better matching expected semantics of the two different callbacks. - Improve data marshalling comments. adi,ad4695 - Use u16 for buffer elements as oversampling is not yet supported except with SPI offload (which doesn't use this path). adi,ad5592r - Clean up destruction of mutexes. - Use lock guards to simplify code (later patch fixes a missed unlock) adi,ad5933 - Correct some incorrect settling times. adi,ad7091 - Deduplicate handling of writable vs volatile registers as they are the inverse of each other for this device. adi,ad7124 - Fix 3db Filter frequency. - Remove ability to directly write the filter frequency (which was broken) - Register naming improvements. adi,ad7606 - Add a missing return value check. - Fill in max sampling rates for all chips. - Use devm_mutex_init() - Fix up some kernel-doc formatting issues. - Remove some camel case that snuck in. - Drop setting address field in channels as easily established from other fields. - Drop unnecessary parameter to ad76060_scale_setup_cb_t. adi,ad7768-1 - Convert to regmap. - Factor out buffer allocation. - Tidy up headers. adi,ad7944 - Stop setting bits_per_word in SPI xfers with no data. adi,ad9832 - Add of_device_id table rather than just relying on fallbacks. - Use FIELD_PREP() to set values of fields. adi,admv1013 - Cleanup a pointless ternary. adi,admv8818 - Fix up LPF Band 5 frequency which was slightly wrong. - Fix an integer overflow. - Fix range calculation adi,adt7316 - Replace irqd_get_trigger_type(irq_get_irq_data()) with simpler irq_get_trigger_type() adi,adxl345 - Use regmap cache instead of various state variables that were there to reduce bus accesses. - Make regmap return value checking consistent across all call sites. adi,axi-dac - Add a check on number of channels (0 to 15 valid) allwinner,sun20i - Use new adc-helpers to replace local parsing code for channel nodes. bosch,bmp290 - Move to local variables for sensor data marshalling removing the need for a messy definition that has to work for all supported parts. Follow up fix adds a missing initialization. dynaimage,al3010 and dynaimage,al3320a - Various minor cleanup to bring these drivers inline with reviewed feedback given on a new driver. - Fix an error path in which power down is not called when it should be. - Switch to regmap. google,cros_ec - Fix up a flexible array in middle of structure warning. - Flush fifo when changing the timeout to avoid potential long wait for samples. hid-sensor-rotation - Remove an __aligned(16) marking that doesn't seem to be justified. kionix,kxcjk-1013 - Deduplicate code for setting up interrupts. microchip,mcp3911 - Fix handling of conversion results register which differs across supported devices. idt,zopt2201 - Avoid duplicating register lists as all volatile registers are the inverse of writeable registers on this device. renesas,rzg2l - Use new adc-helpers to replace local parsing code for channel nodes. ti,ads1298 - Fix a missing Kconfig dependency. * tag 'iio-for-6.16a-take2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (260 commits) dt-bindings: iio: adc: Add ROHM BD79100G iio: adc: add support for Nuvoton NCT7201 dt-bindings: iio: adc: add NCT7201 ADCs iio: chemical: Add driver for SEN0322 dt-bindings: trivial-devices: Document SEN0322 iio: adc: ad7768-1: reorganize driver headers iio: bmp280: zero-init buffer iio: ssp_sensors: optimalize -> optimize HID: sensor-hub: Fix typo and improve documentation iio: admv1013: replace redundant ternary operator with just len iio: chemical: mhz19b: Fix error code in probe() iio: adc: at91-sama5d2: use IIO_DECLARE_BUFFER_WITH_TS iio: accel: sca3300: use IIO_DECLARE_BUFFER_WITH_TS iio: adc: ad7380: use IIO_DECLARE_DMA_BUFFER_WITH_TS iio: adc: ad4695: rename AD4695_MAX_VIN_CHANNELS iio: adc: ad4695: use IIO_DECLARE_DMA_BUFFER_WITH_TS iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros iio: make IIO_DMA_MINALIGN minimum of 8 bytes iio: pressure: zpa2326_spi: remove bits_per_word = 8 iio: pressure: ms5611_spi: remove bits_per_word = 8 ... commit 8cbc95f983bcec7e042266766ffe0d68980e4290 Author: Miguel Ojeda Date: Tue Mar 25 19:43:09 2025 +0100 rust: workaround `bindgen` issue with forward references to `enum` types `bindgen` currently generates the wrong type for an `enum` when there is a forward reference to it. For instance: enum E; enum E { A }; generates: pub const E_A: E = 0; pub type E = i32; instead of the expected: pub const E_A: E = 0; pub type E = ffi::c_uint; The issue was reported to upstream `bindgen` [1]. Now, both GCC and Clang support silently these forward references to `enum` types, unless `-Wpedantic` is passed, and it turns out that some headers in the kernel depend on them. Thus, depending on how the headers are included, which in turn may depend on the kernel configuration or the architecture, we may get a different type on the Rust side for a given C `enum`. That can be quite confusing, to say the least, especially since developers may only notice issues when building for other architectures like in [2]. In particular, they may end up forcing a cast and adding an `#[allow(clippy::unnecessary_cast)]` like it was done in commit 94e05a66ea3e ("rust: hrtimer: allow timer restart from timer handler"), which isn't great. Instead, let's have a section at the top of our `bindings_helper.h` that `#include`s the headers with the affected types -- hopefully there are not many cases and there is a single ordering that covers all cases. This allows us to remove the cast and the `#[allow]`, thus keeping the correct code in the source files. When the issue gets resolved in upstream `bindgen` (and we update our minimum `bindgen` version), we can easily remove this section at the top. Link: https://github.com/rust-lang/rust-bindgen/issues/3179 [1] Link: https://lore.kernel.org/rust-for-linux/87tt7md1s6.fsf@kernel.org/ [2] Acked-by: Andreas Hindborg Link: https://lore.kernel.org/r/20250325184309.97170-1-ojeda@kernel.org [ Added extra paragraph on the comment to clarify that the workaround may not be possible in some cases. - Miguel ] Signed-off-by: Miguel Ojeda commit 7ce3bf76c3adfbfcfa712d5090428f67c97db201 Merge: fd4b6c0fdf71d7 7d852b34be4df6 Author: Mark Brown Date: Thu May 22 14:38:05 2025 +0100 Add Tegra264 support in AHUB drivers Merge series from "Sheetal ." : The patch series includes the necessary changes to enable support for the Tegra264 platforms in AHUB drivers. commit 4ff4d86f6cceb6bea583bdb230e5439655778cce Author: Kory Maincent Date: Mon May 19 10:45:05 2025 +0200 net: Add support for providing the PTP hardware source in tsinfo Multi-PTP source support within a network topology has been merged, but the hardware timestamp source is not yet exposed to users. Currently, users only see the PTP index, which does not indicate whether the timestamp comes from a PHY or a MAC. Add support for reporting the hwtstamp source using a hwtstamp-source field, alongside hwtstamp-phyindex, to describe the origin of the hardware timestamp. Remove HWTSTAMP_SOURCE_UNSPEC enum value as it is not used at all. Signed-off-by: Kory Maincent Link: https://patch.msgid.link/20250519-feature_ptp_source-v4-1-5d10e19a0265@bootlin.com Signed-off-by: Paolo Abeni commit 70a299ed2e03e7ef26e5be7889bab1a47960ed25 Author: Chaoyi Chen Date: Tue May 20 10:47:18 2025 +0800 dt-bindings: display: rockchip: Convert cdn-dp-rockchip.txt to yaml Convert cdn-dp-rockchip.txt to yaml. Add new "port@1" property which represents the CDN DP output to keep the same style as the other display interfaces. This patch also changes the constraints for "phys" and "extcon". For the original binding, only one phy and the corresponding extcon can be specified. In the new binding, one or two phys can be specified. Since the RK3399 has two DP-USB PHYs, specifying one allows output via the corresponding PHY, while specifying two lets the driver choose one PHY for output. This rule also applies to extcon, which provides the cable state for the corresponding PHY. Signed-off-by: Chaoyi Chen Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250520024718.142-3-kernel@airkyi.com Signed-off-by: Rob Herring (Arm) commit 1c12fbdf40e17df2efc24bf2009a0c3bfa75bfa7 Author: Mathieu Dubois-Briand Date: Thu May 22 14:06:20 2025 +0200 regmap: irq: Add support for chips without separate IRQ status Some GPIO chips allow to rise an IRQ on GPIO level changes but do not provide an IRQ status for each separate line: only the current gpio level can be retrieved. Add support for these chips, emulating IRQ status by comparing GPIO levels with the levels during the previous interrupt. Signed-off-by: Mathieu Dubois-Briand Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250522-mdb-max7360-support-v9-5-74fc03517e41@bootlin.com Signed-off-by: Mark Brown commit fd4b6c0fdf71d71f2bbc2f9aceb6f0814b4d93e2 Author: Richard Fitzgerald Date: Thu May 22 11:38:16 2025 +0100 ASoC: wm_adsp: Make cirrus_dir const The cirrus_dir pointer should be const data but was missing the second const needed to achieve this. I haven't marked this as a 'Fixes' because it isn't causing any bugs, it's only a code improvement. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20250522103816.543919-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 5963edd98a2159f2114b08e402a7341c1e7dd293 Merge: 4d1c69e53ea7ae 695d702f42bf4b Author: Arnd Bergmann Date: Thu May 22 13:22:02 2025 +0200 Merge tag 'soc_fsl-6.16-1' of https://github.com/chleroy/linux into soc/drivers FSL SOC Changes for 6.16: - Various fixes and cleanups from Ioana on fsl-mc bus driver - Other misc fixes on fsl-mc bus driver - A build fix on DPAA2 driver - Some preparation work from Kees on qbman driver - Some cleanup on FSL qe interrupt driver init * tag 'soc_fsl-6.16-1' of https://github.com/chleroy/linux: soc: fsl: qe: Consolidate chained IRQ handler install/remove bus: fsl-mc: Use strscpy() instead of strscpy_pad() soc: fsl: qbman: Remove const from portal->cgrs allocation type bus: fsl_mc: Fix driver_managed_dma check bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value bus: fsl-mc: drop useless cleanup bus: fsl-mc: add the dprc_get_mem() command to the whitelist bus: fsl-mc: fix GET/SET_TAILDROP command ids bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device bus: fsl-mc: fix double-free on mc_dev soc: fsl: Do not enable DPAA2_CONSOLE by default during compile testing Link: https://lore.kernel.org/r/9e5b3e8e-3280-4ff9-915b-9a8b934bac22@csgroup.eu Signed-off-by: Arnd Bergmann commit ed73728fd14e14714a86b4826fb7115d9dade1b6 Merge: 783e2a47530241 e54b870212c079 Author: Johannes Berg Date: Thu May 22 13:13:07 2025 +0200 Merge tag 'mt76-next-2025-05-21' of https://github.com/nbd168/wireless Felix Fietkau says: =================== mt76 patches for 6.16 - fixes - EHT improvements - new device ids =================== Signed-off-by: Johannes Berg commit 783e2a47530241ed4d8271ba5f91c60d12534521 Merge: 0b0ff976af94fc 886bb3624e4c99 Author: Johannes Berg Date: Thu May 22 13:09:53 2025 +0200 Merge tag 'ath-next-20250521' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git patches for v6.16 ath12k: Add monitor mode support for WCN7850. Enhance regulatory support including 6 GHz power modes. In addition, perform the usual set of bug fixes and cleanups across all supported drivers. ================== Signed-off-by: Johannes Berg commit 16066e29d3f5a45cd1ced62dacfce45c9560be1d Merge: e32697dec4a6db 840bb13005f2d0 Author: Arnd Bergmann Date: Thu May 22 13:06:27 2025 +0200 Merge tag 'arm-soc/for-6.16/maintainers' of https://github.com/Broadcom/stblinux into soc/arm This pull request contains MAINTAINERS file update for Broadcom SoCs, please pull the following for 6.16: - Krzysztof updates the BCM2711/BCM283X entry to also match on the bcm2712 pattern to cover the Raspberry Pi 5 files * tag 'arm-soc/for-6.16/maintainers' of https://github.com/Broadcom/stblinux: ARM: broadcom: MAINTAINERS: Cover bcm2712 files Link: https://lore.kernel.org/r/20250513140808.2047729-1-florian.fainelli@broadcom.com Signed-off-by: Arnd Bergmann commit e32697dec4a6db500001771451346864f37811ab Merge: acda1d3a0ec754 55da73fa7a68cc Author: Arnd Bergmann Date: Thu May 22 13:05:31 2025 +0200 Merge tag 'davinci-updates-for-v6.16-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into soc/arm TI DaVinci updates for v6.16-rc1 - remove support for the da830 SoC - increase the panel FIFO threshold in da850-evm * tag 'davinci-updates-for-v6.16-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: ARM: dts: davinci: da850-evm: Increase fifo threshold ARM: davinci: remove support for da830 Link: https://lore.kernel.org/r/20250519090232.13147-1-brgl@bgdev.pl Signed-off-by: Arnd Bergmann commit e7f3d11567c2c79c4342791ba91c500b434ce147 Author: Greg Kroah-Hartman Date: Thu May 22 12:59:14 2025 +0200 spi: loopback-test: fix up const pointer issue in rx_ranges_cmp() When a list head is a const pointer, the list entry for that head also must remain a const pointer, otherwise we are just "throwing it away" for no good reason. Fix this up by properly marking these structures as const. Cc: Mark Brown Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/2025052213-semifinal-sublevel-d631@gregkh Signed-off-by: Mark Brown commit 2712a7d362904d0c4283ae91fac8cea6ecd6f9c2 Author: Greg Kroah-Hartman Date: Thu May 22 12:57:26 2025 +0200 spi: gpio: fix const issue in spi_to_spi_gpio() While the struct spi_device * passed into spi_to_spi_gpio() is a const one, the struct spi_bitbang * that is retrieved from the controller field in the spi_device is NOT a const pointer, as it is coming from the spi_controller_get_devdata() call, and then passed to container_of() which would strip off the const attribute for no good reason (i.e. if a const pointer is passed to container_of() it still is const coming out). Fix this all up by properly declaring the struct spi_bitbang * as not const. Cc: Mark Brown Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/2025052225-scallion-ritzy-dbbd@gregkh Signed-off-by: Mark Brown commit ae006498a0723e1cbb14fb7c56a1fa4642791897 Merge: 5c9876f9d1b78a bd088836a10e41 Author: Arnd Bergmann Date: Thu May 22 13:01:41 2025 +0200 Merge tag 'v6.16-rockchip-defconfig64-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/defconfig Enable Rockchip SAI and ES8328 modules. * tag 'v6.16-rockchip-defconfig64-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: arm64: defconfig: Enable Rockchip SAI and ES8328 Link: https://lore.kernel.org/r/4060740.R56niFO833@phil Signed-off-by: Arnd Bergmann commit 5234f2c3e3010f1b9c90b617e92c4b38e3240914 Author: Caleb Sander Mateos Date: Wed May 21 10:07:19 2025 -0600 ublk: remove io argument from ublk_auto_buf_reg_fallback() The argument has been unused since the function was added, so remove it. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250521160720.1893326-1-csander@purestorage.com Signed-off-by: Jens Axboe commit 5c9876f9d1b78ad303ba2c86ce7cb547ef24dcd9 Merge: a34a3ddc6b32e9 543e0ecee19ec6 Author: Arnd Bergmann Date: Thu May 22 13:00:11 2025 +0200 Merge tag 'mtk-defconfig-for-v6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/defconfig MediaTek ARM64 defconfig updates for v6.16 This enables some drivers as modules to enable fully booting some of the supported MediaTek boards; In particular, this enables the following drivers as module: - PHYs for PCIe, HDMI, DSI and DisplayPort for all boards - MediaTek UART DMA Controller, also for all boards - MDP3 driver for MT8186/88/95 (Chromebooks and Genio variants) - Auxiliary ADC for the MT6357/58/59 PMICs found on both Genio EVK and Chromebooks based on designs with MT8183/86/88/92/95 SoCs - iTE IT5205 Type-C USB Alternate Mode Passive MUX, found on both Chromebooks and Genio EVKs with MT8188/95 - Richtek RT1715 Type-C PD Controller, found on all Genio boards - Himax HX8279 DSI panel DriverIC and KD070FHFID015 panel, found on various revisions of the Genio Evaluation Kit boards. * tag 'mtk-defconfig-for-v6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux: arm64: defconfig: Enable configs for MediaTek Genio EVK boards arm64: defconfig: mediatek: enable PHY drivers Link: https://lore.kernel.org/r/20250520114356.1194450-2-angelogioacchino.delregno@collabora.com Signed-off-by: Arnd Bergmann commit 631b2af2f35737750af284be22e63da56bf20139 Author: Zhe Qiao Date: Wed Apr 30 14:06:03 2025 +0800 PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root() In the pci_acpi_scan_root() function, when creating a PCI bus fails, we need to free up the previously allocated memory, which can avoid invalid memory usage and save resources. Fixes: 789befdfa389 ("arm64: PCI: Migrate ACPI related functions to pci-acpi.c") Signed-off-by: Zhe Qiao [kwilczynski: commit log] Signed-off-by: Krzysztof Wilczyński Acked-by: Rafael J. Wysocki Link: https://lore.kernel.org/r/20250430060603.381504-1-qiaozhe@iscas.ac.cn commit a34a3ddc6b32e988a85951c78a08fd1bb7cec7c0 Merge: 74b1d172c3b59c 4b77122818239b Author: Arnd Bergmann Date: Thu May 22 12:59:45 2025 +0200 Merge tag 'qcom-arm64-defconfig-for-6.16-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/defconfig One more Qualcomm Arm64 defconfig update for v6.16 Enable global clock controller and TLMM pinctrl drivers for IPQ5424 to make this boot. * tag 'qcom-arm64-defconfig-for-6.16-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: defconfig: Enable IPQ5424 RDP466 base configs Link: https://lore.kernel.org/r/20250520025119.40021-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 74b1d172c3b59ccff03761d9aad4bba54c0bf862 Merge: 93b07587bb256c 60c6d3797239d0 Author: Arnd Bergmann Date: Thu May 22 12:59:04 2025 +0200 Merge tag 'riscv-config-for-v6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/defconfig RISC-V config for v6.16 PM_GENERIC_DOMAINS is enabled because T-Head SoCs need to use it and spacemit's gpio and clock controller are enabled for more obvious reasons. Signed-off-by: Conor Dooley * tag 'riscv-config-for-v6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: riscv: defconfig: spacemit: enable clock controller driver for SpacemiT K1 riscv: defconfig: spacemit: enable gpio support for K1 SoC riscv: Enable PM_GENERIC_DOMAINS for T-Head SoCs Link: https://lore.kernel.org/r/20250516-joystick-mortified-385820b1ad0b@spud Signed-off-by: Arnd Bergmann commit e54b870212c079bef4ff61238f8c1278a14d1863 Author: Allan Wang Date: Wed May 7 13:31:31 2025 +0800 wifi: mt76: mt7925: add rfkill_poll for hardware rfkill Add mac80211 rfkill_poll ops to monitor hardware rfkill state and state change will be updated. Signed-off-by: Allan Wang Link: https://patch.msgid.link/20250507053131.4173691-1-allan.wang@mediatek.com Signed-off-by: Felix Fietkau commit 56e38675c5bdd185e52387bf75de8237d4cda106 Author: Shayne Chen Date: Thu May 15 11:29:52 2025 +0800 wifi: mt76: support power delta calculation for 5 TX paths One variant of MT7992 has 5 TX paths, so extend the power delta function to support it. Also, rename nss_delta to path_delta since the value is based on the number of TX paths rather tha the number of spatial streams. (path delta [0.5 dBm] = 10 * log(path number) [dBm] * 2) Co-developed-by: StanleyYP Wang Signed-off-by: StanleyYP Wang Signed-off-by: Shayne Chen Link: https://patch.msgid.link/20250515032952.1653494-9-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit 249173e94dd5edef9e704f89513de7d9715ddf22 Author: Shayne Chen Date: Thu May 15 11:29:51 2025 +0800 wifi: mt76: fix available_antennas setting Check if available_antennas_tx and available_antennas_rx are already set during the per-chip initialization phase; otherwise, they could be overwritten with incorrect values. Fixes: 69d54ce7491d ("wifi: mt76: mt7996: switch to single multi-radio wiphy") Signed-off-by: Shayne Chen Link: https://patch.msgid.link/20250515032952.1653494-8-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit 42cb27af34de4acf680606fad2c1f2932110591f Author: Shayne Chen Date: Thu May 15 11:29:50 2025 +0800 wifi: mt76: mt7996: fix RX buffer size of MCU event Some management frames are first processed by the firmware and then passed to the driver through the MCU event rings. In CONNAC3, event rings do not support scatter-gather and have a size limitation of 2048 bytes. If a packet sized between 1728 and 2048 bytes arrives from an event ring, the ring will hang because the driver attempts to use scatter-gather to process it. To fix this, include the size of struct skb_shared_info in the MCU RX buffer size to prevent scatter-gather from being used for event skb in mt76_dma_rx_fill_buf(). Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Co-developed-by: Peter Chiu Signed-off-by: Peter Chiu Signed-off-by: Shayne Chen Link: https://patch.msgid.link/20250515032952.1653494-7-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit 79e788fcb2043eabf99e73f6af35a79ccca365c4 Author: Peter Chiu Date: Thu May 15 11:29:49 2025 +0800 wifi: mt76: mt7996: change max beacon size According to hardware capability, the maximum beacon size is 2048 bytes minus the size of TLV headers. Signed-off-by: Peter Chiu Signed-off-by: Shayne Chen Link: https://patch.msgid.link/20250515032952.1653494-6-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit d5012734fc4bd5371e2e8dea8c2f3d28287573b8 Author: Peter Chiu Date: Thu May 15 11:29:48 2025 +0800 wifi: mt76: mt7996: fix invalid NSS setting when TX path differs from NSS The maximum TX path and NSS may differ on a band. For example, one variant of the MT7992 has 5 TX paths and 4 NSS on the 5 GHz band. To address this, add orig_antenna_mask to record the maximum NSS and prevent setting an invalid NSS in mt7996_set_antenna(). Fixes: 69d54ce7491d ("wifi: mt76: mt7996: switch to single multi-radio wiphy") Signed-off-by: Peter Chiu Signed-off-by: Shayne Chen Link: https://patch.msgid.link/20250515032952.1653494-5-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit 80fda1cd7b0a1edd0849dc71403a070d0922118d Author: Benjamin Lin Date: Thu May 15 11:29:47 2025 +0800 wifi: mt76: mt7996: drop fragments with multicast or broadcast RA IEEE 802.11 fragmentation can only be applied to unicast frames. Therefore, drop fragments with multicast or broadcast RA. This patch addresses vulnerabilities such as CVE-2020-26145. Signed-off-by: Benjamin Lin Signed-off-by: Shayne Chen Link: https://patch.msgid.link/20250515032952.1653494-4-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit 8b2f574845e33d02e7fbad2d3192a8b717567afa Author: Peter Chiu Date: Thu May 15 11:29:46 2025 +0800 wifi: mt76: mt7996: set EHT max ampdu length capability Set the max AMPDU length in the EHT MAC CAP. Without this patch, the peer station cannot obtain the correct capability, which prevents achieving peak throughput on the 2 GHz band. Fixes: 1816ad9381e0 ("wifi: mt76: mt7996: add max mpdu len capability") Signed-off-by: Peter Chiu Signed-off-by: Shayne Chen Link: https://patch.msgid.link/20250515032952.1653494-3-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit 5c78949fc7cd772d483a8abe126fe90937c0f002 Author: Howard Hsu Date: Thu May 15 11:29:45 2025 +0800 wifi: mt76: mt7996: fix beamformee SS field Fix the beamformee SS field for the mt7996, mt7992 and mt7990 chipsets. For the mt7992, this value shall be set to 0x4, while the others shall be set to 0x3. Fixes: 5b20557593d4 ("wifi: mt76: connac: adjust phy capabilities based on band constraints") Signed-off-by: Howard Hsu Signed-off-by: Shayne Chen Link: https://patch.msgid.link/20250515032952.1653494-2-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit 08419f9e9bbb58f6eeb61990797e6084db6500ec Author: Howard Hsu Date: Thu May 15 11:29:44 2025 +0800 wifi: mt76: remove capability of partial bandwidth UL MU-MIMO The firmware only supports full bandwidth UL MU-MIMO, so remove the partial bandwidth capability from HE PHY CAP. Signed-off-by: Howard Hsu Signed-off-by: Shayne Chen Link: https://patch.msgid.link/20250515032952.1653494-1-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit 0a41b6751e4fe5094f17e5e14908cf3713d58d60 Author: Michael Lo Date: Mon May 5 16:36:18 2025 -0700 wifi: mt76: mt7925: add test mode support The test mode interface allows controlled execution of chip-level operations such as continuous transmission, reception tests, and register access, which are essential during bring-up, diagnostics, and factory testing. Co-developed-by: Sean Wang Signed-off-by: Sean Wang Signed-off-by: Michael Lo Link: https://patch.msgid.link/20250505233618.1951021-2-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit ba7fe3b064639e3e2687b68e5fb2223380114794 Author: Michael Lo Date: Mon May 5 16:36:17 2025 -0700 wifi: mt76: mt7925: extend MCU support for testmode Add MCU command and its handling needed for testmode support on MT7925. This enables low-level chip testing features such as continuous TX/RX.. Co-developed-by: Sean Wang Signed-off-by: Sean Wang Signed-off-by: Michael Lo Link: https://patch.msgid.link/20250505233618.1951021-1-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit aa97ff5782cf01cf2163593e1f57bbde63a06047 Author: Michael Lo Date: Mon Apr 14 09:39:54 2025 +0800 wifi: mt76: mt7925: ensure all MCU commands wait for response Modify MCU command sending functions to wait for a response, ensuring consistent behavior across all commands and improves reliability by confirming that each command is processed successfully. Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") Signed-off-by: Michael Lo Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20250414013954.1151774-3-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit bd02eebfc0b3502fe8322cf229b4c801416d1007 Author: Ming Yen Hsieh Date: Mon Apr 14 09:39:53 2025 +0800 wifi: mt76: mt7925: refine the sniffer commnad Remove a duplicate call to `mt76_mcu_send_msg` to fix redundant operations in the sniffer command handling. Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20250414013954.1151774-2-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit 122f270aca2c86d7de264ab67161c845e0691d73 Author: Ming Yen Hsieh Date: Mon Apr 14 09:39:52 2025 +0800 wifi: mt76: mt7925: prevent multiple scan commands Add a check to ensure only one scan command is active at a time by testing the MT76_HW_SCANNING state. Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20250414013954.1151774-1-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit efb95439c1477bbc955cacd0179c35e7861b437c Author: Henry Martin Date: Mon Apr 7 14:19:00 2025 +0800 wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() devm_ioremap() returns NULL on error. Currently, mt7915_mmio_wed_init() does not check for this case, which results in a NULL pointer dereference. Prevent null pointer dereference in mt7915_mmio_wed_init(). Fixes: 4f831d18d12d ("wifi: mt76: mt7915: enable WED RX support") Signed-off-by: Henry Martin Link: https://patch.msgid.link/20250407061900.85317-1-bsdhenrymartin@gmail.com Signed-off-by: Felix Fietkau commit 8f30e2b059757d8711a823e4c9c023db62a1d171 Author: Henry Martin Date: Mon Apr 7 11:23:49 2025 +0800 wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() devm_ioremap() returns NULL on error. Currently, mt7996_mmio_wed_init() does not check for this case, which results in a NULL pointer dereference. Prevent null pointer dereference in mt7996_mmio_wed_init() Fixes: 83eafc9251d6 ("wifi: mt76: mt7996: add wed tx support") Signed-off-by: Henry Martin Link: https://patch.msgid.link/20250407032349.83360-1-bsdhenrymartin@gmail.com Signed-off-by: Felix Fietkau commit 8284815ca161e0fa0861cc4085f1c0141e10a34d Author: Ming Yen Hsieh Date: Fri Mar 21 09:38:29 2025 +0800 wifi: mt76: mt7925: add RNR scan support for 6GHz Enhance the mt7925 to include RNR scan support. It adds the necessary RNR information to the scan command. Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20250321013829.3598-2-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit 913a61826787669471b5b27b304dd2d0deedd7c8 Author: Ming Yen Hsieh Date: Fri Mar 21 09:38:28 2025 +0800 wifi: mt76: add mt76_connac_mcu_build_rnr_scan_param routine Introduce mt76_connac_mcu_build_rnr_scan_param routine for handling RNR scan. This is a preliminary patch to enable RNR scan in mt7921 and mt7925 driver. Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20250321013829.3598-1-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit 7e1fcf687c2fb22ad25cf3fae322a37452f5f560 Author: Feng Jiang Date: Wed Apr 2 14:24:15 2025 +0800 wifi: mt76: scan: Fix 'mlink' dereferenced before IS_ERR_OR_NULL check Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202504011739.HvUKtUUe-lkp@intel.com/ Fixes: 3ba20af886d1 ("wifi: mt76: scan: set vif offchannel link for scanning/roc") Signed-off-by: Feng Jiang Link: https://patch.msgid.link/20250402062415.25434-1-jiangfeng@kylinos.cn Signed-off-by: Felix Fietkau commit c48cd2e82b6606dc171e89623599d40140645ce9 Merge: b5125e69fb6c6e 6332351622db25 Author: Arnd Bergmann Date: Thu May 22 12:55:44 2025 +0200 Merge tag 'juno-updates-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/dt Armv8 Juno/FVP updates for v6.16 Few updates to the Arm FVP(Fixed Virtual Platform) device tree, enhancing support for system tracing, power management, and firmware coexistence: 1. ETE and TRBE support Adds CoreSight ETE and TRBE nodes for the FVP Rev C model. These are disabled by default as they need to be enabled explicitly via model parameters. 2. CPU idle states and system timer for idle broadcast Introduces CPU idle state definitions but disabled by default due to potential performance impact on the model. Also adds a system-level broadcast timer for use when CPUs enter deep idle states where local timers stop. 3. Firmware memory reservation Reserves 64MB at the end of the first DRAM bank to prevent conflicts with FF-A firmware or similar configurations that rely on this region. 4. Drop the unnecessary clock-frequency property in the timer nodes The boot/secure firmware must configure the timer clock frequency and the non-secure OS must be able to read the same. The clock-frequency is generally used when the firmware is broken which is not the case on most of the fast models and Juno platform. As noted above some of the changes are disabled by default where applicable to ensure backward compatibility and avoid unintended performance impact on platforms using default model parameters. * tag 'juno-updates-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: arm64: dts: fvp: Add ETE and TRBE nodes for Rev C model arm64: dts: arm: Drop the clock-frequency property from timer nodes arm64: dts: fvp: Reserve 64MB for the FF-A firmware in memory map arm64: dts: fvp: Add CPU idle states for Rev C model arm64: dts: fvp: Add system timer for broadcast during CPU idle Link: https://lore.kernel.org/r/20250513143827.3606686-1-sudeep.holla@arm.com Signed-off-by: Arnd Bergmann commit dfc970ad61973111932fc282ebab8d825056d5ab Author: Philipp Stanner Date: Thu May 22 10:46:27 2025 +0200 PCI: Remove function pcim_intx() prototype from pci.h The subsystem-internal header pci.h still contains the function prototype of pcim_intx(), which has since been made public in the global header. Remove the redundant function prototype. Signed-off-by: Philipp Stanner [kwilczynski: commit log] Signed-off-by: Krzysztof Wilczyński Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250522084626.150148-2-phasta@kernel.org commit 226ff35039d05826b738160eff05844c0fa5c2a0 Author: Yicong Yang Date: Fri Apr 25 11:38:43 2025 +0800 arm64: cputype: Add cputype definition for HIP12 Add MIDR encoding for HiSilicon HIP12 which is used on HiSilicon HIP12 SoCs. Signed-off-by: Yicong Yang Link: https://lore.kernel.org/r/20250425033845.57671-2-yangyicong@huawei.com Signed-off-by: Will Deacon commit 80834997154271da58fd69fa7fdfe8238750960e Author: Rob Herring (Arm) Date: Tue May 20 17:27:37 2025 -0500 arm64: el2_setup.h: Make __init_el2_fgt labels consistent, again Commit 5b39db6037e7 ("arm64: el2_setup.h: Rename some labels to be more diff-friendly") reworked the labels in __init_el2_fgt to say what's skipped rather than what the target location is. The exception was "set_fgt_" which is where registers are written. In reviewing the BRBE additions, Will suggested "set_debug_fgt_" where HDFGxTR_EL2 are written. Doing that would partially revert commit 5b39db6037e7 undoing the goal of minimizing additions here, but it would follow the convention for labels where registers are written. So let's do both. Branches that skip something go to a "skip" label and places that set registers have a "set" label. This results in some double labels, but it makes things entirely consistent. While we're here, the SME skip label was incorrectly named, so fix it. Reported-by: Will Deacon Cc: Dave Martin Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250520-arm-brbe-v19-v22-2-c1ddde38e7f8@kernel.org Signed-off-by: Will Deacon commit 7d852b34be4df61ae4327b47c39701d0f7ffcc70 Author: Sheetal Date: Mon May 12 05:17:47 2025 +0000 ASoC: tegra: Tegra264 support in isomgr_bw Tegra264 supports max 32 channels, hence calculating the max bandwidth using the channel info from soc_data. Signed-off-by: Sheetal Link: https://patch.msgid.link/20250512051747.1026770-12-sheetal@nvidia.com Signed-off-by: Mark Brown commit 4152d33ab162d5378f57cd757e1de5cb4867dfb4 Author: Sheetal Date: Mon May 12 05:17:46 2025 +0000 ASoC: tegra: AHUB: Add Tegra264 support Add Tegra264 AHUB support with following changes: - Update Tegra264 IP instances: DMIC(2), DSPK(1), AMX(6), ADX(6), I2S(8). - Update register offsets for Tegra264. - Add soc_data for Tegra264 chip-specific variations. - Increase channels_max to 32 for Tegra264 DAIs. Signed-off-by: Sheetal Link: https://patch.msgid.link/20250512051747.1026770-11-sheetal@nvidia.com Signed-off-by: Mark Brown commit 7dc8299fbb1c8e6373e8e55d562b7674ee37b2b0 Author: Sheetal Date: Mon May 12 05:17:45 2025 +0000 ASoC: tegra: ADX: Add Tegra264 support Add Tegra264 ADX support with following changes: - Add soc_data for Tegra264-specific variations - Tegra264 ADX supports 32 input channels, hence update the playback DAI channels_max parameter and CIF configuration API. - Register offsets and default values are updated to align with Tegra264. - Add 128 byte map controls for Tegra264 to accommodate each byte per channel (32channels x 32bits). Signed-off-by: Sheetal Link: https://patch.msgid.link/20250512051747.1026770-10-sheetal@nvidia.com Signed-off-by: Mark Brown commit fd509c6f8e4028539bf35d80e3bcdce7b3ba0f9f Author: Sheetal Date: Mon May 12 05:17:44 2025 +0000 ASoC: tegra: AMX: Add Tegra264 support Add Tegra264 AMX support with following changes: - Add soc_data for Tegra264-specific variations - Tegra264 AMX supports 32 output channels, hence update the capture DAI channels_max parameter and CIF configuration API. - Register offsets and default values are updated to align with Tegra264. - Add 128 byte map controls for Tegra264 to accommodate each byte per channel (32channels x 32bits). Signed-off-by: Sheetal Link: https://patch.msgid.link/20250512051747.1026770-9-sheetal@nvidia.com Signed-off-by: Mark Brown commit b3354438d89867654b4a95a9630fd3393e275e33 Author: Sheetal Date: Mon May 12 05:17:43 2025 +0000 ASoC: tegra: I2S: Add Tegra264 support Add Tegra264 I2S support with following changes: - Add soc_data for Tegra264-specific variations - Tegra264 I2S supports 32 audio channels, hence update the TDM config, CIF configuration API and DAI channel_max parameter. - Register offsets and default values are updated to align with Tegra264. Signed-off-by: Sheetal Link: https://patch.msgid.link/20250512051747.1026770-8-sheetal@nvidia.com Signed-off-by: Mark Brown commit 1fb500476f609008ee1c499540af32c4fa5a19de Author: Sheetal Date: Mon May 12 05:17:42 2025 +0000 ASoC: tegra: Update PLL rate for Tegra264 The PLLs should be set with a VCO frequency in the 900MHz – 1GHz range to minimize jitter and ppm error for Tegra264. Add the PLLA rate accordingly. Therefore, use 983040000 frequency is for multiple of 8K frequencies and 993484800 frequency is for multiple of 11.025K frequencies. Signed-off-by: Sheetal Link: https://patch.msgid.link/20250512051747.1026770-7-sheetal@nvidia.com Signed-off-by: Mark Brown commit fa83757df3f40c05b5ab4154253e8aeefa31a9a6 Author: Sheetal Date: Mon May 12 05:17:41 2025 +0000 ASoC: tegra: ASRC: Update ARAM address The ARAM address for Tegra264 has been updated. To maintain backward compatibility given its chip-specific nature, it's now included in the soc_data. Signed-off-by: Sheetal Link: https://patch.msgid.link/20250512051747.1026770-6-sheetal@nvidia.com Signed-off-by: Mark Brown commit 7668c6378b0577893bcf8c0f272b6ed099e0787d Author: Sheetal Date: Mon May 12 05:17:40 2025 +0000 ASoC: tegra: ADMAIF: Add Tegra264 support Add Tegra264 I2S support with following changes: - Add soc_data for Tegra264-specific variations - Tegra264 supports 32 RX and 32 TX ADMAIF channels and each ADMAIF stream supports max 32 channels. To accommodate the change dais, CIF configuration API and driver components are updated. - Register offsets and default values are updated to align with Tegra264. Signed-off-by: Sheetal Link: https://patch.msgid.link/20250512051747.1026770-5-sheetal@nvidia.com Signed-off-by: Mark Brown commit 35c0d1de8e669878797e40cc625f4bdc37c3e084 Author: Sheetal Date: Mon May 12 05:17:39 2025 +0000 ASoC: tegra: CIF: Add Tegra264 support In Tegra264, the CIF register data bit positions are changed for I2S, AMX, ADX and ADMAIF AHUB modules, as they now support a maximum of 32 channels. tegra264_set_cif API added to set the CIF for IPs supporting 32 channels. Signed-off-by: Sheetal Link: https://patch.msgid.link/20250512051747.1026770-4-sheetal@nvidia.com Signed-off-by: Mark Brown commit 628dafc476eb658544ad6b5b3592bfcd82597051 Author: Sheetal Date: Mon May 12 05:17:38 2025 +0000 dt-bindings: ASoC: Document Tegra264 APE support Add Tegra264 compatible strings to APE subsystem device bindings: - audio-graph-card: Due to different PLL clock rate. - admaif: Due to 32 channels supported and register offset changes. - i2s: Due to 32 channels supported and register offset changes. - amx/adx: Due to 32 channels supported and register offset changes. - asrc: Due to different ARAM address. - ahub: Due to AHUB IPs number of instances updates. - for future proofing the T264 compatibility is added for other device nodes. These bindings enable the enhanced audio features of Tegra264 while maintaining compatibility with existing platforms. Signed-off-by: Sheetal Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250512051747.1026770-3-sheetal@nvidia.com Signed-off-by: Mark Brown commit 37240f703041439cd8a39abd670dbfc0e75b725c Author: Sheetal Date: Mon May 12 05:17:37 2025 +0000 dt-bindings: ASoC: admaif: Add missing properties Add optional interconnect and iommu properties to admaif yaml. These properties are supported from Tegra186 SoC onwards. This fixes below dtbs_check error for Tegra194 and Tegra234: 'interconnect-names', 'interconnects', 'iommus' do not match any of the regexes: 'pinctrl-[0-9]+' Signed-off-by: Sheetal Acked-by: "Rob Herring (Arm)" Link: https://patch.msgid.link/20250512051747.1026770-2-sheetal@nvidia.com Signed-off-by: Mark Brown commit cbeaa41dfe26b72639141e87183cb23e00d4b0dd Author: Miguel Ojeda Date: Tue May 20 20:55:55 2025 +0200 objtool/rust: relax slice condition to cover more `noreturn` Rust functions Developers are indeed hitting other of the `noreturn` slice symbols in Nova [1], thus relax the last check in the list so that we catch all of them, i.e. *_4core5slice5index22slice_index_order_fail *_4core5slice5index24slice_end_index_len_fail *_4core5slice5index26slice_start_index_len_fail *_4core5slice5index29slice_end_index_overflow_fail *_4core5slice5index31slice_start_index_overflow_fail These all exist since at least Rust 1.78.0, thus backport it too. See commit 56d680dd23c3 ("objtool/rust: list `noreturn` Rust functions") for more details. Cc: stable@vger.kernel.org # Needed in 6.12.y and later. Cc: John Hubbard Cc: Timur Tabi Cc: Kane York Cc: Josh Poimboeuf Cc: Peter Zijlstra Reported-by: Joel Fernandes Fixes: 56d680dd23c3 ("objtool/rust: list `noreturn` Rust functions") Closes: https://lore.kernel.org/rust-for-linux/20250513180757.GA1295002@joelnvbox/ [1] Tested-by: Joel Fernandes Link: https://lore.kernel.org/r/20250520185555.825242-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 195746046c256ce5324772394c886ba798859fca Author: I Hsin Cheng Date: Tue Mar 11 21:33:57 2025 +0800 rust: list: Add examples for linked list Add basic examples for the structure "List", which also serve as unit tests for basic list methods. It includes the following manipulations: * List creation * List emptiness check * List insertion through push_front(), push_back() * List item removal through pop_front(), pop_back() * Push one list to another through push_all_back() The method "remove()" doesn't have an example here because insertion with push_front() or push_back() will take the ownership of the item, which means we can't keep any valid reference to the node we want to remove, unless Cursor is used. The "remove" example through Cursor is already demonstrated with commit 52ae96f5187c ("rust: list: make the cursor point between elements"). Link: https://github.com/Rust-for-Linux/linux/issues/1121 Signed-off-by: I Hsin Cheng Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Link: https://lore.kernel.org/r/20250311133357.90322-1-richard120310@gmail.com [ Removed prelude import and spurious newlines. Formatted comments with the usual style. Reworded slightly. - Miguel ] Signed-off-by: Miguel Ojeda commit 28669b2f37e9b7e98b62d0be2e10a5bf31c2b16f Author: I Hsin Cheng Date: Mon Mar 10 15:38:52 2025 +0800 rust: list: Use "List::is_empty()" to perform checking when possible "List::is_empty()" provides a straight forward convention to check whether a given "List" is empty or not. There're numerous places in the current implementation still use "self.first.is_null()" to perform the equivalent check, replace them with "List::is_empty()". Signed-off-by: I Hsin Cheng Link: https://lore.kernel.org/r/20250310073853.427954-1-richard120310@gmail.com Reviewed-by: Benno Lossin [ Rebased dropping the cases that do not apply anymore. - Miguel ] Signed-off-by: Miguel Ojeda commit ef7f3631a44b8e0990ab8ffcbed4b2c3a4270883 Author: Artur Weber Date: Thu May 15 16:16:35 2025 +0200 regulator: bcm590xx: Add support for BCM59054 regulators The BCM59056 and BCM59054 are very similar in terms of regulators. Add the register definitions for the BCM59054 and enable support for it in the driver. Signed-off-by: Artur Weber Reviewed-by: Stanislav Jakubek Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20250515-bcm59054-v9-8-14ba0ea2ea5b@gmail.com Signed-off-by: Lee Jones commit d92f474420e5bb2c8b773a4fe9cf93b6051dc1ff Author: Artur Weber Date: Thu May 15 16:16:34 2025 +0200 regulator: bcm590xx: Rename BCM59056-specific data as such Previously, the driver used the BCM590XX prefix for register data specific to the BCM59056. As we will be introducing other regulators to this driver as well, make the BCM59056-specific values use the BCM59056 prefix. Signed-off-by: Artur Weber Reviewed-by: Stanislav Jakubek Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20250515-bcm59054-v9-7-14ba0ea2ea5b@gmail.com Signed-off-by: Lee Jones commit 75dc12b4450269821fca4c8634f5185d28cf2117 Author: Artur Weber Date: Thu May 15 16:16:33 2025 +0200 regulator: bcm590xx: Store regulator descriptions in table Instead of filling in the regulator description programatically, store the data in a struct. This will make it a bit nicer to introduce support for other BCM590xx chips besides the BCM59056. To do this, add a new struct type, bcm590xx_reg_data, to store all of the necessary information. Drop the old IS_LDO, IS_GPLDO... macros in favor of the "type" field in this struct. Adapt the old bcm590xx_reg struct to the new types. Signed-off-by: Artur Weber Reviewed-by: Stanislav Jakubek Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20250515-bcm59054-v9-6-14ba0ea2ea5b@gmail.com Signed-off-by: Lee Jones commit 37512643e1f889549e4f9632d6bccef6804cb776 Author: Artur Weber Date: Thu May 15 16:16:32 2025 +0200 regulator: bcm590xx: Use dev_err_probe for regulator register error Instead of calling dev_err() and returning PTR_ERR(...) separately, use a single "return dev_err_probe" statement. Signed-off-by: Artur Weber Reviewed-by: Stanislav Jakubek Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20250515-bcm59054-v9-5-14ba0ea2ea5b@gmail.com Signed-off-by: Lee Jones commit d310cdbb4ee6285f374d4dfc32173c35f8a2273e Author: Artur Weber Date: Thu May 15 16:16:31 2025 +0200 mfd: bcm590xx: Add PMU ID/revision parsing function The BCM590xx PMUs have two I2C registers for reading the PMU ID and revision. The revision is useful for subdevice drivers, since different revisions may have slight differences in behavior (for example - BCM59054 has different regulator configurations for revision A0 and A1). Check the PMU ID register and make sure it matches the DT compatible. Fetch the digital and analog revision from the PMUREV register so that it can be used in subdevice drivers. Also add some known revision values to bcm590xx.h, for convenience when writing subdevice drivers. Signed-off-by: Artur Weber Reviewed-by: Stanislav Jakubek Link: https://lore.kernel.org/r/20250515-bcm59054-v9-4-14ba0ea2ea5b@gmail.com Signed-off-by: Lee Jones commit 6adf48a3aa316ce360e02dd10222e96da9a0eff5 Author: Artur Weber Date: Thu May 15 16:16:30 2025 +0200 mfd: bcm590xx: Add support for multiple device types + BCM59054 compatible The BCM59054 is another chip from the BCM590xx line of PMUs, commonly used on devices with the BCM21664/BCM23550 chipsets. Prepare the BCM590xx driver for supporting other devices by adding the PMUID register values for supported chip types and store them in the MFD data struct as "pmu_id". (These will be checked against the actual PMUID register values in a later commit.) Then, add a DT compatible for the BCM59054, and provide the PMU ID as OF match data. Signed-off-by: Artur Weber Reviewed-by: Stanislav Jakubek Link: https://lore.kernel.org/r/20250515-bcm59054-v9-3-14ba0ea2ea5b@gmail.com Signed-off-by: Lee Jones commit 13980ebf8e9431975fe834df9df31dea39cb9a45 Author: Artur Weber Date: Thu May 15 16:16:29 2025 +0200 dt-bindings: mfd: brcm,bcm59056: Add compatible for BCM59054 The BCM59054 MFD is fairly similar to the BCM59056, and will use the same driver. Add compatible and specify the allowed regulator nodes. Signed-off-by: Artur Weber Reviewed-by: "Rob Herring (Arm)" Reviewed-by: Stanislav Jakubek Link: https://lore.kernel.org/r/20250515-bcm59054-v9-2-14ba0ea2ea5b@gmail.com Signed-off-by: Lee Jones commit 9d56594f3ebf6ea4b23884412d3fde11f39518d2 Author: Artur Weber Date: Thu May 15 16:16:28 2025 +0200 dt-bindings: mfd: brcm,bcm59056: Convert to YAML Convert devicetree bindings for the Broadcom BCM59056 PMU MFD from TXT to YAML format. This patch does not change any functionality; the bindings remain the same. The bindings have been split into two parts: the MFD binding and a separate binding for the regulator node, to simplify the addition of other models later (which have different regulators). Signed-off-by: Artur Weber Reviewed-by: "Rob Herring (Arm)" Reviewed-by: Stanislav Jakubek Link: https://lore.kernel.org/r/20250515-bcm59054-v9-1-14ba0ea2ea5b@gmail.com Signed-off-by: Lee Jones commit 249c3a0e53acefc2b06d3b3e1fc28fb2081f878d Author: FUJITA Tomonori Date: Sat Mar 8 13:45:06 2025 +0900 rust: module: place cleanup_module() in .exit.text section Place cleanup_module() in .exit.text section. Currently, cleanup_module() is likely placed in the .text section. It's inconsistent with the layout of C modules, where cleanup_module() is placed in .exit.text. [ Boqun asked for an example of how the section changed to be put in the log. Tomonori provided the following examples: C module: $ objdump -t ~/build/x86/drivers/block/loop.o|grep clean 0000000000000000 l O .exit.data 0000000000000008 __UNIQUE_ID___addressable_cleanup_module412 0000000000000000 g F .exit.text 000000000000009c cleanup_module Rust module without this patch: $ objdump -t ~/build/x86/samples/rust/rust_minimal.o|grep clean 00000000000002b0 g F .text 00000000000000c6 cleanup_module 0000000000000000 g O .exit.data 0000000000000008 _R...___UNIQUE_ID___addressable_cleanup_module Rust module with this patch: $ objdump -t ~/build/x86/samples/rust/rust_minimal.o|grep clean 0000000000000000 g F .exit.text 00000000000000c6 cleanup_module 0000000000000000 g O .exit.data 0000000000000008 _R...___UNIQUE_ID___addressable_cleanup_module - Miguel ] Signed-off-by: FUJITA Tomonori Acked-by: Jarkko Sakkinen Link: https://lore.kernel.org/r/20250308044506.14458-1-fujita.tomonori@gmail.com Signed-off-by: Miguel Ojeda commit bb941ea789f803cce766ca1e0f7c59a362aaf99a Author: Miguel Ojeda Date: Tue May 20 20:21:25 2025 +0200 rust: remove unneeded Rust 1.87.0 `allow(clippy::ptr_eq)` For the Rust 1.87.0 release, Clippy was expected to warn with: error: use `core::ptr::eq` when comparing raw pointers --> rust/kernel/list.rs:438:12 | 438 | if self.first == item { | ^^^^^^^^^^^^^^^^^^ help: try: `core::ptr::eq(self.first, item)` | = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#ptr_eq = note: `-D clippy::ptr-eq` implied by `-D warnings` = help: to override `-D warnings` add `#[allow(clippy::ptr_eq)]` However, a backport to relax a bit the `clippy::ptr_eq` finally landed, and thus Clippy did not warn by the time the release happened. Thus remove the `allow`s added back then, which were added just in case the backport did not land in time. See commit a39f30870927 ("rust: allow Rust 1.87.0's `clippy::ptr_eq` lint") for details. Link: https://github.com/rust-lang/rust/pull/140859 [1] Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250520182125.806758-1-ojeda@kernel.org [ Reworded for clarity. - Miguel ] Signed-off-by: Miguel Ojeda commit 396639299e95fbb915c6ff12cb42391f04741ab3 Author: Kuninori Morimoto Date: Tue May 13 23:40:20 2025 +0000 ASoC: dt-bindings: audio-graph-card2: reference audio-graph routing property audio-graph.yaml already has "routing" property, let's reference it. Signed-off-by: Kuninori Morimoto Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/875xi4axln.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit ae3392c0f12f179b969ce17856ed18bf8d69a35e Author: Dharma Balasubiramani Date: Tue May 20 20:51:46 2025 +0530 counter: microchip-tcb-capture: Add watch validation support The Timer Counter Block (TCB) exposes several kinds of events to the Counter framework, but not every event is meaningful on every hardware channel. Add a `watch_validate()` callback so userspace may register only the combinations actually supported: * Channel 0 (COUNTER_MCHP_EVCHN_CV, COUNTER_MCHP_EVCHN_RA) - COUNTER_EVENT_CAPTURE - COUNTER_EVENT_CHANGE_OF_STATE - COUNTER_EVENT_OVERFLOW * Channel 1 (COUNTER_MCHP_EVCHN_RB) - COUNTER_EVENT_CAPTURE * Channel 2 (COUNTER_MCHP_EVCHN_RC) - COUNTER_EVENT_THRESHOLD Any other request is rejected with `-EINVAL`. Signed-off-by: Dharma Balasubiramani Link: https://lore.kernel.org/r/20250520-counter-tcb-v3-1-4631e2aff7ed@microchip.com Signed-off-by: William Breathitt Gray commit 17a3a30e8e3df77d1d1f5bc705b903604a1eedc9 Author: Cosmin Tanislav Date: Wed May 7 15:19:15 2025 +0300 i2c: atr: add passthrough flag Some I2C ATRs can have other I2C ATRs as children. The I2C messages of the child ATRs need to be forwarded as-is if the parent I2C ATR can only do static mapping. In the case of GMSL, the deserializer I2C ATR actually doesn't have I2C address remapping hardware capabilities, but it is able to select which GMSL link to talk to, allowing it to change the address of the serializer. The child ATRs need to have their alias pools defined in such a way to prevent overlapping addresses between them, but there's no way around this without orchestration between multiple ATR instances. To allow for this use-case, add a flag that allows unmapped addresses to be passed through, since they are already remapped by the child ATRs. There's no case where an address that has not been remapped by the child ATR will hit the parent ATR. Signed-off-by: Cosmin Tanislav Reviewed-by: Luca Ceresoli Reviewed-by: Romain Gantois Signed-off-by: Wolfram Sang commit 18355307dc56c198365c6b6b359a4a24db013685 Author: Cosmin Tanislav Date: Wed May 7 15:19:13 2025 +0300 i2c: atr: add static flag Some I2C ATRs do not support dynamic remapping, only static mapping of direct children. Mappings will only be added or removed as a result of devices being added or removed from a child bus. The ATR pool will have to be big enough to accommodate all devices expected to be added to the child buses. Add a new flag that prevents old mappings to be replaced or new mappings to be created in the alias finding code paths. That mens adding a flags parameter to i2c_atr_new() and an i2c_atr_flags enum. Signed-off-by: Cosmin Tanislav Reviewed-by: Luca Ceresoli Reviewed-by: Romain Gantois Signed-off-by: Wolfram Sang commit b09d8a9cce2664cdcef91f10eed9557321ce4a81 Author: Cosmin Tanislav Date: Wed May 7 15:19:12 2025 +0300 i2c: atr: allow replacing mappings in attach_addr() It is possible for aliases to be exhausted while we are still attaching children. Allow replacing mapping on attach by calling i2c_atr_replace_mapping_by_addr() if i2c_atr_create_mapping_by_addr() fails. Signed-off-by: Cosmin Tanislav Reviewed-by: Luca Ceresoli Signed-off-by: Wolfram Sang commit 02426327e2286d16fdd86b4ba0b56af9939160f3 Author: Cosmin Tanislav Date: Wed May 7 15:19:11 2025 +0300 i2c: atr: deduplicate logic in attach_addr() This is the same logic as in i2c_atr_create_mapping_by_addr(). Signed-off-by: Cosmin Tanislav Reviewed-by: Luca Ceresoli Reviewed-by: Romain Gantois Signed-off-by: Wolfram Sang commit 5efe815ad7355655f3a6ce9593530afd6ecc6d21 Author: Cosmin Tanislav Date: Wed May 7 15:19:10 2025 +0300 i2c: atr: do not create mapping in detach_addr() It is useless to create a new mapping just to detach it immediately. Use the newly added i2c_atr_find_mapping_by_addr() function to avoid it, and exit without logging an error if not found. Signed-off-by: Cosmin Tanislav Reviewed-by: Luca Ceresoli Signed-off-by: Wolfram Sang commit 5988589eb38124f6eb311ada0f92a0b68625659d Author: Cosmin Tanislav Date: Wed May 7 15:19:09 2025 +0300 i2c: atr: split up i2c_atr_get_mapping_by_addr() The i2c_atr_get_mapping_by_addr() function handles three separate usecases: finding an existing mapping, creating a new mapping, or replacing an existing mapping if a new mapping cannot be created because there aren't enough aliases available. Split up the function into three different functions handling its individual usecases to prepare for better usage of each one. Signed-off-by: Cosmin Tanislav Reviewed-by: Luca Ceresoli Signed-off-by: Wolfram Sang commit 42a70dc49edfc230fe79e3e8141b5b8d537e7a91 Author: Cosmin Tanislav Date: Wed May 7 15:19:08 2025 +0300 i2c: atr: find_mapping() -> get_mapping() A find operation implies that a null result is not an error. Use get naming to clarify things and to prepare for splitting up the logic inside this function. Signed-off-by: Cosmin Tanislav Reviewed-by: Luca Ceresoli Signed-off-by: Wolfram Sang commit ec8c1b92eaec3efebff717b5c13da3b5e87f2dcc Author: Tomi Valkeinen Date: Wed May 7 15:19:07 2025 +0300 i2c: atr: Fix lockdep for nested ATRs When we have an ATR, and another ATR as a subdevice of the first ATR, we get lockdep warnings for the i2c_atr.lock and i2c_atr_chan.orig_addrs_lock. This is because lockdep uses a static key for the locks, and doesn't see the locks of the separate ATR instances as separate. Fix this by generating a dynamic lock key per lock instance. Signed-off-by: Tomi Valkeinen Signed-off-by: Cosmin Tanislav Reviewed-by: Luca Ceresoli Signed-off-by: Wolfram Sang commit 44889ff67cee7b9ee2d305690ce7a5488b137a66 Author: Ingo Molnar Date: Thu May 22 09:51:22 2025 +0200 perf/uapi: Clean up a bit When applying a recent commit to the header I noticed that we have accumulated quite a bit of historic noise in this header, so do a bit of spring cleaning: - Define bitfields in a vertically aligned fashion, like perf_event_mmap_page::capabilities already does. This makes it easier to see the distribution and sizing of bits within a word, at a glance. The following is much more readable: __u64 cap_bit0 : 1, cap_bit0_is_deprecated : 1, cap_user_rdpmc : 1, cap_user_time : 1, cap_user_time_zero : 1, cap_user_time_short : 1, cap_____res : 58; Than: __u64 cap_bit0:1, cap_bit0_is_deprecated:1, cap_user_rdpmc:1, cap_user_time:1, cap_user_time_zero:1, cap_user_time_short:1, cap_____res:58; So convert all bitfield definitions from the latter style to the former style. - Fix typos and grammar - Fix capitalization - Remove whitespace noise - Harmonize the definitions of various generations and groups of PERF_MEM_ ABI values. - Vertically align all definitions and assignments to the same column (48), as the first definition (enum perf_type_id), throughout the entire header. - And in general make the code and comments to be more in sync with each other and to be more readable overall. No change in functionality. Copy the changes over to tools/include/uapi/linux/perf_event.h. Signed-off-by: Ingo Molnar Cc: Peter Zijlstra Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Alexander Shishkin Cc: Mark Rutland Cc: Namhyung Kim Cc: Ian Rogers Link: https://lore.kernel.org/r/20250521221529.2547099-1-irogers@google.com commit b338a2ae9b316df1d81b5289badcc8cbbbfe1b2b Author: Matthias Fend Date: Wed May 14 12:10:08 2025 +0200 leds: tps6131x: Add support for Texas Instruments TPS6131X flash LED driver The TPS61310/TPS61311 is a flash LED driver with I2C interface. Its power stage is capable of supplying a maximum total current of roughly 1500mA. The TPS6131x provides three constant-current sinks, capable of sinking up to 2 x 400mA (LED1 and LED3) and 800mA (LED2) in flash mode. In torch mode each sink (LED1, LED2, LED3) supports currents up to 175mA. Signed-off-by: Matthias Fend Link: https://lore.kernel.org/r/20250514-leds-tps6131x-v5-2-a4fb9e7f2c47@emfend.at Signed-off-by: Lee Jones commit 0d12bb1a7fb6aee144cc2c710573763221b4c245 Author: Matthias Fend Date: Wed May 14 12:10:07 2025 +0200 dt-bindings: leds: Add Texas Instruments TPS6131x flash LED driver Document Texas Instruments TPS61310/TPS61311 flash LED driver devicetree bindings. Signed-off-by: Matthias Fend Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250514-leds-tps6131x-v5-1-a4fb9e7f2c47@emfend.at Signed-off-by: Lee Jones commit bf809a0aab2f3a3a97264f217f2dbee0913b2ed7 Author: Marc Zyngier Date: Thu May 22 09:15:02 2025 +0100 KVM: arm64: Fix documentation for vgic_its_iter_next() As reported by the build robot, the documentation for vgic_its_iter_next() contains a typo. Fix it. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202505221421.KAuWlmSr-lkp@intel.com/ Signed-off-by: Marc Zyngier commit f4b18ff2c147d3b56384fcc8adb30bf733bf2300 Author: Ian Rogers Date: Wed May 21 15:15:28 2025 -0700 perf/uapi: Fix PERF_RECORD_SAMPLE comments in AAUX data for PERF_SAMPLE_AUX appears last. PERF_SAMPLE_CGROUP is missing from the comment. This makes the comment match that in the perf_event_open man page. Signed-off-by: Ian Rogers Signed-off-by: Ingo Molnar Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: linux-perf-users@vger.kernel.org Link: https://lore.kernel.org/r/20250521221529.2547099-1-irogers@google.com commit 8b8ef309093ff196967a21ee51a9cdb404a13bf6 Author: Peng Fan Date: Thu May 22 15:11:53 2025 +0800 gpio: timberdale: select GPIOLIB_IRQCHIP This driver uses gpiochip_irq_reqres() and gpiochip_irq_relres() which are only built with GPIOLIB_IRQCHIP=y. Add the missing Kconfig select. Fixes: 2993d2dd8ff4 ("gpio: timberdale: Make irq_chip immutable") Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20250522-gpio-fix-v1-4-98ceae7c4c3c@nxp.com Signed-off-by: Bartosz Golaszewski commit 01e4397d0c1c9ae434c574f45359ad0c226a864b Author: Peng Fan Date: Thu May 22 15:11:52 2025 +0800 gpio: lpc18xx: select GPIOLIB_IRQCHIP This driver uses gpiochip_irq_reqres() and gpiochip_irq_relres() which are only built with GPIOLIB_IRQCHIP=y. Add the missing Kconfig select. Fixes: 289e42df1358 ("gpio: lpc18xx: Make irq_chip immutable") Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20250522-gpio-fix-v1-3-98ceae7c4c3c@nxp.com Signed-off-by: Bartosz Golaszewski commit 3dff3563cc11e90f046902f0b2be40e82f5ee251 Author: Peng Fan Date: Thu May 22 15:11:51 2025 +0800 gpio: grgpio: select GPIOLIB_IRQCHIP This driver uses gpiochip_irq_reqres() and gpiochip_irq_relres() which are only built with GPIOLIB_IRQCHIP=y. Add the missing Kconfig select. Fixes: a30be40bf1d4 ("gpio: grgpio: Make irq_chip immutable") Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20250522-gpio-fix-v1-2-98ceae7c4c3c@nxp.com Signed-off-by: Bartosz Golaszewski commit 86fabf1b174069465ea12b4140cb35543fd0c738 Author: Peng Fan Date: Thu May 22 15:11:50 2025 +0800 gpio: bcm-kona: select GPIOLIB_IRQCHIP This driver uses gpiochip_irq_reqres() and gpiochip_irq_relres() which are only built with GPIOLIB_IRQCHIP=y. Add the missing Kconfig select. Fixes: 7b04f98027af ("gpio: bcm-kona: make irq_chip immutable") Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20250522-gpio-fix-v1-1-98ceae7c4c3c@nxp.com Signed-off-by: Bartosz Golaszewski commit bdcea7e396916c1cc4a7611c33554e5ecf93a54f Author: AngeloGioacchino Del Regno Date: Wed May 21 17:15:48 2025 +0200 iommu/mediatek: Fix compatible typo for mediatek,mt6893-iommu-mm Fix the "mediatek.mt6893-iommu-mm" compatible string typo, as the dot was actually meant to be a comma: "mediatek,mt6893-iommu-mm". Fixes: f6a1e89ab6e3 ("iommu/mediatek: Add support for Dimensity 1200 MT6893 MM IOMMU") Signed-off-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250521151548.185910-1-angelogioacchino.delregno@collabora.com Signed-off-by: Joerg Roedel commit e320050eb75e914aa5e12de2a9ab830c9a2ce311 Author: Andreas Gruenbacher Date: Fri May 16 02:58:02 2025 +0200 gfs2: No more gfs2_find_jhead caching We are no longer calling gfs2_find_jhead() on the same log twice, so there is no more reason for keeping the log contents cached across those calls. In addition, log head lookup and log header writing didn't go through the same address space and so the caching wasn't even fully working, anyway. Signed-off-by: Andreas Gruenbacher commit 93bd5edbd6480e3466320ecf97a105f51249c474 Author: Andreas Gruenbacher Date: Fri May 16 04:33:49 2025 +0200 gfs2: Get rid of duplicate log head lookup Currently at mount time, the recovery code looks up the current log head and, if necessary, replays the log and writes a recovery header to indicate that the log is clean. It does that for each log that may need recovery. We also know that our own log will always be checked as part of that process. Then, the mount code looks up the log head of our own log again. The double log head lookup can be costly, but more importantly, it is unnecessary because we can trivially compute the position of the log head after recovery; all we need to do for that is bump the position and lh_sequence by one when writing a recovery header. With that in mind, move the call to gfs2_log_pointers_init() into gfs2_recover_func() and get rid of the double lookup in gfs2_make_fs_rw(). Signed-off-by: Andreas Gruenbacher commit 2ebb94ab93c3e4052f1d76275534d0ff46fc9b91 Author: Andreas Gruenbacher Date: Sat May 17 08:28:14 2025 +0200 gfs2: Simplify clean_journal In function clean_journal(), update @head to point at the log header that indicates successful recovery: this is where logging needs to resume. Signed-off-by: Andreas Gruenbacher commit 8a43d2187691f1f2b9db66f6b08afcc8a1b3095a Author: Andreas Gruenbacher Date: Fri May 16 05:34:20 2025 +0200 gfs2: Simplify gfs2_log_pointers_init Move the initialization of sdp->sd_log_sequence and sdp->sd_log_flush_head inside gfs2_log_pointers_init(). Use gfs2_replay_incr_blk(). Before this change, the log head lookup code in freeze_go_xmote_bh() didn't update sdp->sd_log_flush_head. This is now fixed, but the code in freeze_go_xmote_bh() appears to be pretty useless in the first place: on a frozen filesystem, the log head will not change. Signed-off-by: Andreas Gruenbacher commit 703a4af35647f0f7f77e8942053251d71d221170 Author: Andreas Gruenbacher Date: Fri May 16 05:24:22 2025 +0200 gfs2: Move gfs2_log_pointers_init Move gfs2_log_pointers_init to recovery.c: there is no need for inlining this function. Signed-off-by: Andreas Gruenbacher commit 91793971f3b6db17f234d875e70ebf921901dee4 Author: Andreas Gruenbacher Date: Wed May 14 21:53:00 2025 +0200 gfs2: Minor comments fix Commit 40829760096df ("gfs2: Convert gfs2_find_jhead() to use a folio") replaced grab_cache_page() by filemap_grab_folio(), but the comments were still referring to grab_cache_page(). Signed-off-by: Andreas Gruenbacher commit 5a90f8d499225512a385585ffe3e28f687263d47 Author: Andreas Gruenbacher Date: Fri Mar 28 22:47:02 2025 +0100 gfs2: Don't start unnecessary transactions during log flush Commit 8d391972ae2d ("gfs2: Remove __gfs2_writepage()") changed the log flush code in gfs2_ail1_start_one() to call aops->writepages() instead of aops->writepage(). For jdata inodes, this means that we will now try to reserve log space and start a transaction before we can determine that the pages in question have already been journaled. When this happens in the context of gfs2_logd(), it can now appear that not enough log space is available for freeing up log space, and we will lock up. Fix that by issuing journal writes directly instead of going through aops->writepages() in the log flush code. Fixes: 8d391972ae2d ("gfs2: Remove __gfs2_writepage()") Signed-off-by: Andreas Gruenbacher commit d50a64e3c55e59e45e415c65531b0d76ad4cea36 Author: Andreas Gruenbacher Date: Wed Mar 26 22:21:08 2025 +0100 gfs2: Move gfs2_trans_add_databufs Move gfs2_trans_add_databufs() to trans.c. Pass in a glock instead of a gfs2_inode. Signed-off-by: Andreas Gruenbacher commit 2f022736ee483cffd40f91d9562bc93cea7cba93 Author: Andreas Gruenbacher Date: Thu Mar 20 16:28:38 2025 +0100 gfs2: Rename jdata_dirty_folio to gfs2_jdata_dirty_folio Signed-off-by: Andreas Gruenbacher commit b6ccde39b1c1292ad4442e9410e2c4c2510fe759 Author: Eric Biggers Date: Sun May 11 11:31:33 2025 -0700 gfs2: avoid inefficient use of crc32_le_shift() __get_log_header() was using crc32_le_shift() to update a CRC with four zero bytes. However, this is about 5x slower than just CRC'ing four zero bytes in the normal way. Just do that instead. (We could instead make crc32_le_shift() faster on short lengths. But all its callers do just fine without it, so I'd like to just remove it.) Signed-off-by: Eric Biggers Signed-off-by: Andreas Gruenbacher commit 87faee382d294a35f3dad06dd0c27cdbee12cb97 Author: Andreas Gruenbacher Date: Wed May 7 21:05:40 2025 +0200 gfs2: Do not call iomap_zero_range beyond eof Since commit eb65540aa9fc ("iomap: warn on zero range of a post-eof folio"), iomap_zero_range() warns when asked to zero a folio beyond eof. The warning triggers on the following code path: gfs2_fallocate(FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE) __gfs2_punch_hole() gfs2_block_zero_range() iomap_zero_range() In __gfs2_punch_hole(), gfs2 zeroes out partial folios at the beginning and at the end of the specified range, whether those folios are beyond eof or not. This may add folios to the page cache which are entirely beyond eof, which isn't of any use. Avoid that by truncating the range to zero out at eof. Signed-off-by: Andreas Gruenbacher commit e9a4af22af8fad2dd779e16759d86fb4cf037a73 Author: Christoph Hellwig Date: Mon May 5 11:18:28 2025 +0200 gfs: don't check for AOP_WRITEPAGE_ACTIVATE in gfs2_write_jdata_batch __gfs2_jdata_write_folio can't return AOP_WRITEPAGE_ACTIVATE, so don't check for it in gfs2_write_jdata_batch. Signed-off-by: Christoph Hellwig Signed-off-by: Andreas Gruenbacher commit 4fe238513407d83f38bf5782e8bcdd7b8baeb85d Author: Shenghao Ding Date: Thu May 22 09:43:47 2025 +0800 ALSA: hda/tas2781: Move and unified the calibrated-data getting function for SPI and I2C into the tas2781_hda lib Calibration data getting function for SPI and I2C HDA drivers are almost same, which read the calibration data from UEFI. To put them into tas2781_hda lib for code cleanup is more reasonable than to still keep them in the codec driver. For tas2781 codec driver, there're two different sources for calibrated data, one is from bin file, generated in factory test, requested and read in codec driver side; the other is from user space during device bootup. Signed-off-by: Shenghao Ding Link: https://patch.msgid.link/20250522014347.1163-1-shenghao-ding@ti.com Signed-off-by: Takashi Iwai commit f4c7baa0699b69edb6887a992283b389761e0e81 Author: Haoxiang Li Date: Fri May 16 15:16:54 2025 +0300 drm/i915/display: Add check for alloc_ordered_workqueue() and alloc_workqueue() Add check for the return value of alloc_ordered_workqueue() and alloc_workqueue(). Furthermore, if some allocations fail, cleanup works are added to avoid potential memory leak problem. Fixes: 40053823baad ("drm/i915/display: move modeset probe/remove functions to intel_display_driver.c") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/20d3d096c6a4907636f8a1389b3b4dd753ca356e.1747397638.git.jani.nikula@intel.com Signed-off-by: Jani Nikula (cherry picked from commit dcab7a228f4ea9cda3f5b0a1f0679e046d23d7f7) Signed-off-by: Joonas Lahtinen commit 9cb15478916e849d62a6ec44b10c593b9663328c Author: Imre Deak Date: Mon May 19 16:34:17 2025 +0300 drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read Due to a problem in the iTBT DP-in adapter's firmware the sink on a TBT link may get disconnected inadvertently if the SINK_COUNT_ESI and the DP_LINK_SERVICE_IRQ_VECTOR_ESI0 registers are read in a single AUX transaction. Work around the issue by reading these registers in separate transactions. The issue affects MTL+ platforms and will be fixed in the DP-in adapter firmware, however releasing that firmware fix may take some time and is not guaranteed to be available for all systems. Based on this apply the workaround on affected platforms. See HSD #13013007775. v2: Cc'ing Mika Westerberg. Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/13760 Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14147 Cc: Mika Westerberg Cc: stable@vger.kernel.org Reviewed-by: Mika Westerberg Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250519133417.1469181-1-imre.deak@intel.com (cherry picked from commit c3a48363cf1f76147088b1adb518136ac5df86a0) Signed-off-by: Joonas Lahtinen commit a38b3232d618653155032a51208e974511c151e4 Author: Imre Deak Date: Mon May 12 17:26:00 2025 +0300 drm/i915/ptl: Use everywhere the correct DDI port clock select mask The PTL XELPDP_PORT_CLOCK_CTL register XELPDP_DDI_CLOCK_SELECT field's size is 5 bits vs. the earlier platforms where its size is 4 bits. Make sure the field is read-out/programmed everywhere correctly, according to the above. Cc: Mika Kahola Cc: stable@vger.kernel.org # v6.13+ Tested-by: Mika Kahola Reviewed-by: Mika Kahola Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250512142600.824347-1-imre.deak@intel.com (cherry picked from commit d0bf684bd42db22e7d131a038f8f78927fa6a72a) Signed-off-by: Joonas Lahtinen commit b495021a973e2468497689bd3e29b736747b896f Author: Jiri Slaby (SUSE) Date: Thu May 22 07:38:35 2025 +0200 tty: serial: 8250_omap: fix TX with DMA for am33xx Commit 1788cf6a91d9 ("tty: serial: switch from circ_buf to kfifo") introduced an error in the TX DMA handling for 8250_omap. When the OMAP_DMA_TX_KICK flag is set, the "skip_byte" is pulled from the kfifo and emitted directly in order to start the DMA. While the kfifo is updated, dma->tx_size is not decreased. This leads to uart_xmit_advance() called in omap_8250_dma_tx_complete() advancing the kfifo by one too much. In practice, transmitting N bytes has been seen to result in the last N-1 bytes being sent repeatedly. This change fixes the problem by moving all of the dma setup after the OMAP_DMA_TX_KICK handling and using kfifo_len() instead of the DMA size for the 4-byte cutoff check. This slightly changes the behaviour at buffer wraparound, but it still transmits the correct bytes somehow. Now, the "skip_byte" would no longer be accounted to the stats. As previously, dma->tx_size included also this skip byte, up->icount.tx was updated by aforementioned uart_xmit_advance() in omap_8250_dma_tx_complete(). Fix this by using the uart_fifo_out() helper instead of bare kfifo_get(). Based on patch by Mans Rullgard Signed-off-by: "Jiri Slaby (SUSE)" Fixes: 1788cf6a91d9 ("tty: serial: switch from circ_buf to kfifo") Link: https://lore.kernel.org/all/20250506150748.3162-1-mans@mansr.com/ Reported-by: Mans Rullgard Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250522053835.3495975-1-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit c36ec00d7f67590cb03e233959cd92fe969753a3 Author: Sheng Yong Date: Sat May 17 17:05:43 2025 +0800 erofs: add 'fsoffset' mount option to specify filesystem offset When attempting to use an archive file, such as APEX on android, as a file-backed mount source, it fails because EROFS image within the archive file does not start at offset 0. As a result, a loop or a dm device is still needed to attach the image file at an appropriate offset first. Similarly, if an EROFS image within a block device does not start at offset 0, it cannot be mounted directly either. To address this issue, this patch adds a new mount option `fsoffset=x' to accept a start offset for the primary device. The offset should be aligned to the block size. EROFS will add this offset before performing read requests. Signed-off-by: Sheng Yong Signed-off-by: Wang Shuai Reviewed-by: Gao Xiang Link: https://lore.kernel.org/r/20250517090544.2687651-1-shengyong1@xiaomi.com [ Gao Xiang: minor update on documentation and the error message. ] Reviewed-by: Hongbo Li Signed-off-by: Gao Xiang commit 3da895b23901964fcf23450f10b529d45069f333 Merge: 945301db34f14e 01e035fd0380b2 Author: Jakub Kicinski Date: Wed May 21 20:44:24 2025 -0700 Merge branch 'net-mlx5-hws-set-of-fixes-and-adjustments' Tariq Toukan says: ==================== net/mlx5: HWS, set of fixes and adjustments This patch series by Yevgeny and Vlad introduces a set of steering fixes and adjustments. ==================== Link: https://patch.msgid.link/1747766802-958178-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 01e035fd0380b285d72725adb5a45f1d73549db8 Author: Yevgeny Kliteynik Date: Tue May 20 21:46:42 2025 +0300 net/mlx5: HWS, handle modify header actions dependency Having adjacent accelerated modify header actions (so-called pattern-argument actions) may result in inconsistent outcome. These inconsistencies can take the form of writes to the same field or a read coupled with a write to the same field. The solution is to detect such dependencies and insert nops between the offending actions. The existing implementation had a few issues, which pretty much required a complete rewrite of the code that handles these dependencies. In the new implementation we're doing the following: * Checking any two adjacent actions for conflicts (not just odd-even pairs). * Marking 'set' and 'add' action fields as destination, rather than source, for the purposes of checking for conflicts. * Checking all types of actions ('add', 'set', 'copy') for dependencies. * Managing offsets of the args in the buffer - copy the action args to the right place in the buffer. * Checking that after inserting nops we're still within the number of supported actions - return an error otherwise. Signed-off-by: Vlad Dogaru Signed-off-by: Yevgeny Kliteynik Reviewed-by: Mark Bloch Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1747766802-958178-5-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 0b6e452caf03da63aeb2e84475771d6fb6d6cd99 Author: Yevgeny Kliteynik Date: Tue May 20 21:46:41 2025 +0300 net/mlx5: HWS, fix typo - 'nope' to 'nop' Fix typo - rename 'nope_locations' to 'nop_locations', which describes the locations of 'nop' actions. To shorten the lines, this renaming also required some refactoring. Signed-off-by: Yevgeny Kliteynik Reviewed-by: Mark Bloch Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1747766802-958178-4-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit b206d9ec19dfc2db706883ff6b46b259831a033d Author: Vlad Dogaru Date: Tue May 20 21:46:40 2025 +0300 net/mlx5: HWS, register reformat actions with fw Hardware steering handles actions differently from firmware, but for termination rules that use encapsulation the firmware needs to be aware of the action. Fix this by registering reformat actions with the firmware the first time this is needed. To do this, add a third possible owner for an action, and also a lock to protect against registration of the same action from different threads. Signed-off-by: Vlad Dogaru Signed-off-by: Yevgeny Kliteynik Reviewed-by: Mark Bloch Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1747766802-958178-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit ca7690dae1269f454572c163ed5271feed060af5 Author: Vlad Dogaru Date: Tue May 20 21:46:39 2025 +0300 net/mlx5: SWS, fix reformat id error handling The firmware reformat id is a u32 and can't safely be returned as an int. Because the functions also need a way to signal error, prefer to return the id as an output parameter and keep the return code only for success/error. While we're at it, also extract some duplicate code to fetch the reformat id from a more generic struct pkt_reformat. Signed-off-by: Vlad Dogaru Signed-off-by: Yevgeny Kliteynik Reviewed-by: Mark Bloch Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1747766802-958178-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 945301db34f14eaa0be794458b67aead74ff79fa Author: Eric Dumazet Date: Tue May 20 12:19:08 2025 +0000 net: add debug checks in ____napi_schedule() and napi_poll() While tracking an IDPF bug, I found that idpf_vport_splitq_napi_poll() was not following NAPI rules. It can indeed return @budget after napi_complete() has been called. Add two debug conditions in networking core to hopefully catch this kind of bugs sooner. IDPF bug will be fixed in a separate patch. [ 72.441242] repoll requested for device eth1 idpf_vport_splitq_napi_poll [idpf] but napi is not scheduled. [ 72.446291] list_del corruption. next->prev should be ff31783d93b14040, but was ff31783d93b10080. (next=ff31783d93b10080) [ 72.446659] kernel BUG at lib/list_debug.c:67! [ 72.446816] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI [ 72.447031] CPU: 156 UID: 0 PID: 16258 Comm: ip Tainted: G W 6.15.0-dbg-DEV #1944 NONE [ 72.447340] Tainted: [W]=WARN [ 72.447702] RIP: 0010:__list_del_entry_valid_or_report (lib/list_debug.c:65) [ 72.450630] Call Trace: [ 72.450720] [ 72.450797] net_rx_action (include/linux/list.h:215 include/linux/list.h:287 net/core/dev.c:7385 net/core/dev.c:7516) [ 72.450928] ? lock_release (kernel/locking/lockdep.c:?) [ 72.451059] ? clockevents_program_event (kernel/time/clockevents.c:?) [ 72.451222] handle_softirqs (kernel/softirq.c:579) [ 72.451356] ? do_softirq (kernel/softirq.c:480) [ 72.451480] ? idpf_vc_xn_exec (drivers/net/ethernet/intel/idpf/idpf_virtchnl.c:462) idpf [ 72.451635] do_softirq (kernel/softirq.c:480) [ 72.451750] [ 72.451828] [ 72.451905] __local_bh_enable_ip (kernel/softirq.c:?) [ 72.452051] idpf_vc_xn_exec (drivers/net/ethernet/intel/idpf/idpf_virtchnl.c:462) idpf [ 72.452210] idpf_send_delete_queues_msg (drivers/net/ethernet/intel/idpf/idpf_virtchnl.c:2083) idpf [ 72.452390] idpf_vport_stop (drivers/net/ethernet/intel/idpf/idpf_lib.c:837 drivers/net/ethernet/intel/idpf/idpf_lib.c:868) idpf [ 72.452541] ? idpf_vport_stop (include/linux/bottom_half.h:? include/linux/netdevice.h:4762 drivers/net/ethernet/intel/idpf/idpf_lib.c:855) idpf [ 72.452695] idpf_initiate_soft_reset (drivers/net/ethernet/intel/idpf/idpf_lib.c:?) idpf [ 72.452867] idpf_change_mtu (drivers/net/ethernet/intel/idpf/idpf_lib.c:2189) idpf [ 72.453015] netif_set_mtu_ext (net/core/dev.c:9437) [ 72.453157] ? packet_notifier (include/linux/rcupdate.h:331 include/linux/rcupdate.h:841 net/packet/af_packet.c:4240) [ 72.453292] netif_set_mtu (net/core/dev.c:9515) [ 72.453416] dev_set_mtu (net/core/dev_api.c:?) [ 72.453534] bond_change_mtu (drivers/net/bonding/bond_main.c:4833) [ 72.453666] netif_set_mtu_ext (net/core/dev.c:9437) [ 72.453803] do_setlink (net/core/rtnetlink.c:3116) [ 72.453925] ? rtnl_newlink (net/core/rtnetlink.c:3901) [ 72.454055] ? rtnl_newlink (net/core/rtnetlink.c:3901) [ 72.454185] ? rtnl_newlink (net/core/rtnetlink.c:3901) [ 72.454314] ? trace_contention_end (include/trace/events/lock.h:122) [ 72.454467] ? __mutex_lock (arch/x86/include/asm/preempt.h:85 kernel/locking/mutex.c:611 kernel/locking/mutex.c:746) [ 72.454597] ? cap_capable (include/trace/events/capability.h:26) [ 72.454721] ? security_capable (security/security.c:?) [ 72.454857] rtnl_newlink (net/core/rtnetlink.c:?) [ 72.454982] ? lock_is_held_type (kernel/locking/lockdep.c:5599 kernel/locking/lockdep.c:5938) [ 72.455121] ? __lock_acquire (kernel/locking/lockdep.c:?) [ 72.455256] ? __change_page_attr_set_clr (arch/x86/mm/pat/set_memory.c:685) [ 72.455438] ? __lock_acquire (kernel/locking/lockdep.c:?) [ 72.455582] ? rtnetlink_rcv_msg (include/linux/rcupdate.h:331 include/linux/rcupdate.h:841 net/core/rtnetlink.c:6885) [ 72.455721] ? lock_acquire (kernel/locking/lockdep.c:5866) [ 72.455848] ? rtnetlink_rcv_msg (include/linux/rcupdate.h:331 include/linux/rcupdate.h:841 net/core/rtnetlink.c:6885) [ 72.455987] ? lock_release (kernel/locking/lockdep.c:?) [ 72.456117] ? rcu_read_unlock (include/linux/rcupdate.h:341 include/linux/rcupdate.h:871) [ 72.456249] ? __pfx_rtnl_newlink (net/core/rtnetlink.c:3956) [ 72.456388] rtnetlink_rcv_msg (net/core/rtnetlink.c:6955) [ 72.456526] ? rtnetlink_rcv_msg (include/linux/rcupdate.h:331 include/linux/rcupdate.h:841 net/core/rtnetlink.c:6885) [ 72.456671] ? lock_acquire (kernel/locking/lockdep.c:5866) [ 72.456802] ? net_generic (include/linux/rcupdate.h:331 include/linux/rcupdate.h:841 include/net/netns/generic.h:45) [ 72.456929] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6858) [ 72.457082] netlink_rcv_skb (net/netlink/af_netlink.c:2534) [ 72.457212] netlink_unicast (net/netlink/af_netlink.c:1313) [ 72.457344] netlink_sendmsg (net/netlink/af_netlink.c:1883) [ 72.457476] __sock_sendmsg (net/socket.c:712) [ 72.457602] ____sys_sendmsg (net/socket.c:?) [ 72.457735] ? _copy_from_user (arch/x86/include/asm/uaccess_64.h:126 arch/x86/include/asm/uaccess_64.h:134 arch/x86/include/asm/uaccess_64.h:141 include/linux/uaccess.h:178 lib/usercopy.c:18) [ 72.457875] ___sys_sendmsg (net/socket.c:2620) [ 72.458042] ? __call_rcu_common (arch/x86/include/asm/irqflags.h:42 arch/x86/include/asm/irqflags.h:119 arch/x86/include/asm/irqflags.h:159 kernel/rcu/tree.c:3107) [ 72.458185] ? mntput_no_expire (include/linux/rcupdate.h:331 include/linux/rcupdate.h:841 fs/namespace.c:1457) [ 72.458324] ? lock_acquire (kernel/locking/lockdep.c:5866) [ 72.458451] ? mntput_no_expire (include/linux/rcupdate.h:331 include/linux/rcupdate.h:841 fs/namespace.c:1457) [ 72.458588] ? lock_release (kernel/locking/lockdep.c:?) [ 72.458718] ? mntput_no_expire (include/linux/rcupdate.h:331 include/linux/rcupdate.h:841 fs/namespace.c:1457) [ 72.458856] __x64_sys_sendmsg (net/socket.c:2652) [ 72.458997] ? do_syscall_64 (arch/x86/include/asm/irqflags.h:42 arch/x86/include/asm/irqflags.h:119 include/linux/entry-common.h:198 arch/x86/entry/syscall_64.c:90) [ 72.459136] do_syscall_64 (arch/x86/entry/syscall_64.c:?) [ 72.459259] ? exc_page_fault (arch/x86/mm/fault.c:1542) [ 72.459387] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 72.459555] RIP: 0033:0x7fd15f17cbd0 Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250520121908.1805732-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 8fa18a3e8c0dee9ce060e83257419c8ce39ae3fb Author: Nelson Escobar Date: Wed May 21 01:19:29 2025 +0000 net/enic: Allow at least 8 RQs to always be used Enic started using netif_get_num_default_rss_queues() to set the number of RQs used in commit cc94d6c4d40c ("enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way") This resulted in machines with less than 16 cpus using less than 8 RQs. Allow enic to use at least 8 RQs no matter how many cpus are in the machine to not impact existing enic workloads after a kernel upgrade. Reviewed-by: John Daley Reviewed-by: Satish Kharat Signed-off-by: Nelson Escobar Reviewed-by: Michal Swiatkowski Link: https://patch.msgid.link/20250521-enic_min_8rq-v1-1-691bd2353273@cisco.com Signed-off-by: Jakub Kicinski commit 17fcb3dc12bbee8ec3e32ca1f60898f252e06b2d Author: Fan Gong Date: Tue May 20 13:26:59 2025 +0300 hinic3: module initialization and tx/rx logic This is [1/3] part of hinic3 Ethernet driver initial submission. With this patch hinic3 is a valid kernel module but non-functional driver. The driver parts contained in this patch: Module initialization. PCI driver registration but with empty id_table. Auxiliary driver registration. Net device_ops registration but open/stop are empty stubs. tx/rx logic. All major data structures of the driver are fully introduced with the code that uses them but without their initialization code that requires management interface with the hw. Co-developed-by: Xin Guo Signed-off-by: Xin Guo Signed-off-by: Fan Gong Co-developed-by: Gur Stavi Signed-off-by: Gur Stavi Link: https://patch.msgid.link/76a137ffdfe115c737c2c224f0c93b60ba53cc16.1747736586.git.gur.stavi@huawei.com Signed-off-by: Jakub Kicinski commit bd15b2b26c982540d973b1d672c8aa37dae25a8b Author: Sumanth Gavini Date: Tue May 20 00:21:19 2025 -0700 nfc: Correct Samsung "Electronics" spelling in copyright headers Fix the misspelling of "Electronics" in copyright headers across: - s3fwrn5 driver - virtual_ncidev driver Signed-off-by: Sumanth Gavini Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250520072119.176018-1-sumanth.gavini@yahoo.com Signed-off-by: Jakub Kicinski commit edb888d29748cee674006a52e544925dacc7728e Author: Alok Tiwari Date: Mon May 19 07:17:19 2025 -0700 emulex/benet: correct command version selection in be_cmd_get_stats() Logic here always sets hdr->version to 2 if it is not a BE3 or Lancer chip, even if it is BE2. Use 'else if' to prevent multiple assignments, setting version 0 for BE2, version 1 for BE3 and Lancer, and version 2 for others. Fixes potential incorrect version setting when BE2_chip and BE3_chip/lancer_chip checks could both be true. Signed-off-by: Alok Tiwari Link: https://patch.msgid.link/20250519141731.691136-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit 731bdd97466a280d6bdd8eceeb13d9fab6f26cbd Author: JP Kobryn Date: Wed May 21 18:32:02 2025 -0700 cgroup: avoid per-cpu allocation of size zero rstat cpu locks Subsystem rstat locks are dynamically allocated per-cpu. It was discovered that a panic can occur during this allocation when the lock size is zero. This is the case on non-smp systems, since arch_spinlock_t is defined as an empty struct. Prevent this allocation when !CONFIG_SMP by adding a pre-processor conditional around the affected block. Signed-off-by: JP Kobryn Reported-by: Klara Modin Fixes: 748922dcfabd ("cgroup: use subsystem-specific rstat locks to avoid contention") Signed-off-by: Tejun Heo commit bfc0c6fecf3bd2da93beb565ccfb9e704cadddcc Author: Kent Overstreet Date: Wed May 21 15:54:56 2025 -0400 bcachefs: Drop empty accounting updates Signed-off-by: Kent Overstreet commit 136d082abc2adcdc10a472e29710826eee7f5f80 Author: Kent Overstreet Date: Wed May 21 03:19:18 2025 -0400 bcachefs: Improve trace_trans_restart_upgrade - Convert to a 'fs_str' tracepoint that just emits as a string: this lets us build up the tracepoint with a printbuf, using our pretty printers, and they're much easier to manage - Include locks_held, before and after - Include the btree node pointer we failed on (error pointer, null, or real node) Signed-off-by: Kent Overstreet commit f638b84224348dd58a348617e6f648e967e1b1ce Author: Kent Overstreet Date: Tue May 20 22:59:58 2025 -0400 bcachefs: fix bch2_inum_snapshot_to_path() Signed-off-by: Kent Overstreet commit 2faa8ab0d03cd4e619024a257f69b7e51ac82c15 Author: Kent Overstreet Date: Tue May 20 20:15:39 2025 -0400 bcachefs: fix duplicate printk Signed-off-by: Kent Overstreet commit 4ba99dde330b2d4b6de65f27ced60e7f0fbc21c2 Author: Kent Overstreet Date: Mon May 19 10:31:44 2025 -0400 bcachefs: BCH_INODE_has_case_insensitive Add a flag for tracking whether a directory has case-insensitive descendents - so that overlayfs can disallow mounting, even though the filesystem supports case insensitivity. This is a new on disk format version, with a (cheap) upgrade to ensure the flag is correctly set on existing inodes. Create, rename and fssetxattr are all plumbed to ensure the new flag is set, and we've got new fsck code that hooks into check_inode(0. Signed-off-by: Kent Overstreet commit 77eac89c7943a4ed5c9bc42def9b3140d951184f Author: Kent Overstreet Date: Mon May 19 10:10:19 2025 -0400 bcachefs: bch2_inode_find_by_inum_snapshot() Move a fsck.c helper into inode.c, eliminate some duplicate and organize the inode lookup helpers. Signed-off-by: Kent Overstreet commit 77aeaa2f0fcac2d68fe1af61169fe26d5fac9a22 Author: Kent Overstreet Date: Mon May 19 09:48:50 2025 -0400 bcachefs: bch2_inum_snapshot_to_path() Add a better helper for printing out paths of inodes when we don't know the subvolume, for fsck. Signed-off-by: Kent Overstreet commit 7c4f22af251ae32762cbacb998f86977535ee0f2 Author: Kent Overstreet Date: Mon May 19 09:17:39 2025 -0400 bcachefs: bch2_rename_trans() only runs rename-to-dir code if needed Signed-off-by: Kent Overstreet commit 011d644b769609ecf6ceef71a1411c4a9e008a5b Author: Kent Overstreet Date: Mon May 19 09:12:49 2025 -0400 bcachefs: subvol_inum_eq() Signed-off-by: Kent Overstreet commit c3a7fd95e02a33cad16f3c455e482951bcbc7224 Author: Kent Overstreet Date: Mon May 19 09:15:31 2025 -0400 bcachefs: Don't set bi_casefold on non directories bi_casefold only makes sense for directories, and since it's one of the variable length fields setting it unnecessarily wastes space. Signed-off-by: Kent Overstreet commit a96c5e504538cf150ec6e3b19702f8c658298323 Author: Alan Huang Date: Mon May 19 19:51:04 2025 +0800 bcachefs: Remove duplicate call to bch2_trans_begin() There is one in for_each_btree_key_max(). Signed-off-by: Alan Huang Signed-off-by: Kent Overstreet commit c631bb41f5a9cf266762290166a00132a04f215d Author: Kent Overstreet Date: Fri May 16 16:45:44 2025 -0400 bcachefs: Call bch2_bkey_set_needs_rebalance() earlier in write path There's no reason to be running this inside our transaction; it forces us to copy the key we're updating to a temporary, which we'd like to skip. Signed-off-by: Kent Overstreet commit f132a78095b6a67f717657a09640539cb847d2d6 Author: Kent Overstreet Date: Fri May 16 17:07:06 2025 -0400 bcachefs: Simplify bch2_extent_atomic_end() It used to be that we had a fixed maximum number of btree paths to work with - 64. That's no longer the case, so bch2_extent_atomic_end() doesn't have to be as strict. Signed-off-by: Kent Overstreet commit 7fd643c032ae0ced53d57fc23981c4d3d269d352 Author: Kent Overstreet Date: Fri May 16 20:43:18 2025 -0400 bcachefs: Coalesce accounting in trans commit Accounting has gotten quite heavy, and there's lots of redundancy in accounting updates within a transaction, as we often add/delete multiple extents that touch the same accountign counters. This will reduce the amount of data that we journal, and reduce pressure downstream on the btree write buffer. Signed-off-by: Kent Overstreet commit e8f9992b0aab188ce37ef011a3ec8613f02d05aa Author: Kent Overstreet Date: Fri May 16 20:26:01 2025 -0400 bcachefs: Split out accounting in transaction commit There can be a lot of rendundancy in accounting updates within a single btree transaction. Split out accounting updates so that they can be deduped, in the next commit. Signed-off-by: Kent Overstreet commit 247abee6ae6d2c6f283857b16fbf4bf201e72061 Author: Kent Overstreet Date: Fri May 16 20:23:58 2025 -0400 bcachefs: btree_trans_subbuf Signed-off-by: Kent Overstreet commit 81c42933a50766f5230384375e28b5cd64a46113 Author: Kent Overstreet Date: Sat May 17 22:32:51 2025 -0400 bcachefs: Make accounting mismatch errors more readable Signed-off-by: Kent Overstreet commit 51e23c9d60a42f8da4d2f4d48c86eb00c4e351ea Author: Kent Overstreet Date: Sat May 17 19:54:39 2025 -0400 bcachefs: async objs now support bch_write_ops Signed-off-by: Kent Overstreet commit 8c3fc7cca38459751489f5015f3282a64e452b7e Author: Kent Overstreet Date: Sat May 17 19:53:50 2025 -0400 bcachefs: fix bch2_debugfs_flush_buf() when tabstops are in use Signed-off-by: Kent Overstreet commit 6b86da9282b0f6a3fb7aae709dca9feb4c8316b5 Author: Kent Overstreet Date: Sat May 17 15:58:23 2025 -0400 bcachefs: fsck: Include loops in error messages This fixes the subvol loop checking and directory loop checking to print the loop. Signed-off-by: Kent Overstreet commit 39cea302f13a0a9dc4cf39248529a42e79d06842 Author: Kent Overstreet Date: Fri May 9 17:01:05 2025 -0400 bcachefs: bch2_check_bucket_backpointer_mismatch() Detect buckets with missing backpointers, and run repair on demand. __bch2_move_data_phys() now calls bch2_check_bucket_backpointer_mismatch() as it walks buckets, which checks for missing backpointers by comparing backpointers against bucket sector counts. When missing backpointers are detected, we kick off bch2_check_extents_to_backpointers() asynchronously - right away if we're trying to evacuate, or with a threshold if we're just running copygc. Signed-off-by: Kent Overstreet commit 15f969326ee296f7b7faf7704105a99fa02c288d Author: Kent Overstreet Date: Sat May 17 15:05:26 2025 -0400 bcachefs: Improve bucket_bitmap code Add some more helpers, and mismatches is now a superset of the empty bitmap - simplifies most checks. Signed-off-by: Kent Overstreet commit 06977ea82b5df669c833399b4b8e2f163a8bcfbc Author: Kent Overstreet Date: Fri May 9 23:28:01 2025 -0400 bcachefs: Run recovery passes asynchronously When we request a recovery pass to be run online, i.e. not during recovery, if it's an online pass it'll now be run in the background, instead of waiting for the next mount. To avoid situations where recovery passes are running continuously, this also includes ratelimiting: if the RUN_RECOVERY_PASS_ratelimit flag is passed, the pass may be deferred until later - depending on the runtime and last run stats in the recovery_passes superblock section. Signed-off-by: Kent Overstreet commit d4b30ed90c778bd5612fc82c2a5536de66d95184 Author: Kent Overstreet Date: Wed May 14 15:54:20 2025 -0400 bcachefs: bch2_run_explicit_recovery_pass() cleanup Consolidate the run_explicit_recovery_pass() interfaces by adding a flags parameter; this will also let us add a RUN_RECOVERY_PASS_ratelimit flag. Signed-off-by: Kent Overstreet commit 06266465cc8a23ae037eb48ede9bdcd5eed8621c Author: Kent Overstreet Date: Sat May 10 18:23:41 2025 -0400 bcachefs: bch2_recovery_pass_status_to_text() Show recovery pass status in sysfs - important now that we're running them automatically in the background. Signed-off-by: Kent Overstreet commit 7ed4c14e20be2b113e111ec9fa1803c778e00280 Author: Kent Overstreet Date: Tue May 13 17:36:55 2025 -0400 bcachefs: Reduce usage of recovery.curr_pass We want recovery.curr_pass to be private to the recovery passes code, for better showing recovery pass status; also, it may rewind and is generally not the correct member to use. Signed-off-by: Kent Overstreet commit ab355520305ce4ab7331757c35b1042b32cae52e Author: Kent Overstreet Date: Sat May 10 17:45:45 2025 -0400 bcachefs: __bch2_run_recovery_passes() Consolidate bch2_run_recovery_passes() and bch2_run_online_recovery_passes(), prep work for automatically scheduling and running recovery passes in the background. - Now takes a mask of which passes to run, automatic background repair will pass in sb.recovery_passes_required. - Skips passes that are failing: a pass that failed may be reattempted after another pass succeeds (some passes depend on repair done by other passes for successful completion). - bch2_recovery_passes_match() helper to skip alloc passes on a filesystem without alloc info. Signed-off-by: Kent Overstreet commit 68708efcac711946ffeb1803eb54ebaf44675010 Author: Kent Overstreet Date: Sat May 10 18:21:49 2025 -0400 bcachefs: struct bch_fs_recovery bch_fs has gotten obnoxiously big, let's start organizing thins a bit better. Signed-off-by: Kent Overstreet commit 878713b5f56aa4b3dce5bdb7f34952a10183b106 Author: Kent Overstreet Date: Fri May 16 23:12:09 2025 -0400 bcachefs: kill copy in bch2_disk_accounting_mod() Signed-off-by: Kent Overstreet commit 295dbf50e5f60cbc41416aff1feadd876d17e492 Author: Kent Overstreet Date: Fri May 16 17:29:53 2025 -0400 bcachefs: Optimize bch2_trans_start_alloc_update() Avoid doing more updates if we already have one. Signed-off-by: Kent Overstreet commit 9469556a5fc1457d0a55f391010dfb82f7c5e20a Author: Kent Overstreet Date: Thu May 15 07:45:52 2025 -0400 bcachefs: btree key cache asserts Signed-off-by: Kent Overstreet commit a78a11900ecbb358710f65f78eee45e3b5691180 Author: Kent Overstreet Date: Fri May 16 17:18:27 2025 -0400 bcachefs: journal path now uses discard_opt_enabled() Signed-off-by: Kent Overstreet commit 8a6fa52e07bc8d2e5535e1e2c64b621d34fef9c7 Author: Kent Overstreet Date: Fri May 16 17:21:00 2025 -0400 bcachefs: relock_fail tracepoint now includes btree Signed-off-by: Kent Overstreet commit 84b9f17195b2d4914763feee00ca44be42c9f8e2 Author: Kent Overstreet Date: Thu May 15 10:08:06 2025 -0400 bcachefs: do_rebalance_scan() now only updates bch_extent_rebalance This ensures that our pending rebalance work accounting is accurate quickly. Signed-off-by: Kent Overstreet commit bde41d9a58f159da8330b499cced04c40104f7f3 Author: Kent Overstreet Date: Thu May 15 09:15:24 2025 -0400 bcachefs: better error message for subvol_fs_path_parent_wrong Signed-off-by: Kent Overstreet commit fdd0807f812204c36bfe71710c8a796731ee3777 Author: Kent Overstreet Date: Thu May 15 08:41:26 2025 -0400 bcachefs: Improve bch2_repair_inode_hash_info() Improve this so it can be used by fsck.c check_inode(); it provides a much better error message than the check_inode() version. Signed-off-by: Kent Overstreet commit 123d2d09ff599ec11a01687f472c7bdc3b3b6f12 Author: Kent Overstreet Date: Thu May 15 08:31:02 2025 -0400 bcachefs: bch2_inode_find_snapshot_root() Factor out a small common helper. Signed-off-by: Kent Overstreet commit 4a67b94bd816b56768fe06d880f02ae0bf6ceade Author: Alan Huang Date: Tue May 13 02:44:26 2025 +0800 bcachefs: Early return to avoid unnecessary lock Signed-off-by: Alan Huang Signed-off-by: Kent Overstreet commit 688321f97e0820024c259a066cd197e9e69cb8c8 Author: Alan Huang Date: Thu May 15 22:29:50 2025 +0800 bcachefs: Kill BTREE_TRIGGER_bucket_invalidate Signed-off-by: Alan Huang Signed-off-by: Kent Overstreet commit e882906929c55a9561641944d24c11dc3f338225 Author: Kent Overstreet Date: Wed May 14 17:58:00 2025 -0400 bcachefs: Fix opt hooks in sysfs for non sb option We weren't checking if the option changed for non-superblock options - this led to rebalance not waking up when enabling the "rebalance_enabled" option. Signed-off-by: Kent Overstreet commit 648c1142c9f1ad914c9fd79cedbd6b92ac788cd6 Author: Kent Overstreet Date: Wed May 14 10:44:21 2025 -0400 bcachefs: fix can_write_extent() Failing to check the return value of bch2_dev_rcu(): we could (technically) race with device removal. Signed-off-by: Kent Overstreet commit c7378d0e5e23db8c7da8173d7961620078071796 Author: Kent Overstreet Date: Tue May 13 13:49:51 2025 -0400 bcachefs: Add tracepoint, counter for io_move_created_rebalance Internal moves shouldn't add new rebalance_work, but it's been reported that this seems to be happening. Add a tracepoint and counter so we can see what's going on. Signed-off-by: Kent Overstreet commit e4e513f2d51d3852a7af90d50c890815a8af70b5 Author: Kent Overstreet Date: Thu May 8 17:19:10 2025 -0400 bcachefs: move_buckets in rhashtable when allocated Signed-off-by: Kent Overstreet commit fb7e78cc251bb931dea2b41bffbea344bdac5ddb Author: Kent Overstreet Date: Thu May 8 17:17:17 2025 -0400 bcachefs: Move pending buckets queue to buckets_in_flight Signed-off-by: Kent Overstreet commit 49188a9313e2209d064082378eafe5baf5a27bba Author: Kent Overstreet Date: Thu May 8 17:01:49 2025 -0400 bcachefs: kill move_bucket_in_flight Small cleanup/simplification, and prep work for the next patch, which will add checking if buckets don't get evacuated because they're missing backpointers. Signed-off-by: Kent Overstreet commit b42fac043f95512911f3e496585a0844747dc593 Author: Kent Overstreet Date: Tue May 13 10:53:23 2025 -0400 bcachefs: bch2_fs_emergency_read_only2() More error message cleanup: instead of multiple printk()s per error, we want to be building up a single error message in a printbuf, so that it can be printed with indenting that shows grouping and avoid errors getting interspersed or lost in the log. This gets rid of most calls to bch2_fs_emergency_read_only(). We still have calls to - bch2_fatal_error() - bch2_fs_fatal_error() - bch2_fs_fatal_err_on() that need work. Signed-off-by: Kent Overstreet commit ac4c7ac90eb7f5ea013b8842b2d803742f4484c0 Author: Kent Overstreet Date: Mon May 12 15:14:19 2025 -0400 bcachefs: Extra write buffer asserts Signed-off-by: Kent Overstreet commit 7ad7497862a2484333fa6a054aeab11a9b2f979b Author: Kent Overstreet Date: Mon May 12 14:54:07 2025 -0400 bcachefs: add missing locking in bch2_write_point_to_text() Signed-off-by: Kent Overstreet commit 177ac4925f4cbcfb672cb46f1d443a3d6c8a4b11 Author: Kent Overstreet Date: Sat May 10 17:19:05 2025 -0400 bcachefs: Don't rewind recovery if not in recovery Signed-off-by: Kent Overstreet commit 367cad09664aaf2d37e1b694eab6a14d0b5dedef Author: Kent Overstreet Date: Sat May 10 17:16:11 2025 -0400 bcachefs: Rename fsck_running, recovery_running flags Slightly more readable. Signed-off-by: Kent Overstreet commit 5b1247ca5f286c50dfe58d461c91bc20fe80a749 Author: Kent Overstreet Date: Sat May 10 15:53:10 2025 -0400 bcachefs: debug_check_bkey_unpack Signed-off-by: Kent Overstreet commit 34aeb820f900529bd40680399d379fa04a952850 Author: Kent Overstreet Date: Sat May 10 15:49:38 2025 -0400 bcachefs: debug_check_bset_lookups Signed-off-by: Kent Overstreet commit c4e38894407d27742c1fc8d0d64d8145c83077d5 Author: Kent Overstreet Date: Sat May 10 15:25:56 2025 -0400 bcachefs: debug_check_iterators no longer requires BCACHEFS_DEBUG Signed-off-by: Kent Overstreet commit 110bb6cb8b48bd6736d8e7c08a4236d443f8064a Author: Kent Overstreet Date: Sat May 10 15:12:13 2025 -0400 bcachefs: debug_check_btree_locking modparam Don't put btree locking asserts behind CONFIG_BCACHEFS_DEBUG, put them behind a module parameter. Signed-off-by: Kent Overstreet commit 284251557562f6e8f0ce439cb52a6b9645b4e9a4 Author: Kent Overstreet Date: Sat May 10 14:14:06 2025 -0400 bcachefs: Debug params are now static_keys We'd like users to be able to debug without building custom kernels, so this will help us get rid of CONFIG_BCACHEFS_DEBUG, at least for most things. Signed-off-by: Kent Overstreet commit b51b4055c3cd516cba9e0aee3d8ecfba1d75c047 Author: Kent Overstreet Date: Sat May 10 13:24:25 2025 -0400 bcachefs: Slim down inlined part of bch2_btree_path_upgrade() Signed-off-by: Kent Overstreet commit 001c1d146f38620d6d969b66421460a5d8fd966d Author: Kent Overstreet Date: Fri May 9 23:22:23 2025 -0400 bcachefs: online_fsck_mutex -> run_recovery_passes_lock Prep work for automatically running recovery passes asynchronously. Signed-off-by: Kent Overstreet commit e21f99772112cea57d8389a03d184e69141194b1 Author: Kent Overstreet Date: Fri May 9 18:24:20 2025 -0400 bcachefs: bch_sb_field_recovery_passes New superblock section for statistics on recovery passes - last time ran (successfully), last runtime. This will be used by self healing code to determine when to kick off potentially expensive recovery passes. Signed-off-by: Kent Overstreet commit 20a4b7f3b802f37e44a3c10f97d6ae1aae4daa4e Author: Kent Overstreet Date: Fri May 9 18:12:59 2025 -0400 bcachefs: recovery_passes_types.h -> recovery_passes_format.h Signed-off-by: Kent Overstreet commit 3b7b0c3996b570f9c305c6f3df475a719920d65c Author: Kent Overstreet Date: Fri May 9 23:15:40 2025 -0400 bcachefs: print label correctly in sb_member_to_text() Signed-off-by: Kent Overstreet commit 13ffcbae86dadbf7711f42e4940bafae88a87e1f Author: Kent Overstreet Date: Fri May 9 16:25:21 2025 -0400 bcachefs: "buckets with backpointer mismatches" now allocated on demand More self healing work: we're going to be calling check_bucket_backpointer_mismatch() at runtime, outside of fsck. Then when we need to we'll kick off the full check_extents_to_backpointers recovery pass. Signed-off-by: Kent Overstreet commit 7f9dada701aa357cecf432cf2f345fd3897f92ed Author: Kent Overstreet Date: Fri May 9 15:27:36 2025 -0400 bcachefs: delete dead items in bch_dev Signed-off-by: Kent Overstreet commit 3ffda8c219d636012cfc2b5dae0bf19d831a53e0 Author: Kent Overstreet Date: Fri May 9 15:16:14 2025 -0400 bcachefs: kill dead code in move_data_phys() Signed-off-by: Kent Overstreet commit 82067c916994dd1bfec65496144dc16e17899e36 Author: Kent Overstreet Date: Thu May 8 23:21:28 2025 -0400 bcachefs: buckets_in_flight on stack copygc runs with a full stack available, there's no reason to dynamically allocate this. Signed-off-by: Kent Overstreet commit 1dfa01ef24151547a2a622e90ad73b082b1bc739 Author: Kent Overstreet Date: Thu May 8 14:24:12 2025 -0400 bcachefs: bch2_copygc_dev_wait_amount() Factor out the per-device calculations, for better introspection. Signed-off-by: Kent Overstreet commit 970dde8271b607876bfdbb66b941ffda35e74973 Author: Kent Overstreet Date: Wed May 7 16:34:35 2025 -0400 bcachefs: Add missing include fix debug build in userspace Signed-off-by: Kent Overstreet commit 8c69e2b52ea81b102ace48debd114467199ca77a Author: Kent Overstreet Date: Wed May 7 14:26:18 2025 -0400 bcachefs: Knob for manual snapshot deletion Add 'opts.snapshot_deletion_enabled', enabled by default. This may be turned off so that the new sysfs knob, 'internal/trigger_delete_dead_snapshots', may be used instead - this will allow snapshot deletion to be profiled more easily. Signed-off-by: Kent Overstreet commit a8539ad8fa88e39c3f566b7c35029f25ab90b72e Author: Kent Overstreet Date: Sat May 3 21:26:04 2025 -0400 bcachefs: bcachefs_metadata_version_fast_device_removal Fast device removal, that uses backpointers to find pointers to the device being removed instead of a full metadata scan. This requires BCH_SB_MEMBER_DELETED_UUID, which is an incompatible change - hence the version number bump. We don't fully trust backpointers, so we don't want to reuse device indexes until after a fsck has verified that there aren't any pointers to removed devices. Signed-off-by: Kent Overstreet commit 09fa6c3039d8bb22351ad071ea4656dd4f331d18 Author: Kent Overstreet Date: Sat May 3 21:36:23 2025 -0400 bcachefs: bch2_dev_data_drop_by_backpointers() Currently, device removal has to scan all metadata for pointers to the device being removed. Add a new method, with the same interface as bch2_dev_data_drop(), that scans by backpointers instead - this will drastically speed up device removal. Signed-off-by: Kent Overstreet commit b3f80d09236e4915d7deedfaf15d7bdaef6f14d2 Author: Kent Overstreet Date: Sat May 3 21:55:26 2025 -0400 bcachefs: BCH_SB_MEMBER_DELETED_UUID Add a sentinal value for devices that have been removed, but don't want to reuse their index until a fsck has completed. Signed-off-by: Kent Overstreet commit 66e9a7f13916fb0630cc48e0c21c474607aa3967 Author: Kent Overstreet Date: Tue May 6 00:51:39 2025 -0400 bcachefs: bch2_dev_remove_stripes() respects degraded flags Signed-off-by: Kent Overstreet commit 96fc7d8adb7881f7ffffcd6ab2be3b43fc5a5978 Author: Kent Overstreet Date: Mon May 5 20:35:36 2025 -0400 bcachefs: opts.rebalance_on_ac_only Add an option for setting rebalance to only run when connected to mains power. Signed-off-by: Kent Overstreet commit 502222041c810b5d5ba5d45512e0a131c7f07d0a Author: Kent Overstreet Date: Mon May 5 21:19:17 2025 -0400 bcachefs: __bch2_fs_free() cleanup Signed-off-by: Kent Overstreet commit 39430cfd27ed2e1243374ea28479773506e119c3 Author: Kent Overstreet Date: Sun May 4 15:02:53 2025 -0400 bcachefs: Improve bch2_extent_ptr_set_cached() Preferentially keep existing cached pointers instead of adding new ones. Signed-off-by: Kent Overstreet commit fbe728f9569b683564421a9190be53e60111a864 Author: Kent Overstreet Date: Mon May 5 21:15:34 2025 -0400 bcachefs: improve check_inode_hash_info_matches_root() error message Signed-off-by: Kent Overstreet commit 84bd6afee121b9e9bcc26f88cb55e0ee5c7a8f56 Author: Kent Overstreet Date: Sun May 4 16:24:43 2025 -0400 bcachefs: inline bch2_ob_ptr() This was an oversight, we want bch2_alloc_sectors_append_ptrs_inlined() fully inlined. Signed-off-by: Kent Overstreet commit e02888faab24494f91016d578e3dc9dce81e3d71 Author: Kent Overstreet Date: Sun May 4 14:45:54 2025 -0400 bcachefs: bch2_dev_in_target() no longer takes rcu_read_lock() Minor optimization, the caller generally has it already. Signed-off-by: Kent Overstreet commit 7d4f2687ef8a625742c5df4e2d42f50ba398f3a2 Author: Kent Overstreet Date: Sat May 3 19:14:54 2025 -0400 bcachefs: bch2_journal_write() refactoring Make the locking easier to follow; also take io_refs earlier, in __journal_write_alloc(). Signed-off-by: Kent Overstreet commit 88f62ed60ceebf387140c8e59df8db827668d09a Author: Kent Overstreet Date: Fri May 2 13:23:22 2025 -0400 bcachefs: delete_dead_snapshot_keys_v2() Since extents, dirents and xattrs require an inode with the corresponding snapshot ID to exists, we can avoid a lot of scanning by only scanning those trees for keys to process if the correspending inode exists. Signed-off-by: Kent Overstreet commit e9756dd29f33ede1a595d9fb5e0e2586f7542c1f Author: Kent Overstreet Date: Fri May 2 12:37:36 2025 -0400 bcachefs: bcachefs_metadata_version_snapshot_deletion_v2 We're going to be speeding up snapshot deletion, by only having it process the extents/dirents/xattrs btrees if an inode of a given snapshot ID was present. This raises the possibility of 'bkey_in_missing_snapshot' errors popping up, if we ever accidentally don't do the corresponding inode update, or if the new algorithm has bugs. So instead of deleting snapshot IDs, add a new deleted flag, so that 'key in missing snapshot' errors can more definitively tell what happened and automatically repair. Signed-off-by: Kent Overstreet commit 08d14d90a42a96f409ef3bb1fd073ca0a6bace27 Author: Kent Overstreet Date: Fri May 2 12:33:17 2025 -0400 bcachefs: BCH_SNAPSHOT_DELETED -> BCH_SNAPSHOT_WILL_DELETE We're going to be speeding up snapshot deletion, by only having it process the extents/dirents/xattrs btrees if an inode of a given snapshot ID was present. This raises the possibility of 'bkey_in_missing_snapshot' errors popping up, if we ever accidentally don't do the corresponding inode update, or if the new algorithm has bugs. So we'll want to be able to differentiate more definitively between 'snapshot went missing' (and perhaps needs to be reconstructed), and 'key in snapshot that was deleted'. So instead of deleting snapshot IDs, we'll be adding a new deleted flag and leaving them permanently. Signed-off-by: Kent Overstreet commit 3f8e97726557f2130c2992bf214c9e936b4a0877 Author: Kent Overstreet Date: Fri May 2 14:43:45 2025 -0400 bcachefs: Skip unrelated snapshot trees in snapshot deletion Don't scan keys in inodes for which the snapshot tree doesn't match any we're deleting from. Signed-off-by: Kent Overstreet commit 0afdf4969e0ac24f63b499c6c75731564a072eb8 Author: Kent Overstreet Date: Thu May 1 15:14:04 2025 -0400 bcachefs: BCH_FSCK_ERR_snapshot_key_missing_inode_snapshot We're going to be doing some snapshot deletion performance improvements, and those will strictly require that if an extent/dirent/xattr is present, an inode is present in that snapshot ID. We already check for this, but we don't repair it on disk: this patch adds that repair and turns it into a real fsck_err(). Signed-off-by: Kent Overstreet commit 855070dc0b349eb4f17cfbe7e73829b1b2851bdc Author: Kent Overstreet Date: Sat May 3 16:48:00 2025 -0400 bcachefs: get_inodes_all_snapshots() now includes whiteouts The next patch is going to change lookup_inode_for_snapshot to rigorously require that a extent/dirent/xattr keys have a corresponding inode key present - whiteouts included, so this simplifies the checks lookup_inode_for_snapshot() will have to do. Signed-off-by: Kent Overstreet commit a9421140fc5a5647191704c8a5e93bf2aaeb2c0a Author: Kent Overstreet Date: Sat May 3 18:17:26 2025 -0400 bcachefs: bch2_inode_unpack() cleanup bi_snapshot is now handled like other fields Signed-off-by: Kent Overstreet commit 00757984d55e769a108fee6cfabee1b289c9516f Author: Kent Overstreet Date: Sat May 3 18:16:49 2025 -0400 bcachefs: Improve bch2_request_incompat_feature() message Signed-off-by: Kent Overstreet commit 3c97ebea61e3ebdbab5b2564296a86d601b632e6 Author: Alan Huang Date: Sun May 4 04:03:42 2025 +0800 bcachefs: Fix inconsistent req->ec There is req->ec = erasure_code above. Signed-off-by: Alan Huang Signed-off-by: Kent Overstreet commit 6f2bbd57474b3f8448c30cb1b986fbf127bb103e Author: Kent Overstreet Date: Thu May 1 15:18:40 2025 -0400 bcachefs: kill inode_walker_entry.snapshot redundant Signed-off-by: Kent Overstreet commit 7b8c41c178742c680e6acb610a760f9e007cfeac Author: Kent Overstreet Date: Fri May 2 12:23:59 2025 -0400 bcachefs: Add comments for inode snapshot requirements Signed-off-by: Kent Overstreet commit 15dbd0d8146356a43003784ce38aabae32e96197 Author: Kent Overstreet Date: Thu May 1 14:47:39 2025 -0400 bcachefs: snapshot delete progress indicator Signed-off-by: Kent Overstreet commit e3006cb010150cefde5739d2b8c2e8f7b876eb84 Author: Kent Overstreet Date: Wed Apr 16 09:28:10 2025 -0400 bcachefs: Don't emit bch_sb_field_members_v1 if not required In 'bcachefs_metadata_extent_flags', we stopped requireding members_v1 to be present - only that either v1 or v2 is present. Signed-off-by: Kent Overstreet commit 9180c5f91804e9b381d11b6c19cbefa5c5490b2b Author: Alan Huang Date: Fri May 2 04:01:32 2025 +0800 bcachefs: Rename x_name to x_name_and_value The flexible array contains name and value, the x_name is misleading. Signed-off-by: Alan Huang Signed-off-by: Kent Overstreet commit a42f709f9ac1dc7b4ff32ab428acf7abaf3358b9 Author: Kent Overstreet Date: Wed Apr 30 22:26:00 2025 -0400 bcachefs: Improve bch2_disk_groups_to_text() Print out the actual name of each path/label, instead of just the integer indexes. Signed-off-by: Kent Overstreet commit c53e5c0c191ec6cc85c630249cbd68a2adb3f715 Author: Kent Overstreet Date: Wed Apr 30 23:10:44 2025 -0400 docs: bcachefs: add casefolding reference Signed-off-by: Kent Overstreet commit 8a6b883e78bfed6909e21c2afb6138b603d1ee6c Author: Kent Overstreet Date: Wed Apr 30 22:05:49 2025 -0400 bcachefs: Fix setting ca->name in device add Device add doesn't get the devide index and attach to the filesystem until after attaching the block device, and setting the device name from the block device name - these needs some minor tweaks. Signed-off-by: Kent Overstreet commit 5ce11d9d1bd5dfd8876d35bd9e61f38f47807c42 Author: Kent Overstreet Date: Tue Apr 29 14:41:37 2025 -0400 bcachefs: sysfs trigger_recalc_capacity For bug diagnosis Signed-off-by: Kent Overstreet commit ae0386e111253eee0f71ae3f32635a3ba22e5a7b Author: Gustavo A. R. Silva Date: Wed Apr 30 13:22:01 2025 -0600 bcachefs: Avoid -Wflex-array-member-not-at-end warnings -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Refactor a couple of structs that contain flexible arrays in the middle by replacing them with unions. So, with these changes, fix the following warnings: fs/bcachefs/disk_accounting.c:429:51: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] fs/bcachefs/ec_types.h:8:41: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva Signed-off-by: Kent Overstreet commit 98e5e36d8c58ab41c28367d3bfc9ec4e8795e421 Author: Kent Overstreet Date: Mon Apr 28 22:00:01 2025 -0400 bcachefs: bch2_dev_add() can run on a non-started fs Signed-off-by: Kent Overstreet commit a349868b5e2503271bedf5f0b6e3638552047e0f Author: Kent Overstreet Date: Mon Apr 28 14:50:07 2025 -0400 bcachefs: bch2_fs_open() now takes a darray Signed-off-by: Kent Overstreet commit cf95296295bebadcf8b4a695064d2df35e0c127e Author: Kent Overstreet Date: Mon Apr 28 11:45:56 2025 -0400 bcachefs: bch2_trans_update_ip() Allow btree_insert_entry.ip_allocated to be passed in, so we get better info on where alloc updates are coming from. Signed-off-by: Kent Overstreet commit 7677859a47a464f1c5603077809d4bc13f2d549f Author: Kent Overstreet Date: Sat Apr 26 12:39:17 2025 -0400 bcachefs: Run most explicit recovery passes persistent If we detect an error that requires running a recovery pass, and we're not in recovery, we won't be able to fix it until the next mount - make sure we're noting in the superblock that it needs to run. Signed-off-by: Kent Overstreet commit aff2b6a7fc285287f7ffc6691aca333a63b18230 Author: Kent Overstreet Date: Sat Apr 26 12:38:53 2025 -0400 bcachefs: provide unlocked version of run_explicit_recovery_pass_persistent Signed-off-by: Kent Overstreet commit c21f41f6905be4fc5059a10a5bba94105ba87269 Author: Kent Overstreet Date: Thu Apr 24 17:55:20 2025 -0400 bcachefs: bch2_dirent_to_text() shows casefolded dirents Signed-off-by: Kent Overstreet commit cd3cdb1ef706a1ac725194d81858d58375739b25 Author: Kent Overstreet Date: Tue Apr 22 09:14:19 2025 -0400 bcachefs: Single err message for btree node reads Like we just did with the data read path, emit a single error message per btree node reads, nicely formatted, with all the actions we took grouped together. Signed-off-by: Kent Overstreet commit 9c2472658be20d04c6dc34d5314a7e99cc4fed25 Author: Kent Overstreet Date: Tue Apr 22 20:38:50 2025 -0400 bcachefs: bch2_mark_btree_validate_failure() Signed-off-by: Kent Overstreet commit d31f155964aee6e6141967fc392a9a99b221e117 Author: Kent Overstreet Date: Tue Apr 22 09:02:15 2025 -0400 bcachefs: bch2_fsck_err_opt() Signed-off-by: Kent Overstreet commit 600a9207c8def056b4681fde8158c463576d5aca Author: Kent Overstreet Date: Thu Apr 24 09:27:10 2025 -0400 bcachefs: Plumb printbuf through bch2_btree_lost_data() Part of the ongoing project to improve error messages by building them up in printbufs and emitting them all at once, so that we can easily see what events are related in the log. Signed-off-by: Kent Overstreet commit 300904700f14e4e05db2a16cf8e3890c8e856cf8 Author: Kent Overstreet Date: Thu Apr 24 09:28:56 2025 -0400 bcachefs: kill bch2_run_explicit_recovery_pass_persistent() No longer has users, so we can kill it and rename bch2_run_explicit_recovery_pass_persistent_locked(). Signed-off-by: Kent Overstreet commit 3aecbb01a168bf6396955e5da0533f6e5f000441 Author: Kent Overstreet Date: Thu Apr 24 09:13:28 2025 -0400 bcachefs: Remove redundant calls to btree_lost_data() The btree node read path calls this before returning the read error. Signed-off-by: Kent Overstreet commit 3be132f93cff2586be482cb81807ff83899f572e Author: Kent Overstreet Date: Thu Apr 24 09:09:56 2025 -0400 bcachefs: bch2_btree_lost_data() now handles snapshots tree We have a consolidated places for "this btree lost data, run this repair", so use it. Signed-off-by: Kent Overstreet commit b3bbd47f8314997b7a13cfe0b2048a19a5b62fcf Author: Kent Overstreet Date: Tue Apr 22 09:16:49 2025 -0400 bcachefs: Kill redundant error message in topology repair The btree node read path already logs btree node read errors, this isn't needed. Signed-off-by: Kent Overstreet commit 156d9e8341e8aad55b0e79b2dc54003cb14e5077 Author: Kent Overstreet Date: Tue Apr 22 05:49:20 2025 -0400 bcachefs: Emit a single log message on data read error Instead of emitting a message immediately when we get an error in the read path, and then another at the end if we successfully retry - emit one single log message before returning from bch2_rbio_retry(). Signed-off-by: Kent Overstreet commit 353b89c6e6df522c221997a527358854b1c826d7 Author: Kent Overstreet Date: Tue Apr 22 05:45:48 2025 -0400 bcachefs: bch2_io_failures_to_text() Pretty printer for bch_io_failures, to be used for better read error messages. Signed-off-by: Kent Overstreet commit dbc18c97f1f0d336e3c4f6bb50f34c5255216995 Author: Kent Overstreet Date: Tue Apr 22 06:03:33 2025 -0400 bcachefs: print_string_as_lines: avoid printing empty line If the final line in in the message to be printed is blang, don't print it. This happens with indented printbufs - after a newline we emit spaces up to the indent level. Signed-off-by: Kent Overstreet commit 41e51769b8a649dd3db7070370cb6aa127f86307 Author: Kent Overstreet Date: Mon Apr 21 13:02:51 2025 -0400 bcachefs: Make various async objs visible in debugfs Add async objs list for - promote_op - bch_read_bio - btree_read_bio - btree_write_bio This gets us introspection on in-flight async ops, and because under the hood it uses fast_lists (percpu slot buffer on top of a radix tree), it'll be fast enough to enable in production. This will be very helpful for debugging "something got stuck" issues, which have been cropping up from time to time (in the CI, especially with folio writeback). Signed-off-by: Kent Overstreet commit 0499a82b18b5ddee0d97d2cfcae0c0120f858c1f Author: Kent Overstreet Date: Mon Apr 21 12:01:50 2025 -0400 bcachefs: Async object debugging Debugging infrastructure for async objs: this lets us easily create fast_lists for various object types so they'll be visible in debugfs. Add new object types to the BCH_ASYNC_OBJS_TYPES() enum, and drop a pretty-printer wrapper in async_objs.c. Signed-off-by: Kent Overstreet commit d49bafdc5d1659171d988888ebfc773629f8ca97 Author: Kent Overstreet Date: Sat Sep 28 16:22:38 2024 -0400 bcachefs: fast_list A fast "list" data structure, which is actually a radix tree, with an IDA for slot allocation and a percpu buffer on top of that. Items cannot be added or moved to the head or tail, only added at some (arbitrary) position and removed. The advantage is that adding, removing and iteration is generally lockless, only hitting the lock in ida when the percpu buffer is full or empty. Signed-off-by: Kent Overstreet commit 989b4c375a330c8f0cd18aa891c67ac56bec2984 Author: Kent Overstreet Date: Sun Feb 2 11:23:07 2025 -0500 bcachefs: bch2_read_bio_to_text Pretty printer for struct bch_read_bio. Signed-off-by: Kent Overstreet commit 5f0de475f967a094bd596913ffbe9ad9b33b4e3a Author: Kent Overstreet Date: Mon Apr 21 12:04:10 2025 -0400 bcachefs: bch2_bio_to_text() Pretty printer for struct bio, to be used for async object debugging. This is pretty minimal, we'll add more to it as we discover what we need. Signed-off-by: Kent Overstreet commit cca2c0d224c17c99fb2ee7674284f89ce8389f3a Author: Kent Overstreet Date: Fri Apr 18 21:54:12 2025 -0400 bcachefs: bch_dev.io_ref -> enumerated_ref Convert device IO refs to enumerated_refs, for easier debugging of refcount issues. Simple conversion: enumerate all users and convert to the new helpers. Signed-off-by: Kent Overstreet commit c9b1d94a2196fcfd1985ff8728b22abda400b1ac Author: Kent Overstreet Date: Fri Apr 18 14:56:09 2025 -0400 bcachefs: bch_fs.writes -> enumerated_refs Drop the single-purpose write ref code in bcachefs.h, and convert to enumarated refs. Signed-off-by: Kent Overstreet commit f5241e41272858b983da45ac7f8a6ad58c4ba71f Author: Kent Overstreet Date: Fri Apr 18 14:56:09 2025 -0400 bcachefs: enumerated_ref.c Factor out the debug code for rw filesystem refs into a small library. In release mode an enumerated ref is a normal percpu refcount, but in debug mode all enumerated users of the ref get their own atomic_long_t ref - making it much easier to chase down refcount usage bugs for when a refcount has many users. For debugging, we have enumerated_ref_to_text(), which prints the current value of each different user. Additionally, in debug mode enumerated_ref_stop() has a 10 second timeout, after which it will dump outstanding refcounts. Signed-off-by: Kent Overstreet commit 6d67de1079993e09e7a867a6936a8163ece98792 Author: Kent Overstreet Date: Sat Apr 19 19:13:40 2025 -0400 bcachefs: for_each_rw_member_rcu() Signed-off-by: Kent Overstreet commit e14e06e91dadcd1c65f08ba5a02716d3e855fc74 Author: Kent Overstreet Date: Sun Apr 20 11:27:18 2025 -0400 bcachefs: __bch2_fs_read_write() no longer depends on io_ref Signed-off-by: Kent Overstreet commit 9fa4a8a3bdb14c1a36ff439643e00ca416e04b66 Author: Kent Overstreet Date: Fri Apr 18 22:11:15 2025 -0400 bcachefs: for_each_online_member_rcu() Signed-off-by: Kent Overstreet commit 2483dd1243584432c8b407f09673500c00095cd3 Author: Kent Overstreet Date: Sun Apr 20 11:23:53 2025 -0400 bcachefs: recalc_capacity() no longer depends on io_ref Signed-off-by: Kent Overstreet commit c53be0ffaa501d25f58ac2e56b7e5710f3408a50 Author: Kent Overstreet Date: Sat Apr 19 00:57:55 2025 -0400 bcachefs: bch2_target_to_text() no longer depends on io_ref Signed-off-by: Kent Overstreet commit 834f9475aabd84f60760ac8ceffc45eedff4a176 Author: Kent Overstreet Date: Fri Mar 14 09:46:25 2025 -0400 bcachefs: bch2_check_rebalance_work() Add a pass for checking the rebalance_work btree. Signed-off-by: Kent Overstreet commit 09279bba72f809eeb1f02d39a462e8e1d06fa32a Author: Alan Huang Date: Fri Apr 18 15:52:10 2025 +0800 bcachefs: Kill dead code Signed-off-by: Alan Huang Signed-off-by: Kent Overstreet commit 62095464e9d2a2340a6b08a90fb280ea2b091a28 Author: Kent Overstreet Date: Thu Apr 17 12:42:13 2025 -0400 bcachefs: Fix struct with flex member ABI warning This pops up when buliding in userspace. The structs aren't actually variable length, but no way to tell the compiler that... Signed-off-by: Kent Overstreet commit 9e260e4590e044dc5887f9eb21dfaf479226e7d4 Author: Kent Overstreet Date: Sat Apr 20 17:40:47 2024 -0400 docs: bcachefs: idle work scheduling design doc People have been asking to see the plan for this, so - bcachefs has various background tasks that need to be scheduled to balance efficiency, predictability of performance, etc. The design and philosophy hasn't changed too much since bcache, which was primarily designed for server usage, with sustained load in mind. These days we're seeing more desktop usage - where we really want to let the system idle effictively, to reduce total power usage - while also still balancing previous concerns, we still want to let work accumulate to a degree. This lays out all the requirements and starts to sketch out the algorithm I have in mind. Signed-off-by: Kent Overstreet commit fe27298b92001d51797ddc26ca0d7c3d4a0f04d4 Author: Kent Overstreet Date: Tue Apr 15 21:35:28 2025 -0400 bcachefs: bch2_move_data_btree() can now walk roots Signed-off-by: Kent Overstreet commit 3484840ece849ee700c7cf8e0d44d5536b29fa08 Author: Kent Overstreet Date: Sun Apr 13 16:31:34 2025 -0400 bcachefs: bch2_move_data_btree() can move btree nodes Signed-off-by: Kent Overstreet commit 7a274285d3706608d788efcbd9982f08531dd9ec Author: Kent Overstreet Date: Thu Apr 3 19:51:05 2025 -0400 bcachefs: plumb btree_id through move_pred_fd Signed-off-by: Kent Overstreet commit f3c8eaf7a133ef122dfd97e6f6f972265cc84fb0 Author: Kent Overstreet Date: Thu Apr 3 19:42:02 2025 -0400 bcachefs: Plumb target parameter through btree_node_rewrite_pos() Signed-off-by: Kent Overstreet commit ecedc87cfaf016e7e857a209e1b2685a28d59566 Author: Kent Overstreet Date: Thu Apr 3 19:33:54 2025 -0400 bcachefs: export bch2_move_data_phys() Signed-off-by: Kent Overstreet commit 0ca375b1779f22f703f956b22ea2bdbc69c247eb Author: Kent Overstreet Date: Tue Apr 15 14:09:34 2025 -0400 bcachefs: BCH_MEMBER_RESIZE_ON_MOUNT Signed-off-by: Kent Overstreet commit 530112d88ebd7405fb61711892b2a680048984c7 Author: Kent Overstreet Date: Tue Apr 15 15:15:36 2025 -0400 bcachefs: BCH_FEATURE_small_image We can't go RW if it's an image file that hasn't been resized. Signed-off-by: Kent Overstreet commit 203852d9db68e14b50b119cbd123def7e7c9efd0 Author: Kent Overstreet Date: Thu Apr 3 14:19:23 2025 -0400 bcachefs: BCH_FEATURE_no_alloc_info If a filesystem is going to only be used read-only, and will be a deployable image, we can strip out alloc info for a substantial reduction in metadata size - around half, due to backpointers. Alloc info will be regenerated on first read-write mount. Remounting RW is disallowed for now, since we don't yet have check_allocations running in RW mode. Signed-off-by: Kent Overstreet commit 576493133f26a172b8db4313448206d30750c9b2 Author: Kent Overstreet Date: Wed Apr 16 09:23:15 2025 -0400 bcachefs: Print features on startup with -o verbose Signed-off-by: Kent Overstreet commit 0dc73809e93aeb905acf9fa88502c73534cfa83d Author: Kent Overstreet Date: Wed Apr 16 06:48:31 2025 -0400 bcachefs: Shrink superblock downgrade table Don't generate entries for versions that won't be able to mount. Signed-off-by: Kent Overstreet commit 1c8dfd7ba50dbbb72113caf4fa7868512cdad2f4 Author: Kent Overstreet Date: Tue Apr 15 23:35:48 2025 -0400 bcachefs: sb_validate() no longer requires members_v1 Signed-off-by: Kent Overstreet commit d12bd4101825c14222ecbe4c6fba9c03ce42f624 Author: Kent Overstreet Date: Tue Apr 15 19:21:52 2025 -0400 bcachefs: Add a recovery pass for making sure root inode is readable If the root inode/subvolume is unreadable we can repair automatically - but only if we're still in recovery, so that we can rewind to the appropriate recovery pass. Signed-off-by: Kent Overstreet commit bdad8962c94d3e557317b3d0691a507177f27a22 Author: Kent Overstreet Date: Tue Apr 15 19:15:43 2025 -0400 bcachefs: Flag for repair on missing subvolume Instead of going emegency read only with a bch2_fs_inconsistent() call, log the error and recovery pass appropriately. If we're still in recovery it'll be repaired immediately, otherwise it'll be repaired on the next mount. Signed-off-by: Kent Overstreet commit ebf561b2083d797da4673207044855ccd764195b Author: Kent Overstreet Date: Tue Apr 15 17:31:47 2025 -0400 bcachefs: print_str_as_lines() -> print_str() bch2_print_string_as_lines() is a low level helper that allows messages longer than 1k to be printed without truncation. But we should always be printing with the helpers that take a filesystem object, if we're in fsck they direct output to the userspace process controlling fsck instead of the dmesg log. Signed-off-by: Kent Overstreet commit 040c762152f5f4fb1b13e8a46c17ecb4e670d96d Author: Kent Overstreet Date: Tue Apr 15 14:08:42 2025 -0400 bcachefs: bch2_dev_missing_bkey() Part of the ongoing project to kill off bch2_(fs|trans)_inconsistent calls - they generally need to be replaced with either - a fsck_err() call that can repair the error, or - logging an error of the appropriate type in the superblock, and flagging the appropriate recovery pass to repair the error Signed-off-by: Kent Overstreet commit 2085325171f2f2d33a94101e58266f325c286e95 Author: Kent Overstreet Date: Tue Apr 15 13:55:16 2025 -0400 bcachefs: Simplify bch2_count_fsck_err() Signed-off-by: Kent Overstreet commit bb36a12921e5fc76f3b26a80ab0217d3dc62a473 Author: Kent Overstreet Date: Tue Apr 15 13:45:39 2025 -0400 bcachefs: bch2_run_explicit_recovery_pass_printbuf() We prefer helpers that emit log messages to printbufs rather than printing them directly; that way, we can ensure that different log messages from the same event are grouped together and formatted appropriately in the dmesg log. Signed-off-by: Kent Overstreet commit 5022d0e18394c1c1cd41b5aae9ae6056b49ce678 Author: Kent Overstreet Date: Tue Apr 15 10:20:46 2025 -0400 bcachefs: Incompatible features may now be enabled at runtime version_upgrade is now a runtime option. In the future we'll want to add compatible upgrades at runtime, and call the full check_version_upgrade() when the option changes, but we don't have compatible optional upgrades just yet. Signed-off-by: Kent Overstreet commit c79eb06da4c34f29ca8bd23ddf7c1d7c1cd16121 Author: Kent Overstreet Date: Tue Apr 15 09:54:01 2025 -0400 bcachefs: Clean up option pre/post hooks, small fixes The helpers are now: - bch2_opt_hook_pre_set() - bch2_opts_hooks_pre_set() - bch2_opt_hook_post_set Fix a bug where the filesystem discard option would incorrectly be changed when setting the device option, and don't trigger rebalance scans unnecessarily (when options aren't changing). Signed-off-by: Kent Overstreet commit 83ecd1b122f49c907ea3c4178f32bd37223e7fac Author: Kent Overstreet Date: Sun Apr 13 08:20:47 2025 -0400 bcachefs: Use drop_locks_do() in bch2_inode_hash_find() Signed-off-by: Kent Overstreet commit c02e5b57283ad6fd8dec8d834bd340bf2627fcee Author: Kent Overstreet Date: Wed Apr 2 15:12:49 2025 -0400 bcachefs: Single device mode Single device filesystems are now identified by the block device name, not the UUID - and single device filesystems with the same UUID can be mounted simultaneously, without any special options. This allocates a new bit in the superblock, BCH_SB_MULTI_DEVICE, which indicates whether a filesystem has ever been multi device. Signed-off-by: Kent Overstreet commit 58c36e6710d3b3cc050c35c42954cb03c3e01c59 Author: Kent Overstreet Date: Thu Apr 3 13:10:03 2025 -0400 bcachefs: Initialize c->name earlier on single dev filesystems On single device filesystems, c->name contains the block device name, not the UUID. Initialize this earlier, so that single device mode can use it for initializing sysfs/debugfs. Signed-off-by: Kent Overstreet commit 0e43bf5a6a8f440f887b0472367a824c37a4031b Author: Alan Huang Date: Tue Apr 15 13:33:07 2025 +0800 bcachefs: Simplify logic Signed-off-by: Alan Huang Signed-off-by: Kent Overstreet commit 152bae193c480d53283541f5e4e2d1100f8500d3 Author: Alan Huang Date: Tue Apr 15 13:33:06 2025 +0800 bcachefs: Remove spurious +1/-1 operation Signed-off-by: Alan Huang Signed-off-by: Kent Overstreet commit f013b4ca356d37b2cc2e84a096c02dad592b1574 Author: Alan Huang Date: Tue Apr 15 13:33:04 2025 +0800 bcachefs: Kill bch2_trans_unlock_noassert Signed-off-by: Alan Huang Signed-off-by: Kent Overstreet commit 6f03e30e7c6b759c7e9a67ca1c41f896db7b421a Author: Kent Overstreet Date: Sun Apr 13 17:59:10 2025 -0400 bcachefs: Clean up duplicated code in bch2_journal_halt() It's now a wrapper around bch2_journal_halt_locked(). Signed-off-by: Kent Overstreet commit 03f8f9a1292ed3a7160a497f7a36a37d0062b1ca Author: Kent Overstreet Date: Sun Apr 13 16:29:36 2025 -0400 bcachefs: bch2_dev_allocator_set_rw() Add a helper that lets us change bch_member.data_allowed at runtime. Signed-off-by: Kent Overstreet commit 2e0d51d00e84790dfad4191e0f50c33b7cac387c Author: Kent Overstreet Date: Sun Apr 13 13:52:12 2025 -0400 bcachefs: bch2_dev_journal_alloc() now respects data_allowed Signed-off-by: Kent Overstreet commit 93ac4d5f92fc33dc3ba6a60a66e177ac1f4be032 Author: Kent Overstreet Date: Sun Apr 13 07:47:47 2025 -0400 bcachefs: Improve bch2_btree_cache_to_text() Make the output slightly clearer, and include a counter for "nodes we couldn't free because we would have gone under our reserve". Signed-off-by: Kent Overstreet commit e50fe14c5430d30c5464ebdaef7d0e9684480aca Author: Kent Overstreet Date: Sun Apr 13 07:45:13 2025 -0400 bcachefs: __btree_node_reclaim_checks() Factor out a helper so we're not duplicating checks after locking the btree node. Signed-off-by: Kent Overstreet commit 68aaeb7c8bc8fd82805b5045c606bc5fe00cbea8 Author: Kent Overstreet Date: Sun Apr 13 07:42:46 2025 -0400 bcachefs: kill BTREE_CACHE_NOT_FREED_INCREMENT() Small cleanup, just always increment the counters. Signed-off-by: Kent Overstreet commit ef8dd631f788810e19138771a7e72956467bef0f Author: Kent Overstreet Date: Sun Apr 6 13:50:20 2025 -0400 bcachefs: Improve opts.degraded Kill 'opts.very_degraded', and make 'opts.degraded' a persistent option, stored in the superblock. It's now an enum, with available choices ask/yes/very/no. "ask" mode will be handled by the mount helper, for prompting the user (on a machine used interactively) for whether to do a degraded mount. Signed-off-by: Kent Overstreet commit 2758c28acabc16317f690874ac930aae50a4e461 Author: Kent Overstreet Date: Sun Apr 13 05:23:40 2025 -0400 bcachefs: export bch2_chacha20 Needed for userspcae. Signed-off-by: Kent Overstreet commit dd1b99f7060f781bea9973036ee96daa856f08c0 Author: Integral Date: Tue Apr 8 18:31:29 2025 +0800 bcachefs: indent error messages of invalid compression This patch uses printbuf_indent_add_nextline() to set a consistent indentation level for error messages of invalid compression. In my previous patch [1], the newline is added by using '\n' in the argument of prt_str(). This patch replaces prt_str() with prt_printf() to make indentation level work correctly. [1] Link: https://lore.kernel.org/20250406152659.205997-2-integral@archlinuxcn.org Signed-off-by: Integral Signed-off-by: Kent Overstreet commit 84ccd47d265579dd23768e69b5204801ad6b5eca Author: Integral Date: Sun Apr 6 23:26:59 2025 +0800 bcachefs: split error messages of invalid compression into two lines When an invalid compression type or level is passed as an argument to `--compression`, two error messages are squashed into one line: > bcachefs format --compression=lzo bcachefs-comp.img invalid option: invalid compression typecompression: parse error > bcachefs format --compression=lz4:16 bcachefs-comp.img invalid option: invalid compression levelcompression: parse error To resolve this issue, add a newline character at the end of the first error message to separate them into two lines. Signed-off-by: Integral Signed-off-by: Kent Overstreet commit 0e790469bf3044022cb02025abdae775c9908ca8 Author: Integral Date: Sun Apr 6 22:53:28 2025 +0800 bcachefs: early return for negative values when parsing BCH_OPT_UINT Currently, when passing a negative integer as argument, the error message is "too big" due to casting to an unsigned integer: > bcachefs format --block_size=-1 bcachefs.img invalid option: block_size: too big (max 65536) When negative value in argument detected, return early before calling bch2_opt_validate(). A new error code `BCH_ERR_option_negative` is added. Signed-off-by: Integral Signed-off-by: Kent Overstreet commit 3a2a0d08b225047ac1d2504059c45a5acf8072b8 Author: Kent Overstreet Date: Thu Apr 3 20:56:09 2025 -0400 bcachefs: move_data_phys: stats are not required Signed-off-by: Kent Overstreet commit d4d71b58e5139afc5f9bda0139b99404eb216d8a Author: Kent Overstreet Date: Sat Apr 5 17:36:04 2025 -0400 bcachefs: RO mounts now use less memory Defer memory allocations only needed in RW mode until we actually go RW. This is part of improved support for RO images. Signed-off-by: Kent Overstreet commit a17e985be9831bf866795fe5e3da219d2061ce6c Author: Kent Overstreet Date: Sat Apr 5 19:30:43 2025 -0400 bcachefs: Move various init code to _init_early() _init_early() is for initialization that cannot fail, and often must happen for teardown partway through initialization to work. Signed-off-by: Kent Overstreet commit 31813dcf379d7fc513530e3a9cf7b60cd2aa2a9d Author: Kent Overstreet Date: Sat Apr 5 19:41:35 2025 -0400 bcachefs: alphabetize init function calls Signed-off-by: Kent Overstreet commit 25ee021c7fc22797ac34b9b9fb9b24921b647901 Author: Kent Overstreet Date: Sat Apr 5 19:26:19 2025 -0400 bcachefs: simplify journal pin initialization Signed-off-by: Kent Overstreet commit 2767f4f258b8d034a99830fafdb46a8c52910bce Author: Kent Overstreet Date: Sat Apr 5 19:23:52 2025 -0400 bcachefs: btree_io_complete_wq -> btree_write_complete_wq Signed-off-by: Kent Overstreet commit c9b5d9cd26bde01a0591cd8eeed8847da997f576 Author: Kent Overstreet Date: Thu Apr 3 22:30:39 2025 -0400 bcachefs: bch2_kvmalloc() mem alloc profiling Signed-off-by: Kent Overstreet commit bcaea61adc1c19094cafbf0269fe99227b2ac89c Author: Kent Overstreet Date: Thu Apr 3 12:18:39 2025 -0400 bcachefs: add missing include Hygeine, and fix build in userspace. Signed-off-by: Kent Overstreet commit b974357c63d0b26606210942dc5659d755089d4e Author: Kent Overstreet Date: Wed Apr 2 14:40:06 2025 -0400 bcachefs: bch2_snapshot_table_make_room() Add a better helper for check_snapshot_exists(). create_snapids() can't be changed to use this, unfortunately, because the transaction that creates new snapshot will also be inserting other keys (e.g. root inode) that reference that snapshot ID, and they expect the snapshot table to already be updated. Signed-off-by: Kent Overstreet commit ea27e8ca5d8e117b17a3d76c39404d206c5ebdeb Author: Kent Overstreet Date: Wed Apr 2 11:59:39 2025 -0400 bcachefs: darray: provide typedefs for primitive types Signed-off-by: Kent Overstreet commit 2a81bd454c45c89b167b6c2bd3ba7b5a489b0830 Author: Kent Overstreet Date: Wed Apr 2 17:23:22 2025 -0400 bcachefs: reduce new_stripe_alloc_buckets() stack usage Signed-off-by: Kent Overstreet commit a0b0b9bb9e3cb896a5585701fa6b340d2ada6f63 Author: Kent Overstreet Date: Mon Mar 31 17:50:52 2025 -0400 bcachefs: alloc_request no longer on stack Signed-off-by: Kent Overstreet commit 95f2315af7536c220301421eff6291c80ec321e5 Author: Kent Overstreet Date: Mon Mar 31 17:57:06 2025 -0400 bcachefs: alloc_request.ptrs2 Signed-off-by: Kent Overstreet commit e038213658f09bc775a67cf8e18f0aec4b0f7679 Author: Kent Overstreet Date: Mon Mar 31 17:13:22 2025 -0400 bcachefs: alloc_request.ca Signed-off-by: Kent Overstreet commit 7f65d1cf5c30cf3e634cd8a02ea8563f7af53e89 Author: Kent Overstreet Date: Mon Mar 31 17:08:43 2025 -0400 bcachefs: alloc_request.counters Signed-off-by: Kent Overstreet commit 4d00e88d21d6369a2c5ff0fbdec82d418ef10230 Author: Kent Overstreet Date: Mon Mar 31 15:52:39 2025 -0400 bcachefs: alloc_request.usage Signed-off-by: Kent Overstreet commit a0312f425177ce7d70da10b726ba2c7b133089f1 Author: Kent Overstreet Date: Mon Mar 31 17:54:43 2025 -0400 bcachefs: alloc_request: deallocate_extra_replicas() Signed-off-by: Kent Overstreet commit ac0952b0e50934a15fdd67a2ff376e6ab8152c39 Author: Kent Overstreet Date: Mon Mar 31 15:46:45 2025 -0400 bcachefs: new_stripe_alloc_buckets() takes alloc_request More stack usage improvements: instead of creating a new alloc_request (currently on the stack), save/restore just the fields we need to reuse. This is a bit tricky, because we're doing a normal alloc_foreground.c allocation, which calls into ec.c to get a stripe, which then does more normal allocations - some of the fields get reused, and used differently. So we have to save and restore them - but the stack usage improvements will be well worth it. Signed-off-by: Kent Overstreet commit 7100344301d80f09ea64c37c35ea10163d35d433 Author: Kent Overstreet Date: Mon Mar 31 15:37:28 2025 -0400 bcachefs: bch2_ec_stripe_head_get() takes alloc_request Signed-off-by: Kent Overstreet commit 9259883b79e14aaf127c0ef59b5ccca8e04e77ae Author: Kent Overstreet Date: Fri Mar 21 21:13:53 2025 -0400 bcachefs: bch2_bucket_alloc_trans() takes alloc_request Signed-off-by: Kent Overstreet commit 799c41830332121b067c26b43887a95a4f848c22 Author: Kent Overstreet Date: Fri Mar 21 21:06:43 2025 -0400 bcachefs: alloc_request.data_type Signed-off-by: Kent Overstreet commit ad63f9f1e9a10792847bc46f0226323f238a171d Author: Kent Overstreet Date: Fri Mar 21 20:42:42 2025 -0400 bcachefs: struct alloc_request Add a struct for common state for satisfying an on disk allocation, instead of passing the same long list of items to every function. This will help with stack usage, performance, and perhaps enable some code cleanups. Signed-off-by: Kent Overstreet commit d02755b8c5f38e737037e0ff0820eb66ab63c4f5 Author: Kent Overstreet Date: Tue Apr 1 14:29:31 2025 -0400 bcachefs: trace bch2_trans_kmalloc() We're occasionally seeing the WARN_ON() for bump allocator usage exceeding BTREE_TRANS_MEM_MAX; add some tracing so we can see what's going on. Signed-off-by: Kent Overstreet commit caa6baa45f809bd932362030b16a8bb3e1dae083 Author: Roxana Nicolescu Date: Thu Mar 27 14:50:09 2025 +0000 bcachefs: replace memcpy with memcpy_and_pad for jset_entry_log->d buff This was achieved before by zero-ing out the source buffer and then copying the bytes into the destination buffer. This can also be done with memcpy_and_pad which will zero out only the destination buffer if its size is bigger than the size of the source buffer. This is already used in the same way in journal_transaction_name(). Moreover, zero-ing the source buffer was done twice, first in __bch2_fs_log_msg() and then in bch2_trans_log_msg(). And this method may also require allocating some extra memory for the source buffer. In conclusion, using memcpy_and_pad is better even tough the result is the same because it brings uniformity with what's already used in journal_transaction_name, it avoids code duplication and reallocating extra memory. Signed-off-by: Roxana Nicolescu Signed-off-by: Kent Overstreet commit 4e2caf82ce958d1fae96a6d6ba23ea9e80c597b4 Author: Roxana Nicolescu Date: Thu Mar 27 14:50:05 2025 +0000 bcachefs: replace strncpy() with memcpy_and_pad in journal_transaction_name Strncpy is now deprecated. The buffer destination is not required to be NULL-terminated, but we also want to zero out the rest of the buffer as it is already done in other places. Link: https://github.com/KSPP/linux/issues/90 Signed-off-by: Roxana Nicolescu Signed-off-by: Kent Overstreet commit 8c087d2ddf5d4d8c07bec96531a5f5629066cd00 Author: Kent Overstreet Date: Tue Mar 11 09:46:06 2025 -0400 bcachefs: Rebalance now skips poisoned extents Let's not move poisoned extents unnecessarily, since we can't guard against introducing more bitrot. Signed-off-by: Kent Overstreet commit cb8336ca42e493a76b3cc05b76a51a2eed26cdaa Author: Kent Overstreet Date: Tue Mar 11 10:02:40 2025 -0400 bcachefs: Data move can read from poisoned extents Now, if an extent is poisoned we can move it even if there was a checksum error. We'll have to give it a new checksum, but the poison bit means that userspace will still see the appropriate error when they try to read it. Signed-off-by: Kent Overstreet commit 760be1ad5e71b3a23644849cbf3c2245c4dc83f3 Author: Kent Overstreet Date: Mon Mar 10 14:03:25 2025 -0400 bcachefs: Poison extents that can't be read due to checksum errors Copygc needs to be able to move extents that have bitrotted. We don't want to delete them - in the future we'll have an API for "read me the data even if there's checksum errors", and in general we don't want to delete anything unless the user asks us to. That will require writing it with a new checksum, which means we can't forget that there was a checksum error so we return the correct error to userspace. Rebalance also wants to skip bad extents; we can now use the poison flag for that. This is currently disabled by default, as we want read fua support so that we can distinguish between transient and permanent errors from the device. It may be enabled with the module parameter: poison_extents_on_checksum_error Signed-off-by: Kent Overstreet commit 6659ba3b18f71282c7c54f3bffcfecfac73f202f Author: Kent Overstreet Date: Mon Mar 10 13:33:41 2025 -0400 bcachefs: Be precise about bch_io_failures If the extent we're reading from changes, due to be being overwritten or moved (possibly partially) - we need to reset bch_io_failures so that we don't accidentally mark a new extent as poisoned prematurely. This means we have to separately track (in the retry path) the extent we previously read from. Signed-off-by: Kent Overstreet commit 0e5f1f3f8fad0d195099e4a8e7c43ffe71676047 Author: Kent Overstreet Date: Sat Mar 29 17:59:30 2025 -0400 bcachefs: bch2_subvolume_wait_for_pagecache_and_delete() cleanup Signed-off-by: Kent Overstreet commit 220a29d0af240c7ebf6ac1efae8b7a339f7e2026 Merge: d42d440746f8a2 3e2b7229890408 Author: Jakub Kicinski Date: Wed May 21 15:56:11 2025 -0700 Merge branch 'net-phy-add-support-for-new-aeonsemi-phys' Christian Marangi says: ==================== net: phy: Add support for new Aeonsemi PHYs Add support for new Aeonsemi 10G C45 PHYs. These PHYs intergate an IPC to setup some configuration and require special handling to sync with the parity bit. The parity bit is a way the IPC use to follow correct order of command sent. Supported PHYs AS21011JB1, AS21011PB1, AS21010JB1, AS21010PB1, AS21511JB1, AS21511PB1, AS21510JB1, AS21510PB1, AS21210JB1, AS21210PB1 that all register with the PHY ID 0x7500 0x7500 before the firmware is loaded. The big special thing about this PHY is that it does provide a generic PHY ID in C45 register that change to the correct one one the firmware is loaded. In practice: - MMD 0x7 ID 0x7500 0x9410 -> FW LOAD -> ID 0x7500 0x9422 To handle this, we operate on .match_phy_device where we check the PHY ID, if the ID match the generic one, we load the firmware and we return 0 (PHY driver doesn't match). Then PHY core will try the next PHY driver in the list and this time the PHY is correctly filled in and we register for it. To help in the matching and not modify part of the PHY device struct, .match_phy_device is extended to provide also the current phy_driver is trying to match for. This add the extra benefits that some other PHY can simplify their .match_phy_device OP. ==================== Link: https://patch.msgid.link/20250517201353.5137-1-ansuelsmth@gmail.com Signed-off-by: Jakub Kicinski commit 3e2b72298904081ba16b7e98b156eaca07f2db27 Author: Christian Marangi Date: Sat May 17 22:13:50 2025 +0200 dt-bindings: net: Document support for Aeonsemi PHYs Add Aeonsemi PHYs and the requirement of a firmware to correctly work. Also document the max number of LEDs supported and what PHY ID expose when no firmware is loaded. Supported PHYs AS21011JB1, AS21011PB1, AS21010JB1, AS21010PB1, AS21511JB1, AS21511PB1, AS21510JB1, AS21510PB1, AS21210JB1, AS21210PB1 that all register with the PHY ID 0x7500 0x9410 on C45 registers before the firmware is loaded. Reviewed-by: Rob Herring (Arm) Signed-off-by: Christian Marangi Link: https://patch.msgid.link/20250517201353.5137-7-ansuelsmth@gmail.com Signed-off-by: Jakub Kicinski commit 830877d89edcd834e4b4d0fcc021ff619d89505e Author: Christian Marangi Date: Sat May 17 22:13:49 2025 +0200 net: phy: Add support for Aeonsemi AS21xxx PHYs Add support for Aeonsemi AS21xxx 10G C45 PHYs. These PHYs integrate an IPC to setup some configuration and require special handling to sync with the parity bit. The parity bit is a way the IPC use to follow correct order of command sent. Supported PHYs AS21011JB1, AS21011PB1, AS21010JB1, AS21010PB1, AS21511JB1, AS21511PB1, AS21510JB1, AS21510PB1, AS21210JB1, AS21210PB1 that all register with the PHY ID 0x7500 0x7510 before the firmware is loaded. They all support up to 5 LEDs with various HW mode supported. While implementing it was found some strange coincidence with using the same logic for implementing C22 in MMD regs in Broadcom PHYs. For reference here the AS21xxx PHY name logic: AS21x1xxB1 ^ ^^ | |J: Supports SyncE/PTP | |P: No SyncE/PTP support | 1: Supports 2nd Serdes | 2: Not 2nd Serdes support 0: 10G, 5G, 2.5G 5: 5G, 2.5G 2: 2.5G Reviewed-by: Andrew Lunn Signed-off-by: Christian Marangi Link: https://patch.msgid.link/20250517201353.5137-6-ansuelsmth@gmail.com Signed-off-by: Jakub Kicinski commit d6c45707ac84c2d9f274ece1cea4dddb97996bde Author: Christian Marangi Date: Sat May 17 22:13:48 2025 +0200 net: phy: introduce genphy_match_phy_device() Introduce new API, genphy_match_phy_device(), to provide a way to check to match a PHY driver for a PHY device based on the info stored in the PHY device struct. The function generalize the logic used in phy_bus_match() to check the PHY ID whether if C45 or C22 ID should be used for matching. This is useful for custom .match_phy_device function that wants to use the generic logic under some condition. (example a PHY is already setup and provide the correct PHY ID) Reviewed-by: Russell King (Oracle) Signed-off-by: Christian Marangi Link: https://patch.msgid.link/20250517201353.5137-5-ansuelsmth@gmail.com Signed-off-by: Jakub Kicinski commit 1b76b2497aba90ce77a83b0af5943480fec5823f Author: Christian Marangi Date: Sat May 17 22:13:47 2025 +0200 net: phy: nxp-c45-tja11xx: simplify .match_phy_device OP Simplify .match_phy_device OP by using a generic function and using the new phy_id PHY driver info instead of hardcoding the matching PHY ID with new variant for macsec and no_macsec PHYs. Also make use of PHY_ID_MATCH_MODEL macro and drop PHY_ID_MASK define to introduce phy_id and phy_id_mask again in phy_driver struct. Reviewed-by: Russell King (Oracle) Signed-off-by: Christian Marangi Link: https://patch.msgid.link/20250517201353.5137-4-ansuelsmth@gmail.com Signed-off-by: Jakub Kicinski commit 5253972cb9555c81fd021d4d61d95733fd25ee5b Author: Christian Marangi Date: Sat May 17 22:13:46 2025 +0200 net: phy: bcm87xx: simplify .match_phy_device OP Simplify .match_phy_device OP by using a generic function and using the new phy_id PHY driver info instead of hardcoding the matching PHY ID. Reviewed-by: Russell King (Oracle) Signed-off-by: Christian Marangi Link: https://patch.msgid.link/20250517201353.5137-3-ansuelsmth@gmail.com Signed-off-by: Jakub Kicinski commit 31afd6bc55cc0093c3e5b0a368319e423d4de8ea Author: Christian Marangi Date: Sat May 17 22:13:45 2025 +0200 net: phy: pass PHY driver to .match_phy_device OP Pass PHY driver pointer to .match_phy_device OP in addition to phydev. Having access to the PHY driver struct might be useful to check the PHY ID of the driver is being matched for in case the PHY ID scanned in the phydev is not consistent. A scenario for this is a PHY that change PHY ID after a firmware is loaded, in such case, the PHY ID stored in PHY device struct is not valid anymore and PHY will manually scan the ID in the match_phy_device function. Having the PHY driver info is also useful for those PHY driver that implement multiple simple .match_phy_device OP to match specific MMD PHY ID. With this extra info if the parsing logic is the same, the matching function can be generalized by using the phy_id in the PHY driver instead of hardcoding. Rust wrapper callback is updated to align to the new match_phy_device arguments. Suggested-by: Russell King (Oracle) Reviewed-by: Russell King (Oracle) Signed-off-by: Christian Marangi Reviewed-by: Benno Lossin # for Rust Reviewed-by: FUJITA Tomonori Link: https://patch.msgid.link/20250517201353.5137-2-ansuelsmth@gmail.com Signed-off-by: Jakub Kicinski commit d42d440746f8a2dd04b17102993fc85a162dc75a Author: Jiawen Wu Date: Mon May 19 14:33:57 2025 +0800 net: libwx: Fix log level There is a log should be printed as info level, not error level. Fixes: 9bfd65980f8d ("net: libwx: Add sriov api for wangxun nics") Signed-off-by: Jiawen Wu Reviewed-by: Michal Swiatkowski Link: https://patch.msgid.link/67409DB57B87E2F0+20250519063357.21164-1-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit f44092606a3f153bb7e6b277006b1f4a5b914cfc Author: Justin Lai Date: Tue May 20 12:20:31 2025 +0800 rtase: Use min() instead of min_t() Use min() instead of min_t() to avoid the possibility of casting to the wrong type. Signed-off-by: Justin Lai Reviewed-by: Joe Damato Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250520042031.9297-1-justinlai0215@realtek.com Signed-off-by: Jakub Kicinski commit c6634c98e6151ed626a566fbadb54337bb94c532 Merge: 51ebe6b14f6690 c93f75b2d755c3 Author: Jakub Kicinski Date: Wed May 21 15:40:17 2025 -0700 Merge branch 'net-faster-and-simpler-crc32c-computation' Eric Biggers says: ==================== net: faster and simpler CRC32C computation Update networking code that computes the CRC32C of packets to just call crc32c() without unnecessary abstraction layers. The result is faster and simpler code. Patches 1-7 add skb_crc32c() and remove the overly-abstracted and inefficient __skb_checksum(). Patches 8-10 replace skb_copy_and_hash_datagram_iter() with skb_copy_and_crc32c_datagram_iter(), eliminating the unnecessary use of the crypto layer. This unblocks the conversion of nvme-tcp to call crc32c() directly instead of using the crypto layer, which patch 9 does. v1: https://lore.kernel.org/20250511004110.145171-1-ebiggers@kernel.org ==================== Link: https://patch.msgid.link/20250519175012.36581-1-ebiggers@kernel.org Signed-off-by: Jakub Kicinski commit c93f75b2d755c35b596084ddd3feb3528284a53f Author: Eric Biggers Date: Mon May 19 10:50:12 2025 -0700 net: remove skb_copy_and_hash_datagram_iter() Now that skb_copy_and_hash_datagram_iter() is no longer used, remove it. Signed-off-by: Eric Biggers Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20250519175012.36581-11-ebiggers@kernel.org Signed-off-by: Jakub Kicinski commit 427fff9aff295e2c117ed26237d1f4e3d87750a3 Author: Eric Biggers Date: Mon May 19 10:50:11 2025 -0700 nvme-tcp: use crc32c() and skb_copy_and_crc32c_datagram_iter() Now that the crc32c() library function directly takes advantage of architecture-specific optimizations and there also now exists a function skb_copy_and_crc32c_datagram_iter(), it is unnecessary to go through the crypto_ahash API. Just use those functions. This is much simpler, and it also improves performance due to eliminating the crypto API overhead. Reviewed-by: Christoph Hellwig Reviewed-by: Sagi Grimberg Signed-off-by: Eric Biggers Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20250519175012.36581-10-ebiggers@kernel.org Signed-off-by: Jakub Kicinski commit ea6342d98928e243f2024fb97a9b4d42ee55dfba Author: Eric Biggers Date: Mon May 19 10:50:10 2025 -0700 net: add skb_copy_and_crc32c_datagram_iter() Since skb_copy_and_hash_datagram_iter() is used only with CRC32C, the crypto_ahash abstraction provides no value. Add skb_copy_and_crc32c_datagram_iter() which just calls crc32c() directly. This is faster and simpler. It also doesn't have the weird dependency issue where skb_copy_and_hash_datagram_iter() depends on CONFIG_CRYPTO_HASH=y without that being expressed explicitly in the kconfig (presumably because it was too heavyweight for NET to select). The new function is conditional on the hidden boolean symbol NET_CRC32C, which selects CRC32. So it gets compiled only when something that actually needs CRC32C packet checksums is enabled, it has no implicit dependency, and it doesn't depend on the heavyweight crypto layer. Signed-off-by: Eric Biggers Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20250519175012.36581-9-ebiggers@kernel.org Signed-off-by: Jakub Kicinski commit b82f72292ab4c65250bd734281464a6ab1ff4133 Author: Eric Biggers Date: Mon May 19 10:50:09 2025 -0700 lib/crc32: remove unused support for CRC32C combination crc32c_combine() and crc32c_shift() are no longer used (except by the KUnit test that tests them), and their current implementation is very slow. Remove them. Signed-off-by: Eric Biggers Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20250519175012.36581-8-ebiggers@kernel.org Signed-off-by: Jakub Kicinski commit 70c96c7cb9f035d5b960021f2450afa6240e66b4 Author: Eric Biggers Date: Mon May 19 10:50:08 2025 -0700 net: fold __skb_checksum() into skb_checksum() Now that the only remaining caller of __skb_checksum() is skb_checksum(), fold __skb_checksum() into skb_checksum(). This makes struct skb_checksum_ops unnecessary, so remove that too and simply do the "regular" net checksum. It also makes the wrapper functions csum_partial_ext() and csum_block_add_ext() unnecessary, so remove those too and just use the underlying functions. Signed-off-by: Eric Biggers Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20250519175012.36581-7-ebiggers@kernel.org Signed-off-by: Jakub Kicinski commit 99de9d4022e5004f95f425f798f0aa01e87949ff Author: Eric Biggers Date: Mon May 19 10:50:07 2025 -0700 sctp: use skb_crc32c() instead of __skb_checksum() Make sctp_compute_cksum() just use the new function skb_crc32c(), instead of calling __skb_checksum() with a skb_checksum_ops struct that does CRC32C. This is faster and simpler. Signed-off-by: Eric Biggers Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20250519175012.36581-6-ebiggers@kernel.org Signed-off-by: Jakub Kicinski commit 62673b7df998b669229f9aaf85a25cb5c24d5e40 Author: Eric Biggers Date: Mon May 19 10:50:06 2025 -0700 RDMA/siw: use skb_crc32c() instead of __skb_checksum() Instead of calling __skb_checksum() with a skb_checksum_ops struct that does CRC32C, just call the new function skb_crc32c(). This is faster and simpler. Acked-by: Leon Romanovsky Reviewed-by: Bernard Metzler Signed-off-by: Eric Biggers Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20250519175012.36581-5-ebiggers@kernel.org Signed-off-by: Jakub Kicinski commit 86edc94da1063a327d8d4bfc82b31df427db3e5c Author: Eric Biggers Date: Mon May 19 10:50:05 2025 -0700 net: use skb_crc32c() in skb_crc32c_csum_help() Instead of calling __skb_checksum() with a skb_checksum_ops struct that does CRC32C, just call the new function skb_crc32c(). This is faster and simpler. Signed-off-by: Eric Biggers Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20250519175012.36581-4-ebiggers@kernel.org Signed-off-by: Jakub Kicinski commit a5bd029c733b8ae790d5873e2afeb88b58e3a151 Author: Eric Biggers Date: Mon May 19 10:50:04 2025 -0700 net: add skb_crc32c() Add skb_crc32c(), which calculates the CRC32C of a sk_buff. It will replace __skb_checksum(), which unnecessarily supports arbitrary checksums. Compared to __skb_checksum(), skb_crc32c(): - Uses the correct type for CRC32C values (u32, not __wsum). - Does not require the caller to provide a skb_checksum_ops struct. - Is faster because it does not use indirect calls and does not use the very slow crc32c_combine(). According to commit 2817a336d4d5 ("net: skb_checksum: allow custom update/combine for walking skb") which added __skb_checksum(), the original motivation for the abstraction layer was to avoid code duplication for CRC32C and other checksums in the future. However: - No additional checksums showed up after CRC32C. __skb_checksum() is only used with the "regular" net checksum and CRC32C. - Indirect calls are expensive. Commit 2544af0344ba ("net: avoid indirect calls in L4 checksum calculation") worked around this using the INDIRECT_CALL_1 macro. But that only avoided the indirect call for the net checksum, and at the cost of an extra branch. - The checksums use different types (__wsum and u32), causing casts to be needed. - It made the checksums of fragments be combined (rather than chained) for both checksums, despite this being highly counterproductive for CRC32C due to how slow crc32c_combine() is. This can clearly be seen in commit 4c2f24549644 ("sctp: linearize early if it's not GSO") which tried to work around this performance bug. With a dedicated function for each checksum, we can instead just use the proper strategy for each checksum. As shown by the following tables, the new function skb_crc32c() is faster than __skb_checksum(), with the improvement varying greatly from 5% to 2500% depending on the case. The largest improvements come from fragmented packets, mainly due to eliminating the inefficient crc32c_combine(). But linear packets are improved too, especially shorter ones, mainly due to eliminating indirect calls. These benchmarks were done on AMD Zen 5. On that CPU, Linux uses IBRS instead of retpoline; an even greater improvement might be seen with retpoline: Linear sk_buffs Length in bytes __skb_checksum cycles skb_crc32c cycles =============== ===================== ================= 64 43 18 256 94 77 1420 204 161 16384 1735 1642 Nonlinear sk_buffs (even split between head and one fragment) Length in bytes __skb_checksum cycles skb_crc32c cycles =============== ===================== ================= 64 579 22 256 829 77 1420 1506 194 16384 4365 1682 Signed-off-by: Eric Biggers Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20250519175012.36581-3-ebiggers@kernel.org Signed-off-by: Jakub Kicinski commit 55d22ee0358597185f8f5272558ec7cf1a49eb41 Author: Eric Biggers Date: Mon May 19 10:50:03 2025 -0700 net: introduce CONFIG_NET_CRC32C Add a hidden kconfig symbol NET_CRC32C that will group together the functions that calculate CRC32C checksums of packets, so that these don't have to be built into NET-enabled kernels that don't need them. Make skb_crc32c_csum_help() (which is called only when IP_SCTP is enabled) conditional on this symbol, and make IP_SCTP select it. Signed-off-by: Eric Biggers Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20250519175012.36581-2-ebiggers@kernel.org Signed-off-by: Jakub Kicinski commit 51ebe6b14f669019a9e59e315d7c460065468f8e Merge: e6b3527c3b0a67 4e4dc6db2b92bc Author: Jakub Kicinski Date: Wed May 21 15:38:43 2025 -0700 Merge branch 'tools-ynl-gen-add-support-for-inherited-selector-and-therefore-tc' Jakub Kicinski says: ==================== tools: ynl-gen: add support for "inherited" selector and therefore TC Add C codegen support for constructs needed by TC, namely passing sub-message selector from a lower nest, and sub-messages with fixed headers. ==================== Link: https://patch.msgid.link/20250520161916.413298-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit b5125e69fb6c6e0d073a9cf10c80aef28f2c6ad6 Merge: 13649a41bec2f0 654ac800d4ac6b Author: Arnd Bergmann Date: Thu May 22 00:15:20 2025 +0200 Merge tag 'qcom-arm64-for-6.16-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt More Qualcomm Arm64 DeviceTree updates for v6.16 Support for CPU frequency scaling is enabled on the X Elite platform. Also on X Elite, support for the HP EliteBook Ultra G1q is introduced. Support for the QCS6490 RB3gen2 Industrial Mezzanine is also added. PCIe controllers and PHYs are described and enabled across IPQ5018, IPQ5332, and IPQ5424. On IPQ9474 the missing MHI register range is added. The TCSR block is described and used to enable download mode flags on IPQ5018. The venus video encoder/decoder is enabled on the MSM8998-based Lenovo Miix 630 laptop. The crypto engine is enabled on QCM2290 and QCS615. Bluetooth is enabled on the QCM2210-based RB1 board. The Fairphone FP5 gains Displayport sound support. SAR2130P display nodes are added. On 8cx Gen3 the sensor remoteproc (SLPI) is introduced and this is enabled on Lenovo Thinkpad X13s and the CRD. The SDM845-based Samsung Galaxy S9 gains graphics, modem and initial sound support. On SDX75 the QPIC BAM and NAND support is added, and these are enabled on the IDP board. LLCC is added for SM8750. SM8550 gains Iris video decoder support. For X Elite, Lenovo ThinkPad T14s support for the SDX62 modem, as well as audio headset, is added. ASUS Vivobook S 15 gains Bluetooth support, Microsoft Surface Laptop 7 models gets support for DP over USB Type-C, HP Omnibook X 14 gains audio support. The devkit gets the USB multiport controller and the two USB Type-A ports described. Additionally a variety of Devicetree fixes are introduced, primarily identified through binding validation. * tag 'qcom-arm64-for-6.16-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (58 commits) arm64: dts: qcom: sm4450: Add RPMh power domains support arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: add retimers, dp altmode support arm64: dts: qcom: ipq5424: Enable PCIe PHYs and controllers arm64: dts: qcom: ipq5424: Add PCIe PHYs and controller nodes arm64: dts: qcom: sc7280: Mark FastRPC context banks as dma-coherent arm64: dts: qcom: sdx75-idp: Enable QPIC BAM & QPIC NAND support arm64: dts: qcom: sdx75: Add QPIC NAND support arm64: dts: qcom: sdx75: Add QPIC BAM support arm64: dts: qcom: qcm2290: Add crypto engine arm64: dts: qcom: x1e80100-vivobook-s15: Add bluetooth arm64: dts: qcom: x1e80100: Add PCIe lane equalization preset properties arm64: dts: qcom: qcs615: Fix up UFS clocks arm64: dts: qcom: sa8775p: Clean up the PSCI PDs arm64: dts: qcom: msm8996-oneplus: Add SLPI VDD_PX arm64: dts: qcom: sm6350-pdx213: Wire up USB regulators arm64: dts: qcom: msm8998-yoshino: Add QUSB2PHY VDD supply arm64: dts: qcom: msm8998-mtp: Add QUSB2PHY VDD supply arm64: dts: qcom: msm8998-fxtec: Add QUSB2PHY VDD supply arm64: dts: qcom: qcs615: Remove disallowed property from AOSS_QMP node arm64: dts: qcom: msm8998: Remove mdss_hdmi_phy phandle argument ... Link: https://lore.kernel.org/r/20250520024248.38904-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 13649a41bec2f09c747e3fa1634d56eb19992c02 Merge: 9896dde15a677e b2c547cffe2f67 Author: Arnd Bergmann Date: Thu May 22 00:14:35 2025 +0200 Merge tag 'qcom-arm32-for-6.16-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt More Arm32 DeviceTree updates for v6.16 This adds missing LVDS clocks to APQ8064 display controller. The unused HDMI HPD gpio on ifc6410 is dropped (chip uses pinmuxed hpd function). Missing timer clocks are added to MSM8960 to address bindings warning. * tag 'qcom-arm32-for-6.16-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: ARM: dts: qcom: apq8064-ifc6410: drop HDMI HPD GPIO ARM: dts: qcom: apq8064: link LVDS clocks ARM: dts: qcom-msm8960: add missing clocks to the timer node Link: https://lore.kernel.org/r/20250520024716.39418-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 9896dde15a677e16da76965b8ddee93f2d5e493e Merge: 1e1ce25fb70d6b 99af08feb7fad3 Author: Arnd Bergmann Date: Thu May 22 00:12:54 2025 +0200 Merge tag 'mtk-dts64-for-v6.16-2' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/dt Additional MediaTek ARM64 DTS updates for v6.16 This addresses devicetree binding warnings happening on the MDP3 nodes in mt8188 dts, reverts the commit adding the SCP firmware-name as strongly suggested by Arnd, and also adds some more late commits. In particular: - MT6359 PMIC - Renamed PMIC RTC node to fix dtbs_check warning - MT7988(A) - Support for SPI controllers was added to SoC and BPI-R4 - Support for XSPHY, USB and PCIe2 was added as well - Fan and cooling maps were added to BPI-R4 machine - Added BananaPi R4 2G5 machine variant - MT8365 - Added touchscreen support to MT8365 Genio EVK - MT8188 - Addressed dtbs_check warnings for MDP3 nodes - MT8390 (Genio) - Reverted SCP firmware-name addition * tag 'mtk-dts64-for-v6.16-2' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux: (42 commits) Revert "arm64: dts: mediatek: mt8390-genio-common: Add firmware-name for scp0" arm64: dts: mediatek: mt8188: Address binding warnings for MDP3 nodes arm64: dts: mt6359: Rename RTC node to match binding expectations arm64: dts: mt8365-evk: Add goodix touchscreen support arm64: dts: mediatek: mt8188: Add missing #reset-cells property arm64: dts: airoha: en7581: Add PCIe nodes to EN7581 SoC evaluation board arm64: dts: airoha: en7581: Add gpio-ranges property for gpio controller arm64: dts: mediatek: mt7988a-bpi-r4: configure spi-nodes arm64: dts: mediatek: mt7988a-bpi-r4: Add fan and coolingmaps arm64: dts: mediatek: mt7988: add phy calibration efuse subnodes arm64: dts: mediatek: mt7988: move uart0 and spi1 pins to soc dtsi arm64: dts: mediatek: mt7988: add spi controllers arm64: dts: mediatek: mt7988a-bpi-r4: enable xsphy arm64: dts: mediatek: mt7988: Add xsphy for ssusb0/pcie2 arm64: dts: mediatek: mt7988a-bpi-r4: allow hw variants of bpi-r4 dt-bindings: arm: mediatek: add bpi-r4 2g5 phy variant arm64: dts: mt6359: Add missing 'compatible' property to regulators node arm/arm64: dts: mediatek: Add missing "#sound-dai-cells" to linux,bt-sco arm64: dts: mediatek: mt8390-genio-common: Set ssusb2 default dual role mode to host arm64: dts: mediatek: mt8395-genio-1200-evk: Disable unused backlight ... Link: https://lore.kernel.org/r/20250520114356.1194450-1-angelogioacchino.delregno@collabora.com Signed-off-by: Arnd Bergmann commit 1e1ce25fb70d6b0505a5b59fce7bf89943865fc0 Merge: f9930aef2c86c3 9e010737dd434e Author: Arnd Bergmann Date: Thu May 22 00:11:16 2025 +0200 Merge tag 'v6.16-rockchip-dts32-2' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt RK3036 usbphy addition and two Sonoff iHost adjustments. * tag 'v6.16-rockchip-dts32-2' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: ARM: dts: rockchip: add rk3036 usb2phy nodes and enable them on kylin ARM: dts: rockchip: Sonoff-iHost: correct IO domain voltages ARM: dts: rockchip: Sonoff-iHost: adjust SDIO for stability Link: https://lore.kernel.org/r/3652020.5fSG56mABF@phil Signed-off-by: Arnd Bergmann commit f9930aef2c86c3a4bcec1aff9617cbc85de146c4 Merge: b9e82beb37eb65 dfab90b9580c2f Author: Arnd Bergmann Date: Thu May 22 00:10:10 2025 +0200 Merge tag 'v6.16-rockchip-dts64-3' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt Power-domains needed for stability, dropping of unnecessary assigned-clocks (handled by cpufreq) and fixes for dtc W=1 warnings. * tag 'v6.16-rockchip-dts64-3' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: arm64: dts: rockchip: move rk3562 pinctrl node outside the soc node arm64: dts: rockchip: fix rk3562 pcie unit addresses arm64: dts: rockchip: move rk3528 pinctrl node outside the soc node arm64: dts: rockchip: remove a double-empty line from rk3576 core dtsi arm64: dts: rockchip: move rk3576 pinctrl node outside the soc node arm64: dts: rockchip: fix rk3576 pcie unit addresses arm64: dts: rockchip: Drop assigned-clock* from cpu nodes on rk3588 arm64: dts: rockchip: Add missing SFC power-domains to rk3576 Link: https://lore.kernel.org/r/4798229.ejJDZkT8p0@phil Signed-off-by: Arnd Bergmann commit b9e82beb37eb65da4b4c6b82bdc0f270a0979407 Merge: ebe6d8f00d8f1e 1631cbdb808963 Author: Arnd Bergmann Date: Thu May 22 00:09:51 2025 +0200 Merge tag 'v6.16-rockchip-dts64-2' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt New SoC the RK3562 (4xA53, Mali-G52) with one evaluation board. New boards: - Cobra and PP1516 from Theobroma-Systems (build around the PX30) - Radxa Rock 5B+ (rk3588) - Rockchip RK3399 industrial eval board New peripherals: - GMAC + SDMMC/SDIO on rk3528 - SAI + HDMI-audio on rk3576 Interesting general updates: - move rk3528 i2c + uart aliases as requested - rk3568 PCIe3 MSI to use GIC ITS - update deprecated dwmac reset properties on some px30 boards - updates for cypress usb hubs on some Theobroma boards Binding taken with Greg's blessing https://lore.kernel.org/all/2025051550-polish-prude-ed56@gregkh/ * tag 'v6.16-rockchip-dts64-2' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: (35 commits) arm64: dts: rockchip: Improve LED config for NanoPi R5S arm64: dts: rockchip: add px30-pp1516 base dtsi and board variants dt-bindings: arm: rockchip: add PX30-PP1516 boards from Theobroma Systems arm64: dts: rockchip: add px30-cobra base dtsi and board variants dt-bindings: arm: rockchip: add PX30-Cobra boards from Theobroma Systems arm64: dts: rockchip: move reset to dedicated eth-phy node on ringneck arm64: dts: rockchip: add basic mdio node to px30 arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma dt-bindings: usb: cypress,hx3: Add support for all variants arm64: dts: rockchip: move rk3528 i2c+uart aliases to board files arm64: dts: rockchip: drop wrong spdif clock from edp1 on rk3588 arm64: dts: rockchip: Add RK3562 evb2 devicetree arm64: dts: rockchip: add core dtsi for RK3562 SoC dt-bindings: arm: rockchip: Add rk3562 evb2 board dt-bindings: soc: rockchip: Add rk3562 syscon compatibles dt-bindings: rockchip: pmu: Add rk3562 compatible arm64: dts: rockchip: Enable Ethernet controller on Radxa E20C arm64: dts: rockchip: Add GMAC nodes for RK3528 ... Link: https://lore.kernel.org/r/3998939.iIbC2pHGDl@phil Signed-off-by: Arnd Bergmann commit ebe6d8f00d8f1e47702ed63a67507d257dee1a45 Merge: 591ad24c6cda67 9179e4a26bf257 Author: Arnd Bergmann Date: Thu May 22 00:07:27 2025 +0200 Merge tag 'mvebu-dt64-6.16-1' of https://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu into soc/dt mvebu dt64 for 6.16 (part 1) Clean up unused pinctrl-names in pca9555 nodes * tag 'mvebu-dt64-6.16-1' of https://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu: arm64: dts: marvell: Drop unused "pinctrl-names" Link: https://lore.kernel.org/r/87tt5kpqy9.fsf@BLaptop.bootlin.com Signed-off-by: Arnd Bergmann commit 591ad24c6cda6756aec0bbfd2e719fc020bfec17 Merge: 17e6320b0d0f43 652eea251dd852 Author: Arnd Bergmann Date: Thu May 22 00:02:03 2025 +0200 Merge tag 'renesas-dts-for-v6.16-tag4' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/dt Renesas DTS updates for v6.16 (take four) - Fix White Hawk ARD Audio breakage. * tag 'renesas-dts-for-v6.16-tag4' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups Link: https://lore.kernel.org/r/cover.1747817851.git.geert+renesas@glider.be Signed-off-by: Arnd Bergmann commit 17e6320b0d0f435f0d136602218b7815043d589e Merge: 00000994fe3226 1064013303c6dd Author: Arnd Bergmann Date: Wed May 21 23:59:55 2025 +0200 Merge tag 'renesas-dts-for-v6.16-tag3' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/dt Renesas DTS updates for v6.16 (take three) - Silence a DTC warning, - Add an extra compatible value to avoid future issues. * tag 'renesas-dts-for-v6.16-tag3' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: riscv: dts: renesas: Add specific RZ/Five cache compatible arm64: dts: renesas: sparrow-hawk: Disable dtc spi_bus_bridge check Link: https://lore.kernel.org/r/cover.1747399860.git.geert+renesas@glider.be Signed-off-by: Arnd Bergmann commit 00000994fe32264d45e4e011d258779bfb26f6b0 Merge: ced334a21c58dd d50108706a63df Author: Arnd Bergmann Date: Wed May 21 23:57:48 2025 +0200 Merge tag 'riscv-dt-for-v6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/dt RISC-V Devicetrees for v6.16 Starfive: All Starfive this time (again), enabling the usb3 port on the framework laptop mainboard, and a few cleanup patches that are syncing things with the dts used by U-Boot. Signed-off-by: Conor Dooley * tag 'riscv-dt-for-v6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: riscv: dts: starfive: jh7110-common: bootph-pre-ram hinting needed by boot loader riscv: dts: starfive: jh7110-common: add eeprom node to i2c5 riscv: dts: starfive: jh7110-common: qspi flash setting read-delay 2 cycles max 100MHz riscv: dts: starfive: jh7110-common: add CPU BUS PERH QSPI clocks to syscrg riscv: dts: starfive: jh7110-common: use macros for MMC0 pins riscv: dts: starfive: fml13v01: enable USB 3.0 port Link: https://lore.kernel.org/r/20250516-gap-exploring-f8f516ab4e1c@spud Signed-off-by: Arnd Bergmann commit ced334a21c58dd7e35f39ea2992419cbd92b1849 Merge: ea15963b2653b0 ec32344d2a3b84 Author: Arnd Bergmann Date: Wed May 21 23:57:19 2025 +0200 Merge tag 'microchip-dt64-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into soc/dt Microchip ARM64 device tree updates for v6.16 This update includes: - fix CPU node "enable-method" property dependencies * tag 'microchip-dt64-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: arm64: dts: microchip: sparx5: Fix CPU node "enable-method" property dependencies Link: https://lore.kernel.org/r/20250516055607.11248-1-claudiu.beznea@tuxon.dev Signed-off-by: Arnd Bergmann commit ea15963b2653b0adfdabf82a54f036a62e513272 Merge: 0feaf3c056b883 36e9e1ab594519 Author: Arnd Bergmann Date: Wed May 21 23:55:13 2025 +0200 Merge tag 'at91-dt-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into soc/dt Microchip AT91 device tree updates for v6.16 This update includes: - more controllers enabled for SAMA7D65 SoC (Ethernet, Flexcoms, SRAM, DRAM, RTC, RTT, GBPR) - cleanups and fixes for Calao boards * tag 'at91-dt-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: dts: microchip: sama7g54_curiosity: Add fixed-partitions for spi-nor flash ARM: dts: microchip: sama7d65: Add RTT timer to curiosity board ARM: dts: microchip: sama7d65: Add RTT and GPBR Support for sama7d65 SoC ARM: dts: microchip: sama7d65: Add SRAM and DRAM components support ARM: dts: microchip: sama7d65_curiosity: add EEPROM ARM: dts: microchip: sama7d65: Add MCP16502 to sama7d65 curiosity ARM: dts: microchip: sama7d65: Enable GMAC interface ARM: dts: microchip: sama7d65: Add FLEXCOMs to sama7d65 SoC ARM: dts: microchip: sama7d65: Add gmac interfaces for sama7d65 SoC ARM: dts: at91: at91sam9263: fix NAND chip selects ARM: dts: at91: usb_a9g20: move wrong RTC node ARM: dts: at91: calao_usb: simplify chosen node ARM: dts: at91: usb_a9260: use 'stdout-path' ARM: dts: at91: calao_usb: simplify memory node ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select ARM: dts: at91: usb_a9g20: add SPI EEPROM Link: https://lore.kernel.org/r/20250516055330.10852-1-claudiu.beznea@tuxon.dev Signed-off-by: Arnd Bergmann commit 0feaf3c056b88351d13ec527be89262aeec7b96f Merge: 38181494e45aa0 a3cd12acb7b74d Author: Arnd Bergmann Date: Wed May 21 23:52:34 2025 +0200 Merge tag 'sunxi-dt-for-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/dt Allwinner device tree changes for 6.16 Introduce Allwinner A523 / A527 / T527 SoC family w/ three new devices: - Radxa Cubie A5E - X96Q-Pro+ - Avaota-A1 Also enable EMAC0 ethernet MAC on A523 family for Cubie A5E & Avaota-A1. Note: the SoC has two different ethernet controllers. Changes to existing SoCs: - Enable GPU on H616 with all boards enabled - Set maximum MMC frequency for the A100 Changes to existing boards: - Add WiFi/BT header on PINE64 A64 boards - Add hp-det-gpios for Anbernic RG35XX - Add support for PHY LEDs on Bananapi (the original one) Add new devices for existing SoCs: - YuzukiHD Chameleon based on H6 - Liontron H-A133L based on A133 (compatible with A100) Tree wide cleanups: - Use preferred node names for cooling maps - Align wifi node name with bindings - Drop spurious 'clock-latency-ns' properties for H5 & H6 * tag 'sunxi-dt-for-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: (27 commits) arm64: dts: allwinner: a100: add Liontron H-A133L board support dt-bindings: arm: sunxi: Add Liontron H-A133L board name dt-bindings: vendor-prefixes: Add Liontron name ARM: dts: bananapi: add support for PHY LEDs arm64: dts: allwinner: a100: set maximum MMC frequency arm64: dts: allwinner: t527: add EMAC0 to Avaota-A1 board arm64: dts: allwinner: a527: add EMAC0 to Radxa A5E board arm64: dts: allwinner: a523: Add EMAC0 ethernet MAC dt-bindings: sram: sunxi-sram: Add A523 compatible arm64: dts: allwinner: a64: Add WiFi/BT header on SOPINE Baseboard arm64: dts: allwinner: a64: Add WiFi/BT header on PINE A64 arm64: dts: allwinner: correct the model name for Radxa Cubie A5E ARM: dts: allwinner: Align wifi node name with bindings arm64: dts: allwinner: Align wifi node name with bindings arm64: dts: allwinner: h616: enable Mali GPU for all boards arm64: dts: allwinner: h616: Add Mali GPU node arm64: dts: allwinner: h700: Add hp-det-gpios for Anbernic RG35XX arm64: dts: allwinner: h5/h6: Drop spurious 'clock-latency-ns' properties arm/arm64: dts: allwinner: Use preferred node names for cooling maps arm64: dts: allwinner: h616: add YuzukiHD Chameleon support ... Link: https://lore.kernel.org/r/aCaeZJ2t4S_xhgjp@wens.tw Signed-off-by: Arnd Bergmann commit 38181494e45aa09404b276022cb2fdc9111006d3 Merge: ba32d96e90c113 518e8ffa00c874 Author: Arnd Bergmann Date: Wed May 21 23:51:17 2025 +0200 Merge tag 'stm32-dt-for-v6.16-1' of https://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32 into soc/dt STM32 DT for v6.16, round 1 Highlights: ---------- - MCU: - Add low power timer on STM32F746 - Add STM32H747 High end MCU support. It embeds: - dual-core (Cortex-M7 + Cortex-M4) - up to 2 Mbytes flash - 1 Mbyte of internal RAM - Add STM32H747i-disco board support. Detailed information can be found at: https://www.st.com/en/evaluation-tools/stm32h747i-disco.html - MPU: - STM32MP13: - Add VREFINT calibration support based on ADC. - STMP32MP15: - Add new Ultratronik Fly board support: - based on STM32MP157C SoC - 1GB of DDR3 - Several connections are available on this boards: 2*USB2.0, 1*USB2.0 MiniUSB, Debug UART, 1*UART, 1*USART, SDcard, RJ45, ... - STM32MP25: - Add OCTOSPI support on STM32MP25 SoCs - Add SPI NOR flash support on STM32MP257F-EV1 connected to OSPI1 - Add Low power timer TIMER (LPTIM) on STM32MP25 SoCs and use LPTIM3 as low power broadcast timer on STM32MP257F-EV1. * tag 'stm32-dt-for-v6.16-1' of https://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32: (22 commits) ARM: dts: stm32: add initial support for stm32mp157-ultra-fly-sbc board MAINTAINERS: Add entry for ULTRATRONIK BOARD SUPPORT dt-bindings: arm: stm32: Document Ultratronik's Fly board DT binding dt-bindings: vendor-prefixes: Add Ultratronik arm64: dts: st: use lptimer3 as tick broadcast source on stm32mp257f-ev1 arm64: dts: st: add low-power timer nodes on stm32mp251 arm64: defconfig: enable STM32 LP timer clockevent driver arm64: dts: st: Add SPI NOR flash support on stm32mp257f-ev1 board arm64: dts: st: Add ospi port1 pinctrl entries in stm32mp25-pinctrl.dtsi arm64: dts: st: Add OMM node on stm32mp251 ARM: dts: stm32: support STM32h747i-disco board ARM: dts: stm32: add an extra pin map for USART1 on stm32h743 ARM: dts: stm32: add pin map for UART8 controller on stm32h743 ARM: dts: stm32: add uart8 node for stm32h743 MCU dt-bindings: clock: stm32h7: rename USART{7,8}_CK to UART{7,8}_CK ARM: stm32: add a new SoC - STM32H747 dt-bindings: arm: stm32: add compatible for stm32h747i-disco board ARM: dts: stm32h7-pinctrl: add _a suffix to u[s]art_pins phandles ARM: dts: st: stm32: Align wifi node name with bindings ARM: dts: stm32: add low power timer on STM32F746 ... Link: https://lore.kernel.org/r/2f101efb-6d58-48d8-983a-57e30a34827c@foss.st.com Signed-off-by: Arnd Bergmann commit ba32d96e90c113b8aa1b362c4cbb10a6bd1be62c Merge: 759dd3fea1d976 3aa64cd126b4fd Author: Arnd Bergmann Date: Wed May 21 23:48:02 2025 +0200 Merge tag 'spacemit-dt-for-6.16-1' of https://github.com/spacemit-com/linux into soc/dt RISC-V SpacemiT DT changes for 6.16 - Add clock driver, fix for pinctrl/uart - Add gpio support, enable LED heartbeat * tag 'spacemit-dt-for-6.16-1' of https://github.com/spacemit-com/linux: riscv: dts: spacemit: add gpio LED for system heartbeat riscv: dts: spacemit: add gpio support for K1 SoC riscv: dts: spacemit: Acquire clocks for UART riscv: dts: spacemit: Acquire clocks for pinctrl riscv: dts: spacemit: Add clock tree for SpacemiT K1 dt-bindings: clock: spacemit: Add spacemit,k1-pll dt-bindings: soc: spacemit: Add spacemit,k1-syscon Link: https://lore.kernel.org/r/20250514044841-GYA524674@gentoo Signed-off-by: Arnd Bergmann commit 759dd3fea1d97663c256960072554f2062aac86e Merge: 2b183108bcbdc8 f2420037d90a83 Author: Arnd Bergmann Date: Wed May 21 23:47:20 2025 +0200 Merge tag 'qcom-arm32-for-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt Qualcomm Arm32 DeviceTree updates for v6.16 Introduce support for the AP8064-based LG Nexus 4. MSM8226 is extended with modem-related features, the LTE-capable variant MSM8926 is introduced, and modem support is enabled on Samsung Galaxy Tab 4. Display-related clocks and power-domains are defined for the simple framebuffer of Motorola Moto G, to allow booting without clk_ignore_unused and pd_ignore_unused. On MSM8960 SDCC BAM and thermal sensor (tsens) is introduced. * tag 'qcom-arm32-for-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: ARM: dts: qcom: apq8064: move replicator out of soc node ARM: dts: qcom: apq8064: use new compatible for SPS SIC device ARM: dts: qcom: apq8064: use new compatible for SFPB device ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device ARM: dts: qcom: apq8064: add missing clocks to the timer node ARM: dts: qcom: apq8064-lg-nexus4-mako: Enable WiFi ARM: dts: qcom: msm8226-motorola-falcon: specify vddio_disp output voltage ARM: dts: qcom: msm8226-motorola-falcon: limit TPS65132 to 5.4V ARM: dts: qcom: msm8226-motorola-falcon: add I2C clock frequencies ARM: dts: qcom: msm8226-motorola-falcon: add clocks, power-domain to simpleFB ARM: dts: qcom: ipq4019: Drop redundant CPU "clock-latency" ARM: dts: qcom: sdx55/sdx65: Fix CPU power-domain-names ARM: dts: qcom: msm8974: Use the header with DSI phy clock IDs ARM: dts: qcom: msm8226: Use the header with DSI phy clock IDs Link: https://lore.kernel.org/r/20250513214111.43401-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 2b183108bcbdc8b4c06409a9ee616aeab6df40c9 Merge: 12a75f2d9f7317 e58afb3e1f365b Author: Arnd Bergmann Date: Wed May 21 23:46:02 2025 +0200 Merge tag 'dt-vt8500-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-dt into soc/dt VT8500 DTS ARM changes for v6.16 1. New board: VIA APC Rock/Paper. 2. Add SCC ID register/socinfo node. 3. List all timer interrupts. * tag 'dt-vt8500-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-dt: ARM: dts: vt8500: list all four timer interrupts ARM: dts: vt8500: add DT nodes for the system config ID register ARM: dts: vt8500: Add VIA APC Rock/Paper board dt-bindings: arm: vt8500: Add VIA APC Rock/Paper boards Link: https://lore.kernel.org/r/20250513104216.25803-5-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 12a75f2d9f73172161d096fc61cacc4989250604 Merge: c307e9c1a47298 a18226be95c7ae Author: Arnd Bergmann Date: Wed May 21 23:41:02 2025 +0200 Merge tag 'qcom-arm64-for-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt Qualcomm Arm64 DeviceTree updates for v6.16 The Snapdragon X Plus platform and related reference device is introduced. Devicetree for the Xiaomi Redmi Note 8 is added. Tsens and thermal zones are added for IPQ5332 and IPQ5424. IPQ6018 gains 1.2GHz and 1.5GHz CPU frequencies. The IPQ5424 gains MMC, LEDs and buttons, while the IPQ9574 gains NSS clock controller and SPI NAND support. IPQ6018 SMEM is transitioned to be described directly in the reserved-memory node. Display and GPU are enabled in the QCM6490-based Fairphone FP5. On QCS6490 Rb3Gen2 ADC channels for thermal profiling are added and Bluetooth is enabled. The USB Type-C orientation GPIO is added on the QCS6490 Rb3Gen2 and the vision mezzanine is described. The Fairphone FP5 gains touchscreen and USB Type-C display support, and the QCM6490 IDP board gains a required listed of protected clocks. The camera subsystem in SC7280 is described and UFS is transitioned to use operating points. On MSM8916, MSM8919 and MSM8939, and devices on these platforms, the UART pinctrl state is cleaned up. The MSM8953 platform gains another UART and interconnects. On SA8775P CTCU and ETR nodes are added, and the CPUfreq throttling interrupts are added. Samsung Galaxy S9 SM-G9600 gains a description of the MAX77705 used for charging, fuel gauge, haptic, and LED, as well as the PMIC used for display and touchscreen, which then is used to enable the touchscreen. The LPG/PWM node is added to PM8937 and Xiaomi Redmi 5A gains display backlight control. Display and GPU are enabled for the Nothing Phone (1). QCS615 platform gains command DB definition. The QCS8300 platform gains description of more QUP instances, CPUfreq, PCIe SMMU and the SPMI controller. On SAR2130P PCIe EP device nodes are added. On SDM630 missing resets are added for SDCC. Then on Fairphone FP3 modem is enabled, and firmware-path are defined on ADSP and WCNSS. The SDM845 RB3/DragonBoard845c and the QRB5165 RB5 has the sensors DSP enabled, and the vision mezzanine on both gets their CMA configuration cleaned up. Xiaomi Pocophone F1 gains touchscreen support. On the SM7325 Nothing Phone (1), display, GPU, and camera EEPROMs are described. On SM8450 the PCIe endpoint controller is described. For SM8550 OPP tables are described for PCIe and QUP. SM8750 gains RPMh sleep stats. SM8650 gians OSM L3 scaling and variety of OPP tables and missing interconnect definitions. The thermal trip points for CPU cores and GPU are raised in reliance on hardware throttling. SM8650 is also transitioned to per-CPU interrupt partitions, in order to properly describe the PMU interrupts. Missing Coresight ETE instances are added. On SM8750 the cluster idle states are corrected, then audio and compute DSPs are introduced, together with the crypto and rng blocks. Modem support is added and enabled on MTP and QRD devices. On SC8280XP overlays are introduced for those running Linux at EL2 on these devices. A few more temp-alarm instances are added for the PMICs. On the X Elite platform GPU cooling and watchdog is introduced, together with a number of smaller fixes. Dell XPS13 gains support for USB Type-C display, the QCP gains WiFi/BT power sequence, and a few devices learns about HBR3. The RTC support is enabled and regulators that are feeding resources that should be always on is marked as such on a variety of boards. The Lenovo Thinkpad T14s DeviceTree is split in two, in order to describe the LCD and OLED variants. Missing properties for the crypto BAM is introduced on a variety of platforms, taking care of a long standing error message in the kernel log during boot. DSI phy clock ids are transitioned to use identifiers from the PHY header file and VBIF region size is corrected, across a large number of platforms. A couple of DWC3 quirks are added across a lot of platforms. The arm32-for-6.15 pull request was accidentally merged into the arm64-for-6.16 branch and this wasn't discovered until a significant number of commits would have to be rebased. As such this is kept here as well. * tag 'qcom-arm64-for-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (308 commits) arm64: dts: qcom: sdm845-xiaomi-beryllium-ebbg: introduce touchscreen support arm64: dts: qcom: sdm845-xiaomi-beryllium-tianma: introduce touchscreen support arm64: dts: qcom: sdm845-xiaomi-beryllium-common: add touchscreen related nodes arm64: dts: qcom: qcs8300: add the pcie smmu node arm64: dts: qcom: x1e80100-*: Drop useless DP3 compatible override arm64: dts: qcom: msm8953: Add interconnects arm64: dts: qcom: msm8953: Add uart_5 arm64: dts: qcom: sm8350: Use q6asm defines for reg arm64: dts: qcom: sm7325-nothing-spacewar: Use q6asm defines for reg arm64: dts: qcom: sdm850*: Use q6asm defines for reg arm64: dts: qcom: sdm845*: Use q6asm defines for reg arm64: dts: qcom: sc7280: Use q6asm defines for reg arm64: dts: qcom: sc7180-acer-aspire1: Use q6asm defines for reg arm64: dts: qcom: qrb5165-rb5: Use q6asm defines for reg arm64: dts: qcom: msm8996*: Use q6asm defines for reg arm64: dts: qcom: msm8953: Use q6asm defines for reg arm64: dts: qcom: msm8916-modem-qdsp6: Use q6asm defines for reg arm64: dts: qcom: apq8096-db820c: Use q6asm defines for reg arm64: dts: qcom: qcm6490-fairphone-fp5: Hook up DisplayPort over USB-C arm64: dts: qcom: qcm6490-fairphone-fp5: Add OCP96011 audio switch ... Link: https://lore.kernel.org/r/20250511235241.15192-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit c307e9c1a472983b1485c058af33f63f8978e5f4 Merge: 7e1a0dfb3f5996 7efb8b92165fea Author: Arnd Bergmann Date: Wed May 21 23:28:23 2025 +0200 Merge tag 'nuvoton-arm-6.16-devicetree' of https://git.kernel.org/pub/scm/linux/kernel/git/joel/bmc into soc/dt Nuvoton ARM devicetree updates for v6.16 - MMC, OHCI, UDC and EDAC blocks added to the NPCM7XX DTSI - Fixes for GPIO hog names in the NPCM730 and RunBMC Olympus platforms * tag 'nuvoton-arm-6.16-devicetree' of https://git.kernel.org/pub/scm/linux/kernel/git/joel/bmc: ARM: dts: nuvoton: Add MMC Nodes ARM: dts: nuvoton: Add OHCI node ARM: dts: nuvoton: Add UDC nodes ARM: dts: nuvoton: Add EDAC node ARM: dts: nuvoton: Align GPIO hog name with bindings Link: https://lore.kernel.org/r/CACPK8Xe=f_hNNWUGL670x4-OeKgDB+2P+mxp5BaTLW==T5jE_A@mail.gmail.com Signed-off-by: Arnd Bergmann commit 4d1c69e53ea7ae344d2502474739719e63a79169 Merge: 07a3c038bd9cc3 936badf282388b Author: Arnd Bergmann Date: Wed May 21 23:16:12 2025 +0200 Merge tag 'qcom-drivers-for-6.16-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers More Qualcomm driver updates for v6.16 Allow HP EliteBook Ultra G1q to use QSSECOM for UEFI variable acecss. Add missing compatible for IPQ5018 TCSR block. Fix a kernel-doc warning in SCM driver. * tag 'qcom-drivers-for-6.16-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: docs: firmware: qcom_scm: Fix kernel-doc warning firmware: qcom: scm: Allow QSEECOM for HP EliteBook Ultra G1q dt-bindings: mfd: qcom,tcsr: Add compatible for ipq5018 Link: https://lore.kernel.org/r/20250520024916.39712-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 07a3c038bd9cc3af3536f0b3e06b5b5516ccaaf0 Merge: a65dc234cd690a 51b081cdb92377 Author: Arnd Bergmann Date: Wed May 21 23:14:37 2025 +0200 Merge tag 'riscv-cache-for-v6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/drivers RISC-V cache drivers for v6.16 SiFive: Add support for the Eswin EIC7700 SoC, which needs to make sure of the non-standard cache-ops provided by the ccache driver. Bindings: Conversions for two Marvell bindings to yaml, and additions of two soc-specific compatibles to the axm45mp bindings. Signed-off-by: Conor Dooley * tag 'riscv-cache-for-v6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: dt-bindings: cache: add QiLai compatible to ax45mp dt-bindings: cache: Convert marvell,tauros2-cache to DT schema dt-bindings: cache: Convert marvell,{feroceon,kirkwood}-cache to DT schema dt-bindings: cache: add specific RZ/Five compatible to ax45mp cache: sifive_ccache: Add ESWIN EIC7700 support dt-bindings: cache: sifive,ccache0: Add ESWIN EIC7700 SoC compatibility Link: https://lore.kernel.org/r/20250516-liability-facility-667fc14a2a85@spud Signed-off-by: Arnd Bergmann commit a65dc234cd690adde1949232dc538e6d07b833fb Merge: 7148b42e85420b 388d0cc33cc6fc Author: Arnd Bergmann Date: Wed May 21 23:13:49 2025 +0200 Merge tag 'memory-controller-drv-6.16-2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into soc/drivers Memory controller drivers for v6.16, part two Few fixes for STM32 Octo Memory Manager driver introduced for the same cycle in few commits before. These fixes were reported only after wider coverage by bots through linux-next exposure. * tag 'memory-controller-drv-6.16-2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl: memory: stm32_omm: Fix error handling in stm32_omm_disable_child() memory: stm32_omm: Fix NULL vs IS_ERR() check in probe() memory: stm32_omm: Fix error handling in stm32_omm_configure() memory: stm32: Fix spelling mistake "resset" -> "reset" Link: https://lore.kernel.org/r/20250516082415.7871-2-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 7148b42e85420bd0d8028a5c5c3611e1c59f6e1f Merge: f1706e0e1a74b0 598995027b9181 Author: Arnd Bergmann Date: Wed May 21 23:12:35 2025 +0200 Merge tag 'samsung-drivers-6.16-2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/drivers Samsung SoC drivers for v6.16, part two Add CPU hotplug support on Google GS101 by toggling respective bits in secondary PMU intr block (Power Management Unit (PMU) Interrupt Generation) from the main PMU driver. * tag 'samsung-drivers-6.16-2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: soc: samsung: exynos-pmu: enable CPU hotplug support for gs101 MAINTAINERS: Add google,gs101-pmu-intr-gen.yaml binding file dt-bindings: soc: samsung: exynos-pmu: gs101: add google,pmu-intr-gen phandle dt-bindings: soc: google: Add gs101-pmu-intr-gen binding documentation Link: https://lore.kernel.org/r/20250516082037.7248-2-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 7e1a0dfb3f5996c74cf39337ecd958342bffe442 Author: William A. Kennington III Date: Thu May 15 16:15:54 2025 +0930 arm64: dts: nuvoton: Add pinctrl This is critical to support multifunction pins shared between devices as well as generic GPIOs. Signed-off-by: William A. Kennington III Link: https://patch.msgid.link/20250416015902.2091251-1-william@wkennington.com Signed-off-by: Andrew Jeffery Link: https://lore.kernel.org/r/20250515-nuvoton-arm64-dt-v1-1-25769b8c1509@codeconstruct.com.au Signed-off-by: Arnd Bergmann commit f1706e0e1a74b095cbc60375b9b1e6205f5f4c98 Author: Henry Martin Date: Thu May 15 16:00:44 2025 +0930 soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() devm_kasprintf() returns NULL when memory allocation fails. Currently, aspeed_lpc_enable_snoop() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to prevent this issue. Fixes: 3772e5da4454 ("drivers/misc: Aspeed LPC snoop output using misc chardev") Signed-off-by: Henry Martin Link: https://patch.msgid.link/20250401074647.21300-1-bsdhenrymartin@gmail.com [arj: Fix Fixes: tag to use subject from 3772e5da4454] Signed-off-by: Andrew Jeffery Signed-off-by: Arnd Bergmann commit d9f0a97e859bdcef51f9c187b1eb712eb13fd3ff Author: Su Hui Date: Thu May 15 16:00:43 2025 +0930 soc: aspeed: lpc: Fix impossible judgment condition smatch error： drivers/soc/aspeed/aspeed-lpc-snoop.c:169 aspeed_lpc_snoop_config_irq() warn: platform_get_irq() does not return zero platform_get_irq() return non-zero IRQ number or negative error code, change '!lpc_snoop->irq' to 'lpc_snoop->irq < 0' to fix this. Fixes: 9f4f9ae81d0a ("drivers/misc: add Aspeed LPC snoop driver") Signed-off-by: Su Hui Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/20231027020703.1231875-1-suhui@nfschina.com Signed-off-by: Andrew Jeffery Signed-off-by: Arnd Bergmann commit e4f59f873c3ffe2a0150e11115a83e2dfb671dbf Author: Joel Stanley Date: Thu May 15 16:00:42 2025 +0930 ARM: aspeed: Don't select SRAM The ASPEED devices have SRAM, but don't require it for basic function (or any function; there's no known users of the driver). Fixes: 8c2ed9bcfbeb ("arm: Add Aspeed machine") Signed-off-by: Joel Stanley Link: https://patch.msgid.link/20250115103942.421429-1-joel@jms.id.au Signed-off-by: Andrew Jeffery Signed-off-by: Arnd Bergmann commit 886bb3624e4c9914a943b63fcfdf30b8d2f2b66e Author: Baochen Qiang Date: Wed May 21 22:29:31 2025 +0530 wifi: ath12k: fix regdomain update failure when connection establishes Commit 7ed3e88664e3 ("wifi: ath12k: update regulatory rules when connection established") introduced a call to ath12k_reg_handle_chan_list() upon connection to update the regulatory domain in cfg80211 based on the power type received from the AP. However, this update fails because ah->regd_updated was already set to true during the earlier regulatory update triggered when the interface was added. To resolve this, reset ah->regd_updated before calling ath12k_reg_handle_chan_list() to ensure the update proceeds correctly. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 Fixes: 7ed3e88664e3 ("wifi: ath12k: update regulatory rules when connection established") Signed-off-by: Baochen Qiang Signed-off-by: Aditya Kumar Singh Link: https://patch.msgid.link/20250521-ath12k-fix-ah-regd_updated-v1-3-9737de5bf98e@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 37e775a0a9d79a031d28d9e21480f99f448e9215 Author: Baochen Qiang Date: Wed May 21 22:29:30 2025 +0530 wifi: ath12k: fix regdomain update failure when adding interface Commit 4c546023d71a ("wifi: ath12k: update regulatory rules when interface added"), introduced a call to ath12k_reg_handle_chan_list() during interface addition to update the regulatory domain based on the interface type. While this works initially, subsequent updates (e.g., after an interface delete/re-add cycle) fail because ah->regd_updated is never reset. To address this, reset ah->regd_updated before calling ath12k_reg_handle_chan_list() to allow the update to proceed. However, this change exposes another issue: a timeout occurs when waiting for the 11D scan to complete, as seen in the log: ath12k_pci 0000:05:00.0: failed to receive 11d scan complete: timed out This happens because during interface down, ar->state_11d is set to ATH12K_11D_PREPARING, and during interface up, the host waits for ar->completed_11d_scan even though the scan hasn't started yet. Fix this by updating the wait condition to check for ATH12K_11D_RUNNING, which is the only state where a scan complete event is expected. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 Fixes: 4c546023d71a ("wifi: ath12k: update regulatory rules when interface added") Signed-off-by: Baochen Qiang Signed-off-by: Aditya Kumar Singh Link: https://patch.msgid.link/20250521-ath12k-fix-ah-regd_updated-v1-2-9737de5bf98e@oss.qualcomm.com Signed-off-by: Jeff Johnson commit d662c14a51910ba0ad66afd248b601ba30b9f7f1 Author: Baochen Qiang Date: Wed May 21 22:29:29 2025 +0530 wifi: ath12k: fix regdomain update failure after 11D scan completes In the current implementation of ath12k_regd_update(), the ah->regd_updated flag is used to ensure that the regulatory domain is updated only once per radio. During MAC registration, this function is called to push the default regulatory domain to cfg80211. At that point, the hardware state is not on and hence ah->regd_updated remains false. However, after commit 4c546023d71a ("wifi: ath12k: update regulatory rules when interface added"), ath12k_reg_handle_chan_list() is invoked when an interface is added, which in turn calls ath12k_regd_update(). By this time, hardware state is on and consecutively ah->regd_updated becomes true. Later, when the 11D scan completes and a new regulatory domain is received from the firmware, the host attempts to update cfg80211 again via ath12k_regd_update(). But since ah->regd_updated is already true, the update is skipped. >From the user's perspective, this results in a failure to connect to 6 GHz APs, as the default regulatory domain (the only one pushed to cfg80211) does not include 6 GHz support. To resolve this, reset the ah->regd_updated flag when handling the 11D regulatory domain update. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 Fixes: 591de41d7008 ("wifi: ath12k: add 11d scan offload support") Signed-off-by: Baochen Qiang Signed-off-by: Aditya Kumar Singh Link: https://patch.msgid.link/20250521-ath12k-fix-ah-regd_updated-v1-1-9737de5bf98e@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 0c905cadf38b49d53deee25819f0eaa46091c83a Merge: 922607a2b462b8 6c9bb86922728c Author: Rafael J. Wysocki Date: Wed May 21 22:49:34 2025 +0200 Merge tag 'cpufreq-arm-updates-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Merge ARM CPUFreq updates for 6.16 from Viresh Kumar: "- Rust abstractions for CPUFreq framework (Viresh Kumar). - Rust abstractions for OPP framework (Viresh Kumar). - Basic Rust abstractions for Clk and Cpumask frameworks (Viresh Kumar). - Minor cleanup to the SCMI cpufreq driver (Mike Tipton)." * tag 'cpufreq-arm-updates-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: (24 commits) cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs cpufreq: Add Rust-based cpufreq-dt driver rust: opp: Extend OPP abstractions with cpufreq support rust: cpufreq: Extend abstractions for driver registration rust: cpufreq: Extend abstractions for policy and driver ops rust: cpufreq: Add initial abstractions for cpufreq framework rust: opp: Add abstractions for the configuration options rust: opp: Add abstractions for the OPP table rust: opp: Add initial abstractions for OPP framework rust: cpu: Add from_cpu() rust: macros: enable use of hyphens in module names rust: clk: Add initial abstractions rust: clk: Add helpers for Rust code MAINTAINERS: Add entry for Rust cpumask API rust: cpumask: Add initial abstractions rust: cpumask: Add few more helpers rust: devres: require a bound device rust: pci: move iomap_region() to impl Device rust: device: implement Bound device context rust: pci: preserve device context in AsRef ... commit 922607a2b462b813c4b461feca04aed0c97d4cfe Author: Lifeng Zheng Date: Wed May 7 11:19:41 2025 +0800 cpufreq: CPPC: Add support for autonomous selection Add sysfs interfaces for CPPC autonomous selection in the cppc_cpufreq driver. Signed-off-by: Lifeng Zheng Reviewed-by: Sumit Gupta Acked-by: Viresh Kumar Link: https://patch.msgid.link/20250507031941.2812701-1-zhenglifeng1@huawei.com [ rjw: Subject edits ] Signed-off-by: Rafael J. Wysocki commit 9172dbf3a6d30fb80aa2f550003961450bb4c0bb Author: Ming Lei Date: Wed May 21 10:54:59 2025 +0800 ublk: handle ublk_set_auto_buf_reg() failure correctly in ublk_fetch() If ublk_set_auto_buf_reg() fails, we need to unlock and return, otherwise `ub->mutex` is leaked. Fixes: 99c1e4eb6a3f ("ublk: register buffer to local io_uring with provided buf index via UBLK_F_AUTO_BUF_REG") Reported-by: Caleb Sander Mateos Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250521025502.71041-2-ming.lei@redhat.com Reviewed-by: Caleb Sander Mateos Signed-off-by: Jens Axboe commit 1da98dc52b948a6063415d8bae0c60ef89044a8c Author: Bowen Yu Date: Mon May 19 15:09:38 2025 +0800 cpufreq: Update sscanf() to kstrtouint() In store_scaling_setspeed(), sscanf is still used to read to sysfs. Newer kstrtox provide more features including overflow protection, better errorhandling and allows for other systems of numeration. It is therefore better to update sscanf() to kstrtouint(). Signed-off-by: Bowen Yu Acked-by: Viresh Kumar Link: https://patch.msgid.link/20250519070938.931396-1-yubowen8@huawei.com Signed-off-by: Rafael J. Wysocki commit 9c5075fc9d322670d4a82881bf41922a90fe423a Author: Bowen Yu Date: Mon May 19 15:09:08 2025 +0800 cpufreq: Replace magic number Setting the length of str_governor with a magic number could cause overflow when max length increases, it is better to use the defined macro in this case. Signed-off-by: Bowen Yu Acked-by: Viresh Kumar Link: https://patch.msgid.link/20250519070908.930879-1-yubowen8@huawei.com Signed-off-by: Rafael J. Wysocki commit c597ce56e9078c6fc27e44470e4c699bac2d3027 Author: Daniel Dadap Date: Wed May 21 09:38:36 2025 -0500 ALSA: hda/tegra: Switch to two-argument strscpy() strscpy() is used in this driver with char[] struct member destinations, so it is possible to use the simplified two-argument variant which was added by commit e6584c3964f2 ("string: Allow 2-argument strscpy()"). Signed-off-by: Daniel Dadap Link: https://patch.msgid.link/aC3lbOTYxWvYR9dl@ddadap-lakeline.nvidia.com Signed-off-by: Takashi Iwai commit 4b214c9bbe26b2d86fd20a5548ac3733fcf36f21 Author: Daniel Dadap Date: Wed May 21 09:35:29 2025 -0500 ALSA: hda - Add new driver for HDA controllers listed via ACPI Some systems expose HD-Audio controllers via objects in the ACPI tables which encapsulate the controller's interrupt and the base address for the HDA registers in an ACPI _CRS object, for example, as listed in this ACPI table dump excerpt: Device (HDA0) { Name (_HID, "NVDA2014") // _HID: Hardware ID ... Name (_CRS, ResourceTemplate () // _CRS: Current Resource Settings { Memory32Fixed (ReadWrite, 0x36078000, // Address Base 0x00008000, // Address Length ) Interrupt (ResourceConsumer, Level, ActiveHigh, Exclusive, ,, ) { 0x0000021E, } }) } Add support for HDA controllers discovered through ACPI, including support for some platforms which expose such HDA controllers on NVIDIA SoCs. This is done with a new driver which uses existing infrastructure for extracting resource information from _CRS objects and plumbs the parsed resource information through to the existing HDA infrastructure to enable HD-Audio functionality on such devices. Although this driver is in the sound/pci/hda/ directory, it targets devices which are not actually enumerated on the PCI bus. This is because it depends upon the Intel "Azalia" infrastructure which has traditionally been usedvfor PCI-based devices. Signed-off-by: Daniel Dadap Link: https://patch.msgid.link/aC3ksXJUM9DlKiz6@ddadap-lakeline.nvidia.com Signed-off-by: Takashi Iwai commit 4e4dc6db2b92bced802bdc19c8ef46a1821151be Author: Jakub Kicinski Date: Tue May 20 09:19:16 2025 -0700 tools: ynl: add a sample for TC Add a very simple TC dump sample with decoding of fq_codel attrs: # ./tools/net/ynl/samples/tc dummy0: fq_codel limit: 10240p target: 5ms new_flow_cnt: 0 proving that selector passing (for stats) works. Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250520161916.413298-13-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 33baf6f73a7ce7ca6a05f9ac2c0758f34f04a423 Author: Jakub Kicinski Date: Tue May 20 09:19:15 2025 -0700 netlink: specs: tc: add qdisc dump to TC spec Hook TC qdisc dump in the TC qdisc get, it only supported doit until now and dumping will be used by the sample code. Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250520161916.413298-12-kuba@kernel.org Signed-off-by: Jakub Kicinski commit e06c9d25159c0b12518c68ffe3e400d49d5284e0 Author: Jakub Kicinski Date: Tue May 20 09:19:14 2025 -0700 tools: ynl: enable codegen for TC We are ready to support most of TC. Enable C code gen. Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250520161916.413298-11-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 4e9806a8f49463074f9a5797c34e0740f4602910 Author: Jakub Kicinski Date: Tue May 20 09:19:13 2025 -0700 tools: ynl-gen: support weird sub-message formats TC uses all possible sub-message formats: - nested attrs - fixed headers + nested attrs - fixed headers - empty Nested attrs are already supported for rt-link. Add support for remaining 3. The empty and fixed headers ones are fairly trivial, we can fake a Binary or Flags type instead of a Nest. For fixed headers + nest we need to teach nest parsing and nest put to handle fixed headers. Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250520161916.413298-10-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 092b34b937353eaa6164ceb1f520b1f640aee54f Author: Jakub Kicinski Date: Tue May 20 09:19:12 2025 -0700 tools: ynl-gen: support local attrs in _multi_parse The _multi_parse() helper calls the _attr_get() method of each attr, but it only respects what code the helper wants to emit, not what local variables it needs. Local variables will soon be needed, support them. Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250520161916.413298-9-kuba@kernel.org Signed-off-by: Jakub Kicinski commit a66a170b68af0d588f4eadb9e5813c4edefe24f5 Author: Jakub Kicinski Date: Tue May 20 09:19:11 2025 -0700 tools: ynl-gen: move fixed header info from RenderInfo to Struct RenderInfo describes a request-response exchange. Struct describes a parsed attribute set. For ease of parsing sub-messages with fixed headers move fixed header info from RenderInfo to Struct. No functional changes. Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250520161916.413298-8-kuba@kernel.org Signed-off-by: Jakub Kicinski commit cb39645d9a6a8b84f2e820db7c2b49ebd4b18b2c Author: Jakub Kicinski Date: Tue May 20 09:19:10 2025 -0700 tools: ynl-gen: support passing selector to a nest In rtnetlink all submessages had the selector at the same level of nesting as the submessage. We could refer to the relevant attribute from the current struct. In TC, stats are one level of nesting deeper than "kind". Teach the code-gen about structs which need to be passed a selector by the caller for parsing. Because structs are "topologically sorted" one pass of propagating the selectors down is enough. For generating netlink message we depend on the presence bits so no selector passing needed there. Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250520161916.413298-7-kuba@kernel.org Signed-off-by: Jakub Kicinski commit ba5a199b2401de3d5df1fba4d5dcd92908461a07 Author: Jakub Kicinski Date: Tue May 20 09:19:09 2025 -0700 netlink: specs: tc: drop the family name prefix from attrs All attribute sets and messages are prefixed with tc-. The C codegen also adds the family name to all structs. We end up with names like struct tc_tc_act_attrs. Remove the tc- prefixes to shorten the names. This should not impact Python as the attr set names are never exposed to user, they are only used to refer to things internally, in the encoder / decoder. Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250520161916.413298-6-kuba@kernel.org Signed-off-by: Jakub Kicinski commit f9aec8025ab5fc440fcc56f31298750d9b039acc Author: Jakub Kicinski Date: Tue May 20 09:19:08 2025 -0700 netlink: specs: tc: add C naming info Add naming info needed by C code gen. Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250520161916.413298-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit eb1f803f9851e1bf40924a06c1db349540290bac Author: Jakub Kicinski Date: Tue May 20 09:19:07 2025 -0700 netlink: specs: tc: use tc-gact instead of tc-gen as struct name There is a define in the uAPI header called tc_gen which expands to the "generic" TC action fields. This helps other actions include the base fields without having to deal with nested structs. A couple of actions (sample, gact) do not define extra fields, so the spec used a common tc-gen struct for both of them. Unfortunately this struct does not exist in C. Let's use gact's (generic act's) struct for basic actions. Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250520161916.413298-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit e9033a846eb9a8ca21dee880b9ac2f5988ceb5f0 Author: Jakub Kicinski Date: Tue May 20 09:19:06 2025 -0700 netlink: specs: tc: remove duplicate nests tc-act-stats-attrs and tca-stats-attrs are almost identical. The only difference is that the latter has sub-message decoding for app, rather than declaring it as a binary attr. tc-act-police-attrs and tc-police-attrs are identical but for the TODO annotations. Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250520161916.413298-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 8b8762eeec59b959fbca60afffe21265bce67168 Author: Jakub Kicinski Date: Tue May 20 09:19:05 2025 -0700 tools: ynl-gen: add makefile deps for neigh Kory is reporting build issues after recent additions to YNL if the system headers are old. Link: https://lore.kernel.org/20250519164949.597d6e92@kmaincent-XPS-13-7390 Reported-by: Kory Maincent Fixes: 0939a418b3b0 ("tools: ynl: submsg: reverse parse / error reporting") Tested-by: Kory Maincent Link: https://patch.msgid.link/20250520161916.413298-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 4e7bca76e3fed58437dcd7f747d1c8d98507379e Author: Hans Zhang Date: Sat May 17 00:52:22 2025 +0800 PCI/MSI: Use bool for MSI enable state tracking Convert pci_msi_enable and pci_msi_enabled() to use bool type for clarity. No functional changes, only code cleanup. Signed-off-by: Hans Zhang Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250516165223.125083-2-18255117159@163.com commit 0589aff47314c06b61df112139d36940ac3951ca Author: Ian Rogers Date: Mon May 19 12:51:40 2025 -0700 perf python: Add evsel cpus and threads functions Allow access to cpus and thread_map structs associated with an evsel. Signed-off-by: Ian Rogers Acked-by: Gautam Menghani Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Howard Chu Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Madhavan Srinivasan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250519195148.1708988-4-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 3ee2255c4fc2b7d424d5f5c744364189b659f123 Author: Ian Rogers Date: Mon May 19 12:51:39 2025 -0700 libperf threadmap: Add perf_thread_map__idx() Allow computation of thread map index from a PID. Note, with a 'struct perf_cpu_map' the sorted nature allows for a binary search to compute the index which isn't currently possible with a 'struct perf_thread_map' as they aren't guaranteed sorted. Signed-off-by: Ian Rogers Acked-by: Gautam Menghani Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Howard Chu Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Madhavan Srinivasan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250519195148.1708988-3-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit eead8a0114775c7250ae27197ac3f3e5bbc567df Author: Ian Rogers Date: Mon May 19 12:51:38 2025 -0700 libperf threadmap: Don't segv for index 0 for the NULL 'struct perf_thread_map' pointer perf_thread_map__nr() returns length 1 if the perf_thread_map is NULL, meaning index 0 is valid. When perf_thread_map__pid() of index 0 is read then return the expected "any" -1 value. Assert this is only done for index 0. Signed-off-by: Ian Rogers Acked-by: Gautam Menghani Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Howard Chu Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Madhavan Srinivasan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250519195148.1708988-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 21fb366b2f45761125230e89a73c0fe29d55d9cf Author: Ravi Bangoria Date: Tue May 20 05:32:48 2025 +0000 perf test amd: Skip amd-ibs-period test on kernel < v6.15 Bunch of IBS kernel fixes went in v6.15-rc1 [1]. The amd-ibs-period test will fail without those kernel patches. Skip the test on system running kernel older than v6.15 to distinguish genuine new failures vs known failure due to old kernel. Since all the related IBS fixes went in -rc1 itself, the ">= 6.15" check will work for any custom compiled v6.15-* kernel as well. Reported-by: Arnaldo Carvalho de Melo Suggested-by: Arnaldo Carvalho de Melo Signed-off-by: Ravi Bangoria Closes: https://lore.kernel.org/r/aCfuGXUnNIbnYo_r@x1 Link: https://lore.kernel.org/r/20250115054438.1021-1-ravi.bangoria@amd.com [1] Signed-off-by: Arnaldo Carvalho de Melo commit 8f454c95817d15ee529d58389612ea4b34f5ffb3 Author: Ian Rogers Date: Mon May 19 15:46:45 2025 -0700 perf thread: Ensure comm_lock held for comm_list Add thread safety annotations for comm_list and add locking for two instances where the list is accessed without the lock held (in contradiction to ____thread__set_comm()). Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Athira Rajeev Cc: Bill Wendling Cc: Chaitanya S Prakash Cc: Fei Lang Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Stephen Brennan Link: https://lore.kernel.org/r/20250519224645.1810891-3-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 6fe064491bd3433ce42b04d5b933eb368c48271e Author: Ian Rogers Date: Mon May 19 15:46:44 2025 -0700 perf rwsem: Add clang's -Wthread-safety annotations Add annotations used by clang's -Wthread-safety. Fix dsos compilation errors caused by a lock of annotations. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Athira Rajeev Cc: Bill Wendling Cc: Chaitanya S Prakash Cc: Fei Lang Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Stephen Brennan Link: https://lore.kernel.org/r/20250519224645.1810891-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit ab2c742d75ac2f52f0172907bfbc898475f75273 Author: Ian Rogers Date: Mon May 19 15:46:43 2025 -0700 perf dso: Minor refactor to allow clang's Wthread-safety analysis The pattern: ``` if (x) { lock(...) } block1; if (x) { unlock(...) } ``` defeats clang's -Wthread-safety analysis where it complains of locks held on one path and not another. Add helper functions for "block1" then restructure as: ``` if (x) { lock(...); block1(); unlock(...); } else { block1(); } ``` Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Athira Rajeev Cc: Bill Wendling Cc: Chaitanya S Prakash Cc: Fei Lang Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Stephen Brennan Link: https://lore.kernel.org/r/20250519224645.1810891-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 0f529570ecaf99244dc86b8af13618f0d07b0e44 Author: Gabor Juhos Date: Tue May 20 21:08:56 2025 +0200 spi: spi-qpic-snand: remove superfluous parameters of qcom_spi_check_error() The qcom_spi_check_error() function determines the errors of a previous page read operation solely by using the cached register values in the register read buffer. The data pointed by the 'data_buf' and the 'oob_buf' parameters are not used for that at all. Remove the superfluous parameters of the function along with the related local variables to simplify the code. Also, remove the variables from the caller functions which became unused due to the change. Note: Althought the similar parse_read_errors() function in the 'qcom_nand' driver has the same parameters, but that function passes down the pointers to check_for_erased_page() at the end of the function. It is not clear, that a similar call is missing here, or the superfluous parameters are simply leftovers of the development process. Nevertheless, if additional code is needed, the parameters can be added back later. Signed-off-by: Gabor Juhos Link: https://patch.msgid.link/20250520-qpic-snand-superfluous-params-v1-1-86dd4963e90f@gmail.com Signed-off-by: Mark Brown commit 477d16c0919e82a7f5f673a6e3ae39a17c773037 Author: Faraz Ata Date: Wed May 21 14:13:24 2025 +0530 dt-bindings: spi: samsung: add exynosautov920-spi compatible Add "samsung,exynosautov920-spi" dedicated compatible for SPI found in ExynosAutov920 SoC. Signed-off-by: Faraz Ata Link: https://patch.msgid.link/20250521084324.2759530-1-faraz.ata@samsung.com Signed-off-by: Mark Brown commit 4026c6b51cb9ffd1eea2206191552f8aa3cb55ea Author: Gabor Juhos Date: Wed May 14 12:16:38 2025 +0200 spi: spi-qpic-snand: reuse qcom_spi_check_raw_flash_errors() The qcom_spi_check_raw_flash_errors() function can be used to verify the flash status after raw operations. Move the function slightly up in the code and change the qcom_spi_read_last_cw() function to call it instead of using an open coded implementation of the same check. Signed-off-by: Gabor Juhos Link: https://patch.msgid.link/20250514-qpic-snand-error-check-v1-1-c0ebd3aae72a@gmail.com Signed-off-by: Mark Brown commit c164679bed3a5f0d235723c2395d9a5122b151c4 Author: Ilya Leoshkevich Date: Thu May 15 17:52:13 2025 +0200 scripts/gdb/symbols: determine KASLR offset on s390 during early boot Using lx-symbols during s390 early boot fails with: Error occurred in Python: 'utf-8' codec can't decode byte 0xcb in position 0: invalid continuation byte The reason is that s390 decompressor's startup_kernel() does not create vmcoreinfo note, and sets vmcore_info to kernel's physical base. This confuses get_vmcore_s390(). Fix by handling this special case. Extract vm_layout.kaslr_offset from the kernel image in physical memory, which is placed there by the decompressor using the __bootdata_preserved mechanism, and generate a synthetic vmcoreinfo note from it. Link: https://lkml.kernel.org/r/20250515155811.114392-4-iii@linux.ibm.com Signed-off-by: Ilya Leoshkevich Cc: Alexander Gordeev Cc: Heiko Carstens Cc: Jan Kiszka Cc: Kieran Bingham Cc: Vasily Gorbik Signed-off-by: Andrew Morton commit e97c4a27cb9c4c06fdc6d0760d7ea031c98b58a5 Author: Ilya Leoshkevich Date: Thu May 15 17:52:12 2025 +0200 scripts/gdb/symbols: factor out pagination_off() Move the code that turns off pagination into a separate function. It will be useful later in order to prevent hangs when loading symbols for kernel image in physical memory during s390 early boot. Link: https://lkml.kernel.org/r/20250515155811.114392-3-iii@linux.ibm.com Signed-off-by: Ilya Leoshkevich Cc: Alexander Gordeev Cc: Heiko Carstens Cc: Jan Kiszka Cc: Kieran Bingham Cc: Vasily Gorbik Signed-off-by: Andrew Morton commit 3545414f2590177a76f86c985130dc4824d3adc9 Author: Ilya Leoshkevich Date: Thu May 15 17:52:11 2025 +0200 scripts/gdb/symbols: factor out get_vmlinux() Patch series "scripts/gdb/symbols: determine KASLR offset on s390 during early boot". I noticed that debugging s390 early boot using the support I introduced in commit 28939c3e9925 ("scripts/gdb/symbols: determine KASLR offset on s390") does not work. The reason is that decompressor does not provide the vmcoreinfo note, so KASLR offset needs to be extracted in a different way, which this series implements. Patches 1-2 are trivial refactorings, and patch 3 is the implementation. This patch (of 3): Move the code that determines the current vmlinux file into a separate function. It will be useful later in order to analyze the kernel image in physical memory during s390 early boot. Link: https://lkml.kernel.org/r/20250515155811.114392-1-iii@linux.ibm.com Link: https://lkml.kernel.org/r/20250515155811.114392-2-iii@linux.ibm.com Signed-off-by: Ilya Leoshkevich Cc: Alexander Gordeev Cc: Heiko Carstens Cc: Jan Kiszka Cc: Kieran Bingham Cc: Vasily Gorbik Signed-off-by: Andrew Morton commit 85915c6cabf74d1f693fd09d95c25d838b82c840 Author: Sravan Kumar Gundu Date: Fri May 16 17:40:31 2025 +0000 kernel/panic.c: format kernel-doc comments kernel-doc function comment don't follows documentation commenting style misinterpreting arguments description with function description. Please see latest docs generated before applying this patch https://docs.kernel.org/driver-api/basics.html#c.panic Link: https://lkml.kernel.org/r/20250516174031.2937-1-sravankumarlpu@gmail.com Signed-off-by: Sravan Kumar Gundu Cc: Greg Kroah-Hartman Cc: Jani Nikula Cc: John Ogness Cc: Petr Mladek Cc: Shuah Khan Signed-off-by: Andrew Morton commit f68b5d165c906d11948c78e5d4b55a3e0975bba4 Author: Casey Connolly Date: Sat May 17 23:32:38 2025 +0100 mailmap: update and consolidate Casey Connolly's name and email I've used several email addresses and a previous name to contribute. Consolidate all of these to my primary email and update my name. Link: https://lkml.kernel.org/r/20250517223237.15647-2-casey.connolly@linaro.org Signed-off-by: Casey Connolly Cc: Krzysztof Kozlowski Signed-off-by: Andrew Morton commit 84e437640ba43259c81048ded6adb5357a844360 Author: Christoph Hellwig Date: Fri May 16 21:31:13 2025 +0900 nilfs2: remove wbc->for_reclaim handling Since commit 013a07052a1a ("nilfs2: convert metadata aops from writepage to writepages"), nilfs_mdt_write_folio can't be called from reclaim context any more. Remove the code keyed of the wbc->for_reclaim flag, which is now only set for writing out swap or shmem pages inside the swap code, but never passed to file systems. Link: https://lkml.kernel.org/r/20250508054938.15894-7-hch@lst.de Link: https://lkml.kernel.org/r/20250516123417.6779-1-konishi.ryusuke@gmail.com Signed-off-by: Christoph Hellwig Signed-off-by: Ryusuke Konishi Signed-off-by: Andrew Morton commit 8e02b1b7fcffcde7cc7d7749513ac1b0fbbfcf0a Author: Linus Walleij Date: Fri May 9 09:25:09 2025 +0200 fork: define a local GFP_VMAP_STACK The current allocation of VMAP stack memory is using (THREADINFO_GFP & ~__GFP_ACCOUNT) which is a complicated way of saying (GFP_KERNEL | __GFP_ZERO): : define THREADINFO_GFP (GFP_KERNEL_ACCOUNT | __GFP_ZERO) : define GFP_KERNEL_ACCOUNT (GFP_KERNEL | __GFP_ACCOUNT) This is an unfortunate side-effect of independent changes blurring the picture: commit 19809c2da28aee5860ad9a2eff760730a0710df0 changed (THREADINFO_GFP | __GFP_HIGHMEM) to just THREADINFO_GFP since highmem became implicit. commit 9b6f7e163cd0f468d1b9696b785659d3c27c8667 then added stack caching and rewrote the allocation to (THREADINFO_GFP & ~__GFP_ACCOUNT) as cached stacks need to be accounted separately. However that code, when it eventually accounts the memory does this: ret = memcg_kmem_charge(vm->pages[i], GFP_KERNEL, 0) so the memory is charged as a GFP_KERNEL allocation. Define a unique GFP_VMAP_STACK to use GFP_KERNEL | __GFP_ZERO and move the comment there. Link: https://lkml.kernel.org/r/20250509-gfp-stack-v1-1-82f6f7efc210@linaro.org Signed-off-by: Linus Walleij Reported-by: Mateusz Guzik Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit d82893c52a64dd5698362ba1d7cb232a18839c87 Author: Pasha Tatashin Date: Fri May 9 08:29:28 2025 +0200 fork: check charging success before zeroing stack No need to do zero cached stack if memcg charge fails, so move the charging attempt before the memset operation. [linus.walleij@linaro.org: rebased] Link: https://lkml.kernel.org/r/20250509-fork-fixes-v3-3-e6c69dd356f2@linaro.org Signed-off-by: Pasha Tatashin Link: https://lore.kernel.org/20240311164638.2015063-6-pasha.tatashin@soleen.com Signed-off-by: Linus Walleij Acked-by: Mike Rapoport (Microsoft) Signed-off-by: Andrew Morton commit 90eb270d8eb46c2d54a13b938643fbc9cf56eaea Author: Pasha Tatashin Date: Fri May 9 08:29:27 2025 +0200 fork: clean-up naming of vm_stack/vm_struct variables in vmap stacks code There are two data types: "struct vm_struct" and "struct vm_stack" that have the same local variable names: vm_stack, or vm, or s, which makes the code confusing to read. Change the code so the naming is consistent: struct vm_struct is always called vm_area struct vm_stack is always called vm_stack One change altering vfree(vm_stack) to vfree(vm_area->addr) may look like a semantic change but it is not: vm_area->addr points to the vm_stack. This was done to improve readability. [linus.walleij@linaro.org: rebased and added new users of the variable names, address review comments] Link: https://lore.kernel.org/20240311164638.2015063-4-pasha.tatashin@soleen.com Link: https://lkml.kernel.org/r/20250509-fork-fixes-v3-2-e6c69dd356f2@linaro.org Signed-off-by: Pasha Tatashin Signed-off-by: Linus Walleij Acked-by: Mike Rapoport (Microsoft) Signed-off-by: Andrew Morton commit 85e1f758b6d770c9d9a7c7de4937e2eb2c200aea Author: Pasha Tatashin Date: Fri May 9 08:29:26 2025 +0200 fork: clean-up ifdef logic around stack allocation Patch series "fork: Page operation cleanups in the fork code", v3. This patchset consists of outtakes from a 1 year+ old patchset from Pasha, which all stand on their own. See: https://lore.kernel.org/all/20240311164638.2015063-1-pasha.tatashin@soleen.com/ These are good cleanups for readability so I split these off, rebased on v6.15-rc1, addressed review comments and send them separately. All mentions of dynamic stack are removed from the patchset as we have no idea whether that will go anywhere. This patch (of 3): There is unneeded OR in the ifdef functions that are used to allocate and free kernel stacks based on direct map or vmap. Therefore, clean up by changing the order so OR is no longer needed. [linus.walleij@linaro.org: rebased] Link: https://lkml.kernel.org/r/20250509-fork-fixes-v3-1-e6c69dd356f2@linaro.org Link: https://lkml.kernel.org/r/20250509-fork-fixes-v3-0-e6c69dd356f2@linaro.org Signed-off-by: Pasha Tatashin Link: https://lore.kernel.org/20240311164638.2015063-3-pasha.tatashin@soleen.com Signed-off-by: Linus Walleij Acked-by: Mike Rapoport (Microsoft) Signed-off-by: Andrew Morton commit 2536c5c7d6ae5e1d844aa21f28b326b5e7f815ef Author: Max Kellermann Date: Sun May 4 20:08:31 2025 +0200 kernel/rcu/tree_stall: add /sys/kernel/rcu_stall_count Expose a simple counter to userspace for monitoring tools. Link: https://lkml.kernel.org/r/20250504180831.4190860-3-max.kellermann@ionos.com Signed-off-by: Max Kellermann Cc: Core Minyard Cc: Doug Anderson Cc: Joel Granados Cc: Kees Cook Cc: Song Liu Signed-off-by: Andrew Morton commit aaf05e96e93cb9c8fc8d35fc4525715530397655 Author: Max Kellermann Date: Sun May 4 20:08:30 2025 +0200 kernel/watchdog: add /sys/kernel/{hard,soft}lockup_count Patch series "sysfs: add counters for lockups and stalls", v2. Commits 9db89b411170 ("exit: Expose "oops_count" to sysfs") and 8b05aa263361 ("panic: Expose "warn_count" to sysfs") added counters for oopses and warnings to sysfs, and these two patches do the same for hard/soft lockups and RCU stalls. All of these counters are useful for monitoring tools to detect whether the machine is healthy. If the kernel has experienced a lockup or a stall, it's probably due to a kernel bug, and I'd like to detect that quickly and easily. There is currently no way to detect that, other than parsing dmesg. Or observing indirect effects: such as certain tasks not responding, but then I need to observe all tasks, and it may take a while until these effects become visible/measurable. I'd rather be able to detect the primary cause more quickly, possibly before everything falls apart. This patch (of 2): There is /proc/sys/kernel/hung_task_detect_count, /sys/kernel/warn_count and /sys/kernel/oops_count but there is no userspace-accessible counter for hard/soft lockups. Having this is useful for monitoring tools. Link: https://lkml.kernel.org/r/20250504180831.4190860-1-max.kellermann@ionos.com Link: https://lkml.kernel.org/r/20250504180831.4190860-2-max.kellermann@ionos.com Signed-off-by: Max Kellermann Cc: Cc: Core Minyard Cc: Doug Anderson Cc: Joel Granados Cc: Song Liu Cc: Kees Cook Signed-off-by: Andrew Morton commit cc66e4863ac3a00c709bfcbec685d48c184172b5 Author: Coiby Xu Date: Fri May 2 09:12:42 2025 +0800 x86/crash: make the page that stores the dm crypt keys inaccessible This adds an addition layer of protection for the saved copy of dm crypt key. Trying to access the saved copy will cause page fault. Link: https://lkml.kernel.org/r/20250502011246.99238-9-coxu@redhat.com Signed-off-by: Coiby Xu Suggested-by: Pingfan Liu Acked-by: Baoquan He Cc: "Daniel P. Berrange" Cc: Dave Hansen Cc: Dave Young Cc: Jan Pazdziora Cc: Milan Broz Cc: Ondrej Kozina Cc: Vitaly Kuznetsov Signed-off-by: Andrew Morton commit 5eb3f60554216b02e9c0f18356709ee4befe72e7 Author: Coiby Xu Date: Fri May 2 09:12:41 2025 +0800 x86/crash: pass dm crypt keys to kdump kernel 1st kernel will build up the kernel command parameter dmcryptkeys as similar to elfcorehdr to pass the memory address of the stored info of dm crypt key to kdump kernel. Link: https://lkml.kernel.org/r/20250502011246.99238-8-coxu@redhat.com Signed-off-by: Coiby Xu Acked-by: Baoquan He Cc: "Daniel P. Berrange" Cc: Dave Hansen Cc: Dave Young Cc: Jan Pazdziora Cc: Liu Pingfan Cc: Milan Broz Cc: Ondrej Kozina Cc: Vitaly Kuznetsov Signed-off-by: Andrew Morton commit e1e6cd01d93359e22be84a23c8bb24ee4e04e142 Author: Coiby Xu Date: Fri May 2 09:12:40 2025 +0800 Revert "x86/mm: Remove unused __set_memory_prot()" This reverts commit 693bbf2a50447353c6a47961e6a7240a823ace02 as kdump LUKS support (CONFIG_CRASH_DM_CRYPT) depends on __set_memory_prot. [akpm@linux-foundation.org: x86 set_memory.h needs pgtable_types.h] Link: https://lkml.kernel.org/r/20250502011246.99238-7-coxu@redhat.com Signed-off-by: Coiby Xu Cc: Baoquan He Cc: "Daniel P. Berrange" Cc: Dave Hansen Cc: Dave Young Cc: Jan Pazdziora Cc: Liu Pingfan Cc: Milan Broz Cc: Ondrej Kozina Cc: Vitaly Kuznetsov Signed-off-by: Andrew Morton commit 62f17d9df6924cf805de5ae970470615c1c8d9f2 Author: Coiby Xu Date: Fri May 2 09:12:39 2025 +0800 crash_dump: retrieve dm crypt keys in kdump kernel Crash kernel will retrieve the dm crypt keys based on the dmcryptkeys command line parameter. When user space writes the key description to /sys/kernel/config/crash_dm_crypt_key/restore, the crash kernel will save the encryption keys to the user keyring. Then user space e.g. cryptsetup's --volume-key-keyring API can use it to unlock the encrypted device. Link: https://lkml.kernel.org/r/20250502011246.99238-6-coxu@redhat.com Signed-off-by: Coiby Xu Acked-by: Baoquan He Cc: "Daniel P. Berrange" Cc: Dave Hansen Cc: Dave Young Cc: Jan Pazdziora Cc: Liu Pingfan Cc: Milan Broz Cc: Ondrej Kozina Cc: Vitaly Kuznetsov Signed-off-by: Andrew Morton commit 9ebfa8dcaea77a8ef02d0f9478717a138b0ad828 Author: Coiby Xu Date: Fri May 2 09:12:38 2025 +0800 crash_dump: reuse saved dm crypt keys for CPU/memory hot-plugging When there are CPU and memory hot un/plugs, the dm crypt keys may need to be reloaded again depending on the solution for crash hotplug support. Currently, there are two solutions. One is to utilizes udev to instruct user space to reload the kdump kernel image and initrd, elfcorehdr and etc again. The other is to only update the elfcorehdr segment introduced in commit 247262756121 ("crash: add generic infrastructure for crash hotplug support"). For the 1st solution, the dm crypt keys need to be reloaded again. The user space can write true to /sys/kernel/config/crash_dm_crypt_key/reuse so the stored keys can be re-used. For the 2nd solution, the dm crypt keys don't need to be reloaded. Currently, only x86 supports the 2nd solution. If the 2nd solution gets extended to all arches, this patch can be dropped. Link: https://lkml.kernel.org/r/20250502011246.99238-5-coxu@redhat.com Signed-off-by: Coiby Xu Acked-by: Baoquan He Cc: "Daniel P. Berrange" Cc: Dave Hansen Cc: Dave Young Cc: Jan Pazdziora Cc: Liu Pingfan Cc: Milan Broz Cc: Ondrej Kozina Cc: Vitaly Kuznetsov Signed-off-by: Andrew Morton commit 479e58549b0fa7e80f1e0b9e69e0a2a8e6711132 Author: Coiby Xu Date: Fri May 2 09:12:37 2025 +0800 crash_dump: store dm crypt keys in kdump reserved memory When the kdump kernel image and initrd are loaded, the dm crypts keys will be read from keyring and then stored in kdump reserved memory. Assume a key won't exceed 256 bytes thus MAX_KEY_SIZE=256 according to "cryptsetup benchmark". Link: https://lkml.kernel.org/r/20250502011246.99238-4-coxu@redhat.com Signed-off-by: Coiby Xu Acked-by: Baoquan He Cc: "Daniel P. Berrange" Cc: Dave Hansen Cc: Dave Young Cc: Jan Pazdziora Cc: Liu Pingfan Cc: Milan Broz Cc: Ondrej Kozina Cc: Vitaly Kuznetsov Signed-off-by: Andrew Morton commit 180cf31af7c313790f1e0fba1c7aa42512144dd5 Author: Coiby Xu Date: Fri May 2 09:12:36 2025 +0800 crash_dump: make dm crypt keys persist for the kdump kernel A configfs /sys/kernel/config/crash_dm_crypt_keys is provided for user space to make the dm crypt keys persist for the kdump kernel. Take the case of dumping to a LUKS-encrypted target as an example, here is the life cycle of the kdump copies of LUKS volume keys, 1. After the 1st kernel loads the initramfs during boot, systemd uses an user-input passphrase to de-crypt the LUKS volume keys or simply TPM-sealed volume keys and then save the volume keys to specified keyring (using the --link-vk-to-keyring API) and the keys will expire within specified time. 2. A user space tool (kdump initramfs loader like kdump-utils) create key items inside /sys/kernel/config/crash_dm_crypt_keys to inform the 1st kernel which keys are needed. 3. When the kdump initramfs is loaded by the kexec_file_load syscall, the 1st kernel will iterate created key items, save the keys to kdump reserved memory. 4. When the 1st kernel crashes and the kdump initramfs is booted, the kdump initramfs asks the kdump kernel to create a user key using the key stored in kdump reserved memory by writing yes to /sys/kernel/crash_dm_crypt_keys/restore. Then the LUKS encrypted device is unlocked with libcryptsetup's --volume-key-keyring API. 5. The system gets rebooted to the 1st kernel after dumping vmcore to the LUKS encrypted device is finished Eventually the keys have to stay in the kdump reserved memory for the kdump kernel to unlock encrypted volumes. During this process, some measures like letting the keys expire within specified time are desirable to reduce security risk. This patch assumes, 1) there are 128 LUKS devices at maximum to be unlocked thus MAX_KEY_NUM=128. 2) a key description won't exceed 128 bytes thus KEY_DESC_MAX_LEN=128. And here is a demo on how to interact with /sys/kernel/config/crash_dm_crypt_keys, # Add key #1 mkdir /sys/kernel/config/crash_dm_crypt_keys/7d26b7b4-e342-4d2d-b660-7426b0996720 # Add key #1's description echo cryptsetup:7d26b7b4-e342-4d2d-b660-7426b0996720 > /sys/kernel/config/crash_dm_crypt_keys/description # how many keys do we have now? cat /sys/kernel/config/crash_dm_crypt_keys/count 1 # Add key# 2 in the same way # how many keys do we have now? cat /sys/kernel/config/crash_dm_crypt_keys/count 2 # the tree structure of /crash_dm_crypt_keys configfs tree /sys/kernel/config/crash_dm_crypt_keys/ /sys/kernel/config/crash_dm_crypt_keys/ ├── 7d26b7b4-e342-4d2d-b660-7426b0996720 │   └── description ├── count ├── fce2cd38-4d59-4317-8ce2-1fd24d52c46a │   └── description Link: https://lkml.kernel.org/r/20250502011246.99238-3-coxu@redhat.com Signed-off-by: Coiby Xu Acked-by: Baoquan He Cc: "Daniel P. Berrange" Cc: Dave Hansen Cc: Dave Young Cc: Jan Pazdziora Cc: Liu Pingfan Cc: Milan Broz Cc: Ondrej Kozina Cc: Vitaly Kuznetsov Signed-off-by: Andrew Morton commit bf454ec31add6790f6cdc88328e38901fcbbade6 Author: Coiby Xu Date: Fri May 2 09:12:35 2025 +0800 kexec_file: allow to place kexec_buf randomly Patch series "Support kdump with LUKS encryption by reusing LUKS volume keys", v9. LUKS is the standard for Linux disk encryption, widely adopted by users, and in some cases, such as Confidential VMs, it is a requirement. With kdump enabled, when the first kernel crashes, the system can boot into the kdump/crash kernel to dump the memory image (i.e., /proc/vmcore) to a specified target. However, there are two challenges when dumping vmcore to a LUKS-encrypted device: - Kdump kernel may not be able to decrypt the LUKS partition. For some machines, a system administrator may not have a chance to enter the password to decrypt the device in kdump initramfs after the 1st kernel crashes; For cloud confidential VMs, depending on the policy the kdump kernel may not be able to unseal the keys with TPM and the console virtual keyboard is untrusted. - LUKS2 by default use the memory-hard Argon2 key derivation function which is quite memory-consuming compared to the limited memory reserved for kdump. Take Fedora example, by default, only 256M is reserved for systems having memory between 4G-64G. With LUKS enabled, ~1300M needs to be reserved for kdump. Note if the memory reserved for kdump can't be used by 1st kernel i.e. an user sees ~1300M memory missing in the 1st kernel. Besides users (at least for Fedora) usually expect kdump to work out of the box i.e. no manual password input or custom crashkernel value is needed. And it doesn't make sense to derivate the keys again in kdump kernel which seems to be redundant work. This patchset addresses the above issues by making the LUKS volume keys persistent for kdump kernel with the help of cryptsetup's new APIs (--link-vk-to-keyring/--volume-key-keyring). Here is the life cycle of the kdump copies of LUKS volume keys, 1. After the 1st kernel loads the initramfs during boot, systemd use an user-input passphrase to de-crypt the LUKS volume keys or TPM-sealed key and then save the volume keys to specified keyring (using the --link-vk-to-keyring API) and the key will expire within specified time. 2. A user space tool (kdump initramfs loader like kdump-utils) create key items inside /sys/kernel/config/crash_dm_crypt_keys to inform the 1st kernel which keys are needed. 3. When the kdump initramfs is loaded by the kexec_file_load syscall, the 1st kernel will iterate created key items, save the keys to kdump reserved memory. 4. When the 1st kernel crashes and the kdump initramfs is booted, the kdump initramfs asks the kdump kernel to create a user key using the key stored in kdump reserved memory by writing yes to /sys/kernel/crash_dm_crypt_keys/restore. Then the LUKS encrypted device is unlocked with libcryptsetup's --volume-key-keyring API. 5. The system gets rebooted to the 1st kernel after dumping vmcore to the LUKS encrypted device is finished After libcryptsetup saving the LUKS volume keys to specified keyring, whoever takes this should be responsible for the safety of these copies of keys. The keys will be saved in the memory area exclusively reserved for kdump where even the 1st kernel has no direct access. And further more, two additional protections are added, - save the copy randomly in kdump reserved memory as suggested by Jan - clear the _PAGE_PRESENT flag of the page that stores the copy as suggested by Pingfan This patchset only supports x86. There will be patches to support other architectures once this patch set gets merged. This patch (of 9): Currently, kexec_buf is placed in order which means for the same machine, the info in the kexec_buf is always located at the same position each time the machine is booted. This may cause a risk for sensitive information like LUKS volume key. Now struct kexec_buf has a new field random which indicates it's supposed to be placed in a random position. Note this feature is enabled only when CONFIG_CRASH_DUMP is enabled. So it only takes effect for kdump and won't impact kexec reboot. Link: https://lkml.kernel.org/r/20250502011246.99238-1-coxu@redhat.com Link: https://lkml.kernel.org/r/20250502011246.99238-2-coxu@redhat.com Signed-off-by: Coiby Xu Suggested-by: Jan Pazdziora Acked-by: Baoquan He Cc: "Daniel P. Berrange" Cc: Dave Hansen Cc: Dave Young Cc: Liu Pingfan Cc: Milan Broz Cc: Ondrej Kozina Cc: Vitaly Kuznetsov Signed-off-by: Andrew Morton commit 36adf6fe6cbe59a22f64c004b201685cb6f38c42 Author: Andrea Righi Date: Wed May 21 09:34:07 2025 +0200 selftests/sched_ext: Update test enq_select_cpu_fails With commit 08699d20467b6 ("sched_ext: idle: Consolidate default idle CPU selection kfuncs") allowing scx_bpf_select_cpu_dfl() to be invoked from multiple contexts, update the test to validate that the kfunc behaves correctly when used from ops.enqueue() and via BPF test_run. Additionally, rename the test to enq_select_cpu, dropping "fails" from the name, as the logic has now been inverted. Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit a730e3f7a48bc591bfa838c5d922e5a80ea51738 Author: Andrea Righi Date: Wed May 21 09:34:06 2025 +0200 sched_ext: idle: Consolidate default idle CPU selection kfuncs There is no reason to restrict scx_bpf_select_cpu_dfl() invocations to ops.select_cpu() while allowing scx_bpf_select_cpu_and() to be used from multiple contexts, as both provide equivalent functionality, with the latter simply accepting an additional "allowed" cpumask. Therefore, unify the two APIs, enabling both kfuncs to be used from ops.select_cpu(), ops.enqueue(), and unlocked contexts (e.g., via BPF test_run). This allows schedulers to implement a consistent idle CPU selection policy and helps reduce code duplication. Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit 6333f2974ce9fbe9c51b964da285ede903492a05 Merge: 3fc5aea250af44 c8754c7deab4cb Author: Arnd Bergmann Date: Wed May 21 19:25:07 2025 +0200 Merge tag 'riscv-sophgo-soc-for-v6.16' of https://github.com/sophgo/linux into soc/drivers RISC-V SoC for v6.16 Sophgo: Add support for SG2044 TOP syscon device. The SG2044 TOP device provide PLL clock function in its area. Add RTC support for CV1800 series SoC. The device is called RTC, but contains control registers of other HW blocks in its address space, most notably of Power-on-Reset (PoR) module, DW8051 IP (MCU core), accompanying SRAM, hence putting it in SoC subsystem. Signed-off-by: Chen Wang * tag 'riscv-sophgo-soc-for-v6.16' of https://github.com/sophgo/linux: soc: sophgo: cv1800: rtcsys: New driver (handling RTC only) dt-bindings: soc: sophgo: add RTC support for Sophgo CV1800 series soc: sophgo: sg2044: Add support for SG2044 TOP syscon device Link: https://lore.kernel.org/r/MA0P287MB2262B041A26A0F5EAD1E296CFE91A@MA0P287MB2262.INDP287.PROD.OUTLOOK.COM Signed-off-by: Arnd Bergmann commit 3fc5aea250af440988bef5afd0138441103de5fa Merge: 5bba2c46756821 2c04e58e30ce85 Author: Arnd Bergmann Date: Wed May 21 19:23:43 2025 +0200 Merge tag 'qcom-drivers-for-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers Qualcomm driver updates for v6.16 Allow list QSEECOM for EFI variable services on on the Asus Zenbook A14, and block list TZMEM on the SM7150 platform to avoid issues with rmtfs. Extend the last-level cache (llcc) driver to support version 6 of the hardware and enable SM8750 support. Also add socinfo for the SM8750 platform. Re-enable UCSI support on SC8280XP, now that the reported crash has been dealt with, and filter the altmode notifications to avoid spurious hotplug events being propagated to user space. Add SM7150 support to pd-mapper. * tag 'qcom-drivers-for-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: soc: qcom: llcc-qcom: Add support for SM8750 soc: qcom: llcc-qcom: Add support for LLCC V6 dt-bindings: cache: qcom,llcc: Document SM8750 LLCC block soc: qcom: socinfo: add SM8750 SoC ID dt-bindings: arm: qcom,ids: add SoC ID for SM8750 dt-bindings: soc: qcom: qcom,rpm: add missing clock/-names properties dt-bindings: soc: qcom,rpm: add missing clock-controller node soc: qcom: smem: Update max processor count firmware: qcom: tzmem: disable sm7150 platform soc: qcom: pd-mapper: Add support for SM7150 soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events soc: qcom: smp2p: Fix fallback to qcom,ipc parse soc: qcom: pmic_glink: enable UCSI on sc8280xp firmware: qcom: scm: Allow QSEECOM on Asus Zenbook A14 dt-bindings: soc: qcom,rpmh-rsc: Limit power-domains requirement Link: https://lore.kernel.org/r/20250513215656.44448-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 5bba2c46756821a207954450928e581c5908059e Merge: 382af529bec441 d47f1233374597 Author: Arnd Bergmann Date: Wed May 21 19:22:13 2025 +0200 Merge tag 'soc-drivers-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-dt into soc/drivers VT8500 (and FSL) SoC drivers for v6.16 1. VT8500: Add SCC socinfo/hwinfo driver. 2. Cleanup unused function in PowerPC Freescale QE driver to have W=1 builds warnings free. * tag 'soc-drivers-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-dt: soc: fsl: qe: remove unused qe_ic_from_irq function ARM: vt8500: MAINTAINERS: Include vt8500 soc driver in maintainers entry soc: Add VIA/WonderMedia SoC identification driver dt-bindings: hwinfo: Add VIA/WonderMedia SoC identification Link: https://lore.kernel.org/r/20250513104216.25803-6-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 382af529bec441e6e965f8fe9fef0482ad5eee0b Merge: 50c77033bced32 87b480e04af458 Author: Arnd Bergmann Date: Wed May 21 19:21:24 2025 +0200 Merge tag 'amlogic-driver-for-v6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux into soc/drivers Amlogic Driver for v6.16: - Amlogic clk measure memory usage optimization - Amlogic clk measure support for S4 & C3 Socs - Amlogic A4/A5 reset controller bindings * tag 'amlogic-driver-for-v6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux: dt-bindings: reset: Add compatible for Amlogic A4/A5 Reset Controller soc: amlogic: clk-measure: Add support for S4 soc: amlogic: clk-measure: Add support for C3 dt-bindings: soc: amlogic: S4 supports clk-measure dt-bindings: soc: amlogic: C3 supports clk-measure soc: amlogic: clk-measure: Define MSR_CLK's register offset separately soc: amlogic: clk-measure: Optimize the memory size of clk-measure Link: https://lore.kernel.org/r/04908842-4c55-44a0-b74c-3aca82a1f204@linaro.org Signed-off-by: Arnd Bergmann commit 93b07587bb256c45110dd339a304278175cc53f1 Author: Tudor Ambarus Date: Tue May 13 12:17:54 2025 +0200 arm64: defconfig: enable ACPM protocol and Exynos mailbox Enable the Samsung Exynos ACPM protocol and its transport layer, the Exynos mailbox driver. Samsung Exynos platforms implement ACPM to provide support for PMIC, clock frequency scaling, clock configuration and temperature sensors. Signed-off-by: Tudor Ambarus Link: https://lore.kernel.org/r/20250207-gs101-acpm-dt-v4-4-230ba8663a2d@linaro.org Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250513101754.23158-2-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit acda1d3a0ec754a08285c2faf6a00733f189636d Author: Andy Shevchenko Date: Tue May 13 12:10:25 2025 +0200 ARM: s3c: stop including gpio.h The driver does not use legacy GPIO API, stop including this header. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250331093650.4028999-1-andriy.shevchenko@linux.intel.com Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250513101023.21552-8-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 816a748bee7b3ae6d5052094d4027c75cc912264 Merge: 53c3712fd5c0c8 04e7638dd64af2 Author: Arnd Bergmann Date: Wed May 21 19:13:59 2025 +0200 Merge tag 'dt64-cleanup-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-dt into soc/dt Minor improvements in ARM64 DTS for v6.16 Two cleanups which were missed on mailing lists - align GPIO node names with DT bindings for Mediatek mt7622 and Nvidia Tegra210-p2894. * tag 'dt64-cleanup-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-dt: arm64: tegra: tegra210-p2894: Align GPIO hog node name with preferred style arm64: dts: mediatek: mt7622: Align GPIO hog name with bindings Link: https://lore.kernel.org/r/20250513104216.25803-4-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 53c3712fd5c0c81212329833da50b7365c85b7db Merge: 709c8afa15066c f0911f29478992 Author: Arnd Bergmann Date: Wed May 21 19:12:38 2025 +0200 Merge tag 'amlogic-arm64-dt-for-v6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux into soc/dt Amlogic ARM64 DT for v6.16: - Amlogic A4 Pinctrl support - UART RX/TX pull-up pinconf properties for all SoCs - SARADC support for the S905L SoC variant - Drop clock-latency in CPU node - Amlogic clk measure support for S4 & C3 Socs - Amlogic S6/S7/S7D initial support - I2C default pull-up bias pinconf property on Amlogic GXL based boards - Amlogic A4 & A5 Reset Controller support - New Boards: - Amlogic S6 BL209 Reference Board - Amlogic S7 BP201 Reference Board - Amlogic S7D BM202 Reference Board - Amlogic S805Y xiaomi-aquaman/Mi TV Stick * tag 'amlogic-arm64-dt-for-v6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux: (21 commits) arm64: dts: amlogic: Add A5 Reset Controller arm64: dts: amlogic: Add A4 Reset Controller arm64: dts: amlogic: add support for xiaomi-aquaman/Mi TV Stick dt-bindings: arm: amlogic: add S805Y and Mi TV Stick arm64: dts: amlogic: gxl: set i2c bias to pull-up arm64: dts: add support for S7D based Amlogic BM202 arm64: dts: add support for S7 based Amlogic BP201 arm64: dts: add support for S6 based Amlogic BL209 dt-bindings: arm: amlogic: add S7D support dt-bindings: arm: amlogic: add S7 support dt-bindings: arm: amlogic: add S6 support arm64: dts: amlogic: S4: Add clk-measure controller node arm64: dts: amlogic: C3: Add clk-measure controller node arm64: dts: amlogic: Drop redundant CPU "clock-latency" arm64: dts: amlogic: gxlx-s905l-p271: add saradc compatible arm64: dts: amlogic: a1: enable UART RX and TX pull up by default arm64: dts: amlogic: axg: enable UART RX and TX pull up by default arm64: dts: amlogic: g12: enable UART RX and TX pull up by default arm64: dts: amlogic: gxl: enable UART RX and TX pull up by default arm64: dts: amlogic: gxbb: enable UART RX and TX pull up by default ... Link: https://lore.kernel.org/r/5f7d3fa4-2d9d-450b-b384-abdd903284dc@linaro.org Signed-off-by: Arnd Bergmann commit 709c8afa15066c4fd65ae3da80851dbefc7ae597 Merge: e04381e7b74a66 2c1879a440315e Author: Arnd Bergmann Date: Wed May 21 19:09:46 2025 +0200 Merge tag 'amlogic-arm-dt-for-v6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux into soc/dt Amlogic ARM DT for v6.16: - UART RX/TX pull-up pinconf properties for all SoCs - New Boards: - Meson8 TCU Fernsehfee 3.0 * tag 'amlogic-arm-dt-for-v6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux: ARM: dts: amlogic: meson8-fernsehfee3: Describe regulators ARM: dts: amlogic: Add TCU Fernsehfee 3.0 dt-bindings: arm: amlogic: Add TCU Fernsehfee 3.0 board dt-bindings: vendor-prefixes: Add TC Unterhaltungselektronik AG ARM: dts: amlogic: meson8b: enable UART RX and TX pull up by default ARM: dts: amlogic: meson8: enable UART RX and TX pull up by default Link: https://lore.kernel.org/r/838c5305-5c5b-4232-b7fe-86598dc50ace@linaro.org Signed-off-by: Arnd Bergmann commit e04381e7b74a663694deab15801925a2852a69fd Merge: 87901f69400a25 aaf02428fdd50b Author: Arnd Bergmann Date: Wed May 21 19:08:29 2025 +0200 Merge tag 'samsung-dt64-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/dt Samsung DTS ARM64 changes for v6.16 1. Tesla FSD: Add Ethernet. 2. ExynosAutov920: Add more serial nodes, clock controllers for CPU cluster CL0, CL1 and CL2. 3. New Exynos7870 SoC with pretty decent coverage: pin controllers, clock controllers, I2C, MMC, serial and USB. New boards using Exynos7870: Samsung Galaxy J7 Prime, Samsung Galaxy A2 Core and Samsung Galaxy J6. 4. Google GS101: Add pmu-intr-gen syscon node for proper CPU hotplug. 5. Switch USI (serial engines) nodes to new samsung,mode constant coming with DT bindings v6.15-rc1. * tag 'samsung-dt64-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: arm64: dts: exynos: gs101: add pmu-intr-gen syscon node arm64: dts: exynos: add initial support for Samsung Galaxy J6 arm64: dts: exynos: add initial support for Samsung Galaxy A2 Core arm64: dts: exynos: add initial support for Samsung Galaxy J7 Prime arm64: dts: exynos: add initial devicetree support for exynos7870 dt-bindings: arm: samsung: add compatibles for exynos7870 devices arm64: dts: exynosautov920: add cpucl1/2 clock DT nodes arm64: dts: exynosautov920: add cpucl0 clock DT nodes arm64: dts: exynos: Add DT node for all UART ports arm64: dts: exynos: update all samsung,mode constants arm64: dts: fsd: Add Ethernet support for PERIC Block of FSD SoC arm64: dts: fsd: Add Ethernet support for FSYS0 Block of FSD SoC Link: https://lore.kernel.org/r/20250513101023.21552-6-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit e87c7478a31b4e481db6123c10754d87d37c2a3d Merge: 509710c6fdcee7 42cfb00c919e59 Author: Arnd Bergmann Date: Wed May 21 19:07:25 2025 +0200 Merge tag 'ti-k3-config-for-v6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/defconfig TI K3 defconfig updates for v6.16 - Enable Cadence DSI and PHY driver support for DSI support on BeagleBone-AI64, BeaglePlay, BeagleY-AI, All TI EVMs etc. - Enable hardware spinlock and Quadrature Encoder Pulse (QEP) support for AM64-SK and other boards. - Enable TMP102 driver to support Phytec phyCORE-AM68x/TDA4x and the phyGATE-Tauri-L-iMX8MM - Enable TPIC2810 for AM64-SK LED GPIO control. * tag 'ti-k3-config-for-v6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: arm64: defconfig: Enable TPIC2810 GPIO expander arm64: defconfig: Enable TMP102 as module arm64: defconfig: Enable hwspinlock and eQEP for K3 arm64: defconfig: Add CDNS_DSI and CDNS_PHY config Link: https://lore.kernel.org/r/20250512144738.dv63fd4fyuly3s44@diocese Signed-off-by: Arnd Bergmann commit 50c77033bced322c2138bc803c6d55b82b5cca51 Merge: a97bf0c6aa5c37 877afe1ee34df5 Author: Arnd Bergmann Date: Wed May 21 19:04:33 2025 +0200 Merge tag 'ti-driver-soc-for-v6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/drivers TI SoC driver updates for v6.16 - ti_sci: Bug fix in CPU latency conversion from us to ms for TISCI protocol - k3-socinfo: Add JTAG ID for AM62LX - Code cleanups: wkup_m3_ipc: Use dev_err_probe, k3-ringacc: use device_match_of_probe and knav_qmss_queue: drop unnecessary NULL check * tag 'ti-driver-soc-for-v6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: soc: ti: wkup_m3_ipc: Use dev_err_probe firmware: ti_sci: Convert CPU latency constraint from us to ms soc: ti: k3-socinfo: Add JTAG ID for AM62LX soc: ti: knav_qmss_queue: Remove unnecessary NULL check before free_percpu() soc: ti: k3-ringacc: Use device_match_of_node() Link: https://lore.kernel.org/r/20250512144719.mpkyw2jbyzslb5hy@yearly Signed-off-by: Arnd Bergmann commit a97bf0c6aa5c37504ea10436d3b5b763f5665140 Merge: b892924264c19a 1c64de886b8893 Author: Arnd Bergmann Date: Wed May 21 19:03:42 2025 +0200 Merge tag 'reset-for-v6.16' of git://git.pengutronix.de/pza/linux into soc/drivers Reset controller updates for v6.16 * Add T-HEAD TH1520 and Renesas RZ/V2H(P) USB2PHY reset controller drivers. * Add devm_reset_control_array_get_exclusive_released() variant to allow using the acquire/release hand-off mechanism for exclusive reset controls bundled into reset control arrays. * Add Sophgo SG2044 reset controller to device tree bindings. * tag 'reset-for-v6.16' of git://git.pengutronix.de/pza/linux: dt-bindings: reset: sophgo: Add SG2044 bindings. MAINTAINERS: Add entry for Renesas RZ/V2H(P) USB2PHY Port Reset driver reset: Add USB2PHY port reset driver for Renesas RZ/V2H(P) dt-bindings: reset: Document RZ/V2H(P) USB2PHY reset reset: Add devm_reset_control_array_get_exclusive_released() reset: thead: Add TH1520 reset controller driver dt-bindings: reset: Add T-HEAD TH1520 SoC Reset Controller Link: https://lore.kernel.org/r/20250513092516.3331585-1-p.zabel@pengutronix.de Signed-off-by: Arnd Bergmann commit 87901f69400a25bf5e24c71b4de42b18dab3beda Author: Krzysztof Kozlowski Date: Tue May 13 12:10:24 2025 +0200 ARM: dts: samsung: sp5v210-aries: Align wifi node name with bindings Recently DT bindings expect 'wifi' as node name: s5pv210-fascinate4g.dtb: wlan@1: $nodename:0: 'wlan@1' does not match '^wifi(@.*)?$' Link: https://lore.kernel.org/r/20250424084655.105011-1-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250513101023.21552-7-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 0d2992d30af6a9d4e38e8471e02e0e1d205e10a7 Merge: 828497fba7b855 108f878d435437 Author: Mark Brown Date: Wed May 21 18:01:20 2025 +0100 Add DAPM/ASoC helpers to create SDCA drivers Merge series from Charles Keepax : Add helper functions to add DAPM widgets, routes, ALSA controls, and DAI drivers, these will be used to create SDCA function device drivers. This series should provide most of the core functionality needed to get a device registered and have a working DAPM graph within the device. There are some features that still need additional work, these are marked with FIXMEs in the code. The two main things are SDCA Clock Muxes (not used in our devices and needs some ASoC core work), and better support for more complex SDCA volume control definitions (our parts have fairly simple volumes, and SDCA has a large amount of flexibility in how the volume control is specified). The next steps in the process are to add helpers for the DAI ops themselves, some IRQ handling, and firmware download. And finally we should be able to actually add the SDCA class driver itself. commit b65e4b56e9f406f291656b3e92723952c180fbab Author: Alexander Potapenko Date: Wed May 7 18:00:12 2025 +0200 kmsan: rework kmsan_in_runtime() handling in kmsan_report() kmsan_report() calls used to require entering/leaving the runtime around them. To simplify the things, drop this requirement and move calls to kmsan_enter_runtime()/kmsan_leave_runtime() into kmsan_report(). Link: https://lkml.kernel.org/r/20250507160012.3311104-5-glider@google.com Signed-off-by: Alexander Potapenko Cc: Marco Elver Cc: Bart Van Assche Cc: Kent Overstreet Cc: Dmitriy Vyukov Cc: Ilya Leoshkevich Signed-off-by: Andrew Morton commit e17c1f15b0ccfa4802cedbd464d00ece50a10cf1 Author: Alexander Potapenko Date: Wed May 7 18:00:11 2025 +0200 kmsan: enter the runtime around kmsan_internal_memmove_metadata() call kmsan_internal_memmove_metadata() transitively calls stack_depot_save() (via kmsan_internal_chain_origin() and kmsan_save_stack_with_flags()), which may allocate memory. Guard it with kmsan_enter_runtime() and kmsan_leave_runtime() to avoid recursion. This bug was spotted by CONFIG_WARN_CAPABILITY_ANALYSIS=y Link: https://lkml.kernel.org/r/20250507160012.3311104-4-glider@google.com Signed-off-by: Alexander Potapenko Acked-by: Marco Elver Cc: Bart Van Assche Cc: Kent Overstreet Cc: Dmitriy Vyukov Cc: Ilya Leoshkevich Signed-off-by: Andrew Morton commit ce6a1c978f9c2beb38dbb1793799614255094290 Author: Alexander Potapenko Date: Wed May 7 18:00:10 2025 +0200 kmsan: drop the declaration of kmsan_save_stack() This function is not defined anywhere. Link: https://lkml.kernel.org/r/20250507160012.3311104-3-glider@google.com Signed-off-by: Alexander Potapenko Acked-by: Marco Elver Cc: Bart van Assche Cc: Dmitriy Vyukov Cc: Ilya Leoshkevich Cc: Kent Overstreet Signed-off-by: Andrew Morton commit 8312ab31d362fcb6d68f1f2da4d1e89bc5d3f48c Author: Alexander Potapenko Date: Wed May 7 18:00:09 2025 +0200 kmsan: fix usage of kmsan_enter_runtime() in kmsan_vmap_pages_range_noflush() Only enter the runtime to call __vmap_pages_range_noflush(), so that error handling does not skip kmsan_leave_runtime(). This bug was spotted by CONFIG_WARN_CAPABILITY_ANALYSIS=y Link: https://lkml.kernel.org/r/20250507160012.3311104-2-glider@google.com Signed-off-by: Alexander Potapenko Acked-by: Marco Elver Cc: Bart Van Assche Cc: Kent Overstreet Cc: Dmitriy Vyukov Cc: Ilya Leoshkevich Signed-off-by: Andrew Morton commit 1c1db467068d5e57e58756666f7dc54c9dda9b2c Author: Alexander Potapenko Date: Wed May 7 18:00:08 2025 +0200 kmsan: apply clang-format to files mm/kmsan/ KMSAN source files are expected to be formatted with clang-format, fix some nits that slipped in. No functional change. Link: https://lkml.kernel.org/r/20250507160012.3311104-1-glider@google.com Signed-off-by: Alexander Potapenko Cc: Ilya Leoshkevich Cc: Bart van Assche Cc: Dmitriy Vyukov Cc: Kent Overstreet Cc: Macro Elver Signed-off-by: Andrew Morton commit e341f9c3c8412e57fe0042a33a2640245ecdf619 Author: Joshua Hahn Date: Mon May 5 11:23:28 2025 -0700 mm/mempolicy: Weighted Interleave Auto-tuning On machines with multiple memory nodes, interleaving page allocations across nodes allows for better utilization of each node's bandwidth. Previous work by Gregory Price [1] introduced weighted interleave, which allowed for pages to be allocated across nodes according to user-set ratios. Ideally, these weights should be proportional to their bandwidth, so that under bandwidth pressure, each node uses its maximal efficient bandwidth and prevents latency from increasing exponentially. Previously, weighted interleave's default weights were just 1s -- which would be equivalent to the (unweighted) interleave mempolicy, which goes through the nodes in a round-robin fashion, ignoring bandwidth information. This patch has two main goals: First, it makes weighted interleave easier to use for users who wish to relieve bandwidth pressure when using nodes with varying bandwidth (CXL). By providing a set of "real" default weights that just work out of the box, users who might not have the capability (or wish to) perform experimentation to find the most optimal weights for their system can still take advantage of bandwidth-informed weighted interleave. Second, it allows for weighted interleave to dynamically adjust to hotplugged memory with new bandwidth information. Instead of manually updating node weights every time new bandwidth information is reported or taken off, weighted interleave adjusts and provides a new set of default weights for weighted interleave to use when there is a change in bandwidth information. To meet these goals, this patch introduces an auto-configuration mode for the interleave weights that provides a reasonable set of default weights, calculated using bandwidth data reported by the system. In auto mode, weights are dynamically adjusted based on whatever the current bandwidth information reports (and responds to hotplug events). This patch still supports users manually writing weights into the nodeN sysfs interface by entering into manual mode. When a user enters manual mode, the system stops dynamically updating any of the node weights, even during hotplug events that shift the optimal weight distribution. A new sysfs interface "auto" is introduced, which allows users to switch between the auto (writing 1 or Y) and manual (writing 0 or N) modes. The system also automatically enters manual mode when a nodeN interface is manually written to. There is one functional change that this patch makes to the existing weighted_interleave ABI: previously, writing 0 directly to a nodeN interface was said to reset the weight to the system default. Before this patch, the default for all weights were 1, which meant that writing 0 and 1 were functionally equivalent. With this patch, writing 0 is invalid. Link: https://lkml.kernel.org/r/20250520141236.2987309-1-joshua.hahnjy@gmail.com [joshua.hahnjy@gmail.com: wordsmithing changes, simplification, fixes] Link: https://lkml.kernel.org/r/20250511025840.2410154-1-joshua.hahnjy@gmail.com [joshua.hahnjy@gmail.com: remove auto_kobj_attr field from struct sysfs_wi_group] Link: https://lkml.kernel.org/r/20250512142511.3959833-1-joshua.hahnjy@gmail.com https://lore.kernel.org/linux-mm/20240202170238.90004-1-gregory.price@memverge.com/ [1] Link: https://lkml.kernel.org/r/20250505182328.4148265-1-joshua.hahnjy@gmail.com Co-developed-by: Gregory Price Signed-off-by: Gregory Price Signed-off-by: Joshua Hahn Suggested-by: Yunjeong Mun Suggested-by: Oscar Salvador Suggested-by: Ying Huang Suggested-by: Harry Yoo Reviewed-by: Harry Yoo Reviewed-by: Huang Ying Reviewed-by: Honggyu Kim Cc: Dan Williams Cc: Dave Jiang Cc: Greg Kroah-Hartman Cc: Joanthan Cameron Cc: Johannes Weiner Cc: Len Brown Signed-off-by: Andrew Morton commit 179fa6e8c2b632949dd9b63681ff696f03a8e1dd Merge: c07da6de0eb87a 6a9d340b1f9910 Author: Arnd Bergmann Date: Wed May 21 18:54:51 2025 +0200 Merge tag 'ti-k3-dt-for-v6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/dt TI K3 device tree updates for v6.16 Generic Fixups/Cleanups: * am62*: emmc - drop disable-wp, Add bootphase tags to support MMC boot SoC Specific features and Fixes: AM62Ax: * C7x and R5F support added * Bug fix for emmc clock to point to default * CPUFreq thermal throttling on thermal alert AM62P5: * Add RNG Node (common to J722s) * Bug fix for emmc clock to point to default (common to J722S) AM625: * Wakeup R5 node * Bug fix for emmc clock to point to default * PRUSS-M support * New GPU bindings AM64: * Switch to 64-bit address space for PCIe0 * Add PCIe control nodes for main_conf region * Reserve timer nodes used by MCU F/w. AM65: * MMC: Add missing delay timing values for SDR and legacy modes * Add compatible for AM65x syscon and PCIe control properties (dtbs_check fixes) J7200: * PCIe control node to scm_conf, switch to 64-bit address space for PCIe1. J721E: * PCIe control node to scm_conf, switch to 64-bit address space for PCIe0,1. J721S2: * GPU node for Imagination Tech Rouge BXS GPU. * PCIe control node to scm_conf, switch to 64-bit address space for PCIe1. J722s/AM67A: * Switch serdes status to be enabled by board file than at SoC level. * Switch to 64-bit address space for PCIe0. J784S4/J742S2/AM69: * Add ASPCIE0 and enable output for PCIe1 * Fix length of serdes_ln_ctrl. * Switch to 64-bit address space for PCIe0,1. Board Specific: AM62Ax: * SK: co-processors C7x, R5, PWM support added * phycore-som: co-processors C7x, R5 AM62P5: * Add Toradex Verdin AM62P boards with Dahlia, Ivy, Mallow and Yavia support. * SK: Add remote processor support, PWM AM625: * Add BeagleBoard.org PocketBeagle-2 support * phycore-som: Enable R5F support * Verdin: Add eeprom compatible fallback * SK: Enable PWM, voltage supplies, clock, i2cmux rename for camera overlays (dtbs_check fixes) * BeaglePlay: Add voltage supplies for camera overlays (dtbs_check fixes) * phyboard-lyra: Add cooling maps for fan * emmc bug fixes: add non-removable flag for eMMC. AM65: * EVM: Add missing power supply description ofr Rocktech panel (dtbs_check fixes) J721E: * EVM: Enable OSPI1 * EVM/SK: Dt nodes description for mandatory power suplpies for panel and sensors (dtbs_check fixes) J721S2/AM68: * Add phyBOARD-Izar-AM68x * am68-SK: Fix regulator hierarchy J722s/AM67A: * EVM: Add mux controls for CSI2, power regulator nodes and add overlays for quad IMX219 and TEVI OV5640. * BeagleY-AI: Add bootph for main_gpio1 J784S4/J742S2/AM69: * usxgmii expansion board: Drop un-necessary pinctrl-names * evm: Add overlay for USB0 Type-A option * tag 'ti-k3-dt-for-v6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: (86 commits) arm64: dts: ti: k3-j722s-evm: Add overlay for TEVI OV5640 arm64: dts: ti: k3-j722s-evm: Add overlay for quad IMX219 arm64: dts: ti: j722s-evm: Add MUX to control CSI2RX arm64: dts: ti: j722s-evm: Add DT nodes for power regulators arm64: dts: ti: k3-am62a-phycore-som: Reserve main_timer2 for C7x DSP arm64: dts: ti: k3-am62a-phycore-som: Reserve main_rti4 for C7x DSP arm64: dts: ti: k3-am62a-phycore-som: Enable Co-processors arm64: dts: ti: k3-am62-phycore-som: Enable Co-processors arm64: dts: ti: k3-am62x-phyboard-lyra-gpio-fan: Update cooling maps arm64: dts: ti: k3-am62a: Enable CPU freq throttling on thermal alert arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E arm64: dts: ti: k3-j721s2: Add GPU node arm64: dts: ti: k3-am62: New GPU binding details arm64: dts: ti: k3-am62-main: Add PRUSS-M node arm64: dts: ti: k3-am64: Reserve timers used by MCU FW arm64: dts: ti: k3-am62a7-sk: Reserve main_rti4 for C7x DSP arm64: dts: ti: k3-am62a7-sk: Reserve main_timer2 for C7x DSP arm64: dts: ti: k3-am62x-sk-common: Enable IPC with remote processors arm64: dts: ti: k3-am62p5-sk: Enable IPC with remote processors arm64: dts: ti: k3-am62a7-sk: Enable IPC with remote processors ... Link: https://lore.kernel.org/r/20250512144807.yn64klchtmjjl6ac@protrude Signed-off-by: Arnd Bergmann commit c07da6de0eb87a328d8905585a9ca1076c6ee216 Author: Nikolaos Pasaloukos Date: Mon May 12 13:33:17 2025 +0000 arm64: dts: blaize-blzp1600: Enable GPIO support Blaize BLZP1600 uses the custom silicon provided from VeriSilicon to add GPIO support. This interface is used to control signals on many other peripherals, such as Ethernet, USB, SD and eMMC. Signed-off-by: Nikolaos Pasaloukos Link: https://lore.kernel.org/r/20250512133302.151621-1-nikolaos.pasaloukos@blaize.com Signed-off-by: Arnd Bergmann commit 828497fba7b855243826bd96531920dc6bb93ec9 Merge: 15c2b04abe8639 8c4d2cc1e1cb9b Author: Mark Brown Date: Wed May 21 17:50:09 2025 +0100 ASoC: Add Intel machine driver support for CS35L63 Merge series from Stefan Binding : This adds support to the Intel machine drivers for CS35L63 codecs using soundwire, and also adds match entries for the CDB35L63-CB2 on MTL systems. commit 7e358b8cc138918381757d5e796b971bc238c6ee Merge: 24822c4b476c7d a4c95b924d5137 Author: Arnd Bergmann Date: Wed May 21 18:50:08 2025 +0200 Merge tag 'thead-dt-for-v6.16' of https://github.com/pdp7/linux into soc/dt T-HEAD Devicetrees for v6.16 There are several additions for the T-Head TH1520 SoC: - AON (Always-On) node which serves as a power-domain controller - Reset controller node - VO (Video Output) clock controller node These changes have all been tested in linux-next with the corresponding driver patches. Signed-off-by: Drew Fustini * tag 'thead-dt-for-v6.16' of https://github.com/pdp7/linux: riscv: dts: thead: Add device tree VO clock controller riscv: dts: thead: Introduce reset controller node riscv: dts: thead: Introduce power domain nodes with aon firmware commit 24822c4b476c7d7387eec21711d7908a86728d8a Author: Matthew Gerlach Date: Thu Apr 24 07:43:41 2025 -0700 dt-bindings: clock: socfpga: convert to yaml Convert the clock device tree bindings to yaml for the Altera SoCFPGA Cyclone5, Arria5, and Arria10 chip families. Since the clock nodes are subnodes to Altera SOCFPGA Clock Manager, the yaml was added to socfpga-clk-manager.yaml. Signed-off-by: Matthew Gerlach Signed-off-by: Dinh Nguyen commit dc9f08bac28bcd4c1b7a79d39c816dfdf5279818 Author: Shashank Balaji Date: Tue May 20 23:07:45 2025 +0900 cgroup, docs: be specific about bandwidth control of rt processes Signed-off-by: Shashank Balaji Signed-off-by: Tejun Heo commit 3e20585abf2233da5212e6fb2f7c7ea0f337cd09 Author: Vincent Mailhol Date: Wed May 21 23:18:53 2025 +0900 selftests: can: test_raw_filter.sh: add support of physical interfaces Allow the user to specify a physical interface through the $CANIF environment variable. Add a $BITRATE environment variable set with a default value of 500000. If $CANIF is omitted or if it starts with vcan (e.g. vcan1), the test will use the virtual can interface type. Otherwise, it will assume that the provided interface is a physical can interface. For example: CANIF=can1 BITRATE=1000000 ./test_raw_filter.sh will run set the can1 interface with a bitrate of one million and run the tests on it. Signed-off-by: Vincent Mailhol Signed-off-by: Marc Kleine-Budde commit 77442ffa83e8ed49d1c5192b90f9950b192e09e5 Author: Felix Maurer Date: Wed May 21 15:16:09 2025 +0200 selftests: can: Import tst-filter from can-tests Tests for the can subsystem have been in the can-tests repository[1] so far. Start moving the tests to kernel selftests by importing the current tst-filter test. The test is now named test_raw_filter and is substantially updated to be more aligned with the kernel selftests, follow the coding style, and simplify the validation of received CAN frames. We also include documentation of the test design. The test verifies that the single filters on raw CAN sockets work as expected. We intend to import more tests from can-tests and add additional test cases in the future. The goal of moving the CAN selftests into the tree is to align the tests more closely with the kernel, improve testing of CAN in general, and to simplify running the tests automatically in the various kernel CI systems. [1]: https://github.com/linux-can/can-tests Signed-off-by: Felix Maurer Reviewed-by: Vincent Mailhol Link: https://patch.msgid.link/87d289f333cba7bbcc9d69173ea1c320e4b5c3b8.1747833283.git.fmaurer@redhat.com Signed-off-by: Marc Kleine-Budde commit 772e50a76ee664e75581624f512df4e45582605a Author: Tzung-Bi Shih Date: Tue May 20 08:20:49 2025 +0000 kunit: Fix wrong parameter to kunit_deactivate_static_stub() kunit_deactivate_static_stub() accepts real_fn_addr instead of replacement_addr. In the case, it always passes NULL to kunit_deactivate_static_stub(). Fix it. Link: https://lore.kernel.org/r/20250520082050.2254875-1-tzungbi@kernel.org Fixes: e047c5eaa763 ("kunit: Expose 'static stub' API to redirect functions") Signed-off-by: Tzung-Bi Shih Reviewed-by: David Gow Signed-off-by: Shuah Khan commit 4e9d73034196ac8ab496bb47583197b36ba13327 Author: Haibo Chen Date: Tue May 20 11:46:12 2025 +0800 dt-bindings: gpio: vf610: add ngpios and gpio-reserved-ranges Add optional ngpios and gpio-reserved-ranges property. Reviewed-by: Frank Li Signed-off-by: Haibo Chen Acked-by: Conor Dooley Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250520-gpio-dts-v3-1-04771c6cf325@nxp.com Signed-off-by: Bartosz Golaszewski commit a510bb87da72aa8d1504b0e4b343cfe013ee8a89 Author: Claudiu Beznea Date: Wed May 21 17:25:41 2025 +0300 genirq/irqdesc: Remove double locking in hwirq_show() &desc->lock is acquired on 2 consecutive lines in hwirq_show(). This leads obviously to a deadlock. Drop the raw_spin_lock_irq() and keep guard(). Fixes: 5d964a9f7cd8 ("genirq/irqdesc: Switch to lock guards") Signed-off-by: Claudiu Beznea Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250521142541.3832130-1-claudiu.beznea.uj@bp.renesas.com commit 29857e6f4e30b475e0713fc7a65a962745c429ab Merge: 0af2f6be1b4281 d204e391a0d83d Author: Thomas Gleixner Date: Wed May 21 17:42:19 2025 +0200 Merge tag 'timers-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/daniel.lezcano/linux into timers/drivers - Add the System Timer Module driver for the S32G NXP platforms (Daniel Lezcano) - Convert the remaining text formatted DT bindings in schemas (Rob Herring) - Fix a Kconfig dependency on the atmel TCB driver to prevent a compilation warning when CONFIG_OF is disabled (Arnd Bergmann) - Fix self-pinging and support gettimeleft in the watchdog part of the tegra186 timer (Pohsun Su) - Add the Sophgo SG2044 ACLINT timer binding (Inochi Amaoto) - Add the EcoNet Timer HPT driver along with the DT bindings (Caleb James DeLisle) - Add the Renesas R9A09G056 compatible string bindings and enable reprobe support on the Renesas OSTM (Lab Prabhakar) Link: https://lore.kernel.org/all/aCy43_obHEdIpwWg@mai.linaro.org commit d3a889482bd5abf2bbdc1ec3d2d49575aa160c9c Author: Charles Yeh Date: Wed May 21 21:23:54 2025 +0800 USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB Add new bcd (0x905) to support PL2303GT-2AB (TYPE_HXN). Add new bcd (0x1005) to support PL2303GC-Q20 (TYPE_HXN). Signed-off-by: Charles Yeh Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit eb4e0298a05684f88fbd2106fc482f859f804aa6 Author: Andy Shevchenko Date: Wed May 21 16:55:37 2025 +0300 regmap-irq: Use dedicated interrupt wake setters Use enable_irq_wake() and disable_irq_wake() instead of calling low-level irq_set_irq_wake() with a parameter. No functional changes. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20250521135538.1086717-1-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit 92cd405b648605db4da866f3b9818b271ae84ef0 Author: Greg Kroah-Hartman Date: Wed May 21 15:41:34 2025 +0200 USB: serial: bus: fix const issue in usb_serial_device_match() usb_serial_device_match() takes a const pointer, and then decides to cast it away into a non-const one, which is not a good thing to do overall. Fix this up by properly setting the pointers to be const to preserve that attribute. Fixes: d69d80484598 ("driver core: have match() callback in struct bus_type take a const *") Signed-off-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold commit 46550e2b878d60923c72f0526a7aac02e8eda3d5 Author: Pali Rohár Date: Sun May 4 20:22:44 2025 +0200 include: pe.h: Fix PE definitions * Rename constants to their standard PE names: - MZ_MAGIC -> IMAGE_DOS_SIGNATURE - PE_MAGIC -> IMAGE_NT_SIGNATURE - PE_OPT_MAGIC_PE32_ROM -> IMAGE_ROM_OPTIONAL_HDR_MAGIC - PE_OPT_MAGIC_PE32 -> IMAGE_NT_OPTIONAL_HDR32_MAGIC - PE_OPT_MAGIC_PE32PLUS -> IMAGE_NT_OPTIONAL_HDR64_MAGIC - IMAGE_DLL_CHARACTERISTICS_NX_COMPAT -> IMAGE_DLLCHARACTERISTICS_NX_COMPAT * Import constants and their description from readpe and file projects which contains current up-to-date information: - IMAGE_FILE_MACHINE_* - IMAGE_FILE_* - IMAGE_SUBSYSTEM_* - IMAGE_DLLCHARACTERISTICS_* - IMAGE_DLLCHARACTERISTICS_EX_* - IMAGE_DEBUG_TYPE_* * Add missing IMAGE_SCN_* constants and update their incorrect description * Fix incorrect value of IMAGE_SCN_MEM_PURGEABLE constant * Add description for win32_version and loader_flags PE fields Signed-off-by: Pali Rohár Signed-off-by: Ard Biesheuvel commit 8bb9d6ccd36062d16baa707b759809e1f494017e Author: Jens Axboe Date: Thu May 8 14:48:33 2025 -0600 io_uring: finish IOU_OK -> IOU_COMPLETE transition IOU_COMPLETE is more descriptive, in that it explicitly says that the return value means "please post a completion for this request". This patch completes the transition from IOU_OK to IOU_COMPLETE, replacing existing IOU_OK users. This is a purely mechanical change. Signed-off-by: Jens Axboe commit 15c2b04abe863978e23ab97d1055638ad631475f Author: Kuninori Morimoto Date: Tue May 13 23:39:27 2025 +0000 ASoC: dt-bindings: audio-graph-card2: add missing mic-det-gpios The yaml has "hp-det-gpios" property, but Audio-Graph-Card2 can handle "mic-det-gpios" too. Add it. Signed-off-by: Kuninori Morimoto Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/877c2kaxn4.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 23205562ffc8de20f57afdd984858cab29e77968 Author: Pauli Virtanen Date: Sat May 3 17:08:21 2025 +0300 Bluetooth: separate CIS_LINK and BIS_LINK link types Use separate link type id for unicast and broadcast ISO connections. These connection types are handled with separate HCI commands, socket API is different, and hci_conn has union fields that are different in the two cases, so they shall not be mixed up. Currently in most places it is attempted to distinguish ucast by bacmp(&c->dst, BDADDR_ANY) but it is wrong as dst is set for bcast sink hci_conn in iso_conn_ready(). Additionally checking sync_handle might be OK, but depends on details of bcast conn configuration flow. To avoid complicating it, use separate link types. Fixes: f764a6c2c1e4 ("Bluetooth: ISO: Add broadcast support") Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 5bd5c716f7ec3e25d8d3b8a7566e192a26f9c7ce Author: Jiande Lu Date: Tue Apr 29 18:16:05 2025 +0800 Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925 Add VID 13d3 & PID 3630 for MediaTek MT7925 USB Bluetooth chip. The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below. T: Bus=07 Lev=01 Prnt=01 Port=10 Cnt=02 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=13d3 ProdID=3630 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us Signed-off-by: Jiande Lu Signed-off-by: Luiz Augusto von Dentz commit dd0ccf858057b793beb3779be7576d92c93cf828 Author: Pauli Virtanen Date: Sun Apr 27 14:27:25 2025 +0300 Bluetooth: add support for SIOCETHTOOL ETHTOOL_GET_TS_INFO Bluetooth needs some way for user to get supported so_timestamping flags for the different socket types. Use SIOCETHTOOL API for this purpose. As hci_dev is not associated with struct net_device, the existing implementation can't be reused, so we add a small one here. Add support (only) for ETHTOOL_GET_TS_INFO command. The API differs slightly from netdev in that the result depends also on socket type. Signed-off-by: Pauli Virtanen Acked-by: Willem de Bruijn Signed-off-by: Luiz Augusto von Dentz commit 190377500fdefce2bda3bbd08409f4f4d813b2d1 Author: Chandrashekar Devegowda Date: Thu Apr 24 08:01:47 2025 +0530 Bluetooth: btintel_pcie: Dump debug registers on error Dumping debug registers on GP1 MSIx and error conditions, such as TX completion timeout, aiding in understanding the controller's state during errors. The register dump includes: - Boot stage - IPC control - IPC status - Mailbox registers HCI traces: = Vendor Diagnostic (len 199) 2d 2d 2d 2d 20 44 75 6d 70 20 6f 66 20 64 65 62 ---- Dump of deb 75 67 20 72 65 67 69 73 74 65 72 73 20 2d 2d 2d ug registers --- 62 6f 6f 74 20 73 74 61 67 65 3a 20 30 78 61 30 boot stage: 0xa0 66 61 30 30 34 37 69 70 63 20 73 74 61 74 75 73 fa0047ipc status 3a 20 30 78 30 30 30 30 30 30 30 34 69 70 63 20 : 0x00000004ipc 63 6f 6e 74 72 6f 6c 3a 20 30 78 30 30 30 30 30 control: 0x00000 30 30 30 69 70 63 20 73 6c 65 65 70 20 63 6f 6e 000ipc sleep con 74 72 6f 6c 3a 20 30 78 30 30 30 30 30 30 30 30 trol: 0x00000000 6d 62 6f 78 20 73 74 61 74 75 73 3a 20 30 78 30 mbox status: 0x0 30 30 30 30 30 30 30 72 78 71 3a 20 63 72 5f 74 0000000rxq: cr_t 69 61 3a 20 37 20 63 72 5f 68 69 61 3a 20 37 74 ia: 7 cr_hia: 7t 78 71 3a 20 63 72 5f 74 69 61 3a 20 36 20 63 72 xq: cr_tia: 6 cr 5f 68 69 61 3a 20 36 _hia: 6 Signed-off-by: Chandrashekar Devegowda Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz commit 0a766a0affb563789a0ebaab41d68964ae94fc0e Author: Luiz Augusto von Dentz Date: Tue Apr 15 11:26:55 2025 -0400 Bluetooth: ISO: Fix getpeername not returning sockaddr_iso_bc fields If the socket is a broadcast receiver fields from sockaddr_iso_bc shall be part of the values returned to getpeername since some of these fields are updated while doing the PA and BIG sync procedures. Signed-off-by: Luiz Augusto von Dentz commit e2d471b7806b09744d65a64bcf41337468f2443b Author: Luiz Augusto von Dentz Date: Fri Apr 11 12:37:50 2025 -0400 Bluetooth: ISO: Fix not using SID from adv report Up until now it has been assumed that the application would be able to enter the advertising SID in sockaddr_iso_bc.bc_sid, but userspace has no access to SID since the likes of MGMT_EV_DEVICE_FOUND cannot carry it, so it was left unset (0x00) which means it would be unable to synchronize if the broadcast source is using a different SID e.g. 0x04: > HCI Event: LE Meta Event (0x3e) plen 57 LE Extended Advertising Report (0x0d) Num reports: 1 Entry 0 Event type: 0x0000 Props: 0x0000 Data status: Complete Address type: Random (0x01) Address: 0B:82:E8:50:6D:C8 (Non-Resolvable) Primary PHY: LE 1M Secondary PHY: LE 2M SID: 0x04 TX power: 127 dBm RSSI: -55 dBm (0xc9) Periodic advertising interval: 180.00 msec (0x0090) Direct address type: Public (0x00) Direct address: 00:00:00:00:00:00 (OUI 00-00-00) Data length: 0x1f 06 16 52 18 5b 0b e1 05 16 56 18 04 00 11 30 4c ..R.[....V....0L 75 69 7a 27 73 20 53 32 33 20 55 6c 74 72 61 uiz's S23 Ultra Service Data: Broadcast Audio Announcement (0x1852) Broadcast ID: 14748507 (0xe10b5b) Service Data: Public Broadcast Announcement (0x1856) Data[2]: 0400 Unknown EIR field 0x30[16]: 4c75697a27732053323320556c747261 < HCI Command: LE Periodic Advertising Create Sync (0x08|0x0044) plen 14 Options: 0x0000 Use advertising SID, Advertiser Address Type and address Reporting initially enabled SID: 0x00 (<- Invalid) Adv address type: Random (0x01) Adv address: 0B:82:E8:50:6D:C8 (Non-Resolvable) Skip: 0x0000 Sync timeout: 20000 msec (0x07d0) Sync CTE type: 0x0000 So instead this changes now allow application to set HCI_SID_INVALID which will make hci_le_pa_create_sync to wait for a report, update the conn->sid using the report SID and only then issue PA create sync command: < HCI Command: LE Periodic Advertising Create Sync Options: 0x0000 Use advertising SID, Advertiser Address Type and address Reporting initially enabled SID: 0x04 Adv address type: Random (0x01) Adv address: 0B:82:E8:50:6D:C8 (Non-Resolvable) Skip: 0x0000 Sync timeout: 20000 msec (0x07d0) Sync CTE type: 0x0000 > HCI Event: LE Meta Event (0x3e) plen 16 LE Periodic Advertising Sync Established (0x0e) Status: Success (0x00) Sync handle: 64 Advertising SID: 0x04 Advertiser address type: Random (0x01) Advertiser address: 0B:82:E8:50:6D:C8 (Non-Resolvable) Advertiser PHY: LE 2M (0x02) Periodic advertising interval: 180.00 msec (0x0090) Advertiser clock accuracy: 0x05 Signed-off-by: Luiz Augusto von Dentz commit 96ace5519f8ff12644be626b278a02d742b7694c Author: Hsin-chen Chuang Date: Wed Apr 16 09:53:38 2025 +0000 Revert "Bluetooth: btusb: add sysfs attribute to control USB alt setting" This reverts commit b16b327edb4d030fb4c8fe38c7d299074d47ee3f. The sysfs node introduced by this patch could potentially race with user space. The original motivation - Support configuring altsetting from the user space will be added by another series. Cc: chromeos-bluetooth-upstreaming@chromium.org Signed-off-by: Hsin-chen Chuang Signed-off-by: Luiz Augusto von Dentz commit f330734a6315ab3360a524946ea624675b246956 Author: Hsin-chen Chuang Date: Wed Apr 16 09:53:37 2025 +0000 Revert "Bluetooth: btusb: Configure altsetting for HCI_USER_CHANNEL" This reverts commit 75ddcd5ad40ecd9fbc9f5a7a2ed0e1e74921db3c. This patch doesn't work quite well - It's observed that with this patch HFP is flaky on most of the existing USB Bluetooth controllers: Intel chips sometimes send out no packet for Transparent codec; MTK chips may generate SCO data with a wrong handle for CVSD codec; RTK could split the data with a wrong packet size for Transparent codec; ... etc. Cc: chromeos-bluetooth-upstreaming@chromium.org Signed-off-by: Hsin-chen Chuang Signed-off-by: Luiz Augusto von Dentz commit 7d70989fcea7f79afe018a7e34d3486406c7a94e Author: Hsin-chen Chuang Date: Wed Apr 16 09:53:36 2025 +0000 Bluetooth: btusb: Add HCI Drv commands for configuring altsetting Although commit 75ddcd5ad40e ("Bluetooth: btusb: Configure altsetting for HCI_USER_CHANNEL") has enabled the HCI_USER_CHANNEL user to send out SCO data through USB Bluetooth chips, it's observed that with the patch HFP is flaky on most of the existing USB Bluetooth controllers: Intel chips sometimes send out no packet for Transparent codec; MTK chips may generate SCO data with a wrong handle for CVSD codec; RTK could split the data with a wrong packet size for Transparent codec; ... etc. To address the issue above one needs to reset the altsetting back to zero when there is no active SCO connection, which is the same as the BlueZ behavior, and another benefit is the bus doesn't need to reserve bandwidth when no SCO connection. This patch adds "Supported Altsettings" and "Switch Altsetting" commands that allow the user space program to configure the altsetting freely. This patch is tested on ChromeOS devices. The USB Bluetooth models (CVSD, TRANS alt3, and TRANS alt6) could pass the stress HFP test narrow band speech and wide band speech. Cc: chromeos-bluetooth-upstreaming@chromium.org Fixes: b16b327edb4d ("Bluetooth: btusb: add sysfs attribute to control USB alt setting") Signed-off-by: Hsin-chen Chuang Signed-off-by: Luiz Augusto von Dentz commit 04425292a62c15d1fde714522beaf8f3c2ed1de9 Author: Hsin-chen Chuang Date: Wed Apr 16 09:53:35 2025 +0000 Bluetooth: Introduce HCI Driver protocol Although commit 75ddcd5ad40e ("Bluetooth: btusb: Configure altsetting for HCI_USER_CHANNEL") has enabled the HCI_USER_CHANNEL user to send out SCO data through USB Bluetooth chips, it's observed that with the patch HFP is flaky on most of the existing USB Bluetooth controllers: Intel chips sometimes send out no packet for Transparent codec; MTK chips may generate SCO data with a wrong handle for CVSD codec; RTK could split the data with a wrong packet size for Transparent codec; ... etc. To address the issue above one needs to reset the altsetting back to zero when there is no active SCO connection, which is the same as the BlueZ behavior, and another benefit is the bus doesn't need to reserve bandwidth when no SCO connection. This patch adds the infrastructure that allow the user space program to talk to Bluetooth drivers directly: - Define the new packet type HCI_DRV_PKT which is specifically used for communication between the user space program and the Bluetooth drviers - hci_send_frame intercepts the packets and invokes drivers' HCI Drv callbacks (so far only defined for btusb) - 2 kinds of events to user space: Command Status and Command Complete, the former simply returns the status while the later may contain additional response data. Cc: chromeos-bluetooth-upstreaming@chromium.org Fixes: b16b327edb4d ("Bluetooth: btusb: add sysfs attribute to control USB alt setting") Signed-off-by: Hsin-chen Chuang Signed-off-by: Luiz Augusto von Dentz commit c50b56664e48b66b0249230ec16378082088c7ec Author: Neeraj Sanjay Kale Date: Mon Apr 14 23:29:52 2025 +0530 Bluetooth: btnxpuart: Implement host-wakeup feature This implements host wakeup feature by reading the device tree property wakeup-source and 'wakeup' interrupt, and nxp,wakeout-pin, and configuring it as a FALLING EDGE triggered interrupt. When host is suspended, a trigger from the WAKE_OUT pin of the controller wakes it up. To enable this feature, both device tree properties are needed to be defined. Signed-off-by: Neeraj Sanjay Kale Signed-off-by: Luiz Augusto von Dentz commit a12a5f5ff0c98f204409a252257e69d5b82fe9df Author: Neeraj Sanjay Kale Date: Mon Apr 14 23:29:51 2025 +0530 dt-bindings: net: bluetooth: nxp: Add support for host-wakeup Add support for host wakeup on interrupt. Signed-off-by: Neeraj Sanjay Kale Signed-off-by: Luiz Augusto von Dentz commit c4dbb1bdada90168dd5fa2f7e4553cb0e1dad3c8 Author: WangYuli Date: Tue Apr 15 10:33:50 2025 +0800 Bluetooth: btusb: Add RTL8851BE device 0x0bda:0xb850 The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below: T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 3 Spd=12 MxCh= 0 D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0bda ProdID=b850 Rev= 0.00 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=00e04c000001 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms Co-developed-by: Hao Li Signed-off-by: Hao Li Signed-off-by: WangYuli Signed-off-by: Luiz Augusto von Dentz commit bd3cb3c5aec80f70762c34fdd3068f07b212108e Author: Chen Ni Date: Thu Apr 10 15:34:56 2025 +0800 Bluetooth: hci_uart: Remove unnecessary NULL check before release_firmware() release_firmware() checks for NULL pointers internally. Remove unneeded NULL check for fmw here. Signed-off-by: Chen Ni Signed-off-by: Luiz Augusto von Dentz commit ee3e4209e66d44180a41d5ca7271361a2a28fccf Author: Krzysztof Kozlowski Date: Sun Apr 6 22:10:17 2025 +0200 Bluetooth: btmtksdio: Fix wakeup source leaks on device unbind Device can be unbound or probe can fail, so driver must also release memory for the wakeup source. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Luiz Augusto von Dentz commit ba6535e8b494931471df9666addf0f1e5e6efa27 Author: Krzysztof Kozlowski Date: Sun Apr 6 22:10:16 2025 +0200 Bluetooth: btmrvl_sdio: Fix wakeup source leaks on device unbind Device can be unbound or probe can fail, so driver must also release memory for the wakeup source. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Luiz Augusto von Dentz commit 689b5a8071c4fb9af89216d4d1ffa027db16e531 Author: Kiran K Date: Wed Apr 2 07:41:48 2025 +0530 Bluetooth: btintel_pcie: Do not generate coredump for diagnostic events All Intel diagnostic events are part of HCI traces and there is no need to generate coredump for the same. Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz commit bbf56029322c06a9227f09c2064f50278111159a Author: Youn MÉLOIS Date: Tue Apr 1 12:24:35 2025 +0000 Bluetooth: btusb: Add new VID/PID 13d3/3613 for MT7925 Add VID 13d3 & PID 3613 for MediaTek MT7925 USB Bluetooth chip. The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below. T: Bus=01 Lev=02 Prnt=02 Port=02 Cnt=01 Dev#= 4 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=13d3 ProdID=3613 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms I: If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us I:* If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us Signed-off-by: Youn Melois Signed-off-by: Luiz Augusto von Dentz commit 582847f9702461b0a1cba3efdb2b8135bf940d53 Author: Lukas Bulwahn Date: Wed May 7 15:30:43 2025 +0200 Makefile.kcov: apply needed compiler option unconditionally in CFLAGS_KCOV Commit 852faf805539 ("gcc-plugins: remove SANCOV gcc plugin") removes the config CC_HAS_SANCOV_TRACE_PC, as all supported compilers include the compiler option '-fsanitize-coverage=trace-pc' by now. The commit however misses the important use of this config option in Makefile.kcov to add '-fsanitize-coverage=trace-pc' to CFLAGS_KCOV. Include the compiler option '-fsanitize-coverage=trace-pc' unconditionally to CFLAGS_KCOV, as all compilers provide that option now. Fixes: 852faf805539 ("gcc-plugins: remove SANCOV gcc plugin") Signed-off-by: Lukas Bulwahn Reviewed-by: Nathan Chancellor Reviewed-by: Dmitry Vyukov Signed-off-by: Arnd Bergmann commit 3dcb524d785373fd43b129f01f32bd394fe167e0 Author: Ivan Hu Date: Mon Mar 31 15:45:04 2025 +0800 efi/efi_test: Fix missing pending status update in getwakeuptime The pending status was not being passed to user space, leading to false test alarms when using the pending status. This patch ensures that the pending status is correctly updated and exposed to user space when calling getwakeuptime, preventing incorrect handling of the pending status. Signed-off-by: Ivan Hu Signed-off-by: Ard Biesheuvel commit c353fde17d8f7e710884532da50393cd22ddbfbe Author: Vincent Donnefort Date: Wed May 21 13:48:34 2025 +0100 KVM: arm64: np-guest CMOs with PMD_SIZE fixmap With the introduction of stage-2 huge mappings in the pKVM hypervisor, guest pages CMO is needed for PMD_SIZE size. Fixmap only supports PAGE_SIZE and iterating over the huge-page is time consuming (mostly due to TLBI on hyp_fixmap_unmap) which is a problem for EL2 latency. Introduce a shared PMD_SIZE fixmap (hyp_fixblock_map/hyp_fixblock_unmap) to improve guest page CMOs when stage-2 huge mappings are installed. On a Pixel6, the iterative solution resulted in a latency of ~700us, while the PMD_SIZE fixmap reduces it to ~100us. Because of the horrendous private range allocation that would be necessary, this is disabled for 64KiB pages systems. Suggested-by: Quentin Perret Signed-off-by: Vincent Donnefort Signed-off-by: Quentin Perret Link: https://lore.kernel.org/r/20250521124834.1070650-11-vdonnefort@google.com Signed-off-by: Marc Zyngier commit db14091d8f75852d960b18834c7bdb1b7c2bb74f Author: Vincent Donnefort Date: Wed May 21 13:48:33 2025 +0100 KVM: arm64: Stage-2 huge mappings for np-guests Now np-guests hypercalls with range are supported, we can let the hypervisor to install block mappings whenever the Stage-1 allows it, that is when backed by either Hugetlbfs or THPs. The size of those block mappings is limited to PMD_SIZE. Signed-off-by: Vincent Donnefort Link: https://lore.kernel.org/r/20250521124834.1070650-10-vdonnefort@google.com Signed-off-by: Marc Zyngier commit 3669ddd8fa8b5a46d96b9c54a6fa519a17e4a4fa Author: Quentin Perret Date: Wed May 21 13:48:32 2025 +0100 KVM: arm64: Add a range to pkvm_mappings In preparation for supporting stage-2 huge mappings for np-guest, add a nr_pages member for pkvm_mappings to allow EL1 to track the size of the stage-2 mapping. Signed-off-by: Quentin Perret Signed-off-by: Vincent Donnefort Link: https://lore.kernel.org/r/20250521124834.1070650-9-vdonnefort@google.com Signed-off-by: Marc Zyngier commit b38c9775f73941ee59aebc0a489aa5c22e632def Author: Quentin Perret Date: Wed May 21 13:48:31 2025 +0100 KVM: arm64: Convert pkvm_mappings to interval tree In preparation for supporting stage-2 huge mappings for np-guest, let's convert pgt.pkvm_mappings to an interval tree. No functional change intended. Suggested-by: Vincent Donnefort Signed-off-by: Quentin Perret Signed-off-by: Vincent Donnefort Link: https://lore.kernel.org/r/20250521124834.1070650-8-vdonnefort@google.com Signed-off-by: Marc Zyngier commit c4d99a833d34d8041a568f0c076379ae53c47896 Author: Vincent Donnefort Date: Wed May 21 13:48:30 2025 +0100 KVM: arm64: Add a range to __pkvm_host_test_clear_young_guest() In preparation for supporting stage-2 huge mappings for np-guest. Add a nr_pages argument to the __pkvm_host_test_clear_young_guest hypercall. This range supports only two values: 1 or PMD_SIZE / PAGE_SIZE (that is 512 on a 4K-pages system). Signed-off-by: Vincent Donnefort Link: https://lore.kernel.org/r/20250521124834.1070650-7-vdonnefort@google.com Signed-off-by: Marc Zyngier commit 0eb802b3b4ecfb10046bc325f47e7fd741c72ffe Author: Vincent Donnefort Date: Wed May 21 13:48:29 2025 +0100 KVM: arm64: Add a range to __pkvm_host_wrprotect_guest() In preparation for supporting stage-2 huge mappings for np-guest. Add a nr_pages argument to the __pkvm_host_wrprotect_guest hypercall. This range supports only two values: 1 or PMD_SIZE / PAGE_SIZE (that is 512 on a 4K-pages system). Signed-off-by: Vincent Donnefort Link: https://lore.kernel.org/r/20250521124834.1070650-6-vdonnefort@google.com Signed-off-by: Marc Zyngier commit f28f1d02f4eaac05c2ad6bf7264a8696dc21d011 Author: Vincent Donnefort Date: Wed May 21 13:48:28 2025 +0100 KVM: arm64: Add a range to __pkvm_host_unshare_guest() In preparation for supporting stage-2 huge mappings for np-guest. Add a nr_pages argument to the __pkvm_host_unshare_guest hypercall. This range supports only two values: 1 or PMD_SIZE / PAGE_SIZE (that is 512 on a 4K-pages system). Signed-off-by: Vincent Donnefort Link: https://lore.kernel.org/r/20250521124834.1070650-5-vdonnefort@google.com Signed-off-by: Marc Zyngier commit 4274385ebf090461b46b9bddb0f7c526182ba3c0 Author: Vincent Donnefort Date: Wed May 21 13:48:27 2025 +0100 KVM: arm64: Add a range to __pkvm_host_share_guest() In preparation for supporting stage-2 huge mappings for np-guest. Add a nr_pages argument to the __pkvm_host_share_guest hypercall. This range supports only two values: 1 or PMD_SIZE / PAGE_SIZE (that is 512 on a 4K-pages system). Signed-off-by: Vincent Donnefort Link: https://lore.kernel.org/r/20250521124834.1070650-4-vdonnefort@google.com Signed-off-by: Marc Zyngier commit 3db771fa23ed6aecdf28ce4b806309198eea84e2 Author: Vincent Donnefort Date: Wed May 21 13:48:26 2025 +0100 KVM: arm64: Introduce for_each_hyp_page Add a helper to iterate over the hypervisor vmemmap. This will be particularly handy with the introduction of huge mapping support for the np-guest stage-2. Signed-off-by: Vincent Donnefort Link: https://lore.kernel.org/r/20250521124834.1070650-3-vdonnefort@google.com Signed-off-by: Marc Zyngier commit 944a1ed8cc3ea6c5b16b6aca11475ced0daf68a9 Author: Vincent Donnefort Date: Wed May 21 13:48:25 2025 +0100 KVM: arm64: Handle huge mappings for np-guest CMOs clean_dcache_guest_page() and invalidate_icache_guest_page() accept a size as an argument. But they also rely on fixmap, which can only map a single PAGE_SIZE page. With the upcoming stage-2 huge mappings for pKVM np-guests, those callbacks will get size > PAGE_SIZE. Loop the CMOs on a PAGE_SIZE basis until the whole range is done. Signed-off-by: Vincent Donnefort Link: https://lore.kernel.org/r/20250521124834.1070650-2-vdonnefort@google.com Signed-off-by: Marc Zyngier commit d5702dd22427789bc2178e942d92a2245e87b31a Merge: cd6b97bc897101 48d56450729308 Author: Marc Zyngier Date: Wed May 21 14:33:43 2025 +0100 Merge branch kvm-arm64/pkvm-selftest-6.16 into kvm-arm64/pkvm-np-thp-6.16 * kvm-arm64/pkvm-selftest-6.16: : . : pKVM selftests covering the memory ownership transitions by : Quentin Perret. From the initial cover letter: : : "We have recently found a bug [1] in the pKVM memory ownership : transitions by code inspection, but it could have been caught with a : test. : : Introduce a boot-time selftest exercising all the known pKVM memory : transitions and importantly checks the rejection of illegal transitions. : : The new test is hidden behind a new Kconfig option separate from : CONFIG_EL2_NVHE_DEBUG on purpose as that has side effects on the : transition checks ([1] doesn't reproduce with EL2 debug enabled). : : [1] https://lore.kernel.org/kvmarm/20241128154406.602875-1-qperret@google.com/" : . KVM: arm64: Extend pKVM selftest for np-guests KVM: arm64: Selftest for pKVM transitions KVM: arm64: Don't WARN from __pkvm_host_share_guest() KVM: arm64: Add .hyp.data section Signed-off-by: Marc Zyngier commit cd6b97bc897101652a203839912e17bb3d1a2db8 Merge: b4432656b36e5c 43c475504a39e9 Author: Marc Zyngier Date: Wed May 21 14:33:39 2025 +0100 Merge branch kvm-arm64/pkvm-6.16 into kvm-arm64/pkvm-np-thp-6.16 * kvm-arm64/pkvm-6.16: : . : pKVM memory management cleanups, courtesy of Quentin Perret. : From the cover letter: : : "This series moves the hypervisor's ownership state to the hyp_vmemmap, : as discussed in [1]. The two main benefits are: : : 1. much cheaper hyp state lookups, since we can avoid the hyp stage-1 : page-table walk; : : 2. de-correlates the hyp state from the presence of a mapping in the : linear map range of the hypervisor; which enables a bunch of : clean-ups in the existing code and will simplify the introduction of : other features in the future (hyp tracing, ...)" : . KVM: arm64: Unconditionally cross check hyp state KVM: arm64: Defer EL2 stage-1 mapping on share KVM: arm64: Move hyp state to hyp_vmemmap KVM: arm64: Introduce {get,set}_host_state() helpers KVM: arm64: Use 0b11 for encoding PKVM_NOPAGE KVM: arm64: Fix pKVM page-tracking comments KVM: arm64: Track SVE state in the hypervisor vcpu structure Signed-off-by: Marc Zyngier commit 869c788909b93a78ead1ca28c42b95eeb0779215 Author: Thomas Weißschuh Date: Mon May 5 17:15:30 2025 +0200 selftests: harness: Stop using setjmp()/longjmp() Usage of longjmp() was added to ensure that teardown is always run in commit 63e6b2a42342 ("selftests/harness: Run TEARDOWN for ASSERT failures") However instead of calling longjmp() to the teardown handler it is easier to just call the teardown handler directly from __bail(). Any potential duplicate teardown invocations are harmless as the actual handler will only ever be executed once since commit fff37bd32c76 ("selftests/harness: Fix fixture teardown"). Additionally this removes a incompatibility with nolibc, which does not support setjmp()/longjmp(). Signed-off-by: Thomas Weißschuh Acked-by: Shuah Khan Link: https://lore.kernel.org/r/20250505-nolibc-kselftest-harness-v4-12-ee4dd5257135@linutronix.de Signed-off-by: Thomas Weißschuh commit f46ddc2cbac34d73f959c798505d81413866ecf0 Author: Thomas Weißschuh Date: Mon May 5 17:15:29 2025 +0200 selftests: harness: Add "variant" and "self" to test metadata To get rid of setjmp()/longjmp(), the variant and self need to be usable from __bail(). Make them available from the test metadata. Signed-off-by: Thomas Weißschuh Acked-by: Shuah Khan Link: https://lore.kernel.org/r/20250505-nolibc-kselftest-harness-v4-11-ee4dd5257135@linutronix.de Signed-off-by: Thomas Weißschuh commit 5f036a2a8e0985e52f7cf63a06f51911b5e8cae2 Author: Thomas Weißschuh Date: Mon May 5 17:15:28 2025 +0200 selftests: harness: Add teardown callback to test metadata To get rid of setjmp()/longjmp(), the teardown logic needs to be usable from __bail(). Introduce a new callback for it. Signed-off-by: Thomas Weißschuh Acked-by: Shuah Khan Link: https://lore.kernel.org/r/20250505-nolibc-kselftest-harness-v4-10-ee4dd5257135@linutronix.de Signed-off-by: Thomas Weißschuh commit 906dbc17d61c3877b93407dafdff443fc6e21d7f Author: Thomas Weißschuh Date: Mon May 5 17:15:27 2025 +0200 selftests: harness: Move teardown conditional into test metadata To get rid of setjmp()/longjmp(), the teardown logic needs to be usable from __bail(). To access the atomic teardown conditional from there, move it into the test metadata. This also allows the removal of "setup_completed". Signed-off-by: Thomas Weißschuh Acked-by: Shuah Khan Link: https://lore.kernel.org/r/20250505-nolibc-kselftest-harness-v4-9-ee4dd5257135@linutronix.de Signed-off-by: Thomas Weißschuh commit fb25e99bce8d6e72d976c6e9a6a238298936ae94 Author: Thomas Weißschuh Date: Mon May 5 17:15:26 2025 +0200 selftests: harness: Don't set setup_completed for fixtureless tests This field is unused and has no meaning for tests without fixtures. Don't set it for them. Signed-off-by: Thomas Weißschuh Acked-by: Shuah Khan Link: https://lore.kernel.org/r/20250505-nolibc-kselftest-harness-v4-8-ee4dd5257135@linutronix.de Signed-off-by: Thomas Weißschuh commit 73a3cde97677933f292d678fcc84bae5d9ac2651 Author: Thomas Weißschuh Date: Mon May 5 17:15:25 2025 +0200 selftests: harness: Implement test timeouts through pidfd Make the kselftest harness compatible with nolibc which does not implement signals by replacing the signal logic with pidfds. The code also becomes simpler. Signed-off-by: Thomas Weißschuh Acked-by: Shuah Khan Link: https://lore.kernel.org/r/20250505-nolibc-kselftest-harness-v4-7-ee4dd5257135@linutronix.de Signed-off-by: Thomas Weißschuh commit 67ee52611b4d7a0da38e82409b86607c3a43fe8d Author: Thomas Weißschuh Date: Mon May 5 17:15:24 2025 +0200 selftests: harness: Remove dependency on libatomic __sync_bool_compare_and_swap() is deprecated and requires libatomic on GCC. Compiler toolchains don't necessarily have libatomic available, so avoid this requirement by using atomics that don't need libatomic. Signed-off-by: Thomas Weißschuh Reviewed-by: Muhammad Usama Anjum Acked-by: Shuah Khan Link: https://lore.kernel.org/r/20250505-nolibc-kselftest-harness-v4-6-ee4dd5257135@linutronix.de Signed-off-by: Thomas Weißschuh commit 5cccec7239c4765f5339951b1aa9063b80cfc29f Author: Thomas Weißschuh Date: Mon May 5 17:15:23 2025 +0200 selftests: harness: Remove inline qualifier for wrappers The pointers to the wrappers are stored in function pointers, preventing them from actually being inlined. Remove the inline qualifier, aligning these wrappers with the other functions defined through macros. Signed-off-by: Thomas Weißschuh Reviewed-by: Muhammad Usama Anjum Acked-by: Shuah Khan Link: https://lore.kernel.org/r/20250505-nolibc-kselftest-harness-v4-5-ee4dd5257135@linutronix.de Signed-off-by: Thomas Weißschuh commit c2bcc8e9577a35f9cf4707f8bb0b58bce30991aa Author: Thomas Weißschuh Date: Mon May 5 17:15:22 2025 +0200 selftests: harness: Mark functions without prototypes static With -Wmissing-prototypes the compiler will warn about non-static functions which don't have a prototype defined. As they are not used from a different compilation unit they don't need to be defined globally. Avoid the issue by marking the functions static. Signed-off-by: Thomas Weißschuh Reviewed-by: Muhammad Usama Anjum Acked-by: Shuah Khan Link: https://lore.kernel.org/r/20250505-nolibc-kselftest-harness-v4-4-ee4dd5257135@linutronix.de Signed-off-by: Thomas Weißschuh commit 6c409e0d87e340c2ce16fc3a1dd5b625c73fe54b Author: Thomas Weißschuh Date: Mon May 5 17:15:21 2025 +0200 selftests: harness: Ignore unused variant argument warning For tests without fixtures the variant argument is unused. This is intentional, prevent to compiler from complaining. Example warning: harness-selftest.c: In function 'wrapper_standalone_pass': ../kselftest_harness.h:181:52: error: unused parameter 'variant' [-Werror=unused-parameter] 181 | struct __fixture_variant_metadata *variant) \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~ ../kselftest_harness.h:156:25: note: in expansion of macro '__TEST_IMPL' 156 | #define TEST(test_name) __TEST_IMPL(test_name, -1) | ^~~~~~~~~~~ harness-selftest.c:15:1: note: in expansion of macro 'TEST' 15 | TEST(standalone_pass) { | ^~~~ Signed-off-by: Thomas Weißschuh Reviewed-by: Muhammad Usama Anjum Acked-by: Shuah Khan Link: https://lore.kernel.org/r/20250505-nolibc-kselftest-harness-v4-3-ee4dd5257135@linutronix.de Signed-off-by: Thomas Weißschuh commit 575eca2c8c7d40a1dccb0e3abc58ed13f45c4e8a Author: Thomas Weißschuh Date: Mon May 5 17:15:20 2025 +0200 selftests: harness: Use C89 comment style All comments in this file use C89 comment style. Except for this one. Change it to get one step closer to C89 compatibility. Signed-off-by: Thomas Weißschuh Acked-by: Shuah Khan Link: https://lore.kernel.org/r/20250505-nolibc-kselftest-harness-v4-2-ee4dd5257135@linutronix.de Signed-off-by: Thomas Weißschuh commit df82ffc5a3c18b21ea0140faed81241c7d273e88 Author: Thomas Weißschuh Date: Mon May 5 17:15:19 2025 +0200 selftests: harness: Add kselftest harness selftest Add a selftest for the kselftest harness itself so any changes can be validated. Signed-off-by: Thomas Weißschuh Reviewed-by: Muhammad Usama Anjum Acked-by: Shuah Khan Link: https://lore.kernel.org/r/20250505-nolibc-kselftest-harness-v4-1-ee4dd5257135@linutronix.de Signed-off-by: Thomas Weißschuh commit 2011097c17c6c947efd57ade071927c13784dcbc Author: Thomas Weißschuh Date: Thu May 15 21:57:55 2025 +0200 selftests/nolibc: drop include guards around standard headers Nolibc now provides all the headers required by nolibc-test.c. Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20250515-nolibc-sys-v1-9-74f82eea3b59@weissschuh.net Acked-by: Willy Tarreau commit 2217abe09ce4e0dcbe17ed83b44cb48de11fae1d Author: Thomas Weißschuh Date: Thu May 15 21:57:54 2025 +0200 tools/nolibc: move NULL and offsetof() to sys/stddef.h This is the location regular userspace expects these definitions. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250515-nolibc-sys-v1-8-74f82eea3b59@weissschuh.net commit 0f971358dcf34ca4e430e828582cb1c70cfe1f70 Author: Thomas Weißschuh Date: Thu May 15 21:57:53 2025 +0200 tools/nolibc: move uname() and friends to sys/utsname.h This is the location regular userspace expects these definitions. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250515-nolibc-sys-v1-7-74f82eea3b59@weissschuh.net commit e1211e2206356785365f065ece4965a997903f69 Author: Thomas Weißschuh Date: Thu May 15 21:57:52 2025 +0200 tools/nolibc: move makedev() and friends to sys/sysmacros.h This is the location regular userspace expects these definitions. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250515-nolibc-sys-v1-6-74f82eea3b59@weissschuh.net commit 9089524753b480b7a169004c46296d1e45103a31 Author: Thomas Weißschuh Date: Thu May 15 21:57:51 2025 +0200 tools/nolibc: move getrlimit() and friends to sys/resource.h This is the location regular userspace expects these definitions. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250515-nolibc-sys-v1-5-74f82eea3b59@weissschuh.net commit 2efb9050909f1fc0db39b2600bada8341ebc56c3 Author: Thomas Weißschuh Date: Thu May 15 21:57:50 2025 +0200 tools/nolibc: move reboot() to sys/reboot.h This is the location regular userspace expects this definition. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250515-nolibc-sys-v1-4-74f82eea3b59@weissschuh.net commit 3edd5365f99eeff38c5d31d9809afa6231e6de2d Author: Thomas Weißschuh Date: Thu May 15 21:57:49 2025 +0200 tools/nolibc: move prctl() to sys/prctl.h This is the location regular userspace expects this definition. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250515-nolibc-sys-v1-3-74f82eea3b59@weissschuh.net commit 6e7c805a93a07ca9b1de49e8a020ab6c05e93f4e Author: Thomas Weißschuh Date: Thu May 15 21:57:48 2025 +0200 tools/nolibc: move mount() to sys/mount.h This is the location regular userspace expects this definition. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250515-nolibc-sys-v1-2-74f82eea3b59@weissschuh.net commit 7281be583117d7ff12c52684ffc732e6ffca8f58 Author: Thomas Weißschuh Date: Thu May 15 21:57:47 2025 +0200 tools/nolibc: move ioctl() to sys/ioctl.h This is the location regular userspace expects this definition. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250515-nolibc-sys-v1-1-74f82eea3b59@weissschuh.net commit 59303930326ac00bec5ec61321d662a165350939 Author: Thomas Weißschuh Date: Mon Apr 28 14:40:16 2025 +0200 tools/nolibc: implement wait() in terms of waitpid() Newer architectures like riscv 32-bit are missing sys_wait4(). Make use of the fact that wait(&status) is defined to be equivalent to waitpid(-1, status, 0) to implement it on all architectures. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250428-nolibc-misc-v2-15-3c043eeab06c@linutronix.de Signed-off-by: Thomas Weißschuh commit 5e7392dc82ed7bf3e734cbca77a1c6fd044ec871 Author: Thomas Weißschuh Date: Mon Apr 28 14:40:15 2025 +0200 tools/nolibc: fall back to sys_clock_gettime() in gettimeofday() Newer architectures (like riscv32) do not implement sys_gettimeofday(). In those cases fall back to sys_clock_gettime(). While that does not support the timezone argument of sys_gettimeofday(), specifying this argument invokes undefined behaviour, so it's safe to ignore. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250428-nolibc-misc-v2-14-3c043eeab06c@linutronix.de Signed-off-by: Thomas Weißschuh commit a009a0c6faa9e7ffac13d55ef6cdac1f9a68efbe Author: Thomas Weißschuh Date: Mon Apr 28 14:40:14 2025 +0200 tools/nolibc: add fopen() This is used in various selftests and will be handy when integrating those with nolibc. Only the standard POSIX modes are supported. No extensions nor the (noop) "b" from ISO C are accepted. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250428-nolibc-misc-v2-13-3c043eeab06c@linutronix.de Signed-off-by: Thomas Weißschuh commit 256dc7339d466f4d928be48ced6d590a99d447cc Author: Thomas Weißschuh Date: Mon Apr 28 14:40:13 2025 +0200 tools/nolibc: add namespace functionality This is used in various selftests and will be handy when integrating those with nolibc. Not all configurations support namespaces, so skip the tests where necessary. Also if the tests are running without privileges. Enable the namespace configuration for those architectures where it is not enabled by default. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250428-nolibc-misc-v2-12-3c043eeab06c@linutronix.de Signed-off-by: Thomas Weißschuh commit 7ff3c71a4795f524b4dc643db4d00d4467be26a0 Author: Thomas Weißschuh Date: Mon Apr 28 14:40:12 2025 +0200 tools/nolibc: add difftime() This is used in various selftests and will be handy when integrating those with nolibc. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250428-nolibc-misc-v2-11-3c043eeab06c@linutronix.de Signed-off-by: Thomas Weißschuh commit da69cfb17b2afbb8692b74eefb844f85febb6674 Author: Thomas Weißschuh Date: Mon Apr 28 14:40:11 2025 +0200 tools/nolibc: add timerfd functionality This is used in various selftests and will be handy when integrating those with nolibc. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250428-nolibc-misc-v2-10-3c043eeab06c@linutronix.de Signed-off-by: Thomas Weißschuh commit fa7bf84486e48c65c5e450248b5d6922352203d1 Author: Thomas Weißschuh Date: Mon Apr 28 14:40:10 2025 +0200 tools/nolibc: add timer functions This is used in various selftests and will be handy when integrating those with nolibc. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250428-nolibc-misc-v2-9-3c043eeab06c@linutronix.de Signed-off-by: Thomas Weißschuh commit 50647213e115cbf5eb92c56a076af34dcd984174 Author: Thomas Weißschuh Date: Mon Apr 28 14:40:09 2025 +0200 tools/nolibc: add clock_getres(), clock_gettime() and clock_settime() This is used in various selftests and will be handy when integrating those with nolibc. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250428-nolibc-misc-v2-8-3c043eeab06c@linutronix.de Signed-off-by: Thomas Weißschuh commit 857faddd16c52b267da6519ba03d4578046f056f Merge: c8e1927e7f7d63 0f9a1739dd0e1c Author: Ard Biesheuvel Date: Wed May 21 15:32:06 2025 +0200 Merge branch 'efi-sbat' into efi/next commit 1e10b8534f5af42b7da528c254595f2a0cf4997d Author: Thomas Weißschuh Date: Mon Apr 28 14:40:08 2025 +0200 tools/nolibc: add support for access() and faccessat() This is used in various selftests and will be handy when integrating those with nolibc. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250428-nolibc-misc-v2-7-3c043eeab06c@linutronix.de Signed-off-by: Thomas Weißschuh commit bf5e8a78beded3503bbcfe86b3094a42ce492556 Author: Thomas Weißschuh Date: Mon Apr 28 14:40:07 2025 +0200 tools/nolibc: add abs() and friends This is used in various selftests and will be handy when integrating those with nolibc. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250428-nolibc-misc-v2-6-3c043eeab06c@linutronix.de Signed-off-by: Thomas Weißschuh commit 801f020b5f3d6159826ca38f63cd55e5536b35dd Author: Thomas Weißschuh Date: Mon Apr 28 14:40:06 2025 +0200 tools/nolibc: add getrandom() This is used in various selftests and will be handy when integrating those with nolibc. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250428-nolibc-misc-v2-5-3c043eeab06c@linutronix.de Signed-off-by: Thomas Weißschuh commit 55175d8659d22bfde30d4a1277328f090d8c0c2f Author: Thomas Weißschuh Date: Mon Apr 28 14:40:05 2025 +0200 tools/nolibc: add mremap() This is used in various selftests and will be handy when integrating those with nolibc. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250428-nolibc-misc-v2-4-3c043eeab06c@linutronix.de Signed-off-by: Thomas Weißschuh commit 2337d39f7233fc3fb9d90489f0d48904eb129a2e Author: Thomas Weißschuh Date: Mon Apr 28 14:40:04 2025 +0200 tools/nolibc: add more stat() variants Add fstat(), fstatat() and lstat(). All of them use the existing implementation based on statx(). Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250428-nolibc-misc-v2-3-3c043eeab06c@linutronix.de Signed-off-by: Thomas Weißschuh commit 7a7cd445d9275be8e4650d390156595685c3ac03 Author: Thomas Weißschuh Date: Mon Apr 28 14:40:03 2025 +0200 tools/nolibc: add %m printf format The %m format can be used to format the current errno. It is non-standard but supported by other commonly used libcs like glibc and musl, so applications do rely on them. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250428-nolibc-misc-v2-2-3c043eeab06c@linutronix.de Signed-off-by: Thomas Weißschuh commit 05b6b2a9efa4b40b7bc1668f887b7d98f719efb1 Author: Thomas Weißschuh Date: Mon Apr 28 14:40:02 2025 +0200 tools/nolibc: add strstr() This is used in various selftests and will be handy when integrating those with nolibc. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250428-nolibc-misc-v2-1-3c043eeab06c@linutronix.de Signed-off-by: Thomas Weißschuh commit 1f421ddf494d3263842bcf430a683aaf33c3e31c Author: Thomas Weißschuh Date: Wed Apr 30 11:35:33 2025 +0200 tools/nolibc: use poll-related definitions from UAPI headers The UAPI headers already provide definitions for these symbols. Using them makes the code shorter, more robust and compatible with applications using linux/poll.h directly. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250430-poll-v1-2-44b5ceabdeee@linutronix.de Signed-off-by: Thomas Weißschuh commit dc2c656e1f687d9f8decc4ee10092ee7258722c1 Author: Thomas Weißschuh Date: Wed Apr 30 11:35:32 2025 +0200 tools/nolibc: move poll() to poll.h This is the location regular userspace expects the definition. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250430-poll-v1-1-44b5ceabdeee@linutronix.de Signed-off-by: Thomas Weißschuh commit 66a4f9bb1e895aa64f0e786f4cd9864929242e4f Author: Daniel Palmer Date: Sun Apr 27 07:47:38 2025 +0900 tools/nolibc: Add m68k support Add nolibc support for m68k. Should be helpful for nommu where linking libc can bloat even hello world to the point where you get an OOM just trying to load it. Signed-off-by: Daniel Palmer Link: https://lore.kernel.org/r/20250426224738.284874-1-daniel@0x0f.com Signed-off-by: Thomas Weißschuh commit 443c6467fcd65d10506b473cc6b187f95bcb2b22 Author: Thomas Weißschuh Date: Thu Apr 24 13:48:13 2025 +0200 selftests/nolibc: always run nolibc header check Prevent regressions of issues validates by the header check by always running it together with the nolibc selftests. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250424-nolibc-header-check-v1-3-011576b6ed6f@linutronix.de commit 3785289f97e2118b157332ffaae9fd2ec71237c8 Author: Thomas Weißschuh Date: Thu Apr 24 13:48:12 2025 +0200 tools/nolibc: include nolibc.h early from all header files Inclusion of any nolibc header file should also bring all other headers. On the other hand it should also be possible to include any nolibc header files in any order. Currently this is implemented by including the catch-all nolibc.h after the headers own definitions. This is problematic if one nolibc header depends on another one. The first header has to include the other one before defining any symbols. That in turn will include the rest of nolibc while the current header has not defined anything yet. If any other part of nolibc depends on definitions from the current header, errors are encountered. This is already the case today. Effectively nolibc can only be included in the order of nolibc.h. Restructure the way "nolibc.h" is included. Move it to the beginning of the header files and before the include guards. Now any header will behave exactly like "nolibc.h" while the include guards prevent any duplicate definitions. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250424-nolibc-header-check-v1-2-011576b6ed6f@linutronix.de commit a6a054c8ad32b04c2e5d3cc5592fa737a2bb771f Author: Thomas Weißschuh Date: Thu Apr 24 13:48:11 2025 +0200 tools/nolibc: add target to check header usability Each nolibc header should be valid for inclusion irrespective of any special ordering requirements. Add a new make target, based on the old kbuild "make header_check" target to validate this requirement. For now the check fails, but the following commits will fix the issues. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250424-nolibc-header-check-v1-1-011576b6ed6f@linutronix.de commit 0f9a1739dd0e1ca3942e51dc3ec18f0d68c23be5 Author: Vitaly Kuznetsov Date: Tue May 13 14:58:07 2025 +0200 efi: zboot specific mechanism for embedding SBAT section SBAT is a mechanism which improves SecureBoot revocations of UEFI binaries by introducing a generation-based technique. Compromised or vulnerable UEFI binaries can be prevented from booting by bumping the minimal required generation for the specific component in the bootloader. More information on the SBAT can be obtained here: https://github.com/rhboot/shim/blob/main/SBAT.md Upstream Linux kernel does not currently participate in any way in SBAT as there's no existing policy in how SBAT generation number should be defined. Keep the status quo and provide a mechanism for distro vendors and anyone else who signs their kernel for SecureBoot to include their own SBAT data. This leaves the decision on the policy to the vendor. Basically, each distro implementing SecureBoot today, will have an option to inject their own SBAT data during kernel build and before it gets signed by their SecureBoot CA. Different distro do not need to agree on the common SBAT component names or generation numbers as each distro ships its own 'shim' with their own 'vendor_cert'/'vendor_db' Implement support for embedding SBAT data for architectures using zboot (arm64, loongarch, riscv). Put '.sbat' section in between '.data' and '.text' as the former also covers '.bss' and thus must be the last one. Reviewed-by: Ard Biesheuvel Signed-off-by: Vitaly Kuznetsov Signed-off-by: Ard Biesheuvel commit 0c86e33819785fe50616b6ee3fb35c1e4be406d5 Author: Matti Vaittinen Date: Wed May 14 09:25:13 2025 +0300 dt-bindings: iio: adc: Add ROHM BD79100G The ROHM BD79100G is a 12-bit ADC which can be read over SPI. Device has no MOSI pin. ADC results can be read from MISO by clocking in 16 bits. The 4 leading bits will be zero, last 12 containig the data. Device has only VCC supply pin, which acts also as a VFS, determining the voltage for full 12-bits. Specifying it is mandatory. This seems identical to the ti,ads7866.